Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2026

357 records · 26 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 4

  • CVE-2026-11645
    66This week

    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a san

    HighCVSS 8.8KEVWeaponizedEPSS 2%

    google · chromeJun 8, 2026

  • CVE-2026-41710
    23Monitor

    Cache Exhaustion in Stateful Retries leads to Denial of Service

    MediumCVSS 5.9Proof of conceptEPSS 0%

    broadcom · spring retryJun 9, 2026

  • CVE-2017-20251
    37Monitor

    WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    themeisle · woody code snippetsJun 9, 2026

  • CVE-2026-10523
    55Plan

    An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthent

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    ivanti · standalone sentryJun 9, 2026

  • CVE-2026-10727
    32Monitor

    An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker

    HighCVSS 7.2No exploitEPSS 13%

    ivanti · endpoint manager mobileJun 9, 2026

  • CVE-2026-25089
    92Now

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 th

    CriticalCVSS 9.8KEVWeaponizedEPSS 76%

    fortinet · fortisandboxJun 9, 2026

  • CVE-2026-46316
    37Monitor

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    linux · linux kernelJun 9, 2026

  • CVE-2026-42978
    31Monitor

    Windows Push Notifications Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    microsoft · windows 10 1809Jun 9, 2026

  • CVE-2026-42980
    31Monitor

    NT OS Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    microsoft · windows 10 1607Jun 9, 2026

  • CVE-2026-45447
    36Monitor

    Heap Use-After-Free in the PKCS7_verify() Function

    HighCVSS 8.8Proof of conceptEPSS 4%

    openssl · opensslJun 9, 2026

  • CVE-2026-45504
    35Monitor

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    microsoft · exchange serverJun 9, 2026

  • CVE-2026-49160
    30Monitor

    HTTP.sys Denial of Service Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    microsoft · windows 10 1607Jun 9, 2026

  • CVE-2026-50507
    27Monitor

    Windows BitLocker Security Feature Bypass Vulnerability

    MediumCVSS 6.8Proof of conceptEPSS 0%

    microsoft · windows 10 1607Jun 9, 2026

  • CVE-2026-8863
    31Monitor

    Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass.

    HighCVSS 7.8Proof of conceptEPSS 0%

    oracle corporation · oraclelinux(7.2) shimJun 9, 2026

  • CVE-2026-10520
    100Now

    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    ivanti · standalone sentryJun 9, 2026

  • CVE-2026-25860
    21Monitor

    OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler

    MediumCVSS 5.3Proof of conceptEPSS 0%

    frankverbeke · openclinic gaJun 9, 2026

  • CVE-2026-44963
    37Monitor

    A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    veeam · backup and replicationJun 9, 2026

  • CVE-2026-41729
    32Monitor

    Spring Data REST SpEL Injection via Map Key in JSON Patch

    HighCVSS 8.1Proof of conceptEPSS 0%

    vmware · spring data restJun 9, 2026

  • CVE-2025-59382
    4Monitor

    QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)

    LowCVSS 1.2Proof of conceptEPSS 0%

    qnap systems inc. · qtsJun 9, 2026

  • CVE-2026-29114
    9Monitor

    A vulnerability has been found in some Dahua products.

    LowCVSS 2.3Proof of conceptEPSS 0%

    dahua · ipcJun 10, 2026

  • CVE-2026-29115
    27Monitor

    A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, trigg

    MediumCVSS 6.9Proof of conceptEPSS 0%

    dahua · ipc/sdJun 10, 2026

  • CVE-2026-29116
    34Monitor

    A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, tri

    HighCVSS 8.7Proof of conceptEPSS 0%

    dahua · ipc/sd/nvr/xvr/evs/vto/vth/asi/tpcJun 10, 2026

  • CVE-2026-3326
    34Monitor

    XStore < 9.7.3 - Unauthenticated SQLi

    HighCVSS 8.6Proof of conceptEPSS 1%

    unknown · xstoreJun 10, 2026

  • CVE-2026-9067
    36Monitor

    Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    unknown · schema & structured data for wp & ampJun 10, 2026

  • CVE-2026-11837
    29Monitor

    Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown

    HighCVSS 7.3Proof of conceptEPSS 0%

    red hat · red hat enterprise linux 10Jun 10, 2026

  • CVE-2026-3018
    30Monitor

    Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter

    HighCVSS 7.5Proof of conceptEPSS 1%

    contrid · newslettersJun 10, 2026

  • CVE-2025-6254
    39Monitor

    Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    amentotech · doctreat coreJun 10, 2026

  • CVE-2026-49069
    28Monitor

    WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    wpzoom · wpzoom portfolioJun 10, 2026

  • CVE-2026-53435
    36Monitor

    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in J

    HighCVSS 8.8Proof of conceptEPSS 2%

    jenkins · jenkinsJun 10, 2026

  • CVE-2026-46558
    33Monitor

    Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

    HighCVSS 8.3Proof of conceptEPSS 0%

    plane · planeJun 10, 2026

  • CVE-2026-53694
    29Monitor

    Potential local privileges escalation through argument injection in the nxchmod.sh script

    HighCVSS 7.3Proof of conceptEPSS 0%

    nomachine · nomachineJun 10, 2026

  • CVE-2025-71329
    34Monitor

    image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser

    HighCVSS 8.7Proof of conceptEPSS 0%

    image-size · image-sizeJun 10, 2026

  • CVE-2026-11417
    28Monitor

    OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

    HighCVSS 7.0Proof of conceptEPSS 0%

    aws · aws cloud development kit libraryJun 10, 2026

  • CVE-2026-20251
    45Plan

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

    HighCVSS 8.8Proof of conceptEPSS 32%

    splunk · splunkJun 10, 2026

  • CVE-2026-20253
    98Now

    Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    splunk · splunkJun 10, 2026

  • CVE-2026-46529
    33Monitor

    PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

    HighCVSS 8.4Proof of conceptEPSS 0%

    mate-desktop · atrilJun 10, 2026

  • CVE-2026-0273
    24Monitor

    PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI

    MediumCVSS 6.1Proof of conceptEPSS 1%

    paloaltonetworks · pan-osJun 10, 2026

  • CVE-2026-46522
    31Monitor

    ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

    HighCVSS 7.5Proof of conceptEPSS 1%

    imagemagick · imagemagickJun 10, 2026

  • CVE-2026-50131
    34Monitor

    Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

    HighCVSS 8.6Proof of conceptEPSS 0%

    fedify-dev · fedifyJun 10, 2026

  • CVE-2026-42568
    17Monitor

    Yamcs Vulnerable to LDAP Injection in LdapAuthModule

    MediumCVSS 4.3Proof of conceptEPSS 1%

    yamcs · yamcsJun 10, 2026

  • CVE-2026-46645
    17Monitor

    SQLAdmin: Authorization Bypass on `ajax_lookup`

    MediumCVSS 4.3Proof of conceptEPSS 0%

    smithyhq · sqladminJun 10, 2026

  • CVE-2026-35273
    98Now

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    oracle · peoplesoft enterprise peopletoolsJun 11, 2026

  • CVE-2026-10795
    33Monitor

    UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

    HighCVSS 8.1Proof of conceptEPSS 3%

    davidanderson · updraftplus: wp backup & migration pluginJun 11, 2026

  • CVE-2026-40987
    28Monitor

    Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

    HighCVSS 7.1Proof of conceptEPSS 0%

    vmware · spring integrationJun 11, 2026

  • CVE-2026-11561
    39Monitor

    SSTI in Soagen Informatics' Apinizer

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    soagen informatics technologies software and consulting inc. · apinizerJun 11, 2026

  • CVE-2026-47172
    38Monitor

    Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.

