CVEs published in June 2026

CVE-2026-0273High

PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI

CVE-2026-9126High

CVE-2026-9124High

CVE-2026-9123High

CVE-2026-9121High

CVE-2026-9110High

CVE-2026-8587High

CVE-2026-8586High

CVE-2026-8585High

CVE-2026-8584High

CVE-2026-8583High

CVE-2026-8582High

CVE-2026-8581High

CVE-2026-8580High

CVE-2026-8579High

CVE-2026-8578High

CVE-2026-8577High

CVE-2026-8576High

CVE-2026-8575High

CVE-2026-8574High

CVE-2026-8573High

CVE-2026-8572High

CVE-2026-8571High

CVE-2026-8570High

CVE-2026-8569High

CVE-2026-8568High

CVE-2026-8567High

CVE-2026-8566High

CVE-2026-8565High

CVE-2026-8564High

CVE-2026-8563High

CVE-2026-8562High

CVE-2026-8561High

CVE-2026-8560High

CVE-2026-73283Medium

Tunnel forwarding restriction bypass

CVE-2026-73282Medium

Information disclosure and data corruption via use-after-free in ssh client

CVE-2026-73281Low

ssh-agent allows remote execution of local operations

CVE-2026-60002High

Use-after-free vulnerability during host key re-exchange on the client side

CVE-2026-60000High

Denial of Service via excessive GSSAPI authentication attempts

CVE-2026-59999Critical

OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options

CVE-2026-59998High

Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory

CVE-2026-59997High

SFTP security bypass due to command-line argument parsing flaw

CVE-2026-59996High

`scp` file misplacement vulnerability during remote copy

CVE-2026-59995High

sftp client allows attacker to control downloaded file location

CVE-2026-10022High

CVE-2026-10021High

CVE-2026-10020High

CVE-2026-10019High

CVE-2026-10018High

CVE-2026-10017High

CVE-2026-0274Critical

Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration

CVE-2026-0272High

PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)

CVE-2026-0271High

Prisma Access Agent: Local Privilege Escalation by Authorized Users

CVE-2026-0270High

Cortex XSOAR: Path Traversal Vulnerability

CVE-2026-0269Medium

PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing

CVE-2026-0268Medium

Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux

CVE-2026-0267Medium

GlobalProtect App: Information Exposure Vulnerability on macOS

CVE-2026-0266Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

CVE-2026-49759High

Denial of Service via crafted SCTP ERROR chunk

CVE-2025-62850Medium

QuTS hero: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-66276Critical

QuTS hero: QuTS hero is not affected.

CVE-2025-58468Medium

cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center.

CVE-2026-47838Medium

Spring Security: SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can le…

CVE-2026-41837Medium

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does…

CVE-2026-41732High

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package…

CVE-2026-41730Medium

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing…

CVE-2026-41729High

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties

CVE-2026-41728High

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to…

CVE-2026-41727Medium

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them

CVE-2026-41726Medium

When an application opts into DelegatingDeserializer, a producer

CVE-2026-41721Medium

Spring Data Commons contains a vulnerability that can

CVE-2026-41719Medium

SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository…

CVE-2026-41717High

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability.

CVE-2026-41716High

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing…

CVE-2026-41714Medium

Applications that configure their broker connection

CVE-2026-41711Medium

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException

CVE-2026-41706Medium

Spring Security: Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a brows…

CVE-2026-41701Medium

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable

CVE-2026-41697Medium

Spring Data Relational does not properly escape binding values of externally-controlled input

CVE-2026-41696Medium

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient…

CVE-2026-41695High

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion

CVE-2026-41694Low

Spring Security: Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses wit…

CVE-2026-41008Medium

Spring Security: Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri par…

CVE-2026-41003High

Spring Security: attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms gene…

CVE-2026-40993High

Spring Security: attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asser…

CVE-2026-40991Medium

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker…

CVE-2026-40988High

Spring Security: application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may…

CVE-2026-44186Critical

CVE-2026-44119Critical

CVE-2026-29167Critical

CVE-2026-41731High

Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of crafted header values

CVE-2026-9212Medium

Insufficient authentication and input validation in certain NETGEAR products

CVE-2026-9210Medium

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality

CVE-2026-22926High

Omnissa Workspace ONE Assist for macOS contains a Local Privilege Escalation Vulnerability.

CVE-2026-0420Medium

improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle (MiTM) style attacks impacting the product's confidentiality

CVE-2026-0419Medium

Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands

CVE-2026-0417Medium

Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network to tamper with the router's integrity

CVE-2026-0416Medium

insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local network access to submit crafted input that bypasses intended management interface restrictions, resulting in unauthorized modification of protected router software or functionality

CVE-2026-0415Medium

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality

CVE-2026-0414Medium

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality