We are pleased to announce the release of Vulnerability-Lookup 5.5.0!

This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.

What's New

Role-Based Access Control

The boolean admin flags of previous versions are replaced by a full RBAC mechanism: roles and permissions in a unified data model, role assignments with global or per-resource scope, creation policies that automatically grant the creator role when a resource is created, and a configurable default role for self-registration. Permission checks are enforced across the views, the templates and the user, system, KEV, CNA, bundle and sightings APIs. Contributed by @NMD03 in #497.

Each role is a set of fine-grained permissions (bundle:create, cna_publication:publish, kev:modify, ...) that can be edited from the admin interface:

The release also ships the hardening and migration work that followed the initial review: three security gaps around account confirmation and admin lockout were closed, permission checks keep working on a closed session, the creator role assignment is atomic with resource creation, owner role assignments are backfilled for pre-existing resources, the seeding is non-destructive and runs on update, role assignments are no longer bulk-loaded on every request, and the scoped-assignment tables are paginated. A permission-matrix test suite locks the behavior in, and the migration path for existing instances is documented — existing users and their resources are migrated automatically.

AI-suggested MITRE ATT&CK techniques

The vulnerability details page gains a new ATT&CK tab with MITRE ATT&CK techniques suggested by our new AI model, trained with VulnTrain and published as CIRCL/vulnerability-attack-technique-classification-roberta-base on Hugging Face.

A new POST /api/vlai/attack-techniques endpoint proxies the ML-Gateway /classify/attack-techniques service with strict validation of the gateway response. The suggestions are lazy-loaded from the vulnerability description and clearly labelled as AI-generated, with a link to the model card and the exact model revision; gateway, model or network errors are shown to the user and allow a retry.

The approach behind this classifier is described in our paper on mapping CVEs to MITRE ATT&CK techniques.

EUVD ID allocation and creation pipeline

The EUVD support keeps progressing: a per-year EUVD ID allocator with a one-EUVD-per-CVE guarantee, an EnisaID creation pipeline that mints EUVD IDs for published CVEs, bidirectional vendor/product/advisory relationship sets, EUVD search with sort indexes and CVSS/EPSS/date filtering, a source and assigner registry with an assigner filter index, and advisory, vendor/product and CSAF advisory links wired into EUVD creation. Contributed by @archakisn in #475, #476, #479, #480, #488, #489, #491, #498, #499, #500, #501, #502, #503, #509 and #511.

Feeder supervision and CSAF resilience

feeders_manager now watches the feeders and respawns the dead ones, and CSAF sources are suspended with exponential backoff after fully failed cycles (#508, closing #459 and #463). CSAF import memory is bounded — untouched files are skipped and batches flushed on size — while unparseable files stay retryable, the watcher survives launch failures and transient cache errors, and the runtime script_name is aligned with modules.cfg so --stop actually stops the feeders.

More VEX enrichment sources and a VEX records UI

New SUSE CSAF VEX (#483) and Microsoft MSRC CSAF VEX (#469) metadata feeders join the Red Hat one introduced in 5.4.0. A new VEX records browse view allows pivoting from VEX documents to the corresponding CVEs, with index-level paging and input validation (#473).

New feeders: Rocky Linux, Ubuntu and TuxCare

New sources join the platform: Rocky Linux OSV (#482), Ubuntu USN (OSV) and TuxCare CSAF (#487), wired into the web interface and the README.

Profile photo and improved public profile

Users can now upload a profile photo, with Gravatar as fallback (#496). The public profile page was improved: stat tiles and profile links point to the author-filtered public pages, and the header stacks on small screens.

Changes

• Admin — Admin interface redesign: the navbar Admin dropdown is replaced by a full-height sidebar on the admin pages, grouped by mission with an RBAC sub-navigation and a user menu at the bottom. The Maintenance card moved to a dedicated page, the user list can be filtered by role (with role user counts linking to it), breadcrumbs were dropped and the page headings harmonized.

• CWE — Modernized the CWE views: singular /cwe endpoint (with 301 redirects from the legacy paths), vex-style browse list and harmonized detail page; /api/cwe/ can now filter out Discouraged and Prohibited CWEs.
• Sync — Sturdier synchronization of large backfills: pages are streamed with bounded transactions, transient page failures are retried and last_sync is kept on incomplete runs, JSON decode errors are caught per page, and the sightings page size was lowered (#492, #494, #495).
• Feeders — The Red Hat VEX feeder uses the canonical CSAF metadata URL, and csaf_tibco is disabled by default (the endpoint returns 403).
• Documentation — Listed the recently merged feeders in the README and fixed the source gaps.
• Dependencies — Updated Python dependencies (including cryptography 48.0.1 via gcve 0.12.1) and bumped the pinned CodeQL actions.

