CVE Tools
Sign in
month report

June 2026

Data as of Jul 3, 2026, 05:44 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

June 2026 closed with 8,311 published CVEs — +114.5% YoY . 857 criticals, 23 added to CISA KEV (2 ransomware-linked). google led volume, mostly via chrome. Biggest breakout: google at ×17.1 their 12-month median. Top weakness class — CWE-79 (655 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
8,311
+12.8% MoM+114.5% YoY
Severity mix
857 / 3,087
critical / high
KEV added
23
2 ransomware-linked
Nuclei coverage
0.9%
78 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
5.8
n=18
Within 7 days
61.1%
Within 30 days
100.0%
Days → KEV (median)
2
n=15
Detection gap

KEV pressure, no Nuclei coverage

June 2026 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in June 2026

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS416Use After Free89SQL Injection862Missing Authorization20Improper Input Validation284CWE-28422Path Traversal125Out-of-bounds Read502Deserialization306Missing Auth for Critical Func…google7268214204213571linux412oracle corporation31159166oracle31159165microsoft corp2151115932233microsoft244726832134adobe601311159red hat37313151apache software foundation42239526adobe systems inc.59118124google inc71217314pypi51621201314

Most discussed CVEs — June 2026

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google↑1
    1,094 CVE59 critCVSS 7.2
    ×17.1KEV 2
    chrome (965) · android (119) · google chrome (43)
  • 2linux↓1
    514 CVE40 critCVSS 7.8
    linux (514) · linux kernel (32)
  • 3microsoft·
    265 CVE19 critCVSS 7.3
    windows 11 26h1 (111) · windows 11 version 26h1 (111) · windows server 2025 (110)
  • 4oracle↑35
    243 CVE123 critCVSS 8.7
    ×3.1KEV 1Nuclei 1
    webcenter content (32) · oracle webcenter content (29) · jd edwards enterpriseone tools (14)
  • 5adobe↑12
    145 CVE12 critCVSS 6.6
    experience manager (60) · adobe experience manager (59) · acrobat reader (24)
  • 6redhat·
    133 CVE2 critCVSS 6.2
    red hat enterprise linux 9 (81) · red hat enterprise linux 8 (81) · red hat enterprise linux 10 (80)
  • 7apache software foundation·
    121 CVE21 critCVSS 7.2
    ×5.6
    apache airflow (17) · apache activemq (15) · apache http server (13)
  • 8pypi↑23
    98 CVE
    praisonai (27) · praisonaiagents (11) · picklescan (10)
  • 9apache↑1
    94 CVE17 critCVSS 7.1
    ×4.7
    airflow (17) · http server (13) · apisix (12)
  • 10npm↓2
    89 CVE
    openclaw (25) · praisonai (9) · network-ai (5)
  • 11ibm↑9
    75 CVE16 critCVSS 6.9
    langflow oss (14) · websphere application server (14) · watsonx.data intelligence (10)
  • 12spring—
    72 CVECVSS 6.3
    ×5.0
    spring framework (18) · spring web services (7) · spring security (7)
  • 13capgo—
    61 CVE1 critCVSS 6.5
    NEW
    capgo (60) · cli (1)
  • 14openclaw↓3
    61 CVE1 critCVSS 7.0
    openclaw (61)
  • 15themerex—
    58 CVE5 critCVSS 8.2
    Nuclei 5
    line agency (1) · luxmed | medicine & healthcare doctor wordpress theme (1) · maxinet (1)
  • 16сообщество свободного программного обеспечения↓12
    55 CVE5 critCVSS 7.0
    debian gnu/linux (28) · xwayland (8) · gpac (6)
  • 17apple↓12
    52 CVE1 critCVSS 6.6
    macos (51) · iphone os (38) · ios and ipados (38)
  • 18mozilla↑6
    50 CVE8 critCVSS 6.9
    firefox (47) · thunderbird (42) · firefox for ios (4)
  • 19sourcecodester↑16
    49 CVECVSS 5.9
    class and exam timetabling system (16) · pharmacy sales and inventory system (6) · inventory system (3)
  • 20vmware↑137
    44 CVECVSS 7.0
    ×4.9
    spring framework (17) · spring security (7) · spring data rest (4)
  • 21itsourcecode↑63
    43 CVECVSS 6.2
    hospital management system (16) · fees management system (9) · online hotel management system (6)
  • 22imagemagick—
    41 CVECVSS 5.0
    ×3.4
    imagemagick (41)
  • 23dell↑31
    38 CVE1 critCVSS 6.7
    powerflex manager (11) · powerflex (10) · wyse management suite (6)
  • 24jenkins↑68
    36 CVECVSS 5.2
    ×3.3
    jenkins (8) · jenkins assembla plugin (3) · jenkins contrast continuous application security plugin (3)
  • 25go↑4
    35 CVE
    github.com/klever-io/klever-go (4) · github.com/gohugoio/hugo (3) · github.com/go-chi/chi/v5/middleware (3)
  • 26picklescan—
    34 CVE8 critCVSS 8.5
    NEW
    picklescan (34)
  • 27wolfssl—
    32 CVE2 critCVSS 6.9
    wolfssl (32)
  • 28nocodb—
    29 CVECVSS 5.2
    NEW
    nocodb (29)
  • 29gpac—
    28 CVECVSS 6.1
    gpac (28)
  • 30misp↑100
    28 CVE1 critCVSS 7.0
    NEW
    misp (27) · bsimvis (1)
  • 31n8n↑67
    28 CVE8 critCVSS 7.6
    n8n (28)
  • 32flowiseai—
    27 CVE6 critCVSS 7.9
    ×4.5
    flowise (27)
  • 33acer↑72
    26 CVE8 critCVSS 8.0
    NEW
    connect m6e 5g firmware (26) · connect m6e 5g portable wifi router (26)
  • 34codeastro↑105
    26 CVECVSS 5.8
    human resource management system (7) · leave management system (5) · student attendance management system (5)
  • 35frappe↑53
    26 CVE
    frappe framework (12) · frappe (11) · erpnext (2)
  • 36nextcloud—
    26 CVECVSS 5.5
    security-advisories (26) · nextcloud server (8) · tables (3)
  • 37gitlab↑3
    25 CVECVSS 5.5
    gitlab (25)
  • 38netty↑55
    25 CVE1 critCVSS 6.9
    netty (22) · netty-incubator-codec-ohttp (3)
  • 39gogs—
    24 CVE2 critCVSS 7.4
    Nuclei 1
    gogs (24)
  • 40qnap—
    24 CVE4 critCVSS 7.3
    quts hero (13) · qts (12) · file station 5 (6)
  • 41qualcomm↑95
    24 CVE1 critCVSS 7.3
    wcd9380 firmware (22) · fastconnect 7800 firmware (22) · wcd9385 firmware (22)
  • 42flowise—
    23 CVE7 critCVSS 7.9
    NEW
    flowise (23) · flowise components (1)
  • 43qualcomm, inc.↑94
    22 CVECVSS 7.3
    snapdragon (22)
  • 44zephyrproject—
    22 CVECVSS 5.9
    NEW
    zephyr (22)
  • 45n8n-io↑54
    21 CVE7 critCVSS 8.1
    n8n (21)
  • 46mattermost↓13
    20 CVECVSS 5.7
    mattermost (18) · mattermost server (15) · mattermost desktop (2)
  • 47nodejs—
    20 CVE1 critCVSS 5.8
    node (12) · node.js (10) · undici (8)
  • 48geovision inc.↑61
    19 CVE12 critCVSS 8.8
    NEW
    gv-lpclpc2011/2211 (10) · gv-i/o box 4e (8) · geovision (1)
  • 49openssl—
    18 CVE1 critCVSS 6.6
    openssl (18)
  • 50packagist↓24
    18 CVE
    web-token/jwt-library (4) · web-token/jwt-framework (3) · spomky-labs/otphp (2)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79655·
2CWE-416433↑2
3CWE-89405↓1
4CWE-862388↓1
5CWE-20353↑5
6CWE-284352↑7
7CWE-22316↓2
8CWE-125210·
9CWE-502185↑18
10CWE-306184↑16
11CWE-78181↓5
12CWE-200179↑9
13CWE-639174↑5
14CWE-74171·
15CWE-918171↓3
16CWE-863162↑1
17CWE-787159↓1
18CWE-94153↓9
19CWE-400145↑4
20CWE-121130·

