June 2026
8,314 CVEs published, +13% on May 2026 and 2.1× June 2025. CISA added 23 to KEV.
2026 month by month
- Critical
- 91413% of the 7,187 with a CVSS score
- Added to CISA KEV
- 2315 of this month's CVEs are in KEV, listed a median 2 days after publication
- Vendors
- 1,9527,510 products
- Top weakness
- XSSCWE-79 · 663 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleChrome, Android, Google Chrome1,0951072+1
- 2LinuxLinux, Linux Kernel51440none−1
- 3MicrosoftWindows 11 26h1, Windows 11 Version 26h1, Windows Server 202526519none—
- 4OracleWebcenter Content, Oracle Webcenter Content, Enterprise Manager Base Platform2431231+35
- 5AdobeExperience Manager, Adobe Experience Manager, Acrobat Reader14512none+12
- 6Red HatRed Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 101322none—
- 7Apache Software FoundationApache Airflow, Apache Activemq, Apache HTTP Server12121none—
- 8ApacheAirflow, Activemq, HTTP Server11019none+2
- 9PyPIPraisonai, Praisonaiagents, Picklescan980none+22
- 10npmOpenclaw, Praisonai, Network-ai890none−2
- 11IBMWebsphere Application Server, Langflow Oss, Watsonx.data Intelligence7516none+9
- 12SpringSpring Framework, Spring Web Services, Spring Security720nonenew
- 13CapgoCapgo, Cli611nonenew
- 14OpenclawOpenclaw611none−3
- 15ThemerexLine Agency, Luxmed | Medicine & Healthcare Doctor WordPress Theme, Maxinet585nonenew
- 16Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Xwayland, Gpac555none−12
- 17ApplemacOS, iPhone OS, iOS and iPadOS521none−12
- 18MozillaFirefox, Thunderbird, Firefox For IOS509none+6
- 19SourcecodesterClass and Exam Timetabling System, Pharmacy Sales and Inventory System, Inventory System490none+16
- 20VMwareSpring Framework, Spring Security, Spring Data Rest440none+137
- 21ItsourcecodeHospital Management System, Fees Management System, Online Hotel Management System430none+63
- 22ImagemagickImagemagick410nonenew
- 23DellPowerflex Manager, Powerflex, Wyse Management Suite381none+31
- 24JenkinsJenkins, Jenkins Assembla Plugin, Jenkins Contrast Continuous Application Security Plugin360none+68
- 25GoGithub.com/klever-io/klever-go, Github.com/gohugoio/hugo, Github.com/go-chi/chi/v5/middleware350none+4
Severity
How this month's CVEs score on CVSS; 1,127 have no score yet. Severity is not exploitation.
- Critical914
- High3,202
- Medium2,813
- Low258
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS663
- CWE-416Use After Free436
- CWE-89SQL Injection406
- CWE-862Missing Authorization389
- CWE-284Improper Access Control371
- CWE-20Improper Input Validation367
- CWE-22Path Traversal317
- CWE-125Out-of-bounds Read214
- CWE-200Information Exposure186
- CWE-502Deserialization185
- CWE-306Missing Auth for Critical Function184
- CWE-78OS Command Injection182
- CWE-639Auth Bypass via User Key174
- CWE-74Injection172
- CWE-918SSRF171
- CWE-787Out-of-bounds Write169
- CWE-863Incorrect Authorization162
- CWE-94Code Injection153
- CWE-400Resource Consumption146
- CWE-121130
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries1,51317% of sector-tagged CVEs
- Web & CMS Plugins1,47616% of sector-tagged CVEs
- Consumer Software1,40115% of sector-tagged CVEs
- Operating Systems1,20113% of sector-tagged CVEs
- Enterprise Software93410% of sector-tagged CVEs
- Cloud & SaaS4024% of sector-tagged CVEs
- Networking Infrastructure3834% of sector-tagged CVEs
- 8 smaller sectors1,648
- Not yet classified203
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 416Use After Free | 89SQL Injection | 862Missing Authorization | 20Improper Input Validation | 284Improper Access Control | 22Path Traversal | 125Out-of-bounds Read | 502Deserialization | 787Out-of-bounds Write |
|---|---|---|---|---|---|---|---|---|---|---|
| 15 | 268 | 2 | 15 | 219 | 43 | 3 | 60 | 33 | ||
| Linux | 85 | 7 | 42 | 30 | ||||||
| Oracle Corporation | 3 | 1 | 159 | 1 | ||||||
| Oracle | 3 | 1 | 159 | 1 | ||||||
| Microsoft Corp | 21 | 51 | 1 | 15 | 9 | 3 | 22 | 3 | 14 | |
| Microsoft | 24 | 47 | 2 | 6 | 8 | 3 | 21 | 3 | 12 | |
| Adobe | 60 | 13 | 11 | 1 | 5 | 9 | 10 | |||
