June 2026
8,314 CVEs published, +13% on May 2026 and 2.1× June 2025. CISA added 23 to KEV.
2026 month by month
- Critical
- 91413% of the 7,187 with a CVSS score
- Added to CISA KEV
- 2315 of this month's CVEs are in KEV, listed a median 2 days after publication
- Vendors
- 1,9527,510 products
- Top weakness
- XSSCWE-79 · 663 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleChrome, Android, Google Chrome1,0951072+1
- 2LinuxLinux, Linux Kernel51440none−1
- 3MicrosoftWindows 11 26h1, Windows 11 Version 26h1, Windows Server 202526519none—
- 4OracleWebcenter Content, Oracle Webcenter Content, Enterprise Manager Base Platform2431231+35
- 5AdobeExperience Manager, Adobe Experience Manager, Acrobat Reader14512none+12
- 6Red HatRed Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 101322none—
- 7Apache Software FoundationApache Airflow, Apache Activemq, Apache HTTP Server12121none—
- 8ApacheAirflow, Activemq, HTTP Server11019none+2
- 9PyPIPraisonai, Praisonaiagents, Picklescan980none+22
- 10npmOpenclaw, Praisonai, Network-ai890none−2
- 11IBMWebsphere Application Server, Langflow Oss, Watsonx.data Intelligence7516none+9
- 12SpringSpring Framework, Spring Web Services, Spring Security720nonenew
- 13CapgoCapgo, Cli611nonenew
- 14OpenclawOpenclaw611none−3
- 15ThemerexLine Agency, Luxmed | Medicine & Healthcare Doctor WordPress Theme, Maxinet585nonenew
- 16Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Xwayland, Gpac555none−12
- 17ApplemacOS, iPhone OS, iOS and iPadOS521none−12
- 18MozillaFirefox, Thunderbird, Firefox For IOS509none+6
- 19SourcecodesterClass and Exam Timetabling System, Pharmacy Sales and Inventory System, Inventory System490none+16
- 20VMwareSpring Framework, Spring Security, Spring Data Rest440none+137
- 21ItsourcecodeHospital Management System, Fees Management System, Online Hotel Management System430none+63
- 22ImagemagickImagemagick410nonenew
- 23DellPowerflex Manager, Powerflex, Wyse Management Suite381none+31
- 24JenkinsJenkins, Jenkins Assembla Plugin, Jenkins Contrast Continuous Application Security Plugin360none+68
- 25GoGithub.com/klever-io/klever-go, Github.com/gohugoio/hugo, Github.com/go-chi/chi/v5/middleware350none+4
Severity
How this month's CVEs score on CVSS; 1,127 have no score yet. Severity is not exploitation.
- Critical914
- High3,202
- Medium2,813
- Low258
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS663
- CWE-416Use After Free436
- CWE-89SQL Injection406
- CWE-862Missing Authorization389
- CWE-284Improper Access Control371
- CWE-20Improper Input Validation367
- CWE-22Path Traversal317
- CWE-125Out-of-bounds Read214
- CWE-200Information Exposure186
- CWE-502Deserialization185
- CWE-306Missing Auth for Critical Function184
- CWE-78OS Command Injection182
- CWE-639Auth Bypass via User Key174
- CWE-74Injection172
- CWE-918SSRF171
- CWE-787Out-of-bounds Write169
- CWE-863Incorrect Authorization162
- CWE-94Code Injection153
- CWE-400Resource Consumption146
- CWE-121130
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries1,51317% of sector-tagged CVEs
- Web & CMS Plugins1,47616% of sector-tagged CVEs
- Consumer Software1,40115% of sector-tagged CVEs
- Operating Systems1,20113% of sector-tagged CVEs
- Enterprise Software93410% of sector-tagged CVEs
- Cloud & SaaS4024% of sector-tagged CVEs
- Networking Infrastructure3834% of sector-tagged CVEs
- 8 smaller sectors1,648
- Not yet classified203
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 416Use After Free | 89SQL Injection | 862Missing Authorization | 20Improper Input Validation | 284Improper Access Control | 22Path Traversal | 125Out-of-bounds Read | 502Deserialization | 787Out-of-bounds Write |
|---|---|---|---|---|---|---|---|---|---|---|
| 15 | 268 | 2 | 15 | 219 | 43 | 3 | 60 | 33 | ||
| Linux | 85 | 7 | 42 | 30 | ||||||
| Oracle Corporation | 3 | 1 | 159 | 1 | ||||||
| Oracle | 3 | 1 | 159 | 1 | ||||||
| Microsoft Corp | 21 | 51 | 1 | 15 | 9 | 3 | 22 | 3 | 14 | |
| Microsoft | 24 | 47 | 2 | 6 | 8 | 3 | 21 | 3 | 12 | |
| Adobe | 60 | 13 | 11 | 1 | 5 | 9 | 10 | |||
| Red Hat | 3 | 7 | 3 | 1 | 4 | 15 | 6 | |||
| Apache Software Foundation | 4 | 2 | 2 | 3 | 9 | 5 | 2 | 6 | ||
| Adobe Systems Inc. | 58 | 11 | 8 | 1 | 2 | 4 | 7 | |||
| PyPI | 5 | 1 | 6 | 3 | 1 | 21 | 1 | 10 | 1 | |
| Apache | 4 | 2 | 2 | 3 | 9 | 3 | 2 | 6 |
In the news
The CVEs security news mentioned most in June 2026.
