CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- linux, linux kernel +1 moreocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison9.8 Critical
- linux, linux kernel +1 morepower: supply: max77705: Free allocated workqueue and fix removal order5.5 Medium
- linux, linux kernel +1 morepinctrl: pinconf-generic: Fully validate 'pinmux' property5.5 Medium
- linux, linux kernel +1 moretty: hvc_iucv: fix off-by-one in number of supported devices5.5 Medium
- linux, linux kernel +1 moreusb: typec: ps883x: Fix Oops at unbind5.5 Medium
- linux, linux kernel +1 morescsi: sg: Resolve soft lockup issue when opening /dev/sgX5.5 Medium
- linux, linux kernel +1 moref2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()7.1 High
- linux, linux kernel +1 morecrypto: eip93 - fix hmac setkey algo selection5.5 Medium
- linux, linux kernel +1 morereset: amlogic: t7: Fix null reset ops5.5 Medium
- linux, linux kernel +1 morenet: enetc: fix NTMP DMA use-after-free issue7.8 High
- linux, linux kernel +1 morenet: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()5.5 Medium
- linux, linux kernel +1 morenet: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()5.5 Medium
- linux, linux kernel +1 morenet: mana: Guard mana_remove against double invocation5.5 Medium
- linux, linux kernel +1 moremailbox: mailbox-test: free channels on probe error7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moremailbox: add sanity check for channel array5.5 Medium
- linux, linux kernel +1 moremailbox: mailbox-test: don't free the reused channel7.8 High
- linux, linux kernel +1 moredrm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG5.5 Medium
- linux, linux kernel +1 morenet: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind5.5 Medium
- linux, linux kernel +1 moreALSA: hda/conexant: Fix missing error check for jack detection5.5 Medium
- linux, linux kernel +1 moredrm/xe/eustall: Fix drm_dev_put called before stream disable in close7.8 High
- linux, linux kernel +1 moreice: fix NULL pointer dereference in ice_reset_all_vfs()5.5 Medium
- linux, linux kernel +1 morearm64: Reserve an extra page for early kernel mapping5.5 Medium
- linux, linux kernel +1 moreaudit: fix incorrect inheritable capability in CAPSET records5.5 Medium
- linux, linux kernel +1 moreidpf: fix double free and use-after-free in aux device error paths7.8 High
- linux, linux kernel +1 moredrm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED5.5 Medium
- linux, linux kernel +1 morebtrfs: only release the dirty pages io tree after successful writes7.5 High
- linux, linux kernel +1 moreiommu/amd: Bounds-check devid in __rlookup_amd_iommu()5.5 Medium
- linux, linux kernel +1 morex86/kexec: Push kjump return address even for non-kjump kexec5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moreiommu/vt-d: Avoid NULL pointer dereference or refcount corruption8.8 High
- linux, linux kernel +1 moreiommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()5.5 Medium
- linux, linux kernel +1 moredrm/gma500/oaktrail_lvds: fix hang on init failure5.5 Medium
- linux, linux kernel +1 morearm_mpam: Check whether the config array is allocated before destroying it5.5 Medium
- opf openprojectOpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources4.3 Medium
- opf openprojectOpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename6.5 Medium
- opf openprojectOpenProject: Shares API Information Disclosure6.5 Medium
- wummel patoolPatool < 4.0.5 Path Traversal via safe_extract() Function5.3 Medium
- opf openprojectOpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration5.7 Medium
- opf openprojectOpenProject: Private work package data disclosure through single meeting agenda item API4.3 Medium
- opf openprojectOpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects6.5 Medium
- opf openprojectOpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`9.9 Critical
- lxc incusIncus has an arbitrary file write on its client due to trusted image hash9.9 Critical
- sigstore sigstore-jssigstore-js: DSSE payloadType type-binding failure5.4 Medium
- opf openprojectOpenProject: Cache store poisoning leads to Remote Code Execution (RCE)9.6 Critical
- lxc incusIncus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)2.1 Low
- lxc incusIncus has an argument injection in backup compression algorithm leading to AFW and ACE9.9 Critical
- opf openprojectOpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects5.4 Medium
- opf openprojectOpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks7.5 High
- opf openprojectOpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"6.4 Medium
- opf openprojectOpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources9.9 Critical
- opf openprojectOpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure8.2 High
- Show moreLoading…