CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- devolutions powershell universalInsertion of sensitive information into sent data in the AI Agent job API in Devolutions...6.5 Medium
- honeywell technologies iq multiaccessLack of signature verification before execution of downloaded content5.9 Medium
- edimax ew-7478apcEdimax EW-7478APC POST Request formStaDrvSetup os command injection5.3 Medium
- edimax ew-7478apcEdimax EW-7478APC POST Request formQoS buffer overflow8.7 High
- itsourcecode hospital management systemitsourcecode Hospital Management System patientchangepassword.php sql injection5.3 Medium
- ollyo helix3, joomshaper.com helix3 extension for joomla +1 moreJoomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler7.5 High
- joomlack page builder, page builder ck, joomlack.fr page builder ck extension for joomla +2 moreJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.010.0 Critical
- itsourcecode hospital management systemitsourcecode Hospital Management System patientdetail.php sql injection5.3 Medium
- home-assistant coreHome Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data7.5 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution7.7 High
- dojin club micmnis phpuploaderphpUploader < 2.0.2 Unauthenticated Database Exposure via index model8.7 High
- itsourcecode hospital management systemitsourcecode Hospital Management System insertbillingrecord.php sql injection5.3 Medium
- colissimo officiel : méthodes de livraison pour woocommerceWordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- shohei.tanaka japanized for woocommerceWordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability6.5 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability6.6 Medium
- repute info systems arformsWordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pluginops landing page builderWordPress Landing Page Builder plugin <= 1.5.3.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- astoundify jobifyWordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- ads by wpquads by wpquadsWordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability6.5 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability6.5 Medium
- spencer haws link whisper freeWordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wp swings wallet system for woocommerceWordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability7.1 High
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability9.9 Critical
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jma plugins woocommerce designer pro, woocommerce designer pro designer pro +1 moreWordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mainwpWordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability6.3 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- realmag777 bearWordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- code-projects simple food ordering systemSourceCodester Simple Food Ordering System cart.php logic error6.9 Medium
- eclipse foundation csi - piaThe /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation g…6.9 Medium
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalization7.5 High
- gnome libxml2Stack-Based Buffer Overflow in libxml21.8 Low
- hcl software devops deploy / hcl launch, hclsoftware hcl devops deploy / hcl launch, hcltechsw hcl devops deploy +1 more +3 moreHCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information4.3 Medium
- code-projects inventory management systemSourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scripting5.1 Medium
- weng-xianhu eyoucmsweng-xianhu EyouCMS API index.php sql injection5.1 Medium
- code-projects inventory management systemSourceCodester Inventory Management System User Registration Endpoint users_handler.php access control6.9 Medium
- attr project attr, red hat cert manager support for red hat openshift release 1.19, discovery 2 +8 more +10 moreattr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr8.4 High
- acl project aclacl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl7.2 High
- acl project acl, red hat discovery 2, enterprise linux 10 +11 more +13 moreacl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions8.4 High
- red hat openshift dev spaces 3.29, redhat openshift dev spaces +1 moreVscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension8.8 High
- frontaccountingFrontAccounting < 2.4.20 Path Traversal RCE via attachment upload8.7 High
- code-projects online music sitecode-projects Online Music Site POST Request Feedback.php cross site scripting5.3 Medium
- frontaccountingFrontAccounting < 2.4.20 SQL Injection via rep601.php7.1 High
- frontaccountingFrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php7.2 High
- frontaccountingFrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()7.2 High
- krajowa izba rozliczeniowa szafirhostRemote Code Execution in SzafirHost8.6 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System preview3.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_class1.php sql injection6.9 Medium
quick-xmlcrates.ioUnbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service7.5 High- Show moreLoading…