CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- cap-go capgoCapgo - Org/App Scope Mismatch in Device Creation Endpoint7.1 High
- cap-go capgoCapgo - Information Disclosure via /private/validate_password_compliance Endpoint6.9 Medium
- cap-go capgoCapgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions8.7 High
- cap-go capgoCapgo - Account Deletion Without Password Confirmation7.0 High
- cap-go capgoCapgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision7.2 High
- cap-go capgoCapgo - Privilege Escalation via Cross-Scope RBAC Role Assignment8.7 High
- cap-go capgoCapgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy8.7 High
- cap-go capgoCapgo - Broken Object Level Authorization via x-limited-key-id Header8.7 High
- cap-go capgoCapgo - Login CSRF and Session Fixation via URL Query Parameters5.1 Medium
- cap-go capgoCapgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass8.7 High
- ruby jsonRuby JSON: JSON generator heap buffer overflow when streaming to an IO3.7 Low
- py-pdf pypdfpypdf: Missing stream length values ignore defined limits6.9 Medium
- github enterprise serverStored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category6.3 Medium
- offis dicom dcmtk toolkitOFFIS DCMTK Toolkit Path Traversal9.3 Critical
- offis dicom dcmtk toolkitOFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime8.7 High
- offis dicom dcmtk toolkitOFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime8.7 High
- invoiceninjaInvoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter5.3 Medium
- neuml txtaitxtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter9.3 Critical
- offis dicom dcmtk toolkitOFFIS DCMTK Toolkit Path Traversal8.8 High
- yunaiv yudao-cloudyudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API7.1 High
- iv-org invidiousInvidious - Cross-User Playlist Video Deletion via Missing Ownership Check7.1 High
- presentonPresenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint6.9 Medium
- ibm cics transaction gateway for multiplatforms, websphere application server +1 moreInconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.7.4 High
- offis dicom dcmtk toolkitOFFIS DCMTK Toolkit Type Confusion8.7 High
- ibm websphere application serverIBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities8.5 High
- tp-link systems inc. archer ax20 v2.0Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface5.9 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence5.9 Medium
- frangoteam fuxa scada/hmiFrangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing8.7 High
- github enterprise serverMissing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint6.0 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence4.3 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence6.4 Medium
- github enterprise serverUI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen4.8 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence5.7 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence5.4 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence4.3 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence6.5 Medium
- ibm watsonx.data intelligenceError Message Containing Sensitive Information found in Watson Data Intelligence4.3 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence4.3 Medium
- ibm watsonx.data intelligenceCleartext Transmission of Sensitive Information in Watson Data Intelligence5.9 Medium
- hcl software devops loop, ibm devops automation +1 moreIBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.8.1 High
- ibm db2IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables5.5 Medium
- ibm db2IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling9.8 Critical
- ibm langflow oss, langflow +1 moreSSRF via HTTP Redirect Following in Langflow API Request Component8.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows10.0 Critical
- ibm langflow oss, langflow +1 moreCross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem9.6 Critical
- ibm langflow oss, langflow +1 moreDNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component7.1 High
- ibm langflow oss, langflow +1 moreUnauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS8.2 High
- ibm langflow oss, langflow +1 moreSSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection8.2 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability7.1 High
- ibm websphere application serverIBM WebSphere Application Server is affected by a Path Traversal vulnerability4.3 Medium
- Show moreLoading…