boxscore/security
Sunday, June 14, 2026 · all times UTC← 2026-06-13 · archive · 2026-06-15 →

17 CVEs published June 14, 2026: 1 critical, 10 high, 4 medium, 2 low; 0 in KEV; 0 with a public exploit reference; 0 awaiting enrichment.

Standings

League
MTDYTD2025 same span2025 full
CVEs published3375774710612563
KEV catalog size1670

347 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux9610628466331212730.37.8.0013-117
google59176567402272217460.88.1.0023+591
microsoft207697524661584378273.97.8.0043+69
red hat44108848466400.07.0.0030+40
apple146101636293711.55.7.0023+1
canonical0140455000.05.5.00090
freebsd070520000.07.8.00200
debian220020000.06.5.0023+2
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
netgear171700161800.04.3.0024+17
cisco316324096956.37.2.0971+2
palo alto networks911017114218.24.8.0022+8
ivanti49230033555.68.8.5187+3
checkpoint3915303111.17.5.0410+3
ubiquiti584400400.08.9.0052+5
fortinet28132028337.57.3.0066+1
broadcom2400204250.05.3.0887+2
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache679915404124011.07.3.0052+63
gitlab1120041224210.04.8.0024+11
mozilla51134401300.07.5.0032+1
docker250500100.08.8.0021+2
drupal0511305120.05.1.00260
github021100000.08.1.03470
jenkins00000060———0
joomla00000010———0
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
adobe1241284477227532.35.5.0021+124
ibm11601329180700.07.5.0028+11
oracle330916404026.78.1.0027+3
progress591710900.07.5.0036+5
solarwinds36121011466.77.5.3995+3
veeam142200400.09.0.0046+1
zohocorp020110000.07.1.01040
atlassian000000130———0
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
synology52325133000.05.6.0025+5
d-link91204252618.35.5.0058+9
siemens780440100.07.5.0020+6
abb550410000.07.2.0018+5
dahua330111200.06.9.0036+3
hitachi energy020020000.05.7.00140
moxa110100000.07.0.0007+1
schneider electric110100100.07.1.0023+1
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
spring6869227391000.06.5.0023+68
sourcecodester3658002434000.02.1.0026+36
edimax051032019100.07.4.00590
concrete cms2461111321000.06.2.0015+2
open ises044221210000.07.1.00210
helmholz04203930000.07.1.00260
mb connect line04203930000.07.1.00260
openclaw3440024124000.07.4.0022+34

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-10520.9990100.010.0
CVE-2008-4250.987599.9—
CVE-2026-35273.954799.99.8
CVE-2026-0257.939199.8—
CVE-2010-0249.918899.8—
CVE-2026-9082.883299.89.8
CVE-2009-3459.865899.7—
CVE-2025-34291.838499.7—
CVE-2026-42271.830199.6—
CVE-2026-50751.825599.69.3
Highest CVSS
CVECVSSEPSSNote
CVE-2026-1052010.0.9990KEV
CVE-2026-4817210.0.1891KEV
CVE-2026-4977710.0.0166
CVE-2026-805410.0.0158
CVE-2026-4508710.0.0147
CVE-2026-4919910.0.0134
CVE-2026-1142910.0.0115
CVE-2026-2022310.0.0083
CVE-2026-4714010.0.0082
CVE-2026-4720810.0.0076
Most disclosures (vendor)
VendorCVEs
google759
linux521
microsoft238
adobe125
apache84
red hat81
spring69
ibm60
sourcecodester58
edimax51
Most KEV additions (YTD)
VendorKEV
microsoft27
cisco9
apple7
google6
ivanti5
solarwinds4
synacor4
adobe3
fortinet3
linux3
Most-affected ecosystems
EcosystemAdvisories
Maven35
Packagist22
PyPI11
npm4
crates.io2
Fastest to KEV
CVEVendorDays
CVE-2008-4250Microsoft0
CVE-2009-1537Microsoft0
CVE-2009-3459Adobe0
CVE-2010-0249Microsoft0
CVE-2010-0806Microsoft0
CVE-2022-0492Linux0
CVE-2024-21182Oracle0
CVE-2025-34291Langflow0
CVE-2025-48595Google0
CVE-2026-0257Palo Alto Networks0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104Accellion2021-11-171670
CVE-2021-27102Accellion2021-11-171670
CVE-2021-27101Accellion2021-11-171670
CVE-2021-27103Accellion2021-11-171670
CVE-2021-21017Adobe2021-11-171670
CVE-2021-28550Adobe2021-11-171670
CVE-2021-42013Apache2021-11-171670
CVE-2021-41773Apache2021-11-171670
CVE-2021-30858Apple2021-11-171670
CVE-2021-30860Apple2021-11-171670

Transactions

EXPLOIT PUBLISHED — CVE-2026-12188 (Grit42 Grit). Public exploit reference added.

Yesterday's Results

17 CVEs published. 17 box scores, 0 table rows — nothing truncated.

CVE-2026-12197HIGH
Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    7.3   .0238   82.5     —
AFFECTED
  Product   Versions  Fixed
  EG105G-P  2.340 –   —
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-12186HIGH
GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0197   78.7     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-12187HIGH
GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0194   78.4     —
AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-11526CRITICAL
RURBAN GD — GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0135   69.2     —
AFFECTED
  Product  Versions     Fixed
  GD       unspecified  —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 14  Published (CNA: CPANSec)
CWE-73, CWE-78 · CNA: CPANSec · 4 references · NVD status: Deferred
CVE-2026-11527HIGH
SHLOMIF Config::IniFiles — Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  C  H  H  H    8.6   .0107   62.0     —
AFFECTED
  Product           Versions     Fixed
  Config::IniFiles  unspecified  —
TIMELINE
  Jun 7   Reserved by CNA
  Jun 14  Published (CNA: CPANSec)
CWE-73, CWE-78 · CNA: CPANSec · 4 references · NVD status: Deferred
CVE-2026-54410HIGH
debevv nanoMODBUS — nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   H    7.8   .0054   42.9     —
AFFECTED
  Product     Versions     Fixed
  nanoMODBUS  unspecified  —
TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)
CWE-193, CWE-787 · CNA: TuranSec · 4 references · NVD status: Deferred
CVE-2026-54412HIGH
LiamBindle MQTT-C — MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   H    7.8   .0041   33.9     —
AFFECTED
  Product  Versions     Fixed
  MQTT-C   unspecified  —
TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)
CWE-125, CWE-191 · CNA: TuranSec · 4 references · NVD status: Deferred
CVE-2026-54413HIGH
driftregion iso14229 — iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   H    7.8   .0041   33.9     —
AFFECTED
  Product   Versions     Fixed
  iso14229  unspecified  —
TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)
CWE-125, CWE-191 · CNA: TuranSec · 4 references · NVD status: Deferred
CVE-2026-54411MEDIUM
Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   N   H   N   N    6.9   .0033   26.2     —
AFFECTED
  Product    Versions     Fixed
  Linux-PAM  unspecified  —
TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)
CWE-208 · CNA: TuranSec · 4 references · NVD status: Deferred
CVE-2026-12192HIGH
GALAYOU Y4 Web Server buffer overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   N   H   H   H    7.4   .0032   24.4     —
AFFECTED
  Product  Versions  Fixed
  Y4       1.0.0 –   —
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-119, CWE-120 · CNA: VulDB · 4 references · NVD status: Deferred
CVE-2026-54421MEDIUM
OpenStack Ironic — In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is …
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  C  H  N  N    6.8   .0029   21.5     —
AFFECTED
  Product  Versions  Fixed
  Ironic   17.0.0 –  —
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: mitre)
CWE-212 · CNA: mitre · 3 references · NVD status: Deferred
CVE-2026-12188LOW
Grit42 Grit GritEntityController grit_entity_controller.rb sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0020    9.7     —
AFFECTED
  Product  Versions  Fixed
  Grit     0.1 –     —
TIMELINE
  Jun 14  Public exploit reference published
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2025-15546MEDIUM
Unknown Iptanus File Upload — Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   R  U  N  H  L    5.4   .0016    5.5     —
AFFECTED
  Product              Versions     Fixed
  Iptanus File Upload  unspecified  —
TIMELINE
  Jan 26  Reserved by CNA
  Jun 14  Published (CNA: WPScan)
CWE-362 · CNA: WPScan · 1 reference · NVD status: Deferred
CVE-2026-12193HIGH
VS Revo RevoUninstaller IOCTL RevoDetector.sys IOCtl_Handler heap-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   H   H   H    7.1   .0014    4.0     —
AFFECTED
  Product          Versions  Fixed
  RevoUninstaller  2.5.* –   2.7.0
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-119, CWE-122 · CNA: VulDB · 10 references · NVD status: Deferred
CVE-2026-12191HIGH
Comma AI Openpilot Pickle modeld.py pickle.loads deserialization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   H   H   H    7.1   .0014    3.6     —
AFFECTED
  Product    Versions  Fixed
  Openpilot  0.11 –    —
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-20, CWE-502 · CNA: VulDB · 4 references · NVD status: Deferred
CVE-2026-12190MEDIUM
Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    4.8   .0010    1.2     —
AFFECTED
  Product           Versions  Fixed
  AI Workspace App  2.8.4 –   —
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-285, CWE-939 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-12189LOW
Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0010    1.2     —
AFFECTED
  Product                   Versions  Fixed
  Bus & Public Transit App  1.18 –    —
TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)
CWE-285, CWE-939 · CNA: VulDB · 6 references · NVD status: Deferred

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-14 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.