Skip to content
OpenAdvisories

Archive

10 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /10 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.5
    CVE-2026-46522 Public exploit

    ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versi…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 8.6
    CVE-2026-50131 Public exploit

    Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the …

    fedify-dev fedify vocab-runtime @fedify/fedify npm
  • High 8.4
    CVE-2026-46529 Public exploit

    PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

    Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tri…

    mate-desktop atril evince atril Debian Ubuntu Alpine
  • High 7.3
    CVE-2026-11417 Public exploit

    OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

    OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to e…

    AWS AWS Cloud Development Kit library aws-cdk-lib npm
  • High 8.8
    CVE-2026-20251 Public exploit EPSS 31%

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • High 8.5
    CVE-2026-9151 Public exploit

    Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers

    An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a speci…

    TP-Link Systems Archer AX12 V1 Archer AX18 v1 Archer AX1300 v1.6 Network devices
  • High 8.3
    CVE-2026-46558 Public exploit

    Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

    Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in versi…

    makeplane plane
  • High 7.3
    CVE-2026-53694 Public exploit

    Potential local privileges escalation through argument injection in the nxchmod.sh script

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2.

    NoMachine NoMachine
  • High 8.8
    CVE-2026-53435 Public exploit EPSS 51%

    Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP req…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • High 7.5
    CVE-2025-71329 Public exploit

    image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser

    image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can tr…

    image-size image-size langfuse-3-worker image-size Wolfi npm
  • High 7.1
    CVE-2026-49069 Public exploit Scanner template

    WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.

    WPZOOM WPZOOM Portfolio
  • High 8.7
    CVE-2026-29116 Public exploit

    A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a speciall…

    Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC
  • High 8.6
    CVE-2026-3326 Public exploit Scanner template

    XStore < 9.7.3 - Unauthenticated SQLi

    The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

    Web / CMS
  • High 7.3
    CVE-2026-11837 Public exploit

    Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown

    A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu