Skip to content
OpenAdvisories

Archive

26 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /26 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.8
    CVE-2026-48778 Public exploit

    Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter

    Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, wh…

    notepad-plus-plus notepad-plus-plus
  • High 7.5
    CVE-2026-52885 Public exploit

    Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory

    Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires (Time-of-Check). However, the command payload is taken from the in-memory _userCommands v…

    notepad-plus-plus notepad-plus-plus
  • High 7.8
    CVE-2026-48800 Public exploit

    Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection

    Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserComma…

    notepad-plus-plus notepad-plus-plus
  • High 8.1
    CVE-2026-56876 Public exploit

    extract-zip unvalidated symlink path traversal

    extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to p…

    max-mapper extract-zip extract-zip node-extract-zip Debian Ubuntu npm
  • High 7.5
    CVE-2026-0828 Public exploit

    Kernel driver vulnerability in Safetica Endpoint Client

    Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.

    Safetica Endpoint Client
  • High 7.1
    CVE-2026-56011 Public exploit

    WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.

    chrisvrichardson MapPress Maps for WordPress Web / CMS