Week 26, 2026
22 June to 28 June 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,892
- Critical
- 178
- High
- 785
- Added to KEV
- 6
Critical 178High 785Medium 832Low 92Not scored 5All 1,892 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
PTC · Windchill PDMLink
ExploitedCritical9.3 - CVE-2026-20230
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Cisco · Cisco Unified Communications Manager
ExploitedHigh8.6 - CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-34909
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2025-67038
Lantronix EDS5000, G520, and X300 OS Command Injection
Lantronix · EDS5000 series
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2026-49869
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
kestra-io · kestra
ExploitedCritical10.0 - CVE-2026-53576
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
kestra-io · kestra
Critical10.0 - CVE-2026-27604
FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions
FOSSBilling · FOSSBilling
Critical10.0 - CVE-2025-71338
Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API
Flowise · Flowise
Critical10.0 - CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE through Git hooks
gogs · gogs
Critical10.0 - CVE-2026-10561
Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection
IBM · Langflow OSS
Critical10.0 - CVE-2026-12848
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0 - CVE-2026-12847
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0 - CVE-2026-12846
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0 - CVE-2026-12485
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0
Vendors with the most CVEs
Most common weaknesses
- CWE-79 Cross-site scripting (XSS)152
- CWE-862 Missing authorization118
- CWE-416 Use after free105
- CWE-89 SQL injection88
- CWE-22 Path traversal79
- CWE-476 NULL pointer dereference75
- CWE-125 Out-of-bounds read66
- CWE-918 Server-side request forgery (SSRF)58
- CWE-639 Authorization bypass through a user-controlled key (IDOR)55
- CWE-78 OS command injection50