Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2026

355 records · 26 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 4

  • CVE-2026-20452
    32Monitor

    In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow.

    HighCVSS 8.0Proof of conceptEPSS 0%

    mediatek · mt6890 firmwareJun 1, 2026

  • CVE-2026-48188
    36Monitor

    SQL Injection via MySQL Quote Method

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    otrs · otrsJun 1, 2026

  • CVE-2026-48208
    26Monitor

    Denial-of-Service via SVG Rendering in Ticket

    MediumCVSS 6.5Proof of conceptEPSS 0%

    otrs · otrsJun 1, 2026

  • CVE-2026-10243
    22Monitor

    code-projects Smart Parking System Admin Endpoint missing authentication

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · smart parking systemJun 1, 2026

  • CVE-2026-42588
    32Monitor

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

    HighCVSS 8.1Proof of conceptEPSS 0%

    apache · activemqJun 1, 2026

  • CVE-2026-44825
    40Plan

    Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    apache · solrJun 1, 2026

  • CVE-2026-0826
    60This week

    Poly Voice – Possible Remote Control of Certain Poly Devices

    CriticalCVSS 9.2WeaponizedEPSS 32%

    hp inc. · poly_trio_8300Jun 1, 2026

  • CVE-2026-48866
    38Monitor

    WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    rocketgenius inc. · gravity formsJun 1, 2026

  • CVE-2026-45131
    40Plan

    CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    cloudpirates-io · helm-chartsJun 1, 2026

  • CVE-2026-45132
    40Plan

    CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    cloudpirates-io · helm-chartsJun 1, 2026

  • CVE-2026-45156
    32Monitor

    Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

    HighCVSS 8.1Proof of conceptEPSS 0%

    nextcloud · security-advisoriesJun 1, 2026

  • CVE-2024-52011
    30Monitor

    launch-editor vulnerable to command injection via the crafted request on Windows

    HighCVSS 7.5Proof of conceptEPSS 0%

    vitejs · launch-editorJun 1, 2026

  • CVE-2026-45729
    17Monitor

    ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input

    MediumCVSS 4.3Proof of conceptEPSS 0%

    thorvg · thorvgJun 1, 2026

  • CVE-2026-10288
    22Monitor

    code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · hotel and tourism reservation systemJun 1, 2026

  • CVE-2026-10289
    8Monitor

    code-projects Hotel and Tourism Reservation System tour.php cross site scripting

    LowCVSS 2.1Proof of conceptEPSS 0%

    code-projects · hotel and tourism reservation systemJun 1, 2026

  • CVE-2026-46243
    28Monitor

    smb: client: reject userspace cifs.spnego descriptions

    HighCVSS 7.1Proof of conceptEPSS 0%

    linux · linux kernelJun 1, 2026

  • CVE-2025-48595
    64This week

    In multiple locations, there is a possible way to achieve code execution due to an integer overflow.

    HighCVSS 8.4KEVWeaponizedEPSS 1%

    google · androidJun 1, 2026

  • CVE-2026-0009
    31Monitor

    In multiple locations, there is a possible tapjacking due to a logic error in the code.

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidJun 1, 2026

  • CVE-2026-0075
    23Monitor

    In multiple functions, there is a possible way to access the contacts database due to a SQL injection.

    MediumCVSS 5.9Proof of conceptEPSS 0%

    google · androidJun 1, 2026

  • CVE-2026-0091
    31Monitor

    In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user.

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidJun 1, 2026

  • CVE-2026-10290
    22Monitor

    code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · hotel and tourism reservation systemJun 1, 2026

  • CVE-2026-24088
    32Monitor

    Missing Authentication for Critical Function in Boot

    HighCVSS 8.2Proof of conceptEPSS 0%

    qualcomm · ar9380 firmwareJun 1, 2026

  • CVE-2026-8206
    39Monitor

    Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    themeum · kirki – freeform page builder, website builder & customizerJun 2, 2026

  • CVE-2026-49782
    21Monitor

    WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    elementor · elementor website builderJun 2, 2026

  • CVE-2026-7299
    21Monitor

    Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowin

    MediumCVSS 5.4Proof of conceptEPSS 0%

    appsmith · appsmithJun 2, 2026

  • CVE-2026-49943
    25Monitor

    CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in

    MediumCVSS 6.3Proof of conceptEPSS 0%

    nic · birdJun 2, 2026

  • CVE-2026-10702
    17Monitor

    JIT miscompilation in the JavaScript Engine: JIT component

    MediumCVSS 4.3Proof of conceptEPSS 0%

    mozilla · firefoxJun 2, 2026

  • CVE-2026-48598
    8Monitor

    CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection

    LowCVSS 2.1Proof of conceptEPSS 0%

    elixir-tesla · teslaJun 2, 2026

  • CVE-2026-5073
    30Monitor

    ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter

    HighCVSS 7.5Proof of conceptEPSS 1%

    armember · armember premium – membership plugin, content restriction, member levels, user profile & user signupJun 2, 2026

  • CVE-2026-5076
    39Monitor

    ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    armember · armember premium – membership plugin, content restriction, member levels, user profile & user signupJun 2, 2026

  • CVE-2026-47117
    37Monitor

    OpenMed < 1.5.2 Remote Code Execution via PII Model Loading

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    maziyarpanahi · openmedJun 2, 2026

  • CVE-2026-27145
    26Monitor

    Inefficient candidate hostname parsing in crypto/x509

    MediumCVSS 6.5Proof of conceptEPSS 0%

    go standard library · crypto/x509Jun 2, 2026

  • CVE-2026-39107
    25Monitor

    A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature.

