CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- juliangruber brace-expansionbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups7.7 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreSssd: use-after-free crash in sssd' 'sssd_pam' process6.4 Medium
sg3_utilsSUSESecurity update for sg3_utilsNo scoresg3_utilsSUSESecurity update for sg3_utilsNo scoresg3_utilsSUSESecurity update for sg3_utilsNo scoresg3_utilsSUSESecurity update for sg3_utilsNo score- samverschueren decode-uri-componentdecode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input6.6 Medium
azure-vm-utilsTuxCareUpdate of azure-vm-utilsNo score- deltaww dtmsoftDTMSoft - Deserialization of Untrusted Data Vulnerability8.4 High
- qlstudio export user dataExport User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field8.0 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +29 more +31 moreLibarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()7.5 High
- delta electronics dvp-12seDVP-12SE Missing Authentication and Unauthorized Write access Vulnerability9.3 Critical
- delta electronics dvp-12seDVP-12SE Exposure of Sensitive Information Vulnerability9.3 Critical
- gotcha gotcha games inc. rpg maker mv, rpg maker mz +1 moreRPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection...8.4 High
- konica minolta japan, inc. multiple mfps which implement ricoh web image monitor, ricoh company, ltd. multiple laser printers and mfps which implement ricoh web image monitor +1 moreMultiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor...5.1 Medium
- avtech security corporation dgm3103sctDGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability...8.6 High
- shahjahan jewel fluent bookingFluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export4.9 Medium
- unknown wp support plus responsive ticket systemWP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys8.6 High
- unknown wp support plus responsive ticket systemWP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File Upload8.8 High
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption5.9 Medium
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite9.8 Critical
- octagonwebstudio premium addons for kingcomposerPremium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions5.3 Medium
- andrasweb pixmagix – wordpress image editorPixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter6.5 Medium
- engagementanalytics plugin for google analytics by io technologiesPlugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter4.3 Medium
- wpqode editorial rating – product review & rating systemEditorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field4.4 Medium
- wpmart team members – multi language supported team pluginTeam Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter4.4 Medium
- samsung open source escargotTime-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot...5.9 Medium
- linuxcncrtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is...8.4 High
spice-vdagentUbuntu[Unknown description]No score- No product listedBuffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker...7.5 High
- No product listedAn issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of...7.5 High
- No product listedBuffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker...7.5 High
- No product listedBuffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker...7.5 High
- No product listedBuffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker...7.5 High
dokuwikiUbuntuAn issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to execute arbitrary...9.8 CriticalgraphicsmagickDebianGraphicsMagick security update7.8 High- dgraph-io dgraphDgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query7.5 High
- zephyrproject zephyrNULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion6.2 Medium
- zephyrproject zephyrPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read7.5 High
- zephyrproject zephyrBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack8.1 High
- coollabsio coolifyCoolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure7.7 High
- zephyrproject zephyrDeadlock denial of service in USB CDC-NCM device class on TX enqueue failure5.3 Medium
- strapiStrapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration6.3 Medium
- apache tomcatApache Tomcat: Security constraints for default servlet ignored method6.5 Medium
- apache tomcatApache Tomcat: EncryptInterceptor not protected against replay attacks6.5 Medium
- apache tomcatApache Tomcat: Logged effective web.xml is incomplete9.1 Critical
- mik cryptxCryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path3.7 Low
- apache tomcatApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector9.1 Critical
- apache tomcatApache Tomcat: Bad ornext processing in RewriteValve7.3 High
- apache tomcatApache Tomcat: XSS in number guess example6.1 Medium
- Show moreLoading…