Skip to content
OpenAdvisories

Archive

20 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /20 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-5366 Public exploit

    Git Argument Injection in prefecthq/prefect

    Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` sep…

    PrefectHQ prefecthq/prefect prefect PyPI
  • Critical 10.0
    CVE-2026-48908 Exploited Public exploit Scanner template EPSS 89%

    Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

    A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

    joomshaper.net SP Page Builder extension for Joomla Web / CMS
    KEV Jul 7, 2026
  • Critical 10.0
    CVE-2026-48939 Exploited Public exploit Scanner template EPSS 20%

    Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

    A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

    icagenda.com iCagenda extension for Joomla Web / CMS
    KEV Jul 10, 2026
  • Critical 9.5
    CVE-2026-48909 Public exploit Scanner template

    Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

    SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

    joomshaper.net SP LMS extension for Joomla Web / CMS
  • High 7.5
    CVE-2026-11912 Public exploit

    Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action

    The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the…

    eemitch Simple File List Web / CMS