Skip to content
OpenAdvisories

Archive

June 2026

Vulnerabilities first published in this month (UTC), newest first.

← May 2026 2026 / June July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

299 results · Clear filters · Feed

  • High 7.8
    CVE-2026-0075 Public exploit

    In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead …

    Google Android Android
  • High 7.8
    CVE-2026-0009 Public exploit

    In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escala…

    Google Android Android
  • High 8.4
    CVE-2025-48595 Exploited Public exploit

    In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to…

    Google Android Android
    KEV Jun 2, 2026
  • High 7.3
    CVE-2026-10290 Public exploit

    code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection

    A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the file tour.php of the component GET Parameter Handler. Executing a manipulation of the argument tour can lead to sql in…

    code-projects Hotel and Tourism Reservation System
  • Medium 4.3
    CVE-2026-10289 Public exploit

    code-projects Hotel and Tourism Reservation System tour.php cross site scripting

    A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /ht/tour.php. Performing a manipulation of the argument name /email /people /number results in cross site scripting. The…

    code-projects Hotel and Tourism Reservation System
  • High 7.3
    CVE-2026-10288 Public exploit

    code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication

    A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper a…

    code-projects Hotel and Tourism Reservation System
  • Medium 4.3
    CVE-2026-45729 Public exploit

    ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input

    Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. …

    thorvg thorvg thorvg thorvg Debian Ubuntu
  • High 7.5
    CVE-2024-52011 Public exploit

    launch-editor vulnerable to command injection via the crafted request on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a …

    vitejs vite launch-editor vite npm
  • High 8.1
    CVE-2026-45156 Public exploit

    Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

    Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This …

    Nextcloud security-advisories
  • High 7.1
    CVE-2026-46243 Public exploit

    smb: client: reject userspace cifs.spnego descriptions

    In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 10.0
    CVE-2026-45131 Public exploit

    CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests

    CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets includin…

    CloudPirates-io helm-charts
  • Critical 10.0
    CVE-2026-45132 Public exploit

    CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling

    CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe chec…

    CloudPirates-io helm-charts
  • Critical 9.2
    CVE-2026-0826 Public exploit EPSS 32%

    Poly Voice – Possible Remote Control of Certain Poly Devices

    In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

    HP poly_trio_8500 poly_vvx poly_trio_8300
  • Critical 9.6
    CVE-2026-48866 Public exploit

    WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.

    Rocketgenius Gravity Forms
  • High 7.3
    CVE-2026-10243 Public exploit

    code-projects Smart Parking System Admin Endpoint missing authentication

    A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin Endpoint. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit…

    code-projects Smart Parking System
  • High 8.1
    CVE-2026-44825 Public exploit Scanner template

    Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

    Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials insta…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core Maven
  • High 8.1
    CVE-2026-42588 Public exploit

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  • Critical 9.1
    CVE-2026-48188 Public exploit

    SQL Injection via MySQL Quote Method

    An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is config…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-48208 Public exploit

    Denial-of-Service via SVG Rendering in Ticket

    An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when…

    OTRS OTRS ((OTRS)) Community Edition