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily explo...239.8
- CVE-2026-20245Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability197.8
- CVE-2026-45586Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability197.8
- CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability158.6
- CVE-2026-45585Windows BitLocker Security Feature Bypass Vulnerability156.8
- CVE-2026-50507Windows BitLocker Security Feature Bypass Vulnerability156.8
- CVE-2026-33825Microsoft Defender Elevation of Privilege Vulnerability147.8
- CVE-2026-41091Microsoft Defender Elevation of Privilege Vulnerability137.8
- CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Access139.3
- CVE-2026-10520An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution1210.0
- CVE-2026-49160HTTP.sys Denial of Service Vulnerability127.5
- CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise119.8
CVEs published in June 2026
289 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS. Showing 1–100.
- CVE-2026-10520An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code executionKEV10.0
- CVE-2026-48282ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)KEV10.0
- CVE-2026-48558SimpleHelp Authentication Bypass via Missing OIDC JWT Signature VerificationKEV10.0
- CVE-2026-49869Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`KEV10.0
- CVE-2026-12569Remote Code Execution (RCE) vulnerability in Windchill PDMlinkKEV9.8
- CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk EnterpriseKEV9.8
- CVE-2026-25089A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandb...KEV9.8
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily explo...KEV9.8
- CVE-2026-48907Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5KEV9.8
- CVE-2026-48908Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2KEV9.8
- CVE-2026-48939Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15KEV9.8
- CVE-2026-56290Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0KEV9.8
- CVE-2026-8452Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceKEV9.8
- CVE-2026-8037OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAFKEV9.6
- CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile AccessKEV9.3
- CVE-2026-11645Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity...KEV8.8
- CVE-2026-53266netfilter: bridge: make ebt_snat ARP rewrite writableKEV8.8
- CVE-2026-7273A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw...KEV8.8
- CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery VulnerabilityKEV8.6
- CVE-2026-54420LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running C...KEV8.5
- CVE-2025-48595In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed....KEV8.4
- CVE-2026-55255Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowKEV8.4
- CVE-2026-20245Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation VulnerabilityKEV7.8
- CVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityKEV7.5
- CVE-2026-20262Cisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityKEV6.5
- CVE-2026-7473Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding BypassKEV5.8
- CVE-2026-46978Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows un...10.0
- CVE-2026-47938Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)10.0
- CVE-2026-48276ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)10.0
- CVE-2026-48277ColdFusion | Improper Input Validation (CWE-20)10.0
- CVE-2026-48281ColdFusion | Improper Input Validation (CWE-20)10.0
- CVE-2026-48283ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)10.0
- CVE-2026-48286Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0
- CVE-2026-49777WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability10.0
- CVE-2026-10523An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative ...9.9
- CVE-2026-47365Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit ...9.9
- CVE-2026-47369A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such...9.9
- CVE-2024-58351Flowise - Remote Code Execution via overrideConfig Parameter9.8
- CVE-2026-11551Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover9.8
- CVE-2026-12073ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite9.8
- CVE-2026-12818DVP-12SE Exposure of Sensitive Information Vulnerability9.8
- CVE-2026-13763HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF9.8
- CVE-2026-27671Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform9.8
