Week 26, 2026
22 June to 28 June 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,892CVEs publishedin the whole week
- 178CriticalCVSS 9.0 and above
- 785HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
PTC · Windchill PDMLink
ExploitedCritical9.3 - CVE-2026-20230
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Cisco · Cisco Unified Communications Manager
ExploitedHigh8.6 - CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-34909
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2025-67038
Lantronix EDS5000, G520, and X300 OS Command Injection
Lantronix · EDS5000 series
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2026-49869
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
kestra-io · kestra
ExploitedCritical10.0 - CVE-2026-53576
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
kestra-io · kestra
Critical10.0 - CVE-2026-27604
FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions
FOSSBilling · FOSSBilling
Critical10.0 - CVE-2025-71338
Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API
Flowise · Flowise
Critical10.0 - CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE through Git hooks
gogs · gogs
Critical10.0 - CVE-2026-10561
Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection
IBM · Langflow OSS
Critical10.0 - CVE-2026-12848
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0 - CVE-2026-12847
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0 - CVE-2026-12846
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0 - CVE-2026-12485
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GeoVision Inc. · GV-I/O Box 4E
Critical10.0