Skip to content
OpenAdvisories

Archive

29 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /29 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.5
    CVE-2026-8023 Public exploit

    Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

    Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabled) that serves files from a configured root directory. Before this fix, both the HTTP/1 and HTTP/2 …

    zephyrproject zephyr
  • High 7.3
    CVE-2026-55957 Public exploit

    Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

    Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • Medium 6.1
    CVE-2026-50229 Public exploit Scanner template

    Apache Tomcat: XSS in number guess example

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through …

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • Medium 6.5
    CVE-2026-43700 Public exploit

    A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iO…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers
  • High 7.8
    CVE-2026-43724 Public exploit

    The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 8.1
    CVE-2026-43735 Public exploit

    The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers
  • Critical 9.8
    CVE-2026-56782 Public exploit Scanner template

    Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

    Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote att…

    gorse-io gorse
  • High 7.5
    CVE-2026-49049 Exploited Public exploit Scanner template

    Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

    The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

    joomshaper.com Helix3 extension for Joomla Web / CMS
  • Critical 10.0
    CVE-2026-56290 Exploited Public exploit Scanner template EPSS 31%

    Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

    Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

    joomlack.fr JoomlaCK.fr Page Builder CK extension for Joomla Web / CMS
    KEV Jul 7, 2026
  • High 7.5
    CVE-2026-36848 Public exploit

    Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.

  • Critical 9.1
    CVE-2026-37637 Public exploit

    An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php compo…