CVE Tools
Sign in
month report

June 2026

Data as of Jul 6, 2026, 05:00 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

June 2026 closed with 8,314 published CVEs — +114.6% YoY . 914 criticals, 23 added to CISA KEV (2 ransomware-linked). google led volume, mostly via chrome. Biggest breakout: google at ×17.1 their 12-month median. Top weakness class — CWE-79 (663 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
8,314
+12.9% MoM+114.6% YoY
Severity mix
914 / 3,202
critical / high
KEV added
23
2 ransomware-linked
Nuclei coverage
1.0%
80 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
5.8
n=20
Within 7 days
60.0%
Within 30 days
100.0%
Days → KEV (median)
2
n=15
Detection gap

KEV pressure, no Nuclei coverage

June 2026 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in June 2026

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS416Use After Free89SQL Injection862Missing Authorization284CWE-28420Improper Input Validation22Path Traversal125Out-of-bounds Read787Out-of-bounds Write200Information Exposuregoogle15268215432193603314linux7413127oracle corporation315917oracle315917microsoft corp215119153221410microsoft24472863211212adobe60131115910red hat37314156apache software foundation42239525adobe systems inc.591118247apache42239325google inc712317143

Most discussed CVEs — June 2026

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google↑1
    1,095 CVE107 critCVSS 7.1
    ×17.1KEV 2
    chrome (965) · android (119) · google chrome (43)
  • 2linux↓1
    514 CVE40 critCVSS 7.6
    linux (514) · linux kernel (62)
  • 3microsoft·
    265 CVE19 critCVSS 7.3
    windows 11 26h1 (111) · windows 11 version 26h1 (111) · windows server 2025 (110)
  • 4oracle↑35
    243 CVE123 critCVSS 8.7
    ×3.1KEV 1Nuclei 1
    webcenter content (32) · oracle webcenter content (29) · enterprise manager base platform (14)
  • 5adobe↑12
    145 CVE12 critCVSS 6.6
    experience manager (60) · adobe experience manager (59) · acrobat reader (24)
  • 6redhat·
    132 CVE2 critCVSS 6.3
    red hat enterprise linux 8 (81) · red hat enterprise linux 9 (81) · red hat enterprise linux 10 (80)
  • 7apache software foundation·
    121 CVE21 critCVSS 7.2
    ×5.6
    apache airflow (17) · apache activemq (15) · apache http server (13)
  • 8apache↑2
    110 CVE19 critCVSS 7.2
    ×5.5
    airflow (17) · activemq (15) · http server (13)
  • 9pypi↑22
    98 CVE
    praisonai (27) · praisonaiagents (11) · picklescan (10)
  • 10npm↓2
    89 CVE
    openclaw (25) · praisonai (9) · network-ai (5)
  • 11ibm↑9
    75 CVE16 critCVSS 6.9
    websphere application server (17) · langflow oss (14) · watsonx.data intelligence (10)
  • 12spring—
    72 CVECVSS 6.3
    ×5.0
    spring framework (18) · spring web services (7) · spring security (7)
  • 13capgo—
    61 CVE1 critCVSS 6.5
    NEW
    capgo (60) · cli (1)
  • 14openclaw↓3
    61 CVE1 critCVSS 7.0
    openclaw (61)
  • 15themerex—
    58 CVE5 critCVSS 8.2
    Nuclei 5
    line agency (1) · luxmed | medicine & healthcare doctor wordpress theme (1) · maxinet (1)
  • 16сообщество свободного программного обеспечения↓12
    55 CVE5 critCVSS 7.0
    debian gnu/linux (28) · xwayland (8) · gpac (6)
  • 17apple↓12
    52 CVE1 critCVSS 6.6
    macos (51) · iphone os (38) · ios and ipados (38)
  • 18mozilla↑6
    50 CVE9 critCVSS 6.9
