CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- leandrocp mdex, mdex native +1 moreUnbounded memory allocation in highlight_lines range expansion in mdex6.9 Medium
- leandrocp mdex, mdex native +1 moreCross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute2.3 Low
- p11-kit project p11-kit, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +16 more +18 moreP11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing6.2 Medium
- openwrt luci-proto-openvpnluci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey8.7 High
- openwrt luci-app-tailscale-communityluci-app-tailscale-community - Command Injection via tailscale.do_login RPC7.7 High
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 morePath Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder9.3 Critical
- openidentityplatform openamOpenAM OAuth Authorization Bypass via PKCE Challenge9.1 Critical
- openidentityplatform openamOpenAM OAuth Client Impersonation via JWKS Resolver Cache7.6 High
- openidentityplatform openamOpenAM Authenticated RCE via Groovy Sandbox Escape7.5 High
- hieventsdev hi.eventsHi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id8.3 High
- hieventsdev hi.eventsHi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition8.2 High
- inovector mixpostMixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter5.1 Medium
- papermarkPapermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint2.3 Low
- signozSigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules6.1 Medium
- signozSigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter8.3 High
- yahoo elideElide 7.1.17 - Permission Bypass in Sort Expression Validation5.3 Medium
- its-a-feature mythicMythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint5.3 Medium
- its-a-feature mythicMythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID6.0 Medium
- its-a-feature mythicMythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table7.1 High
- yunai ruoyi-vue-proruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController8.6 High
- yunai ruoyi-vue-proruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint7.1 High
- pinpoint-apm pinpointPinpoint - Insecure Session Cookie Attributes in pinpointJwt7.6 High
- pinpoint-apm pinpointPinpoint - Server-Side Request Forgery via Alarm Webhook Registration6.3 Medium
- iv-org invidiousInvidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint6.3 Medium
- photoprismPhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint5.3 Medium
- librephotosLibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared Endpoint6.0 Medium
- libretranslateLibreTranslate - IP Spoofing via X-Forwarded-For Header6.9 Medium
- parseablehq parseableParseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API7.1 High
- gorse-io gorseGorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints9.3 Critical
- teableio teableTeable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override6.9 Medium
- liftoff-sr cipsterliftoff-sr CIPster EtherNet IP Message append out-of-bounds write6.9 Medium
- modoboaModoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API7.7 High
- zedeus nitterNitter - Server-Side Request Forgery in /video Media Proxy Endpoint7.7 High
- deepmyst mystiDeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization2.3 Low
- seladb pcapplusplusseladb PcapPlusPlus Modbus Protocol ModbusLayer.h getLength heap-based overflow6.3 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +17 more +19 moreLibtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image7.3 High
- seladb pcapplusplusseladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow6.3 Medium
- snowflake cliSnowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands6.0 Medium
- seladb pcapplusplusseladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflow6.3 Medium
- snowflake cliSnowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load4.1 Medium
- snowflake cliSnowflake CLI Sensitive Credential Exposure Through Debug Logging5.5 Medium
- tp-link systems inc. tl-wr841n v14, tp-link tl-wr841n firmware +1 moreAuthenticated Stack-Based Buffer Overflow in TP-Link TL-WR841N Web Interface6.8 Medium
- snowflake cliSnowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection8.8 High
- seladb pcapplusplusseladb PcapPlusPlus LightPcapNg light_pcapng.c parse_by_block_type heap-based overflow6.3 Medium
- snowflake cliSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction6.3 Medium
- snowflake cliSnowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters3.6 Low
- edimax ew-7478apcEdimax EW-7478APC POST Request formUSBFolder buffer overflow8.7 High
- suse rancherRancher Privilege Escalation from Project Owner to Host9.4 Critical
- snowflake cliSnowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input8.3 High
- edimax ew-7478apcEdimax EW-7478APC POST Request formUSBAccount buffer overflow8.7 High
- Show moreLoading…