CVEs published in June 2026

CVE-2026-20182CriticalCISA KEV

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

CVE-2026-20127CriticalCISA KEV

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

CVE-2026-42306High

Docker Engine: Moby is an open source container framework

CVE-2026-41568Medium

Docker Engine: Moby is an open source container framework

CVE-2026-12143High

RCE (Remote Code Execution) form-data Dependency in Crowd Data Center

CVE-2026-44170Critical

Mariadb Vulnerability in NetApp Products

CVE-2026-50560Critical

Denial of Service due to HTTP/2 max header size handling

CVE-2026-50020Critical

Data manipulation via request-boundary confusion in HttpObjectDecoder

CVE-2026-50011Critical

Denial of Service via malicious Redis array header

CVE-2026-50010Critical

Improper trust manager handling leads to hostname verification bypass

CVE-2026-48748High

Denial of Service due to memory exhaustion in HTTP/3 codec

CVE-2026-48059Critical

Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

CVE-2026-48043Critical

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Confluence Data Center

CVE-2026-48006Critical

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

CVE-2026-47691Critical

Netty has Insufficient Bailiwick Validation for NS Records

CVE-2026-47244Critical

Denial of Service via uncontrolled HTTP/2 concurrent streams

CVE-2026-46340Critical

Denial of Service due to unbounded memory growth from SctpMessage fragments

CVE-2026-45674Critical

MITM (Man-in-the-Middle) Netty Dependency in Confluence Data Center

CVE-2026-45673Critical

Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs

CVE-2026-45416Critical

DoS (Denial of Service) io.netty:netty-handler Dependency in Bitbucket Data Center

CVE-2026-44894High

Denial of Service amplification via improper QUIC token validation

CVE-2026-44893Critical

Denial of Service via malformed HAProxy message

CVE-2026-50645Critical

Apache CXF: No restriction on attachment headers per message

CVE-2026-50634Critical

Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

CVE-2026-50633Critical

Arbitrary code execution via JNDI Injection

CVE-2026-50632Critical

Arbitrary code execution via untrusted JMS configuration

CVE-2026-50631Critical

Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing

CVE-2026-50630Critical

Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

CVE-2026-50629Critical

Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier

CVE-2026-50628Critical

Unauthorized access due to logic error in OAuthRequestFilter

CVE-2026-50627Critical

Token Confusion/Routing attacks due to improper validation of JWT audience claims

CVE-2026-49875Critical

Information disclosure via out-of-band external entity resolution due to missing JAXP hardening

CVE-2026-50623Critical

Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService

CVE-2026-45169Medium

Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a…

CVE-2026-45170Medium

Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS…

CVE-2026-24051Critical

OpenTelemetry-Go Vulnerability in NetApp Products

CVE-2025-58187High

Golang Vulnerability in NetApp Products

CVE-2024-25621High

Containerd Vulnerability in NetApp Products

CVE-2017-7501High

rpm Vulnerability in NetApp Products

CVE-2017-7500High

rpm Vulnerability in NetApp Products

CVE-2026-45174Medium

Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5

CVE-2026-45173Medium

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw…

CVE-2026-45172Medium

Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5…

CVE-2026-45171Medium

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions…

CVE-2026-41005Critical

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML…

CVE-2026-44890Critical

Denial of Service via crafted Redis payloads

CVE-2026-44250Critical

Denial of Service via crafted Redis payload with deeply nested arrays

CVE-2026-12035High

Use after free Views

CVE-2026-12034High

Insufficient validation of untrusted input Linux Toolkit Theming

CVE-2026-12031High

Inappropriate implementation Views

CVE-2026-12030High

Heap buffer overflow GPU

CVE-2026-12029High

Use after free Video

CVE-2026-12028High

Use after free GPU

CVE-2026-12027High

Insufficient policy enforcement Headless

CVE-2026-12022High

Race Safe Browsing

CVE-2026-12020High

Use after free Autofill

CVE-2026-12019High

Out of bounds write Codecs

CVE-2026-12018High

Inappropriate implementation Mojo

CVE-2026-12017High

Insufficient validation of untrusted input Extensions

CVE-2026-12016High

Insufficient validation of untrusted input DevTools

CVE-2026-12014High

Use after free Cast

CVE-2026-12012High

Use after free Network

CVE-2026-12011High

Use after free WebMIDI

CVE-2026-12009High

Insufficient validation of untrusted input Accessibility

CVE-2026-12008High

Use after free DigitalCredentials

CVE-2026-12007High

CVE-2026-44249Critical

Improper Authorization io.netty:netty-handler Dependency in Bitbucket Data Center

CVE-2026-45175Medium

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation…

CVE-2026-45178Medium

Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints

CVE-2026-45177Medium

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication…

CVE-2026-45176Medium

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent…

CVE-2026-49261Critical

MariaDB Vulnerability in NetApp Products

CVE-2026-10847High

local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS

CVE-2026-9694Low

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content via a specially crafted Service Desk email reply due to improper neutralization in email template processing

CVE-2026-9204Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-8589High

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-7250High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-6976Low

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-6552High

GitLab has remediated an issue in GitLab EE affecting all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-6277Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-6269Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-3553Low

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-1500Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-10733Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-10087High

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0…

CVE-2026-41856High

The Spring GraphQL annotation detection mechanism for @Controller data fetchers

CVE-2026-41700High

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking

CVE-2026-41699High

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.

CVE-2026-41001Medium

Spring Boot: Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's…

CVE-2026-41000Low

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks

CVE-2026-40999High

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS

CVE-2026-40998High

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed…

CVE-2026-40997Medium

Spring Security: Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or…

CVE-2026-40996Medium

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for…

CVE-2026-40995Medium

Spring Security: X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate map…

CVE-2026-40994High

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled…

CVE-2026-40992Medium

Spring Boot: Spring Boot's Mail auto-configuration does not enable hostname verification.

CVE-2026-40986Medium

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even

CVE-2026-40985Medium

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.

CVE-2026-40987High

malicious or compromised FTP/SFTP/SMB server