CVEs published June 3, 2026
151 CVEs were published on June 3, 2026: 8 critical, 63 high. 1 is now in CISA KEV.
- Published
- 151
- Critical
- 8
- High
- 63
- Medium
- 49
- Low
- 12
- Unrated
- 19
- Now in CISA KEV
- 1
- Fix available
- 74
Most affected products
- Linux
- 32
- MBS Single-A · MBS Double-A Profibus +16
- 11
- Securly Chrome Extension
- 7
- djangoproject Django · django
- 5
- glpi-project glpi
- 5
- ABB T-MAC Plus
- 4
- Acronis DeviceLock DLP
- 4
- OP-TEE optee_os
- 3
- djangoproject daphne · daphne
- 2
- FOSSBilling
- 2
Critical 8
- CVE-2026-46266inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMPLinux
- CVE-2026-46244netfilter: nft_inner: Fix IPv6 inner_thoff desyncLinux
- CVE-2026-35075Hardcoded default Password for Service AccountMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-47065Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232Apache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2025-14771File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web SiteABB T-MAC Plus
- CVE-2026-4035Environment Variable Resolution Vulnerability in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-36576An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to ex
- CVE-2026-36748RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.
High 63
- CVE-2026-44682Local privilege escalation due to DLL hijacking vulnerability.Acronis DeviceLock DLP
- CVE-2026-42061Local privilege escalation due to excessive permissions assigned to child processes.Acronis DeviceLock DLP
- CVE-2026-50033Local privilege escalation due to DLL hijacking vulnerability.Acronis DeviceLock DLP
- CVE-2026-44609Local privilege escalation due to EXE hijacking vulnerability.Acronis DeviceLock DLP
- CVE-2026-8888CVE-2026-8888Securly Chrome Extension
- CVE-2026-8889CVE-2026-8889Securly Chrome Extension
- CVE-2026-8881CVE-2026-8881Securly Chrome Extension
- CVE-2026-8879CVE-2026-8879Securly Chrome Extension
- CVE-2026-7888Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.Concrete CMS · concrete5/concrete5
- CVE-2026-8878CVE-2026-8878Securly Chrome Extension
- CVE-2026-8876CVE-2026-8876Securly Chrome Extension
- CVE-2026-8874CVE-2026-8874Securly Chrome Extension
- CVE-2019-25720Dräger SC Monitoring Devices DoS via Malformed Network PacketDräger SC 6002XL · Dräger SC6802XL +3
- CVE-2026-40290OP-TEE has a Use-After-Free race in FF-A shared-memory teardownOP-TEE optee_os
- CVE-2026-46273ibmveth: Disable GSO for packets with small MSSLinux
- CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery VulnerabilityCisco Unified Communications Manager
- CVE-2026-46271wifi: ath12k: do WoW offloads only on primary linkLinux
- CVE-2026-46270power: supply: rt9455: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-46265RDMA/hns: Fix WQ_MEM_RECLAIM warningLinux
- CVE-2026-46264drm/xe/pf: Fix sysfs initializationLinux
- CVE-2026-46263drm/amd/display: Fix out-of-bounds stream encoder index v3Linux
- CVE-2026-46260ipv6: Fix out-of-bound access in fib6_add_rt2node().Linux
- CVE-2026-46259procfs: fix missing RCU protection when reading real_parent in do_task_stat()Linux
- CVE-2026-46253pstore/ram: fix buffer overflow in persistent_ram_save_old()Linux
- CVE-2026-46251btrfs: fix block_group_tree dirty_list corruptionLinux
- CVE-2026-46250MIPS: Work around LLVM bug when gp is used as global register variableLinux
- CVE-2026-42321GLPI has stored XSS in asset locksglpi-project glpi
- CVE-2026-42318GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpointglpi-project glpi
- CVE-2026-42317GLPI vulnerable to arbitrary files deletion by technicianglpi-project glpi
- CVE-2026-44281GLPI vulnerable to unauthorized reading of a specific asset objectglpi-project glpi
- CVE-2022-49036An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business ReSynology Active Backup for Business Recovery Media Creator
- CVE-2022-49042An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.Synology Hyper Backup Explorer
- CVE-2026-5241Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-41259SWUpdate Untrusted Script Execution via Signed Update TOCTOUsbabic SWUpdate
- CVE-2026-35085Stack buffer overflow in method gdv-serverconfigMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35084Stack buffer overflow in method dali-devconfigMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35083Stack buffer overflow in method bac-deviceobjectMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35082Local file inclusion vulnerability and deletion in ugw-logread methodMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35081Arbitrary process termination vulnerability in method ugw-logstopMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35080Arbitrary file delete vulnerability in method ugw-restoreinfoMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35079Arbitrary file delete vulnerability in method ugw-restoreMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35078Arbitrary file delete vulnerability in method ugw-logstopMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35077Arbitrary file delete vulnerability in method ugw-delete-fileMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-35076Arbitrary file delete vulnerability in method bac-scanresultMBS Single-A · MBS Double-A Profibus +16