| Red Hat | 3 | 7 | 3 | 1 | 4 | 15 | 6 | |||
| Apache Software Foundation | 4 | 2 | 2 | 3 | 9 | 5 | 2 | 6 | ||
| Adobe Systems Inc. | 58 | 11 | 8 | 1 | 2 | 4 | 7 | |||
| PyPI | 5 | 1 | 6 | 3 | 1 | 21 | 1 | 10 | 1 | |
| Apache | 4 | 2 | 2 | 3 | 9 | 3 | 2 | 6 |
In the news
The CVEs security news mentioned most in June 2026.
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily explo...239.8
- CVE-2026-20245Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability197.8
- CVE-2026-45586Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability197.8
- CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability158.6
- CVE-2026-45585Windows BitLocker Security Feature Bypass Vulnerability156.8
- CVE-2026-50507Windows BitLocker Security Feature Bypass Vulnerability156.8
- CVE-2026-33825Microsoft Defender Elevation of Privilege Vulnerability147.8
- CVE-2026-41091Microsoft Defender Elevation of Privilege Vulnerability137.8
- CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Access139.3
- CVE-2026-10520An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution1210.0
- CVE-2026-49160HTTP.sys Denial of Service Vulnerability127.5
- CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise119.8
CVEs published in June 2026
289 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS. Showing 201–289.
- CVE-2026-44486Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection7.5
- CVE-2026-44488Axios: Allocation of Resources Without Limits or Throttling in axios7.5
- CVE-2026-45583Microsoft Exchange Server Remote Code Execution Vulnerability7.5
- CVE-2026-45591ASP.NET Core Denial of Service Vulnerability7.5
- CVE-2026-46863Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; ...7.5
- CVE-2026-48516MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings7.5
- CVE-2026-48995pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile7.5
- CVE-2026-49049Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler7.5
- CVE-2026-49160HTTP.sys Denial of Service Vulnerability7.5
- CVE-2026-49755Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies7.5
- CVE-2026-49975Apache HTTP Server: mod_http2 denial of service7.5
- CVE-2026-54066SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)7.5
- CVE-2026-56025WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability7.5
- CVE-2026-8451Insufficient input validation leading to memory overread7.5
- CVE-2026-48294Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain acce...7.4
- CVE-2026-57589sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().7.4
- CVE-2026-13528YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal7.3
- CVE-2026-42306Moby: Race condition in docker cp allows bind mount redirection to host path7.2
- CVE-2026-5513Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie7.2
- CVE-2026-40787WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2026-43725The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 2...7.1
- CVE-2026-46914Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attac...7.1
- CVE-2026-47288Windows Kerberos Key Distribution Center (KDC) Remote Code Execution7.1
- CVE-2026-48569Visual Studio Code Security Feature Bypass Vulnerability7.1
- CVE-2026-49069WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2026-54369acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions7.1
- CVE-2026-54371attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr7.1
- CVE-2026-41108Windows DNS Client Elevation of Privilege Vulnerability7.0
- CVE-2026-42911Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.0
- CVE-2026-42912Windows Telephony Service Elevation of Privilege Vulnerability7.0
- CVE-2026-44818Microsoft Excel Remote Code Execution Vulnerability7.0
- CVE-2026-45596Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.0
- CVE-2026-45598Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.0
- CVE-2026-45601Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.0
- CVE-2026-45603Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.0
- CVE-2026-45653Windows Kernel Elevation of Privilege Vulnerability7.0
