| CVE / ID | Title | Severity | CVSS | Source | Date |
|---|
| CVE-2026-10520 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote | CRITICAL | 10.0 | NVD | 2026-06-09 |
| CVE-2026-47938 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) | CRITICAL | 10.0 | NVD | 2026-06-09 |
| CVE-2026-48303 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerabil | CRITICAL | 10.0 | NVD | 2026-06-09 |
| CVE-2026-46695 | Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers | CRITICAL | 10.0 | NVD | 2026-06-10 |
| CVE-2026-49261 | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, | CRITICAL | 10.0 | NVD | 2026-06-11 |
| CVE-2026-47131 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__ | CRITICAL | 10.0 | NVD | 2026-06-12 |
| CVE-2026-47137 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) | CRITICAL | 10.0 | NVD | 2026-06-12 |
| CVE-2026-47140 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins | CRITICAL | 10.0 | NVD | 2026-06-12 |
| CVE-2026-47208 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability | CRITICAL | 10.0 | NVD | 2026-06-12 |
| CVE-2026-50086 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing ke | CRITICAL | 10.0 | NVD | 2026-06-12 |
| CVE-2026-52704 | Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder a | CRITICAL | 10.0 | NVD | 2026-06-15 |
| CVE-2026-40772 | Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions. | CRITICAL | 10.0 | NVD | 2026-06-15 |
| CVE-2026-48836 | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | CRITICAL | 10.0 | NVD | 2026-06-15 |
| CVE-2026-35292 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-35301 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-35307 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that ar | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-35308 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Su | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-46778 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-46781 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-46798 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-46800 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-46803 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Suppo | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-46846 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Suppo | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-46978 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2025-69129 | Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 vers | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0063 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a lo | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0064 | In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loca | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0068 | In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0071 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0081 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escala | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0082 | In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0083 | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local e | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-0092 | In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-25470 | Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin fo | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-28575 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-28576 | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to l | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-28587 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing per | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-28615 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-48055 | Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, | CRITICAL | 10.0 | NVD | 2026-06-17 |
| CVE-2026-3490 | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolv | CRITICAL | 10.0 | NVD | 2026-06-17 |
| GHSA-r253-r9jw-qg44 | Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args | CRITICAL | 10.0 | GitHub | 2026-06-18 |
| GHSA-82fg-2r99-h7v6 | Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass | CRITICAL | 10.0 | GitHub | 2026-06-17 |
| CVE-2026-45480 | Azure Active Directory Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-06-09 |
| CVE-2026-48567 | Azure HorizonDB Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-06-09 |
| CVE-2026-40175 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2017-20230 | Storable versions before 3.05 for Perl has a stack overflow | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33819 | Microsoft Bing Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-32186 | Microsoft Bing Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33107 | Azure Databricks Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-35431 | Microsoft Entra ID Entitlement Management Spoofing Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-32213 | Azure AI Foundry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33105 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-42960 | Possible cache poisoning via promiscuous records for the authority section | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-46595 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-40412 | Azure Orbital Spatio Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-23652 | Microsoft Power Pages Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-47280 | Azure Resource Manager Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42822 | Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42826 | Azure DevOps Information Disclosure Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-41104 | Microsoft Planetary Computer Pro Information Disclosure Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42901 | Microsoft Entra ID Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2025-55241 | Azure Entra ID Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-09-09 |
| CVE-2025-54914 | Azure Networking Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-09-09 |
| CVE-2022-49043 | xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. | CRITICAL | 10.0 | Microsoft | 2025-01-14 |
| CVE-2026-32169 | Azure Cloud Shell Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-03-10 |
| CVE-2026-54782 | CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation | CRITICAL | 10.0 | GitHub | 2026-06-19 |
| CVE-2025-53767 | Azure OpenAI Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-08-12 |
| CVE-2026-28573 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could l | CRITICAL | 10.0 | NVD | 2026-06-18 |
| CVE-2026-49257 | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and | CRITICAL | 10.0 | NVD | 2026-06-18 |
| CVE-2026-50242 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authenti | CRITICAL | 10.0 | NVD | 2026-06-19 |
| CVE-2026-48772 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL | CRITICAL | 10.0 | NVD | 2026-06-19 |
| CVE-2026-48908 | A vulnerability in the SP Page Builder for Joomla allows the upload of arbitrary files for unauthenticated users, ultima | CRITICAL | 10.0 | NVD | 2026-06-20 |
| CVE-2026-48939 | A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature | CRITICAL | 10.0 | NVD | 2026-06-20 |
| CVE-2025-29813 | Azure DevOps Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-05-13 |
| CVE-2026-44748 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtai | CRITICAL | 9.9 | NVD | 2026-06-09 |
| CVE-2026-10523 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allow | CRITICAL | 9.9 | NVD | 2026-06-09 |
| CVE-2026-45552 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th | CRITICAL | 9.9 | NVD | 2026-06-10 |
| CVE-2026-45556 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PO | CRITICAL | 9.9 | NVD | 2026-06-10 |
| CVE-2026-45558 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th | CRITICAL | 9.9 | NVD | 2026-06-10 |