Skip to content
OpenAdvisories

Archive

June 2026

Vulnerabilities first published in this month (UTC), newest first.

← May 2026 2026 / June July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

54 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-11105 Public exploit

    Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker w…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 6.5
    CVE-2026-11104 Public exploit

    Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the re…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 6.5
    CVE-2026-11106 Public exploit

    Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-o…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 6.5
    CVE-2026-11101 Public exploit

    Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-or…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 6.5
    CVE-2026-47644 Public exploit

    Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

    Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

    Microsoft Copilot Chat (Microsoft Edge) Browsers
  • Medium 6.3
    CVE-2025-65640 Public exploit

    Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5…

  • Medium 6.3
    CVE-2026-39107 Public exploit

    A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fail…

  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  • Medium 4.3
    CVE-2026-10702 Public exploit

    JIT miscompilation in the JavaScript Engine: JIT component

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 6.3
    CVE-2026-49943 Public exploit

    CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask match…

    NIC BIRD bird bird2 Debian Ubuntu
  • Medium 6.3
    CVE-2026-7299 Public exploit

    CVE-2026-7299

    Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code ex…

    Appsmith Appsmith
  • Medium 4.3
    CVE-2026-10289 Public exploit

    code-projects Hotel and Tourism Reservation System tour.php cross site scripting

    A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /ht/tour.php. Performing a manipulation of the argument name /email /people /number results in cross site scripting. The…

    code-projects Hotel and Tourism Reservation System
  • Medium 4.3
    CVE-2026-45729 Public exploit

    ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input

    Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. …

    thorvg thorvg thorvg thorvg Debian Ubuntu
  • Medium 6.5
    CVE-2026-48208 Public exploit

    Denial-of-Service via SVG Rendering in Ticket

    An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when…

    OTRS OTRS ((OTRS)) Community Edition