Skip to content
OpenAdvisories

Archive

17 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /17 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 8.1
    CVE-2026-55200 Public exploit

    libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

    libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length value…

    libssh2 libssh2 rust libssh2 Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2026-53805 Public exploit

    NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API

    NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() …

    nv-tlabs GEN3C
  • Critical 9.8
    CVE-2026-47103 Public exploit

    Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection

    Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evaluated unsafely. The SCX…

    fgmacedo python-statemachine python-statemachine PyPI
  • High 8.1
    CVE-2026-54415 Public exploit

    Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

    Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accoun…

    Azuriom Azuriom CMS
  • High 8.1
    CVE-2026-42530 Public exploit

    NGINX Open-Source ngx_http_v3_module vulnerability

    NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session…

    F5 NGINX Open Source nginx-mainline Network devices Wolfi
  • High 8.1
    CVE-2026-42055 Public exploit

    NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_hea…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-49268 Public exploit

    Apache Shiro: LDAP DN Injection in DefaultLdapRealm

    A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. …

    Apache Software Foundation Apache Shiro neo4j-2026.01 neo4j-2026.05 Debian Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2026-54807 Public exploit

    WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

    ThemeGrill Registration Form for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2026-54806 Public exploit

    WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

    melapress WP Activity Log
  • Critical 9.3
    CVE-2026-49079 Public exploit

    WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

    Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

    Jetimpex JetSearch
  • Critical 10.0
    CVE-2026-28576 Public exploit

    In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to …

    Android Android Android
  • Critical 10.0
    CVE-2026-0092 Public exploit

    In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lea…

    Google Android Android
  • High 7.8
    CVE-2025-48617 Public exploit

    In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass.…

    Google Android Android
  • High 8.8
    CVE-2025-66391 Public exploit

    In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write …

  • High 8.4
    CVE-2025-26240 Public exploit

    pdfkit: Path traversal in from_string

    In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

    pdfkit pdfkit pdfkit Debian Ubuntu PyPI