CVEs published June 14, 2026
18 CVEs were published on June 14, 2026: 1 critical, 11 high. 1 is now in CISA KEV.
- Published
- 18
- Critical
- 1
- High
- 11
- Medium
- 6
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- GL.iNet GL-MT3000
- 2
- Comma AI Openpilot
- 1
- debevv nanoMODBUS
- 1
- driftregion iso14229
- 1
- GALAYOU Y4
- 1
- Genspark AI Workspace App
- 1
- Grit42 Grit
- 1
- Iptanus File Upload
- 1
- LiamBindle MQTT-C
- 1
- Linux-PAM
- 1
Critical 1
High 11
- CVE-2026-12197Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injectionRuijie EG105G-P
- CVE-2026-12193VS Revo RevoUninstaller IOCTL RevoDetector.sys IOCtl_Handler heap-based overflowVS Revo RevoUninstaller
- CVE-2026-12192GALAYOU Y4 Web Server buffer overflowGALAYOU Y4
- CVE-2026-12191Comma AI Openpilot Pickle modeld.py pickle.loads deserializationComma AI Openpilot
- CVE-2026-12187GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injectionGL.iNet GL-MT3000
- CVE-2026-12186GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injectionGL.iNet GL-MT3000
- CVE-2026-54413iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()driftregion iso14229
- CVE-2026-54412MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()LiamBindle MQTT-C
- CVE-2026-54410nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Fielddebevv nanoMODBUS
- CVE-2026-11527Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandleSHLOMIF Config::IniFiles
- CVE-2026-54420LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTPLiteSpeed Technologies cPanel Plugin
Medium, low and unrated 6
- CVE-2026-12190Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url schemeGenspark AI Workspace App
- CVE-2026-12189Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url schemeMoovit Bus & Public Transit App
- CVE-2026-12188Grit42 Grit GritEntityController grit_entity_controller.rb sql injectionGrit42 Grit
- CVE-2026-54411Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password ComparisonLinux-PAM
- CVE-2025-15546Iptanus File Upload < 5.1.7 - File Overwrite via Race ConditionIptanus File Upload
- CVE-2026-54421In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can returnOpenStack Ironic · ironic