    firefox (47) · thunderbird (42) · firefox for ios (4)
  • 19sourcecodester↑16
    49 CVECVSS 5.9
    class and exam timetabling system (16) · pharmacy sales and inventory system (6) · inventory system (3)
  • 20vmware↑137
    44 CVECVSS 7.0
    ×4.9
    spring framework (17) · spring security (7) · spring data rest (4)
  • 21itsourcecode↑63
    43 CVECVSS 6.2
    hospital management system (16) · fees management system (9) · online hotel management system (6)
  • 22imagemagick—
    41 CVECVSS 5.1
    ×3.4
    imagemagick (41)
  • 23dell↑31
    38 CVE1 critCVSS 6.7
    powerflex manager (11) · powerflex (10) · wyse management suite (6)
  • 24jenkins↑68
    36 CVECVSS 5.2
    ×3.3
    jenkins (8) · jenkins assembla plugin (3) · jenkins contrast continuous application security plugin (3)
  • 25go↑4
    35 CVE
    github.com/klever-io/klever-go (4) · github.com/gohugoio/hugo (3) · github.com/go-chi/chi/v5/middleware (3)
  • 26picklescan—
    34 CVE8 critCVSS 8.5
    NEW
    picklescan (34)
  • 27flowiseai—
    32 CVE10 critCVSS 8.1
    ×5.3
    flowise (32)
  • 28wolfssl—
    32 CVE2 critCVSS 6.9
    wolfssl (32)
  • 29nocodb—
    29 CVECVSS 5.2
    NEW
    nocodb (29)
  • 30gpac—
    28 CVECVSS 6.1
    gpac (28)
  • 31misp↑99
    28 CVE1 critCVSS 7.0
    NEW
    misp (27) · bsimvis (1)
  • 32n8n↑66
    28 CVE8 critCVSS 7.6
    n8n (28)
  • 33acer↑72
    26 CVE8 critCVSS 8.0
    NEW
    connect m6e 5g firmware (26) · connect m6e 5g portable wifi router (26)
  • 34codeastro↑105
    26 CVECVSS 5.8
    human resource management system (7) · leave management system (5) · student attendance management system (5)
  • 35frappe↑53
    26 CVE
    frappe framework (12) · frappe (11) · erpnext (2)
  • 36nextcloud—
    26 CVECVSS 5.5
    security-advisories (26) · nextcloud server (8) · tables (3)
  • 37gitlab↑3
    25 CVECVSS 5.5
    gitlab (25)
  • 38langflow—
    25 CVE13 critCVSS 8.4
    NEW×3.1
    langflow (24) · langflow desktop (1)
  • 39netty↑54
    25 CVE1 critCVSS 6.9
    netty (22) · netty-incubator-codec-ohttp (3)
  • 40gogs—
    24 CVE2 critCVSS 7.4
    Nuclei 1
    gogs (24)
  • 41qnap—
    24 CVE4 critCVSS 7.3
    quts hero (13) · qts (12) · file station 5 (6)
  • 42qualcomm↑94
    24 CVE1 critCVSS 7.3
    wcd9380 firmware (22) · fastconnect 7800 firmware (22) · wcd9385 firmware (22)
  • 43flowise—
    23 CVE8 critCVSS 8.0
    NEW
    flowise (23) · flowise components (1)
  • 44qualcomm, inc.↑93
    22 CVECVSS 7.3
    snapdragon (22)
  • 45zephyrproject—
    22 CVECVSS 5.9
    NEW
    zephyr (22)
  • 46n8n-io↑53
    21 CVE7 critCVSS 8.1
    n8n (21)
  • 47mattermost↓14
    20 CVECVSS 5.7
    mattermost (18) · mattermost server (15) · mattermost desktop (2)
  • 48nodejs—
    20 CVE1 critCVSS 5.8
    node (12) · node.js (10) · undici (8)
  • 49geovision inc.↑60
    19 CVE12 critCVSS 8.8
    NEW
    gv-lpclpc2011/2211 (10) · gv-i/o box 4e (8) · geovision (1)
  • 50openssl—
    18 CVE1 critCVSS 6.6
    openssl (18)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79663·
2CWE-416436↑2
3CWE-89406↓1
4CWE-862389↓1
5CWE-284371↑8
6CWE-20367↑4
7CWE-22317↓2
8CWE-125214·
9CWE-200186↑12
10CWE-502185↑17
11CWE-306184↑15
12CWE-78182↓6
13CWE-639174↑5
14CWE-74172·
15CWE-918171↓3
16CWE-787169·
17CWE-863162·
18CWE-94153↓9
19CWE-400146↑4
20CWE-121130·

