Skip to content
OpenAdvisories

Archive

2 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /2 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  • Low 2.1
    CVE-2026-48598 Public exploit

    CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection

    Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{…

    elixir-tesla tesla tesla Hex
  • Critical 9.8
    CVE-2026-5076 Public exploit

    ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

    The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a us…

    armember ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Web / CMS
  • Medium 4.3
    CVE-2026-10702 Public exploit

    JIT miscompilation in the JavaScript Engine: JIT component

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 6.3
    CVE-2026-49943 Public exploit

    CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask match…

    NIC BIRD bird bird2 Debian Ubuntu
  • Critical 9.8
    CVE-2026-47117 Public exploit

    OpenMed < 1.5.2 Remote Code Execution via PII Model Loading

    OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The privacy-filter dispatcher used broad substring matching on the user-supplied model_name parameter, allowing a value such as attacker/foo-priv…

    maziyarpanahi openmed openmed PyPI
  • Medium 6.3
    CVE-2026-7299 Public exploit

    CVE-2026-7299

    Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code ex…

    Appsmith Appsmith
  • Critical 9.8
    CVE-2026-8206 Public exploit

    Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is u…

    Themeum Kirki – Freeform Page Builder, Website Builder & Customizer Web / CMS