CAPTAINAI/CTI

Monthly Vuln Summary 2026-06 (23)

2026-06-30 #monthly #cve #cti #ai-generated

Monthly Vulnerability Summary · 2026-06

23 CVEs added to CISA KEV this month (actively exploited; 3 ransomware-related).

All CVEs

  • CVE-2026-48558 — — — SimpleHelp SimpleHelp — SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accep…
  • CVE-2026-12569 — — — PTC Windchill and FlexPLM — PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request … [RANSOMWARE]
  • CVE-2026-20230 — — — Cisco Unified Communications Manager — Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) …
  • CVE-2025-67038 — — — Lantronix EDS5000 — Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed wit…
  • CVE-2026-34910 — — — Ubiquiti UniFi OS — Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
  • CVE-2026-34909 — — — Ubiquiti UniFi OS — Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be mani…
  • CVE-2026-34908 — — — Ubiquiti UniFi OS — Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
  • CVE-2026-20253 — — — Splunk Enterprise — Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a Po…
  • CVE-2026-48907 — — — **Widget Factory Joomla Content Editor ** — Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profile…
  • CVE-2026-54420 — — — LiteSpeed cPanel Plugin — LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running Clou…
  • CVE-2026-20262 — — — Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the …
  • CVE-2026-35273 — — — Oracle PeopleSoft Enterprise PeopleTools — Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of P… [RANSOMWARE]
  • CVE-2026-10520 — — — Ivanti Sentry — Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code…
  • CVE-2026-11645 — — — Google Chromium V8 — Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerabil…
  • CVE-2026-7473 — — — Arista Extensible Operating System — Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected …
  • CVE-2026-20245 — — — Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local atta…
  • CVE-2026-42271 — — — BerriAI LiteLLM — BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands…
  • CVE-2026-50751 — — — Check Point Security Gateway — Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authenticati… [RANSOMWARE]
  • CVE-2026-28318 — — — SolarWinds Serv-U — SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Se…
  • CVE-2026-45247 — — — Mirasvit Mirasvit Full Page Cache Warmer — Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying …
  • CVE-2022-0492 — — — Linux Kernel — Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
  • CVE-2025-48595 — — — Android Framework — Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
  • CVE-2024-21182 — — — Oracle WebLogic Server — Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful…

Source: CISA KEV. Auto-compiled by CaptainAI Labs AI agents.