CVEs published in June 2026

CVE-2026-57204Critical

Denial of Service via crafted PDF with missing stream length

CVE-2025-53648Medium

SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files

CVE-2026-8452HighCISA KEV

Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-52760Medium

Apache ActiveMQ Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache…

CVE-2026-49877High

Apache ActiveMQ: Improper Authorization vulnerability in Apache ActiveMQ.

CVE-2026-49434High

Unauthorized broker instantiation via improper input validation in LDAP entries

CVE-2026-49432High

Denial of Service via improper input validation in STOMP connector

CVE-2026-50734High

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All

CVE-2026-50750High

DoS (Denial of Service) org.apache.activemq:activemq-broker Dependency in Bamboo Data Center

CVE-2026-53916High

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp

CVE-2026-53917High

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client…

CVE-2026-54475High

Information disclosure due to broken temporary destination isolation

CVE-2026-13149Critical

Denial of Service due to exponential-time complexity

CVE-2026-14101High

Insufficient policy enforcement in Sandbox

CVE-2026-55956Medium

Improper Authorization Allows Security Constraint Bypass

CVE-2026-55955Medium

Replay attack via improper authentication in EncryptionInterceptor

CVE-2026-55276Critical

Misleading security logs due to incorrect control flow

CVE-2026-53434Critical

Error condition not handled when configuring CRLs

CVE-2026-53404High

Incorrect control flow in rewrite valve allows unexpected rule processing

CVE-2026-50229Medium

Cross-Site Scripting vulnerability in number guess example

CVE-2026-13676High

Security policy bypass due to improper Unicode hostname canonicalization

CVE-2026-54371High

Symlink Traversal Privilege Escalation via getfattr and setfattr

CVE-2026-54370High

TOCTOU Symlink Traversal via getfacl/setfacl

CVE-2026-54369High

Symlink traversal privilege escalation via libacl functions

CVE-2026-57915High

Kerberos pre-authentication bypass via unrecognized PA-DATA

CVE-2026-49486Unrated

Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

CVE-2026-46863High

MySQL Server Vulnerability in NetApp Products

CVE-2026-45536Critical

CVE-2026-42586Critical

CVE-2026-42585Critical

CVE-2026-42580Critical

CVE-2026-42502Critical

CVE-2026-41417Critical

IBM Db2 Vulnerability in NetApp Products

CVE-2026-39827Medium

Golang.Org/X/Crypto Vulnerability in NetApp Products

CVE-2026-2303Medium

MongoDB Drivers Vulnerability in NetApp Products

CVE-2026-20175Medium

Cisco Finesse Remote File Inclusion Vulnerability

CVE-2026-8330Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI/CD API endpoint

CVE-2026-5952Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite protected Maven package metadata due to incorrect authorization checks

CVE-2026-5796Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from projects with the Package Registry disabled due to incorrect authorization checks in the group packages feature

CVE-2026-5309Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group's virtual registry cleanup policy settings without authorization

CVE-2026-3176Low

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to access project information due to insufficient authorization checks

CVE-2026-2238Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public projects due to improper authorization checks

CVE-2026-1606Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation

CVE-2026-12635Low

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through mirror synchronization due to improper URL validation

CVE-2026-12053High

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows

CVE-2026-11379Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions

CVE-2026-10712High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions

CVE-2026-10086High

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input

CVE-2026-0934Low

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configurations despite CI/CD visibility being disabled for the project

CVE-2026-53176Medium

Reject login PDUs shorter than ISER_HEADERS_LEN

CVE-2026-13006High

Injection ch.qos.logback:logback-core Dependency in Confluence Data Center

CVE-2026-53088Medium

fix off-by-one in bcmgenet_put_txcb

CVE-2026-52999Medium

fix out-of-bounds read on option matching

CVE-2026-11972High

Python tarfile module: Denial of Service via improper EOF handling in streaming mode

CVE-2026-41862High

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine…

CVE-2026-50193High

Denial of Service via deeply nested JSON processing

CVE-2026-54512High

DoS (Denial of Service) in jackson-databind Dependency in Confluence Data Center

CVE-2026-54513High

Security bypass allows arbitrary code execution

CVE-2026-0864Medium

Python configparser: Configuration injection via crafted multi-line input

CVE-2026-13757Medium

Stack exhaustion via unbounded recursion in RPC attribute parsing

CVE-2026-54651Critical

Denial of Service via crafted PDF

CVE-2026-49460Critical

Denial of Service via crafted PDF with FlateDecode filter

CVE-2026-49461Critical

Denial of Service via crafted PDF with self-referencing form XObject

CVE-2026-54531Critical

Denial of Service via crafted PDF with outlines

CVE-2026-54530Critical

Denial of Service via crafted PDF processing

CVE-2026-54293Critical

Information Disclosure via Path Traversal in `nltk.data.load `

CVE-2026-53540Critical

Negative Content-Length in parse_form buffers the entire body in memory

CVE-2026-53537Critical

Information disclosure via header parsing discrepancy

CVE-2026-54283Critical

request.form limits silently ignored for application/x-www-form-urlencoded enable DoS

CVE-2026-54282Critical

Information disclosure due to improper HTTP request path validation

CVE-2026-20109Medium

CVE-2026-20055Medium

CVE-2026-53655Medium

File smuggling due to inconsistent tar archive parsing

CVE-2026-6653High

Denial of Service via crafted XML input due to use-after-free

CVE-2026-48582Critical

Microsoft Exchange Online Elevation of Privilege Vulnerability

CVE-2026-45480Critical

Azure Active Directory Elevation of Privilege Vulnerability

CVE-2026-20190Critical

CVE-2026-20181Critical

CVE-2026-48095High

7-Zip Vulnerability in NetApp Products

CVE-2026-42501High

Golang Vulnerability in NetApp Products

CVE-2026-39836Critical

Golang Vulnerability in NetApp Products

CVE-2025-15661High

Information disclosure and denial of service via crafted SFTP response

CVE-2026-47847Medium

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the…

CVE-2026-47846Critical

Bitnami Cassandra container images are affected by a retained default superuser vulnerability.

CVE-2026-47833Medium

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow.

CVE-2026-12539Medium

Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts

CVE-2026-12039Medium

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy

CVE-2026-44618Medium

Apache CXF Vulnerability in NetApp Products

CVE-2025-54988High

Apache Tika Vulnerability in NetApp Products

CVE-2026-50107High

When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric

CVE-2026-32682High

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters

CVE-2026-55200Critical

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

CVE-2026-48818Critical

SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

CVE-2026-20246Medium

Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability

CVE-2026-20220Medium

Cisco Crosswork Network Controller Server-Side Template Injection Vulnerability

CVE-2026-20178Medium

Cisco Webex App Open Redirect Vulnerability

CVE-2026-11311High

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric

CVE-2026-48142Medium

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module

CVE-2026-42530Critical

use-after-free issue leads to denial of service

CVE-2026-32967Unrated

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks