CVEs published in June 2026

CVE-2026-46598Critical

CVE-2026-46597Critical

CVE-2026-42771Medium

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email

CVE-2026-42765High

OpenSSL Vulnerability in NetApp Products

CVE-2026-39834Critical

CVE-2026-39833Critical

CVE-2026-39831Critical

CVE-2026-35188Medium

OpenSSL Vulnerability in NetApp Products

CVE-2026-7273HighCISA KEV

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

CVE-2026-97032Critical

Denial of Service via concurrent HPACK encoder modification

CVE-2026-97031Critical

Denial of Service via multiple ECH outer extension references

CVE-2026-94447Critical

Toolchain checksum verification bypass via crafted project configuration

CVE-2026-94444Critical

arbitrary code execution via untrusted module proxy

CVE-2026-94440Critical

Denial of Service via memory limit bypass in multipart form parsing

CVE-2026-94439Critical

HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

CVE-2026-93990Critical

XML Injection via Malformed UTF-16 Input

CVE-2026-93749Critical

Denial of Service via malformed indexed source maps

CVE-2026-8927Critical

Information disclosure due to uncleared proxy authentication state

CVE-2026-89161Critical

Memory corruption vulnerability in pcre2_jit_match

CVE-2026-86145Critical

Out-of-bounds write allows arbitrary code execution via crafted regular expressions

CVE-2026-86140Critical

Libxml2 Vulnerability in NetApp Products

CVE-2026-85061Critical

CVE-2026-84782Critical

Information disclosure via DTLS handshake retransmission

CVE-2026-8458Critical

CVE-2026-78669Critical

Denial of Service via excessive HTTP/2 SETTINGS frames

CVE-2026-78667Critical

Denial of Service via crafted HTTP Range headers

CVE-2026-78663Critical

flow control limit bypass via double refund in HTTP/2 server

CVE-2026-78660Critical

HTTP response smuggling via malformed HTTP/2 framing headers

CVE-2026-78659Critical

Denial of Service via HTTP/2 trailer header memory exhaustion

CVE-2026-77214Critical

Information disclosure via heap buffer over-read in XML_ParseBuffer

CVE-2026-74860Critical

Libxml2: double-free/uaf in libxml2 python bindings

CVE-2026-71556Critical

Arbitrary file read/write via symbolic link resolution

CVE-2026-70464Critical

Denial of Service via handshake stall

CVE-2026-70463Critical

Authorization bypass via `auth users` directive parsing

CVE-2026-70461Critical

Information disclosure and denial of service via crafted files-from entry

CVE-2026-70460Critical

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

CVE-2026-70458Critical

Memory corruption via crafted file entries

CVE-2026-70456Critical

Heap Out-of-Bounds Write via crafted argument list

CVE-2026-70452Critical

rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

CVE-2026-66046Critical

CVE-2026-63388Critical

Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

CVE-2026-63387Critical

Off-by-one stack buffer overflow leading to denial of service or data corruption

CVE-2026-63385Critical

HTTP header handling bugs create risk of access control bypass.

CVE-2026-63384Critical

Denial of Service via integer conversion error in `evtag_unmarshal_header`

CVE-2026-63383Critical

Denial of Service via malformed RPC data

CVE-2026-63382Critical

Multiple HTTP Parser Bugs Enable Request Smuggling

CVE-2026-60005Critical

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module

CVE-2026-56866Critical

Cross-user response poisoning via desynchronized HTTP CONNECT connections

CVE-2026-56865Critical

Supply chain compromise via transparency log tile verification bypass

CVE-2026-56857Critical

Directory traversal via Windows junction handling

CVE-2026-56852Critical

Denial of Service via invalid UTF-8 input

CVE-2026-53803Critical

Local Privilege Escalation via Symlink Following

CVE-2026-53802Critical

CVE-2026-53795Critical

Arbitrary file write via --temp-dir or --link-dest options

CVE-2026-53793Critical

rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

CVE-2026-53791Critical

rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

CVE-2026-53790Critical

rsync < 3.5.0 Command Injection via Multiple Code Paths

CVE-2026-53785Critical

Arbitrary file write via path traversal in --relative mode

CVE-2026-53784Critical

Unauthorized File Access via Symlink Module Root

CVE-2026-53783Critical

Directory escape via TOCTOU race condition in rrsync

CVE-2026-42533Critical

vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable

CVE-2026-42505Critical

Go crypto/tls: Information disclosure in Encrypted Client Hello

CVE-2026-42504Critical

Golang Vulnerability in NetApp Products

CVE-2026-42055Critical

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules

CVE-2026-40345Critical

CVE-2026-39822Critical

Go os.Root: Symlink following vulnerability allows directory traversal

CVE-2026-32952Critical

CVE-2026-14456Critical

Denial of Service via unbounded memory growth in QUIC server

CVE-2026-116689Critical

Information disclosure via cross-origin redirects

CVE-2026-116587Critical

Denial of Service via crafted RSA parameters in JWKs

CVE-2026-114406Critical

Distrust eMudhra intermediate CA certificates due to security concerns

CVE-2026-112942Critical

Command injection via improper file path validation

CVE-2026-111943Critical

Mitigating Impact of Compromised eMudhra Intermediate CA Certificates on Veeam Kasten for Kubernetes

CVE-2026-111756Critical

Information disclosure via array-formatted headers during cross-origin redirects

CVE-2026-111755Critical

Information disclosure via improper regular expression escaping in sensitive header filtering

CVE-2026-10649High

Denial of Service via integer overflow in remote message decompression

CVE-2026-103111Critical

Out-of-bounds write via crafted regular expression

CVE-2026-101909Critical

Prototype Pollution axios Dependency in Crowd Data Center

CVE-2026-101907Critical

Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter

CVE-2026-101906Critical

DoS (Denial of Service) axios Dependency in Crowd Data Center

CVE-2026-101905Critical

Request socket hijacking via inherited createConnection property

CVE-2026-101903Critical

DoS (Denial of Service) axios Dependency in Confluence Data Center

CVE-2026-101901Critical

DoS (Denial of Service) axios Dependency in Crowd Data Center

CVE-2026-101898Critical

Security control bypass via unapplied HTTP/2 proxy and DNS settings

CVE-2024-4323Critical

CVE-2024-24786Critical

CVE-2023-54404Critical

Denial of service via unbounded array validation

CVE-2023-3978Critical

CVE-2022-23806Critical

CVE-2022-23772Critical

CVE-2021-43798CriticalCISA KEV

Grafana Path Traversal Vulnerability

CVE-2021-33194Critical

CVE-2020-14040Critical

CVE-2026-20262MediumCISA KEV

Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

CVE-2026-47825High

Spring Cloud: Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain conf…

CVE-2026-47835High

In Spring AI Vector Stores, special characters

CVE-2026-41708High

Spring Cloud: In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-servi…

CVE-2026-0249High

GlobalProtect App: Certificate Validation Bypass Vulnerabilities

CVE-2026-0250High

GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway

CVE-2026-20245HighCISA KEV

Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability