Week 25, 2026

15 June to 21 June 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 1,801
Critical: 380
High: 852
Added to KEV: 4

Critical 380High 852Medium 530Low 39Not scored 0All 1,801 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
Splunk · Splunk Enterprise
ExploitedCritical9.8
CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla
ExploitedCritical10.0
CVE-2026-54420
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell…
LiteSpeed Technologies · cPanel Plugin
ExploitedHigh8.5
CVE-2026-20262
Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedMedium6.5

Most severe new CVEsBy CVSS score

CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
joomshaper.net · SP Page Builder extension for Joomla
ExploitedCritical10.0
CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
icagenda.com · iCagenda extension for Joomla
ExploitedCritical10.0
CVE-2026-45480
Azure Active Directory Elevation of Privilege Vulnerability
Microsoft · Azure Active Directory
Critical10.0
CVE-2026-3490
picklescan - Universal Blocklist Bypass via pkgutil.resolve_name
picklescan · picklescan
Critical10.0
CVE-2026-48055
Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction
truelockmc · streambert
Critical10.0
CVE-2026-25470
WordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin < 2.0.52 - Remote Code Execution (RCE) vulnerability
ACPT · ACPT (Pro) - Custom Post Types Plugin for WordPress
Critical10.0
CVE-2026-49257
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
startreedata · mcp-pinot
Critical10.0
CVE-2026-50242
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database…
JetBrains · Hub
Critical10.0
CVE-2026-48836
WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability
MantraBrain · Easy Invoice
Critical10.0
CVE-2026-46800
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are…
Oracle Corporation · Oracle WebCenter Sites
Critical10.0

Week 25, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses