CVEs published June 28, 2026
44 CVEs were published on June 28, 2026: 1 critical, 7 high.
- Published
- 44
- Critical
- 1
- High
- 7
- Medium
- 26
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- ANTLR4
- 4
- SourceCodester Class and Exam Timetabling System
- 4
- itsourcecode Hospital Management System
- 3
- zephyrproject zephyr
- 3
- 78 xiaozhi-esp32
- 2
- libssh2
- 2
- Tenda JD12L
- 2
- yashpokharna2555 restaurent-management-system
- 2
- 7-Zip
- 1
- AIDC-AI ComfyUI-Copilot
- 1
Critical 1
High 7
- CVE-2026-13516Tenda JD12L WifiGuestSet fromSetWifiGusetBasic stack-based overflowTenda JD12L
- CVE-2026-13515Tenda JD12L SetPptpServerCfg formSetPPTPServer stack-based overflowTenda JD12L
- CVE-2026-49048Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1joomcoder.com JoomCCK extension for Joomla
- CVE-2026-10646Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellationzephyrproject zephyr
- CVE-2026-58056RustDesk - FileTransfer Session Authorization Scope BypassRustDesk
- CVE-2026-58050libssh2 - Integer Overflow in publickey Subsystem Attribute Allocationlibssh2
- CVE-2026-58049FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()FFmpeg
Medium, low and unrated 36
- CVE-2026-13514Chess Play and Learn App com.chess AndroidManifest.xml backupChess Play and Learn App
- CVE-2026-13513MyScale MyScaleDB SegmentId.h getCacheKey data authenticityMyScaleDB
- CVE-2026-13512Databend Tenant client_session_manager.rs state_key authorizationDatabend
- CVE-2026-13511VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorizationVoltAgent
- CVE-2026-13510SimStudioAI sim Password Protection deployment.ts weak hashSimStudioAI sim
- CVE-2026-13509RAGapp Knowledge File files.py FileHandler.remove_file path traversalRAGapp
- CVE-2026-13508khoj-ai khoj Conversation Sharing api_chat.py authorizationkhoj-ai khoj
- CVE-2026-13507volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticityvolcengine OpenViking
- CVE-2026-13504code-projects Project Management System Mail Compose mail.php cross site scriptingcode-projects Project Management System
- CVE-2026-13503antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversalANTLR4
- CVE-2026-13502antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctouANTLR4
- CVE-2026-13501antlr ANTLR4 gofmt GoTarget.java GoTarget command injectionANTLR4
- CVE-2026-13500antlr ANTLR4 Grammar Action Block OutputFile.java code injectionANTLR4
- CVE-2026-13499yashpokharna2555 restaurent-management-system Registration login_register.php cross site scriptingyashpokharna2555 restaurent-management-system
- CVE-2026-13498yashpokharna2555 restaurent-management-system POST Parameter forgotpassword.php sql injectionyashpokharna2555 restaurent-management-system
- CVE-2026-13497itsourcecode Hospital Management System appointment.php sql injectionitsourcecode Hospital Management System
- CVE-2026-13496itsourcecode Hospital Management System ajaxmedicine.php sql injectionitsourcecode Hospital Management System
- CVE-2026-13495itsourcecode Hospital Management System adminprofile.php sql injectionitsourcecode Hospital Management System
- CVE-2026-13493AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injectionAIDC-AI ComfyUI-Copilot
- CVE-2026-1349178 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service78 xiaozhi-esp32
- CVE-2026-13490glpi-project glpi Document document.send.php canViewFile authorizationglpi-project glpi
- CVE-2026-1348978 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization78 xiaozhi-esp32
- CVE-2026-13488SourceCodester Class and Exam Timetabling System preview7.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-13487SourceCodester Class and Exam Timetabling System archive.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-13486SourceCodester Class and Exam Timetabling System preview6.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-13485SourceCodester Class and Exam Timetabling System preview.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-13484MLflow Experiment-scoped Label Schema CRUD API authorizationMLflow
- CVE-2026-13483arc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticityarc53 DocsGPT
- CVE-2026-13482skypilot-org skypilot User ID server.py username.encode weak hashskypilot-org skypilot
- CVE-2026-10593Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handlingzephyrproject zephyr
- CVE-2026-10644Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte bufferzephyrproject zephyr
- CVE-2026-58058Nmap - Integer Underflow in IPv6 Extension Header ParsingNmap
- CVE-2026-58057Flowise - Custom MCP Environment Variable Denylist Bypass via Case SensitivityFlowise
- CVE-2026-58055nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Lengthnghttp2
- CVE-2026-580527-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision7-Zip
- CVE-2026-58051libssh2 - Free of Uninitialized Pointer in publickey List Cleanuplibssh2