Skip to content
OpenAdvisories

Archive

28 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /28 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-49048 Public exploit

    Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1

    The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

    joomcoder.com JoomCCK extension for Joomla Web / CMS
  • Medium 6.5
    CVE-2026-58058 Public exploit

    Nmap - Integer Underflow in IPv6 Extension Header Parsing

    Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned t…

    Nmap Nmap nmap nmap Debian Ubuntu Azure Linux Wolfi
  • Medium 5.0
    CVE-2026-58057 Public exploit

    Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity

    Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An auth…

    Flowise Flowise