- CVE-2026-41032Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllersPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2025-14774Communication analysis between the Card Reader and TP2CardReaderService daemonABB T-MAC Plus
- CVE-2025-14773Stored Cross-Site Scripting in ABB T-MAC Plus web applicationABB T-MAC Plus
- CVE-2025-14772Broken Access Control in ABB T-MAC Plus web applicationABB T-MAC Plus
- CVE-2025-15656WordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerabilityMojoomla School Management
- CVE-2025-15655WordPress School Management plugin <= 93.2.0 - SQL Injection vulnerabilityMojoomla School Management
- CVE-2025-15654WordPress Prague plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerabilityFox-themes Prague
- CVE-2026-50031ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages.FreeIPMI
- CVE-2026-9516Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throwsRURBAN Cpanel::JSON::XS
- CVE-2026-9334Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabledRURBAN Cpanel::JSON::XS
- CVE-2026-36574A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary cod
- CVE-2026-36603Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, inclu
- CVE-2026-36606Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in
- CVE-2026-36607Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endp
- CVE-2026-36608Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own adm
- CVE-2026-36609Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests fro
- CVE-2026-36611Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAP
- CVE-2026-37460Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cau
- CVE-2026-37462An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (github.com/osrg/gobgp/v4
Medium, low and unrated 80
- CVE-2026-8722Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injectionsTEAM Net::Async::Statsd::Client
- CVE-2026-10783gradio-app gradio Audio Cache Key save_audio_to_cache weak hashgradio-app gradio · gradio
- CVE-2026-10777ealpha072 Student-Management-System Administrative Backend config.php improper authenticationealpha072 Student-Management-System
- CVE-2026-10775sgl-project SGLang Cache data_hash denial of servicesgl-project SGLang · sglang
- CVE-2026-22055Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to performNETAPP Active IQ OneCollect
- CVE-2026-22054Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perNETAPP Active IQ Config Advisor
- CVE-2026-10771crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgerycrmeb_java
- CVE-2026-10766mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hashmlrun
- CVE-2026-43924FOSSBilling has an open redirect via administrator-configured redirect targetsFOSSBilling
- CVE-2026-40495FOSSBilling version exposed via asset cache busterFOSSBilling
- CVE-2026-45702OP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panicOP-TEE optee_os
- CVE-2026-45614OP-TEE vulnerable to ECDH private key recoveryOP-TEE optee_os
- CVE-2026-42839ERPNext 16.16.0 - Stored XSS in POS cart item renderingFrappe ERPNext
- CVE-2026-42840ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsFrappe ERPNext
- CVE-2026-20175Cisco Finesse File Inclusion VulnerabilityCisco Finesse
- CVE-2026-20233Cisco Webex Meetings Cross-Site Scripting VulnerabilityCisco Webex Meetings
- CVE-2026-46272coresight: tmc-etr: Fix race condition between sysfs and perf modeLinux
- CVE-2026-46269pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetreeLinux
- CVE-2026-46268PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning conditionLinux
- CVE-2026-46267nfc: hci: shdlc: Stop timers and work before freeing contextLinux
- CVE-2026-46262ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()Linux
- CVE-2026-46261spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()Linux
- CVE-2026-46258gpio: cdev: Avoid NULL dereference in linehandle_create()Linux
- CVE-2026-46257clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.Linux
- CVE-2026-46256NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepagesLinux
- CVE-2026-46255dmaengine: fsl-edma: don't explicitly disable clocks in .remove()Linux
- CVE-2026-46254AppArmor: Allow apparmor to handle unaligned dfa tablesLinux
- CVE-2026-46252regulator: core: fix locking in regulator_resolve_supply() error pathLinux
- CVE-2026-46249octeontx2-af: Fix PF driver crash with kexec kernel bootingLinux
- CVE-2026-46248wifi: ath12k: clear stale link mapping of ahvif->links_mapLinux
