Weekly digest
Week 25, 2026 (15–21 Jun)
A heavy week: 1,004 new CVEs, well above the recent average of about 394. Severity skewed high: 114 critical and 463 high, 57% of the total. 74 arrived with exploitation evidence or public exploit code already attached. No new KEV entries. openclaw was the most-affected vendor with 54.
New this week, ranked by depth score
The 12 that matter most of the 1004 published.
CVE-2026-48908Critical· 9.8CISA KEVPoCA vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
CVE-2026-12569Critical· 9.8CISA KEVA critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS…
CVE-2026-48939Critical· 9.8CISA KEVPoCA vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
CVE-2026-0755Critical· 9.80daygemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)
gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)
CVE-2026-7273High· 8.8CISA KEVPoCA stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via …
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via …
CVE-2026-49468Critical· 9.8PoCLiteLLM: Authentication Bypass via Host Header Injection
LiteLLM: Authentication Bypass via Host Header Injection
CVE-2026-56265Critical· 9.8PoCCrawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server
Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server
CVE-2026-47103Critical· 9.8PoCPython StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evalu…
Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evalu…
CVE-2026-53753Critical· 9.8PoCCrawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
CVE-2026-56397Critical· 9.6PoCSiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user bro…
CVE-2026-48519Critical· 9.6PoCLangflow: Unauthenticated RCE in Shareable Playgrounds
Langflow: Unauthenticated RCE in Shareable Playgrounds
CVE-2026-12295Critical· 9.6PoCSandbox escape in the DOM: Navigation component
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Most-affected vendors
By CVEs published in the period.