boxscore/security
Sunday, June 7, 2026 · all times UTC← 2026-06-06 · archive · 2026-06-08 →

23 CVEs published June 7, 2026: 0 critical, 1 high, 9 medium, 13 low; 0 in KEV; 0 with a public exploit reference; 0 awaiting enrichment.

Standings

League
MTDYTD2025 same span2025 full
CVEs published1607597910472563
KEV catalog size1670

258 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux3410008163028612730.37.8.0013-112
google48866258331255157450.87.8.0023+488
microsoft7497443331030378275.47.8.0046-5
red hat1983840305400.07.4.0033+15
apple04701227193714.96.2.00340
canonical0140455000.05.5.00090
freebsd070520000.07.8.00200
suse020200000.08.2.00200
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco215314096853.37.0.0694+2
ivanti16020033466.78.8.57510
checkpoint060330300.06.5.03380
fortinet06130028350.07.9.43300
zyxel2300301100.06.5.0017+2
f50320007133.39.2.09960
ubiquiti031200400.08.8.00680
broadcom02000042100.0—.19900
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache32648262724011.67.2.0053+28
mozilla41033401300.07.4.00350
gitlab0901604222.24.3.00320
docker250500100.08.8.0021+2
drupal0511305120.05.1.00260
github021100000.08.1.03470
jenkins00000060———0
joomla00000010———0
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
ibm5541326150700.07.5.0031+5
oracle128815404013.68.1.0027+1
progress591710900.07.5.0036+5
solarwinds25120011480.07.5.7155+2
adobe04010075375.08.6.27760
veeam031200400.08.6.00400
zohocorp020110000.07.1.01040
atlassian000000130———0
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
synology52325133000.05.6.0025+5
d-link58031326112.56.0.0087+5
abb440400000.07.3.0024+4
siemens120110100.07.3.0026+1
hitachi energy020020000.05.7.00140
hikvision01000021100.0—1.00000
dahua00000020———0
qnap00000080———0
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
edimax051032019100.07.4.00590
concrete cms1451101321000.06.0.0015+1
sourcecodester2244001430000.02.1.0025+22
open ises044221210000.07.1.00210
helmholz04203930000.07.1.00260
mb connect line04203930000.07.1.00260
acer2636111960000.08.7.0024+26
nvidia23582070000.07.8.0029+2

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2008-4250.987599.9—
CVE-2026-0257.939199.8—
CVE-2026-43500.928599.87.8
CVE-2010-0249.918899.8—
CVE-2026-20182.915299.8—
CVE-2026-9082.883299.89.8
CVE-2009-3459.865899.7—
CVE-2025-34291.838499.7—
CVE-2010-0806.821799.6—
CVE-2026-41089.796299.69.8
Highest CVSS
CVECVSSEPSSNote
CVE-2026-4817210.0.1891KEV
CVE-2026-4977710.0.0166
CVE-2026-805410.0.0158
CVE-2026-4508710.0.0147
CVE-2026-4919910.0.0134
CVE-2026-1142910.0.0115
CVE-2026-4399710.0.0098
CVE-2026-2022310.0.0083
CVE-2026-4400510.0.0083
CVE-2026-4400610.0.0081
Most disclosures (vendor)
VendorCVEs
google656
linux464
microsoft165
red hat56
ibm54
edimax51
apache49
concrete cms45
open ises44
sourcecodester44
Most KEV additions (YTD)
VendorKEV
microsoft27
cisco8
apple7
google5
ivanti4
solarwinds4
synacor4
adobe3
fortinet3
linux3
Most-affected ecosystems
EcosystemAdvisories
Maven24
PyPI10
Packagist7
crates.io2
npm2
Fastest to KEV
CVEVendorDays
CVE-2008-4250Microsoft0
CVE-2009-1537Microsoft0
CVE-2009-3459Adobe0
CVE-2010-0249Microsoft0
CVE-2010-0806Microsoft0
CVE-2022-0492Linux0
CVE-2024-21182Oracle0
CVE-2025-34291Langflow0
CVE-2025-48595Google0
CVE-2026-0257Palo Alto Networks0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104Accellion2021-11-171663
CVE-2021-27102Accellion2021-11-171663
CVE-2021-27101Accellion2021-11-171663
CVE-2021-27103Accellion2021-11-171663
CVE-2021-21017Adobe2021-11-171663
CVE-2021-28550Adobe2021-11-171663
CVE-2021-42013Apache2021-11-171663
CVE-2021-41773Apache2021-11-171663
CVE-2021-30858Apple2021-11-171663
CVE-2021-30860Apple2021-11-171663

Transactions

DUE DATE PASSED — CVE-2026-45247 (Mirasvit Full Page Cache Warmer for Magento 2). CISA remediation deadline was June 6, 2026; still in catalog.

Yesterday's Results

23 CVEs published. 23 box scores, 0 table rows — nothing truncated.

CVE-2026-11451MEDIUM
GL.iNet GL-MT3000 FTP Protocol glc snprintf command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0203   79.4     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.5 –   4.8.1
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11452MEDIUM
GL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0168   75.0     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.8.1
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11448MEDIUM
GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    5.1   .0158   73.5     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11450MEDIUM
GL.iNet GL-MT3000 Path Normalization dlopen command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0157   73.3     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.5 –   4.7
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11449MEDIUM
GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0110   63.0     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.5 –   4.8.1
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11447LOW
GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.1     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11455LOW
FoundationAgents MetaGPT common.py check_cmd_exists command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   L   L   L    1.3   .0094   57.9     —
AFFECTED
  Product  Versions  Fixed
  MetaGPT  0.8.0 –   —
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 7 references · NVD status: Deferred
CVE-2026-49494HIGH
Xcitium Client Security / Comodo Internet Security Remote Denial of Service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0054   43.0     —
AFFECTED
  Product                        Versions     Fixed
  Comodo Internet Security       unspecified  —
  Xcitium Client Security (XCS)  unspecified  —
TIMELINE
  May 31  Reserved by CNA
  Jun 7   Published (CNA: VulnCheck)
CWE-191 · CNA: VulnCheck · 4 references · NVD status: Deferred
CVE-2026-11457MEDIUM
erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0033   25.7     —
AFFECTED
  Product  Versions                                    Fixed
  JeeWMS   141740afb2ba14d441c82a833d0a418d07ca2d69 –  —
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-707 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11467LOW
jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   L   L    2.1   .0032   25.1     —
AFFECTED
  Product  Versions  Fixed
  jshERP   3.0 –     —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-22 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11463LOW
USCiLab Cereal Shared Pointer type confusion
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   L   L   L    2.9   .0031   24.1     —
AFFECTED
  Product  Versions  Fixed
  Cereal   1.3.0 –   —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-843 · CNA: VulDB · 7 references · NVD status: Deferred
CVE-2026-11460LOW
Boost Serialization improper validation of specified type of input
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   L   L   L    2.9   .0031   23.8     —
AFFECTED
  Product        Versions  Fixed
  Serialization  1.0 –     —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-20, CWE-1287 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11462MEDIUM
Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0029   21.9     —
AFFECTED
  Product    Versions   Fixed
  BeikeShop  1.6.0.0 –  —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-266, CWE-285 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11458MEDIUM
erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   21.8     —
AFFECTED
  Product  Versions                                    Fixed
  JeeWMS   141740afb2ba14d441c82a833d0a418d07ca2d69 –  —
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11456MEDIUM
Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   17.8     —
AFFECTED
  Product  Versions  Fixed
  CRM      1.0 –     —
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11466LOW
zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   L    2.1   .0025   16.9     —
AFFECTED
  Product        Versions  Fixed
  deep-searcher  0.0.1 –   —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-266, CWE-284 · CNA: VulDB · 7 references · NVD status: Deferred
CVE-2026-11469LOW
jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    2.0   .0023   14.2     —
AFFECTED
  Product  Versions  Fixed
  jshERP   3.0 –     —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-918 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11461LOW
NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0022   13.3     —
AFFECTED
  Product       Versions  Fixed
  hermes-agent  0.1 –     —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-285, CWE-639 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11464LOW
n/a JeecgBoot — JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   L   N   N    1.3   .0022   12.8     —
AFFECTED
  Product    Versions  Fixed
  JeecgBoot  3.9.0 –   —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · 7 references · NVD status: Deferred
CVE-2026-11465LOW
songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   N   L   N    1.3   .0022   12.7     —
AFFECTED
  Product  Versions            Fixed
  one-api  0.6.11-preview.0 –  —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-840 · CNA: VulDB · 7 references · NVD status: Deferred
CVE-2026-11468LOW
SourceCodester Hospitals Patient Records Management System page room_types cross site scripting
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   P   N   L   N    1.9   .0021   12.1     —
AFFECTED
  Product                                      Versions  Fixed
  Hospitals Patient Records Management System  1.0 –     —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-79, CWE-94 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11453LOW
Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0019    9.3     —
AFFECTED
  Product                       Versions  Fixed
  Employee Self-Service System  7.0 –     —
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-11459LOW
SecureAge CatchPulse IOCTL saappctl.sys information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   N   N    1.9   .0011    1.3     —
AFFECTED
  Product     Versions  Fixed
  CatchPulse  10.9.0 –  —
TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · 6 references · NVD status: Deferred

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-07 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.