CVEs published June 21, 2026
72 CVEs were published on June 21, 2026: 2 critical, 21 high.
- Published
- 72
- Critical
- 2
- High
- 21
- Medium
- 48
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- libexpat project libexpat
- 10
- BerriAI litellm · litellm
- 9
- craftcms cms · craftcms/cms
- 7
- Capgo
- 6
- Edimax BR-6478AC
- 5
- picklescan
- 4
- EaseUS Partition Master
- 2
- ImageMagick · Magick.NET-Q16-AnyCPU +18
- 2
- Montodel House-Rental-Management
- 2
- zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…
- 2
Critical 2
High 21
- CVE-2026-12806Edimax BR-6478AC V2 POST Request formWlSiteSurvey buffer overflowEdimax BR-6478AC
- CVE-2026-56396phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-56394Craft CMS - Authenticated Path Traversal in assets/icon Extension Parametercraftcms cms · craftcms/cms
- CVE-2026-56382Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsControllercraftcms cms · craftcms/cms
- CVE-2026-56253Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPCCapgo
- CVE-2026-56251Capgo - Privilege Escalation via Broken Row Level Security in org_usersCapgo
- CVE-2026-56242Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPCCapgo
- CVE-2026-56239Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overageCapgo
- CVE-2026-56229Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logsCapgo
- CVE-2025-71378picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Filespicklescan
- CVE-2025-71357picklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommandpicklescan
- CVE-2025-71351picklescan - Remote Code Execution via timeit.timeit() Detection Bypasspicklescan
- CVE-2025-71348picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypasspicklescan
- CVE-2026-12786Ezbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access controlEzbsystems UltraISO Premium Edition
- CVE-2026-12784IM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access controlIM-Magic Partition Resizer
- CVE-2026-52911ksmbd: scope conn->binding slowpath to bound sessions onlyLinux
- CVE-2026-12782EaseUS Partition Master Kernel Driver EUEDKEPM.sys access controlEaseUS Partition Master
- CVE-2026-12781EaseUS Partition Master Kernel Driver epmntdrv.sys access controlEaseUS Partition Master
- CVE-2026-12780AOMEI Backupper Kernel Driver amwrtdrv.sys access controlAOMEI Backupper
- CVE-2026-12779AOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access controlAOMEI Dynamic Disk Manager
- CVE-2026-12778AOMEI Partition Assistant Kernel Driver ampa10.sys access controlAOMEI Partition Assistant
Medium, low and unrated 49
- CVE-2026-12823Browserbase Skills Autobrowse Trace Artifact default permissionBrowserbase Skills
- CVE-2026-12822langflow-ai langflow Bundle URL Loader code injectionlangflow-ai langflow
- CVE-2026-12821FlowiseAI Flowise S3 Document Loader S3.ts path traversalFlowiseAI Flowise
- CVE-2026-12815coollabsio coolify Image Name os command injectioncoollabsio coolify
- CVE-2026-12814Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injectionComfast CF-WR631AX
- CVE-2026-12813activepieces File URL file.ts handleUrlFile server-side request forgeryactivepieces
- CVE-2026-12812Radware Cyber Controller HTML Report Generation HTML injectionRadware Cyber Controller
- CVE-2026-12811kortix-ai suna Auth Endpoint page.tsx router.push cross site scriptingkortix-ai suna
- CVE-2026-12810Edimax BR-6478AC V2 POST Request mp command injectionEdimax BR-6478AC
- CVE-2026-12809Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injectionEdimax BR-6478AC
- CVE-2026-12808Edimax BR-6478AC V2 POST Request stainfo command injectionEdimax BR-6478AC
- CVE-2026-12807Edimax BR-6478AC V2 POST Request setWAN command injectionEdimax BR-6478AC
- CVE-2026-12805OFFIS DCMTK ofxml.cc parseFile heap-based overflowOFFIS DCMTK
- CVE-2026-12804lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirectlemonldap-ng
- CVE-2026-56412libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls frlibexpat project libexpat
- CVE-2026-56411xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.libexpat project libexpat
- CVE-2026-56410xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.libexpat project libexpat
- CVE-2026-56409xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.libexpat project libexpat
- CVE-2026-56408libexpat before 2.8.2 has an integer overflow in copyString.libexpat project libexpat
- CVE-2026-56407libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.libexpat project libexpat
- CVE-2026-56406libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.libexpat project libexpat
- CVE-2026-56405libexpat before 2.8.2 has an integer overflow in getAttributeId.libexpat project libexpat
- CVE-2026-56404libexpat before 2.8.2 has an integer overflow in addBinding.libexpat project libexpat
- CVE-2026-56403libexpat before 2.8.2 has an integer overflow in storeAtts.libexpat project libexpat
- CVE-2026-56393Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Optionscraftcms cms · craftcms/cms
- CVE-2026-56385Craft CMS - Authorization Bypass in assets/preview-file Endpointcraftcms cms · craftcms/cms
- CVE-2026-56384Craft CMS - Missing Authorization in assets/preview-thumb Endpointcraftcms cms · craftcms/cms
- CVE-2026-56383Craft CMS - Stored XSS in Table Field via Row Heading Column Typecraftcms cms · craftcms/cms
- CVE-2026-56381Craft CMS - Stored XSS via User Group Name in User Permissions Pagecraftcms cms · craftcms/cms
- CVE-2026-56378ImageMagick - Heap Out-of-Bounds Read in PCD DecoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56367ImageMagick - Heap Out-of-Bounds Read in PSB RLE DecodingImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56316Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*Cap-go capgo
- CVE-2026-56299Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload EndpointCapgo
- CVE-2026-56236Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operationscapgo cli · @capgo/cli
- CVE-2026-12799BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorizationBerriAI litellm · litellm
- CVE-2026-12798BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgeryBerriAI litellm · litellm
- CVE-2026-12797BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorizationBerriAI litellm · litellm
- CVE-2026-12796BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expirationBerriAI litellm · litellm
- CVE-2026-12795BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authenticationBerriAI litellm · litellm
- CVE-2026-12789ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injectionILIAS Learning Management System
- CVE-2026-12788zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity referencezhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…
- CVE-2026-12787zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserializationzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…
- CVE-2026-12776Montodel House-Rental-Management index.php houses sql injectionMontodel House-Rental-Management
- CVE-2026-12775Montodel House-Rental-Management login.php sql injectionMontodel House-Rental-Management
- CVE-2026-12774BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgeryBerriAI litellm
- CVE-2026-12773BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authenticationBerriAI litellm · litellm
- CVE-2026-12772BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expirationBerriAI litellm · litellm
- CVE-2026-12771BerriAI litellm M2M JWT user_api_key_auth.py improper authorizationBerriAI litellm · litellm
- CVE-2026-12770BerriAI litellm Admin Key key_management_endpoints.py improper authorizationBerriAI litellm · litellm