Skip to content
OpenAdvisories

Archive

22 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /22 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-48500 Public exploit

    Filament: Unauthenticated temporary file upload on auth pages

    Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component …

    filamentphp filament filament/filament Packagist
  • Critical 9.5
    CVE-2026-49468 Public exploit Scanner template

    LiteLLM: Authentication Bypass via Host Header Injection

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth laye…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • Critical 9.2
    CVE-2026-45034 Public exploit

    PhpSpreadsheet: File::prohibitWrappers bypass

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strle…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • High 8.7
    CVE-2026-11834 Public exploit

    Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers

    A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplyi…

    TP-Link Systems Archer C20 v5 Archer C20 v6 Archer MR200 v8 Network devices
  • High 8.2
    CVE-2026-53571 Public exploit

    Vite: `server.fs.deny` bypass on Windows alternate paths

    Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through ser…

    vitejs vite nextcloud-server-33 vite Wolfi npm
  • Critical 9.4
    CVE-2026-56423 Public exploit

    MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

    MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selecte…

    MISP MISP