    MediumCVSS 6.3Proof of conceptEPSS 0%

    Jun 3, 2026

  • CVE-2026-8888
    30Monitor

    Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular ex

    HighCVSS 7.5Proof of conceptEPSS 0%

    securly · securlyJun 3, 2026

  • CVE-2026-20230
    90Now

    Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

    HighCVSS 8.6KEVWeaponizedEPSS 88%

    cisco · unified communications managerJun 3, 2026

  • CVE-2026-49771
    30Monitor

    WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    10web · photo gallery by 10webJun 4, 2026

  • CVE-2026-28318
    61This week

    SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 1%

    solarwinds · serv-uJun 4, 2026

  • CVE-2026-35904
    39Monitor

    Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allo

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Jun 4, 2026

  • CVE-2026-8037
    92Now

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    CriticalCVSS 9.8KEVWeaponizedEPSS 77%

    progress · connection manager for objectscaleJun 4, 2026

  • CVE-2025-65640
    25Monitor

    Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to impro

    MediumCVSS 6.3Proof of conceptEPSS 0%

    Jun 4, 2026

  • CVE-2026-10973
    29Monitor

    Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag

    HighCVSS 7.4Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11101
    26Monitor

    Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craft

    MediumCVSS 6.5Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11102
    35Monitor

    Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary cod

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11103
    31Monitor

    Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level pr

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11104
    26Monitor

    Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obt

    MediumCVSS 6.5Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11105
    26Monitor

    Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th

    MediumCVSS 6.5Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11106
    26Monitor

    Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf

    MediumCVSS 6.5Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11107
    17Monitor

    Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a cra

    MediumCVSS 4.3Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11108
    35Monitor

    Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escala

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11109
    26Monitor

    Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa

    MediumCVSS 6.5Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11110
    26Monitor

    Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa

    MediumCVSS 6.5Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11111
    32Monitor

    Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a

    HighCVSS 8.1Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11112
    38Monitor

    Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11113
    38Monitor

    Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11114
    38Monitor

    Use after free in Device Trust in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11115
    29Monitor

    Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalati

    HighCVSS 7.3Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11116
    35Monitor

    Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious netwo

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11117
    35Monitor

    Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11118
    35Monitor

    Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11119
    38Monitor

    Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-11120
    38Monitor

    Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    google · chromeJun 4, 2026

  • CVE-2026-20245
    69This week

    Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 25%

    cisco · catalyst sd-wan managerJun 4, 2026

  • CVE-2026-47644
    30Monitor

    Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 0%

    microsoft · copilot chatJun 4, 2026

  • CVE-2026-41249
    32Monitor

    CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

    HighCVSS 8.2Proof of conceptEPSS 0%

    coreshop · coreshopJun 4, 2026

  • CVE-2026-41567
    28Monitor

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    HighCVSS 7.2Proof of conceptEPSS 0%

    moby · moby/v2/daemonJun 4, 2026

  • CVE-2026-48907
    75This week

    Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

    CriticalCVSS 10.0KEVWeaponizedEPSS 16%

    widgetfactorylimited · jceJun 5, 2026

  • CVE-2026-49777
    41Plan

    WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 2%

    shapedplugin, llc · product slider pro for woocommerceJun 5, 2026

  • CVE-2026-6274
    39Monitor

    Authentication Bypass in DTS Electronics' Redline WR3200

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    dts electronics industry and trade ltd. co. · redline wr3200Jun 5, 2026

  • CVE-2026-21017
    18Monitor

    Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privil

    MediumCVSS 4.6Proof of conceptEPSS 0%

    samsung · androidJun 5, 2026

  • CVE-2026-50230
    20Monitor

    Lyrion Music Server 9.2.0 Reflected XSS via server.log

    MediumCVSS 5.1Proof of conceptEPSS 0%

    lms community · lyrion music serverJun 5, 2026

  • CVE-2026-48095
    35Monitor

    GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation

    HighCVSS 8.8Proof of conceptEPSS 0%

    7-zip · 7-zipJun 5, 2026

  • CVE-2026-11344
    22Monitor

    code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · vehicle management systemJun 5, 2026

  • CVE-2026-45746
    36Monitor

    Termix Vulnerable to Arbitrary Command Execution via Session Hijacking

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    termix · termixJun 5, 2026