- CVE-2026-46247clk: qcom: gfx3d: add parent to parent request mapLinux
- CVE-2026-46246power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handlerLinux
- CVE-2026-46245drm/amd/display: Fix dc_link NULL handling in HPD initLinux
- CVE-2025-71314drm/panthor: Recover from panthor_gpu_flush_caches() failuresLinux
- CVE-2025-71313PCI: endpoint: Add missing NULL check for alloc_workqueue()Linux
- CVE-2026-42320GLPI vulnerable to arbitrary file accessglpi-project glpi
- CVE-2026-6657CORS Origin Validation Bypass in jupyter-serverjupyter/jupyter · jupyter-server
- CVE-2022-31114backpack/crud Vulnerable to Cross-site ScriptingLaravel-Backpack CRUD · backpack/crud
- CVE-2026-3276Potential DoS via quadratic complexity in unicodedata.normalize()Python Software Foundation CPython
- CVE-2024-47263An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in SynSynology Hyper Backup
- CVE-2024-47273An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology HypSynology Hyper Backup
- CVE-2026-47325Weak password policy in ProjectsAndPrograms school-management-systemProjectsAndPrograms school-management-system
- CVE-2026-47324Stored XSS in Multiple Points in ProjectsAndPrograms school-management-systemProjectsAndPrograms school-management-system
- CVE-2026-44546Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofingdjangoproject daphne · daphne
- CVE-2026-44545Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of servicedjangoproject daphne · daphne
- CVE-2026-48587Potential exposure of private data via whitespace padding in Vary headerdjangoproject Django · django
- CVE-2026-35193Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewaredjangoproject Django · django
- CVE-2026-8404Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddlewaredjangoproject Django · django
- CVE-2026-7666Potential unencrypted email transmission via STARTTLS in the SMTP backenddjangoproject Django · django
- CVE-2026-6873Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookiedjangoproject Django · django
- CVE-2023-52951A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle atSynology Note Station Client
- CVE-2026-10729HTML injection in the notification email for "Slow Redirect" and "Cloned Website" CanarytokensThinkst Applied Research Canarytokens
- CVE-2026-10722cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflowcilium ebpf · github.com/cilium/ebpf
- CVE-2026-5078morgan vulnerable to Log Forging via unneutralized control characters in :remote-usermorgan
- CVE-2026-50052In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend requThe Vinyl Cache Project Vinyl Cache · The Vinyl Cache Pr… +1
- CVE-2026-10705dask HLL hyperloglog.py nunique_approx resource consumptiondask
- CVE-2026-10704SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injectionSourceCodester Pizzafy E-Commerce System
- CVE-2026-10703EIPStackGroup OpENer SendRRData cipmessagerouter.c CreateMessageRouterRequestStructure use after freeEIPStackGroup OpENer
- CVE-2026-10694SourceCodester Online Food Ordering System index.php include file inclusionSourceCodester Online Food Ordering System
- CVE-2026-10693SourceCodester Online Boat Reservation System Administrative Endpoint improper authorizationSourceCodester Online Boat Reservation System
- CVE-2025-60477A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before
- CVE-2025-70100A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to
- CVE-2025-70101An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library allows attackers to cause a de
- CVE-2026-26378Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in I
- CVE-2026-26379Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration.
- CVE-2026-26824libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser.
- CVE-2026-26825A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files.
- CVE-2026-36460Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability.
- CVE-2026-36602Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action.
- CVE-2026-36604Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks.
- CVE-2026-36605Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomp
- CVE-2026-36610Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding.
- CVE-2026-36612Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 a
- CVE-2026-36613Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POS
- CVE-2026-36615Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer con
- CVE-2026-36616Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS te
- CVE-2026-36618Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software ve
- CVE-2026-37700Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file
- CVE-2026-39107A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature.
- CVE-2026-46447OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_infoOpenStack Ironic · ironic