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries1,505 CVE
    111 crit326 vendorsCVSS 7.7
    capgo (73) · imagemagick (41) · wolfssl (32)
  • Web & CMS Plugins1,477 CVE
    172 crit4 KEV705 vendorsCVSS 7.9
    jetengine (10) · eventprime (5) · classified listing (4)
  • Consumer Software1,401 CVE
    128 crit2 KEV97 vendorsCVSS 7.5
    chrome (965) · firefox (47) · google chrome (43)
  • Operating Systems1,163 CVE
    256 crit2 KEV62 vendorsCVSS 7.4
    linux (517) · red hat enterprise linux 8 (81) · red hat enterprise linux 9 (81)
  • Enterprise Software925 CVE
    198 crit4 KEV185 vendorsCVSS 8.3
    microsoft sharepoint server 2019 (31) · microsoft sharepoint enterprise server 2016 (30) · openproject (17)
  • Cloud & SaaS397 CVE
    61 crit101 vendorsCVSS 7.8
    nocodb (29) · n8n (28) · microsoft 365 (26)
  • Networking Infrastructure374 CVE
    133 crit18 KEV102 vendorsCVSS 7.7
    connect m6e 5g firmware (26) · connect m6e 5g portable wifi router (26) · ew-7478apc (9)
  • Security Products302 CVE
    56 crit12 KEV103 vendorsCVSS 7.8
    misp (40) · ghidra (30) · openbullet2 (5)
  • Databases261 CVE
    108 crit1 KEV51 vendorsCVSS 8.5
    webcenter content (32) · pgadmin 4 (11) · webcenter enterprise capture (10)
  • AI / ML259 CVE
    46 crit99 vendorsCVSS 7.6
    flowise (50) · open-webui (17) · open webui (16)
  • DevTools & CI236 CVE
    30 crit50 vendorsCVSS 7.6
    gitlab (25) · gogs (24) · jenkins (16)
  • ICS / OT / IoT206 CVE
    59 crit2 KEV68 vendorsCVSS 8.3
    double-a profibus (11) · double-a x-link (11) · double-x can (11)
  • Hardware Firmware186 CVE
    31 crit51 vendorsCVSS 8.6
    quts hero (24) · qts (23) · fastconnect 7800 firmware (22)
  • Communications156 CVE
    20 crit37 vendorsCVSS 8.0
    librechat (25) · mattermost (18) · mattermost server (15)
  • Mobile Apps23 CVE
    3 crit17 vendorsCVSS 7.2
    setracker2 parental control app (android) package com.tgelec.setracker (4) · hippoo mobile app for woocommerce (2) · samsung assistant (2)
  • Unclassified203 CVE
    39 crit1 KEV112 vendorsCVSS 7.4
    oracle enterprise command center framework (8) · windows app client for windows desktop (7) · collegemanagementsystem (5)
Weakness × Sector

Which weaknesses hit which solution categories in June 2026

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS416Use After Free89SQL Injection862Missing Authorization20Improper Input Validation284CWE-28422Path Traversal125Out-of-bounds Read502Deserialization306Missing Auth for Critical Func…Web & CMS Plugins31720117711266418718OSS Libraries62311251502682394929Consumer Software353124721035178516Operating Systems586219281976513Enterprise Software164210824101502152065Cloud & SaaS2212131783114858Networking Infrastructure882427817716Security Products18351172017887Databases6210469272333AI / ML1049311202612