- CVE-2026-29167Apache HTTP Server: mod_ldap per-dir use-after-free9.8
- CVE-2026-39893Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php9.8
- CVE-2026-39938Cacti: Unauthenticated RCE on Graph Image9.8
- CVE-2026-39955Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php9.8
- CVE-2026-41120Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could pot...9.8
- CVE-2026-44815DHCP Client Service Remote Code Execution Vulnerability9.8
- CVE-2026-45657Windows Kernel Remote Code Execution Vulnerability9.8
- CVE-2026-47065Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-2329.8
- CVE-2026-47291HTTP.sys Remote Code Execution Vulnerability9.8
- CVE-2026-48611Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.9.8
- CVE-2026-49468LiteLLM: Authentication Bypass via Host Header Injection9.8
- CVE-2026-49875Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils9.8
- CVE-2026-50548Cursor Desktop sandbox escape via agent-controlled working directory9.8
- CVE-2026-50549Cursor Desktop sandbox escape via symlink and failed path canonicalization9.8
- CVE-2026-52931batman-adv: tp_meter: avoid use of uninit sender vars9.8
- CVE-2026-53309ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison9.8
- CVE-2026-58138Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators9.8
- CVE-2026-8655Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service9.8
- CVE-2026-10881Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity:...9.6
- CVE-2026-10886Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)9.6
- CVE-2026-12440Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit...9.6
- CVE-2026-13028Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: C...9.6
- CVE-2026-13780Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escap...9.6
- CVE-2026-42904Windows TCP/IP Elevation of Privilege Vulnerability9.6
- CVE-2026-47281Visual Studio Code Elevation of Privilege Vulnerability9.6
- CVE-2026-57498Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers9.6
- CVE-2026-42386WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability9.3
- CVE-2026-42849authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover9.3
- CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`9.3
- CVE-2026-48313ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)9.3
- CVE-2026-48315ColdFusion | Improper Input Validation (CWE-20)9.3
- CVE-2026-49871Apache APISIX: cas-auth login CSRF / session injection issue9.3
- CVE-2026-54808WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability9.3
- CVE-2026-54809WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability9.3
- CVE-2026-54812WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability9.3
- CVE-2026-54843WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability9.3
- CVE-2025-10263Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78...9.1
- CVE-2026-12087Socket versions before 2.041 for Perl have an out-of-bounds heap read9.1
- CVE-2026-20181Cisco Identity Services Engine Remote Code Execution Vulnerability9.1
- CVE-2026-20266OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit9.1
- CVE-2026-39868This issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe ...9.1
- CVE-2026-39999Apache APISIX: JWT Algorithm Confusion allows authentication bypass9.1
- CVE-2026-42535Apache HTTP Server: mod_dav_fs protected directory access9.1
- CVE-2026-45177Idira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanism9.1
- CVE-2026-48579Microsoft Exchange Online Information Disclosure Vulnerability9.1
- CVE-2026-49230Apache APISIX: Authentication bypass in jwe-decrypt9.1
- CVE-2026-53434Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector9.1
- CVE-2026-53519Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key9.1
- CVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value9.1
- CVE-2026-11374Account Takeover via Predictable SSO Ticket Generation9.0
- CVE-2026-12045pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution9.0
- CVE-2026-10954Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)8.8
- CVE-2026-32193Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability8.8
- CVE-2026-40371Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability8.8
- CVE-2026-42985Remote Desktop Client Remote Code Execution Vulnerability8.8
- CVE-2026-43715A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, vi...8.8
- CVE-2026-45484Microsoft SharePoint Elevation of Privilege Vulnerability8.8