CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- ibm websphere application serverIBM WebSphere Application Server is affected by a cross-site scripting vulnerability9.3 Critical
- ibm websphere application serverIBM WebSphere Application Server is affected by a cross-site scripting vulnerability9.3 Critical
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability8.5 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability7.2 High
- ibm db2IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user6.5 Medium
- ibm devops deploy, ucd - ibm devops deploy +1 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains5.4 Medium
- ibm devops deploy, ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more +3 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptable to an Insertion of Sensitive Information Into Sent Data vulnerability6.5 Medium
- ibm devops deploy, ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more +3 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Insertion of Sensitive Information into Log File Vulnerability6.2 Medium
- ibm business automation manager open editions, business automation manager +1 moreXXE attack in IBM Business Automation Manager Open Editions7.6 High
- ibm websphere extreme scaleIBM WebSphere eXtreme Scale is affected by Insecure Deserilization7.5 High
- ibm websphere extreme scaleIBM WebSphere eXtreme Scale's OQL is affected by remote code execution7.5 High
- ibm websphere extreme scaleIBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol6.0 Medium
- ibm app connect enterprise, integration bus for z/os, integration bus +2 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection4.7 Medium
- ibm langflow oss, langflow +1 moreUnauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass9.1 Critical
- ibm langflow oss, langflow +1 moreFlow Validation Bypass via Empty Component Type Field9.8 Critical
- ibm langflow oss, langflow +1 moreInsecure Deserialization in Redis Cache Backend9.8 Critical
- ibm langflow oss, langflow +1 moreCode Injection Vulnerability in Code Validation Endpoint9.9 Critical
- ibm langflow oss, langflow +1 moreWeak Cryptographic Key Derivation Exposed All Stored Credentials9.1 Critical
- paymenterPaymenter: Race condition in payWithCredit() enables credit double-spend5.3 Medium
- ibm websphere extreme scaleIBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled6.5 Medium
WALinuxAgentTuxCare,WALinuxAgent-cvmTuxCare,WALinuxAgent-udevTuxCare +2 moreUpdate of WALinuxAgentNo score- ibm infosphere information serverIBM DataStage Flow Designer application is affected by an information disclosure vulnerability3.5 Low
- conductor-oss conductorOrkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators9.3 Critical
- symfony twigTwig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`6.0 Medium
- symfony twigTwig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters7.1 High
azure-vm-utilsTuxCareUpdate of azure-vm-utilsNo score- symfony twigTwig: Sandbox `__toString()` policy bypass via dynamic mapping keys7.1 High
- symfony twigTwig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`5.3 Medium
- linuxfoundation sigstore timestamp authority, sigstore timestamp-authority +1 moreSigstore Timestamp Authority: OOM due to unbounded metric label cardinality5.9 Medium
- sigstore fulcioFulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage8.7 High
- cefsharpCefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder5.3 Medium
- adonisjs coreIncomplete fix for CVE-2026-25754 in @adonisjs/bodyparser8.6 High
- pfefferle webmentionWebmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties7.2 High
- getprobo proboProbo has an open redirect bypass via path normalization4.7 Medium
github.com/fission/fissionGoFission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec8.1 High- sigstore sigstore-javaSigstore Java has a vulnerability with bundle verification of integratedTime2.0 Low
- cedar-policy authorization-for-expressjs@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation8.8 High
github.com/kahiteam/kahiGoKahi has privilege-drop and socket/log permission issuesNo score- paymenterPaymenter: URL parameter injection bypasses paid plan limits at checkout8.5 High
- zephyrproject zephyrUse-after-free race in SNTP async client when closing the socket while the socket service is still polling it6.5 Medium
- zephyrproject zephyrRFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic3.1 Low
- hp inc. fan control appHP Fan Control App – Potential Escalation of Privilege7.3 High
- zephyrproject zephyrNon-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref6.4 Medium
- zephyrproject zephyrOut-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets6.5 Medium
- jeecgbootJeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys8.6 High
- dolibarrDolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints7.2 High
- jeecgboot jimureportJimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export8.7 High
- cvat-ai cvat, cvat computer vision annotation tool +1 moreCVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence5.3 Medium
- seaweedfsSeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter2.3 Low
- woodpecker-ci woodpeckerWoodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name9.2 Critical
- Show moreLoading…