Week 23, 2026
1 June to 7 June 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,609
- Critical
- 142
- High
- 619
- Added to KEV
- 5
Critical 142High 619Medium 779Low 69Not scored 0All 1,609 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-28318
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
SolarWinds · Serv-U
ExploitedHigh7.5 - CVE-2026-45247
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
Mirasvit · Full Page Cache Warmer for Magento 2
ExploitedCritical9.3 - CVE-2025-48595
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no…
Google · Android
ExploitedHigh8.4 - CVE-2022-0492
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances,…
kernel
ExploitedHigh7.8 - CVE-2024-21182
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and…
Oracle Corporation · WebLogic Server
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla
ExploitedCritical10.0 - CVE-2026-49777
WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability
ShapedPlugin, LLC · Product Slider Pro for WooCommerce
Critical10.0 - CVE-2026-11429
Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution
Altium · Altium Enterprise Server
Critical10.0 - CVE-2026-48567
Azure HorizonDB Elevation of Privilege Vulnerability
Microsoft · Azure HorizonDB
Critical10.0 - CVE-2026-11420
Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read
Altium · Altium Enterprise Server
Critical10.0 - CVE-2026-11414
Unauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path Traversal
Altium · Altium Enterprise Server
Critical10.0 - CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
Progress Software · Sitefinity
Critical10.0 - CVE-2026-49185
Instruction Injection via FieldX MDM
Acer · Connect M6E 5G Portable WiFi Router
Critical10.0 - CVE-2026-40965
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve)…
Cloud Foundry Foundation · uaa_release
Critical10.0 - CVE-2026-46389
UDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator`
defenseunicorns · uds-identity-config
Critical10.0