Skip to content
OpenAdvisories

Archive

23 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /23 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-53753 Public exploit Scanner template

    Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

    Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object at…

    unclecode Crawl4AI crawl4ai PyPI
  • Critical 9.6
    CVE-2026-48519 Public exploit

    Langflow: Unauthenticated RCE in Shareable Playgrounds

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workfl…

    langflow-ai langflow langflow PyPI
  • Critical 9.3
    CVE-2026-55450 Public exploit Scanner template

    Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This ca…

    langflow-ai langflow langflow PyPI
  • Critical 9.4
    CVE-2026-44789 Public exploit

    n8n: HTTP Request Node Pagination Prototype Pollution to RCE

    n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-28496 Public exploit Scanner template

    FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

    FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators with access to features that render Twig templates (em…

    FOSSBilling FOSSBilling
  • Critical 9.9
    CVE-2026-56274 Public exploit

    Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

    Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API…

    Flowise Flowise Flowise Components flowise npm
  • Critical 9.0
    CVE-2026-11374 Public exploit

    Account Takeover via Predictable SSO Ticket Generation

    In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

    Zohocorp ManageEngine ADSelfService Plus ManageEngine ADAudit Plus manageengine_m365_manager_plus