    CriticalCVSS 9.5Proof of conceptEPSS 0%

    duck-organization · quest-botJun 11, 2026

  • CVE-2026-42647
    37Monitor

    WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    beardev · joomsportJun 11, 2026

  • CVE-2026-49060
    39Monitor

    WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    hippoo · hippoo mobile app for woocommerceJun 11, 2026

  • CVE-2026-48611
    40Plan

    Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to u

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    phpbb · phpbbJun 12, 2026

  • CVE-2026-9271
    23Monitor

    KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS

    MediumCVSS 5.9Proof of conceptEPSS 0%

    unknown · keepinmind dashboard notesJun 12, 2026

  • CVE-2026-48914
    26Monitor

    Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

    MediumCVSS 6.7No exploitEPSS 0%

    red hat · red hat enterprise linux 10Jun 12, 2026

  • CVE-2026-45674
    40Plan

    Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    netty · nettyJun 12, 2026

  • CVE-2026-47208
    40Plan

    vm2: Sandbox Breakout Using Promise Species

    CriticalCVSS 10.0No exploitEPSS 0%

    patriksimek · vm2Jun 12, 2026

  • CVE-2026-53787
    39Monitor

    Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.3Proof of conceptEPSS 6%

    amasty · order attributes for magento 2Jun 12, 2026

  • CVE-2026-45833
    37Monitor

    A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary c

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    trychroma · chromadbJun 12, 2026

  • CVE-2026-50011
    30Monitor

    Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

    HighCVSS 7.5Proof of conceptEPSS 0%

    netty · nettyJun 12, 2026

  • CVE-2026-54397
    24Monitor

    MISP event editing allows unauthorized assignment to undisclosed sharing groups

    MediumCVSS 6.1No exploitEPSS 0%

    misp · mispJun 12, 2026

  • CVE-2026-48558
    70This week

    SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

    CriticalCVSS 9.5KEVWeaponizedEPSS 5%

    simple-help · simplehelpJun 12, 2026

  • CVE-2026-46716
    39Monitor

    Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    nezhahq · nezhaJun 12, 2026

  • CVE-2026-53519
    37Monitor

    Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    nezhahq · nezhaJun 12, 2026

  • CVE-2026-53836
    34Monitor

    OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases

    HighCVSS 8.7No exploitEPSS 0%

    openclaw · openclawJun 12, 2026

  • CVE-2026-9848
    30Monitor

    WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter

    HighCVSS 7.5Proof of conceptEPSS 0%

    emarket-design · customer support ticket system & helpdeskJun 12, 2026

  • CVE-2026-5513
    28Monitor

    Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

    HighCVSS 7.2Proof of conceptEPSS 0%

    ladela · online scheduling and appointment booking system – booklyJun 13, 2026

  • CVE-2026-54420
    64This week

    LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP

    HighCVSS 8.5KEVWeaponizedEPSS 0%

    litespeedtech · litespeed cpanel pluginJun 14, 2026

  • CVE-2026-12191
    28Monitor

    Comma AI Openpilot Pickle modeld.py pickle.loads deserialization

    HighCVSS 7.1Proof of conceptEPSS 0%

    comma ai · openpilotJun 14, 2026

  • CVE-2026-8385
    21Monitor

    WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback

    MediumCVSS 5.3Proof of conceptEPSS 0%

    unknown · wp go mapsJun 15, 2026

  • CVE-2026-8386
    21Monitor

    WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID

    MediumCVSS 5.3Proof of conceptEPSS 0%

    unknown · wp go mapsJun 15, 2026

  • CVE-2026-49757
    36Monitor

    OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    team-alembic · ash_authenticationJun 15, 2026

  • CVE-2026-20262
    64This week

    Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

    MediumCVSS 6.5KEVWeaponizedEPSS 28%

    cisco · catalyst sd-wan managerJun 15, 2026

  • CVE-2026-47777
    30Monitor

    Mastodon has a consent-check bypass in its remote Collections

    HighCVSS 7.5Proof of conceptEPSS 0%

    mastodon · mastodonJun 15, 2026

  • CVE-2026-36213
    31Monitor

    An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.