  • CVE-2026-49492
    34Monitor

    Markdown Preview Enhanced OS Command Injection in External File and Link Opening

    HighCVSS 8.6Proof of conceptEPSS 0%

    shd101wyy · markdown preview enhancedJun 5, 2026

  • CVE-2026-10580
    40Plan

    Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    hippooo · hippoo mobile app for woocommerceJun 5, 2026

  • CVE-2026-46391
    34Monitor

    HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

    HighCVSS 8.7Proof of conceptEPSS 0%

    haxtheweb · @haxtheweb/open-apisJun 5, 2026

  • CVE-2026-46394
    30Monitor

    HAX CMS Vulnerable to Command Injection using Git.php

    HighCVSS 7.7Proof of conceptEPSS 0%

    haxtheweb · haxcms-phpJun 5, 2026

  • CVE-2026-46395
    37Monitor

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    haxtheweb · haxcms-nodejsJun 5, 2026

  • CVE-2026-5411
    35Monitor

    WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 0%

    webfactory · advanced google recaptchaJun 5, 2026

  • CVE-2026-5415
    35Monitor

    WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

    HighCVSS 8.8Proof of conceptEPSS 0%

    webfactory · advanced google recaptchaJun 5, 2026

  • CVE-2026-7473
    60This week

    Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

    MediumCVSS 6.9KEVWeaponizedEPSS 0%

    arista · eosJun 5, 2026

  • CVE-2026-7654
    35Monitor

    Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

    HighCVSS 8.8Proof of conceptEPSS 1%

    codepress · admin columnsJun 5, 2026

  • CVE-2025-12656
    15Monitor

    Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion

    LowCVSS 3.8No exploitEPSS 0%

    wpvividplugins · wpvivid — backup, migration & stagingJun 5, 2026

  • CVE-2026-9290
    31Monitor

    WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter

    HighCVSS 7.5Proof of conceptEPSS 2%

    wpusermanager · wp user manager – user profile builder & membershipJun 5, 2026

  • CVE-2026-7537
    28Monitor

    MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

    HighCVSS 7.2Proof of conceptEPSS 1%

    mdjm · mdjm event managementJun 6, 2026

  • CVE-2026-7665
    21Monitor

    Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler

    MediumCVSS 5.3Proof of conceptEPSS 0%

    wpdevteam · essential addons for elementor – popular elementor templates & widgetsJun 6, 2026

  • CVE-2026-8839
    21Monitor

    MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints

    MediumCVSS 5.3Proof of conceptEPSS 1%

    chrisvrichardson · mappress maps for wordpressJun 6, 2026

  • CVE-2026-11450
    27Monitor

    GL.iNet GL-MT3000 Path Normalization dlopen command injection

    MediumCVSS 6.9Proof of conceptEPSS 1%

    gl.inet · gl-mt3000Jun 6, 2026

  • CVE-2026-9506
    35Monitor

    Path Traversal Vulnerability in Bagisto

    HighCVSS 8.7Proof of conceptEPSS 1%

    webkul · bagistoJun 8, 2026

  • CVE-2026-50751
    93Now

    User Authentication Bypass in VPN Remote Access and Mobile Access

    CriticalCVSS 9.3KEVWeaponizedEPSS 85%

    checkpoint · gaia osJun 8, 2026

  • CVE-2026-11499
    39Monitor

    Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow

    CriticalCVSS 9.3Proof of conceptEPSS 6%

    tenda · hg7hg9Jun 8, 2026

  • CVE-2026-11518
    8Monitor

    SourceCodester Inventory System User Management users.php cross site scripting

    LowCVSS 2.1Proof of conceptEPSS 0%

    sourcecodester · inventory systemJun 8, 2026

  • CVE-2026-42536
    31Monitor

    Apache HTTP Server: mod_xml2enc heap overflow

    HighCVSS 7.5Proof of conceptEPSS 2%

    apache · http serverJun 8, 2026

  • CVE-2026-46442
    38Monitor

    Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

    CriticalCVSS 9.4Proof of conceptEPSS 3%

    flowiseai · flowiseJun 8, 2026

  • CVE-2026-49975
    31Monitor

    Apache HTTP Server: mod_http2 denial of service

    HighCVSS 7.5Proof of conceptEPSS 4%

    apache · http serverJun 8, 2026

  • CVE-2026-25555
    38Monitor

    OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    openbullet · openbullet2Jun 8, 2026

  • CVE-2026-46490
    34Monitor

    samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

    HighCVSS 8.7Proof of conceptEPSS 0%

    samlify project · samlifyJun 8, 2026

  • CVE-2026-46275
    31Monitor

    Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelJun 8, 2026

  • CVE-2026-11553
    29Monitor

    Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow

    HighCVSS 7.4Proof of conceptEPSS 0%

    tenda · hg7hg9Jun 8, 2026

  • CVE-2026-11645
    66This week

    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a san

    HighCVSS 8.8KEVWeaponizedEPSS 2%

    google · chromeJun 8, 2026