CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- woodpecker-ci woodpeckerWoodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Service6.9 Medium
- microsoft openapi.netMicrosoft.OpenAPI: Circular schema references may terminate OpenAPI parsing7.5 High
- dromara ruoyi-vue-plusRuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints7.1 High
- nesquena hermes-webuiHermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import6.0 Medium
- hkuds vibe-tradingVibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type6.0 Medium
- threemammals ocelotOcelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests9.3 Critical
- hkuds vibe-tradingVibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier2.3 Low
- hkuds vibe-tradingVibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates7.2 High
- hkuds vibe-tradingVibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution7.7 High
- hkuds deeptutorDeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users7.7 High
- ccfos nightingaleNightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users7.1 High
- openbmb chatdevOpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete8.8 High
- zephyrproject zephyrOut-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)4.8 Medium
- openziti zitiOpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation8.7 High
- dalibo postgresql anonymizerPostgreSQL Anonymizer: Unrestricted function can leak the secret salt4.3 Medium
- suse rancher, rancher fleet +1 morePath Traversal in Rancher Fleet ImageScan GitRepo Path Handler5.3 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)9.3 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)9.3 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)8.6 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)8.8 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)6.5 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- python, python software foundation cpython +1 moreTarfile.extract() doesn't fully respect filter parameter2.0 Low
- suse rancherUnauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook7.0 High
- coollabsio coolifyCoolify: Authenticated RCE via command injection in CA certificate management feature8.8 High
- coollabsio coolifyCoolify: Cross-team application domain enumeration via domains_by_server endpoint4.3 Medium
- coollabsio coolifyCoolify: Command Injection via Single-Quote Breakout in `executeInDocker()`6.6 Medium
- coollabsio coolifyCoolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure5.0 Medium
- siemens mendix studio pro 10.11, mendix studio pro 10.12, mendix studio pro 10.13 +23 more +25 moreA vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro...6.8 Medium
- coollabsio coolifyCoolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)5.0 Medium
- coollabsio coolifyCoolify: Timing Attack in GitLab Webhook Token Validation4.8 Medium
- suse rancherStale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher6.9 Medium
- opengauss-server opengauss-server-7.0.0-rc1, opengauss-server-7.0.0-rc2, opengauss-server-7.0.0-rc3 +2 moreopenGauss存在非法内存访问导致DoS漏洞5.9 Medium
- ktm system e-bokImproper Restriction of Excessive Authentication Attempts in KTM System e-BOK6.9 Medium
- ktm system e-bokWeak Password Requirements in KTM System e-BOK6.9 Medium
- ktm system e-bokCross-Site Request Forgery (CSRF) in KTM System e-BOK5.1 Medium
- ktm system e-bokSession fixation in KTM System e-BOK4.8 Medium
- apache gravitinoApache Gravitino: SQL misconfiguration can access or truncate files5.4 Medium
- mozilla firefoxMemory safety bugs fixed in Firefox 152.0.49.8 Critical
- citrix netscaler gateway, netscaler adc, gateway +1 more +3 moreDenial of service via malformed HTTP/2 requests8.7 High
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +37 more +39 moreGlib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"7.5 High
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +35 more +37 moreGlib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive5.9 Medium
- citrix netscaler gateway, netscaler adc, gateway +1 more +3 moreInsufficient input validation leading to memory overread6.9 Medium
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +38 more +40 moreGlib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"7.3 High
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +29 more +31 moreGlib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"6.5 Medium
- Show moreLoading…