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries1,513 CVE
    113 crit330 vendorsCVSS 7.7
    capgo (73) · imagemagick (41) · wolfssl (32)
  • Web & CMS Plugins1,476 CVE
    173 crit4 KEV705 vendorsCVSS 7.9
    jetengine (10) · eventprime (5) · classified listing (4)
  • Consumer Software1,401 CVE
    177 crit2 KEV97 vendorsCVSS 7.5
    chrome (965) · firefox (47) · google chrome (43)
  • Operating Systems1,201 CVE
    262 crit2 KEV62 vendorsCVSS 7.4
    linux (517) · red hat enterprise linux 8 (81) · red hat enterprise linux 9 (81)
  • Enterprise Software934 CVE
    200 crit4 KEV187 vendorsCVSS 8.3
    microsoft sharepoint server 2019 (31) · microsoft sharepoint enterprise server 2016 (30) · openproject (17)
  • Cloud & SaaS402 CVE
    63 crit102 vendorsCVSS 7.7
    nocodb (29) · n8n (28) · microsoft 365 (26)
  • Networking Infrastructure383 CVE
    143 crit18 KEV107 vendorsCVSS 7.7
    connect m6e 5g firmware (26) · connect m6e 5g portable wifi router (26) · ew-7478apc (9)
  • Security Products301 CVE
    56 crit12 KEV103 vendorsCVSS 7.8
    misp (40) · ghidra (30) · openbullet2 (5)
  • AI / ML272 CVE
    60 crit100 vendorsCVSS 7.6
    flowise (55) · langflow (24) · open-webui (17)
  • Databases260 CVE
    112 crit1 KEV51 vendorsCVSS 8.6
    webcenter content (32) · pgadmin 4 (14) · webcenter enterprise capture (10)
  • DevTools & CI240 CVE
    33 crit53 vendorsCVSS 7.7
    gitlab (25) · gogs (24) · jenkins (16)
  • ICS / OT / IoT209 CVE
    59 crit2 KEV69 vendorsCVSS 8.1
    double-a profibus (11) · double-a x-link (11) · double-x can (11)
  • Hardware Firmware186 CVE
    31 crit51 vendorsCVSS 8.6
    quts hero (24) · qts (23) · fastconnect 7800 firmware (22)
  • Communications156 CVE
    20 crit37 vendorsCVSS 8.0
    librechat (25) · mattermost (18) · mattermost server (15)
  • Mobile Apps24 CVE
    3 crit17 vendorsCVSS 7.2
    setracker2 parental control app (android) package com.tgelec.setracker (4) · hippoo mobile app for woocommerce (2) · samsung assistant (2)
  • Unclassified203 CVE
    39 crit1 KEV112 vendorsCVSS 7.4
    oracle enterprise command center framework (8) · windows app client for windows desktop (7) · collegemanagementsystem (5)
Weakness × Sector

Which weaknesses hit which solution categories in June 2026

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS416Use After Free89SQL Injection862Missing Authorization284CWE-28420Improper Input Validation22Path Traversal125Out-of-bounds Read787Out-of-bounds Write200Information ExposureWeb & CMS Plugins3172011772311641227OSS Libraries63311251265083412754Consumer Software43312485722417876122Operating Systems715631919299957112Enterprise Software1682108241501021512Cloud & SaaS22121317318149616Networking Infrastructure882482717855Security Products18351120718856AI / ML1041011420247Databases621049267243