Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 24, 2026

8 June to 14 June 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
1,769
Critical
135
High
808
Added to KEV
7

Critical 135High 808Medium 751Low 75Not scored 0All 1,769 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2026-35273

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are…

    Oracle Corporation · PeopleSoft Enterprise PeopleTools

    ExploitedCritical9.8
  • CVE-2026-10520

    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve…

    ivanti · Sentry

    ExploitedCritical10.0
  • CVE-2026-11645

    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2026-20245

    Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

    Cisco · Cisco Catalyst SD-WAN Controller

    ExploitedHigh7.8
  • CVE-2026-7473

    Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

    Arista Networks · EOS

    ExploitedMedium6.9
  • CVE-2026-50751

    User Authentication Bypass in VPN Remote Access and Mobile Access

    checkpoint · Quantum Security Gateway

    ExploitedCritical9.3
  • CVE-2026-42271

    LiteLLM: Authenticated command execution via MCP stdio test endpoints

    BerriAI · litellm

    ExploitedHigh8.7

Most severe new CVEsBy CVSS score

  • CVE-2026-10520

    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve…

    ivanti · Sentry

    ExploitedCritical10.0
  • CVE-2026-49261

    MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

    MariaDB · server

    Critical10.0
  • CVE-2026-47208

    vm2: Sandbox Breakout Using Promise Species

    patriksimek · vm2

    Critical10.0
  • CVE-2026-47140

    vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

    patriksimek · vm2

    Critical10.0
  • CVE-2026-47131

    vm2: Sandbox Escape

    patriksimek · vm2

    Critical10.0
  • CVE-2026-48303

    Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

    Adobe · Adobe Campaign Classic

    Critical10.0
  • CVE-2026-47938

    Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe · Adobe Campaign Classic

    Critical10.0
  • CVE-2026-47137

    vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

    patriksimek · vm2

    Critical10.0
  • CVE-2026-50086

    Aqara unauthenticated AES oracle

    Aqara · Aqara IAM/SSO Gateway

    Critical10.0
  • CVE-2026-46695

    BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files

    boxlite-ai · boxlite

    Critical10.0

Vendors with the most CVEs

  1. Microsoft200
  2. Adobe124
  3. Google103
  4. Spring66
  5. Linux62
  6. Apache Software Foundation35
  7. OpenClaw34
  8. ImageMagick28
  9. Red Hat25
  10. QNAP Systems Inc.24

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)196
  2. CWE-416 Use after free137
  3. CWE-20 Improper input validation83
  4. CWE-22 Path traversal69
  5. CWE-125 Out-of-bounds read65
  6. CWE-89 SQL injection65
  7. CWE-862 Missing authorization60
  8. CWE-121 Stack-based buffer overflow56
  9. CWE-787 Out-of-bounds write55
  10. CWE-122 Heap-based buffer overflow54