- CVE-2026-56407libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.6.9
- CVE-2026-50507Windows BitLocker Security Feature Bypass Vulnerability6.8
- CVE-2025-67862An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7....6.7
- CVE-2026-13896Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Med...6.5
- CVE-2026-13904Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security ...6.5
- CVE-2026-28979An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tv...6.5
- CVE-2026-42824M365 Copilot Information Disclosure Vulnerability6.5
- CVE-2026-42903Windows Kerberos Denial of Service Vulnerability6.5
- CVE-2026-43707A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6...6.5
- CVE-2026-43716The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to...6.5
- CVE-2026-43720A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26...6.5
- CVE-2026-43745An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tv...6.5
- CVE-2026-45454Microsoft SharePoint Remote Code Execution Vulnerability6.5
- CVE-2026-45501Microsoft Exchange Server Spoofing Vulnerability6.5
- CVE-2026-47154Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.26.5
- CVE-2026-47284Visual Studio Code Information Disclosure Vulnerability6.5
- CVE-2026-47287Visual Studio Code Tampering Vulnerability6.5
- CVE-2026-47644Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability6.5
- CVE-2026-47655Microsoft Graph Information Disclosure Vulnerability6.5
- CVE-2026-48112GHSL-2026-122 7-Zip Ar SYMDEF OOB Read6.5
- CVE-2026-50508Windows NTLM Spoofing Vulnerability6.5
- CVE-2026-56701Grav - XML External Entity Injection via SVG Upload6.5
- CVE-2026-58058Nmap - Integer Underflow in IPv6 Extension Header Parsing6.5
- CVE-2026-12488GeoVision GV-VMS V20 GV-Cloud memory corruption vulnerability6.2
- CVE-2026-41568Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap6.1
- CVE-2026-45500Microsoft Exchange Server Spoofing Vulnerability6.1
- CVE-2026-41841Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux5.9
- CVE-2025-55645A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.5.5
- CVE-2026-40722WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability5.5
- CVE-2026-42972Windows Hyper-V Information Disclosure Vulnerability5.5
- CVE-2026-43722The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe...5.5
- CVE-2026-45647Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability5.5
- CVE-2026-3341IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services5.4
- CVE-2026-40930LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body5.4
- CVE-2026-45595Windows Mark of the Web Security Feature Bypass Vulnerability5.4
- CVE-2026-47223NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow5.4
- CVE-2026-12969Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation5.3
- CVE-2026-14153Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HT...5.3
- CVE-2026-42914Windows Kerberos Denial of Service Vulnerability5.3
- CVE-2026-45655Windows BitLocker Security Feature Bypass Vulnerability5.3
- CVE-2026-48166Filament: Timing-based user enumeration on login page5.3
- CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3
- CVE-2026-45502Microsoft Exchange Server Information Disclosure Vulnerability5.0
- CVE-2026-44490Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions4.8
- CVE-2024-32110WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.1.2 - Cross Site Request Forgery (CSRF) vulnerability4.3
- CVE-2026-57286A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, su...4.3
- CVE-2026-57921In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint4.3
- CVE-2026-48104GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read4.2
- CVE-2026-10298ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference3.3
- CVE-2026-45455Microsoft Excel Information Disclosure Vulnerability3.3
- CVE-2026-48102GHSL-2026-118: 7-Zip UDF Field OOB Read3.1
- CVE-2026-57922In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible3.1
- CVE-2026-9088Keycloak: keycloak: information disclosure due to user profile permission bypass2.7