    HighCVSS 7.8Proof of conceptEPSS 0%

    Jun 15, 2026

  • CVE-2026-36670
    35Monitor

    A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3

    HighCVSS 8.8Proof of conceptEPSS 0%

    Jun 15, 2026

  • CVE-2026-38812
    39Monitor

    RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Jun 15, 2026

  • CVE-2026-49952
    38Monitor

    Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

    CriticalCVSS 9.3Proof of conceptEPSS 3%

    discuz! · discuz! x5.0Jun 15, 2026

  • CVE-2026-52721
    21Monitor

    Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing

    MediumCVSS 5.3No exploitEPSS 0%

    red hat · red hat enterprise linux 10Jun 15, 2026

  • CVE-2026-39468
    27Monitor

    WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability

    MediumCVSS 6.8Proof of conceptEPSS 1%

    elightup · meta box – wordpress custom fields frameworkJun 15, 2026

  • CVE-2026-39492
    37Monitor

    WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    flipper code – wordpress development company · wp mapsJun 15, 2026

  • CVE-2026-40776
    30Monitor

    WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability

    HighCVSS 7.5Proof of conceptEPSS 0%

    arraytics · wp event solutionJun 15, 2026

  • CVE-2026-40791
    28Monitor

    WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    codepeople · wp time slots booking formJun 15, 2026

  • CVE-2026-49078
    30Monitor

    WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wp travel engine · wp travel engineJun 15, 2026

  • CVE-2026-49083
    30Monitor

    WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

    HighCVSS 7.5Proof of conceptEPSS 0%

    latepoint · latepointJun 15, 2026

  • CVE-2026-49085
    39Monitor

    WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    crm perks · wp insightly for contact form 7, wpforms, elementor, formidable and ninja formsJun 15, 2026

  • CVE-2026-49104
    39Monitor

    WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    crm perks · integration for keap/infusionsoft and contact form 7, wpforms, elementor, formidable, ninja formsJun 15, 2026

  • CVE-2026-49105
    39Monitor

    WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    crm perks · wp zendesk for contact form 7, wpforms, elementor, formidable and ninja formsJun 15, 2026

  • CVE-2026-9691
    39Monitor

    WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    crm perks · integration for activecampaign and contact form 7, wpforms, elementor, ninja formsJun 15, 2026

  • CVE-2026-12087
    36Monitor

    Socket versions before 2.041 for Perl have an out-of-bounds heap read

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    pevans · socketJun 15, 2026

  • CVE-2026-48017
    35Monitor

    DbGate: Remote Code Execution via functionName injection in loadReader endpoint

    HighCVSS 8.8Proof of conceptEPSS 0%

    dbgate · dbgateJun 15, 2026

  • CVE-2026-7273
    66This week

    A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a

    HighCVSS 8.8KEVWeaponizedEPSS 2%

    zyxel · gs1900-8 firmwareJun 15, 2026

  • CVE-2026-49772
    37Monitor

    WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    liquid web / stellarwp · the events calendarJun 16, 2026

  • CVE-2026-52715
    37Monitor

    WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    eyal fitoussi · geo my wordpressJun 16, 2026

  • CVE-2026-46331
    31Monitor

    net/sched: fix pedit partial COW leading to page cache corruption

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelJun 16, 2026

  • CVE-2026-12295
    38Monitor

    Sandbox escape in the DOM: Navigation component

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    mozilla · firefoxJun 16, 2026

  • CVE-2026-42089
    34Monitor

    yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

    HighCVSS 8.6Proof of conceptEPSS 0%

    yeoman · environmentJun 16, 2026

  • CVE-2026-50656
    28Monitor

    Microsoft Defender Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 0%

    microsoft · malware protection engineJun 16, 2026

  • CVE-2026-35301
    40Plan

    Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console).

    CriticalCVSS 10.0No exploitEPSS 0%

    oracle · weblogic serverJun 17, 2026

  • CVE-2026-46838
    39Monitor

    Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).

    CriticalCVSS 9.9No exploitEPSS 0%

    oracle · webcenter portalJun 17, 2026

  • CVE-2026-46858
    36Monitor

    Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics).

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    oracle · application performance managementJun 17, 2026

  • CVE-2026-0092
    40Plan

    In Package Manager, there is a possible device lock controller bypass due to a missing permission check.

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    google · androidJun 17, 2026

  • CVE-2026-12360
    30Monitor

    JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint

    HighCVSS 7.5No exploitEPSS 0%

    crocoblock · jetengineJun 17, 2026

  • CVE-2026-28576
    40Plan

    In Contacts Provider, there is a possible way to access the contacts database due to SQL injection.

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    google · androidJun 17, 2026