CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- opf openprojectOpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"8.8 High
- opf openprojectOpenProject: SQL injection in timestamps functionality9.9 Critical
- lxc incusIncus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}2.1 Low
- lxc incusIncus has an arbitrary file write via path traversal in S3 multipart upload9.9 Critical
- lxc incus, canonical lxd +1 moreIncus has arbitrary file read+write on host via templates/ symlink in malicious image9.9 Critical
- lxc incusIncus has a restricted project bypass leading to arbitrary command execution9.9 Critical
- lxc incusIncus has an arbitrary file write on host via `exec-output` symlink in crafted image9.9 Critical
- lxc incus, canonical lxd +1 moreIncus has an arbitrary file read+write on host via rootfs/ symlink in malicious image9.9 Critical
- devolutions remote desktop managerIncorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions...7.2 High
- nrwl nxNx: `nx graph` dev server permissive CORS policy5.9 Medium
- envoyproxy envoyEnvoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)5.9 Medium
- envoyproxy envoy, red hat openshift service mesh 2, openshift service mesh 3 +2 moreEnvoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format7.5 High
- envoyproxy envoyEnvoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides5.9 Medium
- envoyproxy envoyEnvoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream4.8 Medium
- envoyproxy envoyEnvoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message6.5 Medium
- envoyproxy envoyEnvoy Heap Buffer Overflow in TcpStatsdSink5.9 Medium
- envoyproxy envoyEnvoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes6.5 Medium
- envoyproxy envoyEnvoy: Null pointer deref in internal redirects5.9 Medium
- envoyproxy envoyEnvoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length7.5 High
- openidentityplatform openamOpenAM Account Takeover via Unverified Password Change in OAuth2 Module7.4 High
- envoyproxy envoyEnvoy: Abnormal process termination in DNS UDP filter5.9 Medium
- openidentityplatform openamOpenAM Authentication Bypass via MSISDN LDAP Injection9.3 Critical
- envoyproxy envoyEnvoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion7.5 High
- envoyproxy envoyEnvoy: Stack overflow in destructor of highly nested JSON7.5 High
- envoyproxy envoyEnvoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)4.4 Medium
- envoyproxy envoyEnvoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption6.8 Medium
- fluent-plugins-nursery fluent-plugin-opentelemetryfluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`5.3 Medium
- fluent fluent-plugin-s3fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`2.7 Low
- max-mapper extract-zipextract-zip unvalidated symlink path traversal8.6 High
- dragonflydb dragonflyDragonfly: RESTORE operations may crash the server7.5 High
- dragonflydb dragonflyDragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer2.3 Low
- fluent fluentdFluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`7.2 High
- fluent fluentdFluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`7.5 High
- fluent fluentdFluentd: Exposure of Sensitive Information via Monitor Agent API7.5 High
- fluent fluentdFluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder9.8 Critical
- containers podmanPodman: Malformed Image can trick podman run into leaking host environment variables into the container7.5 High
- dokkuDokku: OS Command Injection via app.json managed Cron9.0 Critical
- canonical lxdSSRF via image import from URL allows internal network probing by authenticated users5.0 Medium
- dokkuDokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add9.0 Critical
- dokkuDokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval9.0 Critical
- dokkuDokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch5.0 Medium
- dokkuDokku: OS Command Injection via App Name in Git Pre-Receive Hook9.0 Critical
- labstack echoEcho: Encoded slash (%2F) bypasses route-level protection and exposes static files7.5 High
- significant-gravitas autogptAutoGPT: There is a DoS vulnerability in AITextSummarizerBlock5.3 Medium
- payloadcmsPayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access5.3 Medium
- significant-gravitas autogptAutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock5.3 Medium
- significant-gravitas autogptAutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access8.5 High
- significant-gravitas autogptAutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering5.4 Medium
- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreVirt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled4.9 Medium
- pagekitPagekit CMS 1.0.18 Privilege Escalation via UserApiController8.7 High
- Show moreLoading…