Fixes

• Feeders — The cvelistv5 vendor/product indexes converge on the shared CNA+ADP helper, and containers.adp is iterated as a list so the adp:shortName:* indexes are actually populated.
• Feeders — The VARIoT feeder paginates its imports itself with small pages, instead of tripping the API's failures on large limits.
• Feeders — The Rocky Linux OSV feeder walks all Apollo pages and dedups against the index (the Apollo API shifts records between pages), and the OSV git mirrors are synced with fetch + reset instead of pull.
• Sightings — Invalid CVE identifiers are rejected by the vulnerability id regex.
• Disclosure — Imported the names is_public_disclosure relies on and fixed test type errors.

Changelog

📂 For the full list of changes, check the GitHub release:
https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v5.5.0

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
https://social.circl.lu/@vulnerability_lookup/

Stegano 2.5.0 is out! 🎉

This release adds a reversible data hiding technique based on histogram shifting (Ni et al., IEEE TCSVT 2006): unlike LSB, the original cover image can be recovered pixel-for-pixel after the hidden message is extracted. Includes a new stegano-rdh command line tool.

Thanks to Eesh Saxena for the contribution!

https://github.com/cedricbonhomme/Stegano/releases/tag/v2.5.0

Vulnerability-Lookup now ingests Red Hat's per-CVE CSAF VEX documents and attaches them straight to the vulnerabilities you're already tracking. Which products are affected? Which are fixed? Which were never affected at all? One glance at the new VEX tab — or the EPSS-style VEX badge right in the vulnerability header — and you know.

No more digging through vendor advisories to answer "does this CVE actually matter to us?" 🔎

Also in this release:

✅ New /api/vex endpoints — VEX data, fully machine-readable 🔐 Per-user enable/disable of CNA publication, with a dedicated admin overview 📬 Admin overview for KEV catalog e-mail subscriptions + richer digest e-mails (entry titles, affected vendors & products) 🛠️ A batch of feeder robustness fixes — no more full re-imports or notification storms after a partial download failure

Vulnerability-Lookup is open source, and you can run your own instance today (https://www.vulnerability-lookup.org/documentation/installation.html).

👉 Release post: https://www.vulnerability-lookup.org/2026/07/10/vulnerability-lookup-5-4-0/

⭐ GitHub: https://github.com/vulnerability-lookup/vulnerability-lookup

Feel free to create an account on the instance operated by CIRCL: 👉 https://vulnerability.circl.lu/user/signup

📚 References

Source code: https://github.com/vulnerability-lookup/vulnerability-lookup

Examples:

• https://vulnerability.circl.lu/vuln/CVE-2026-1207#vex
• https://vulnerability.circl.lu/vuln/CVE-2026-53359#vex
• https://vulnerability.circl.lu/vuln/CVE-2026-4631#vex
• https://vulnerability.circl.lu/vuln/CVE-2023-39361#vex

💶🇪🇺 Funding

Vulnerability-Lookup is co-funded by CIRCL and by the European Union through the #NGSOTI project.

More information from the Restena Foundation: https://www.restena.lu/en/project/ngsoti

#VulnerabilityManagement #VEX #CSAF #CVE #OpenSource #CyberSecurity #ThreatIntelligence

PoC: https://github.com/JakeGinesin/git-chain-malleator

We are pleased to announce the release of Vulnerability-Lookup 5.3.0!

This release brings email subscriptions to KEV catalogs, letting you receive batched digests whenever new exploited vulnerabilities are added to a catalog you follow. Search gained the long-requested ability to filter and sort by CVSS base score, two new feeder families join the platform — the AVID (AI Vulnerability Database) feeder and a set of new CSAF vendor feeders — and the KEV catalogs page gained a whole suite of coverage visualisations. On the account side, 2FA recovery codes make account recovery safer.

What's New

Email subscriptions to KEV catalogs

You can now subscribe to any KEV catalog and receive batched email digests when new entries are added. Subscriber counts are surfaced on the catalogs page, and the notifications page was modernized onto the shared card design language (#457).

Filter and sort by CVSS base score

The search now supports filtering and sorting vulnerabilities by CVSS base score — including CVSS-only searches that need no vendor, product or assigner. The recent vulnerabilities page gained a quick-filter accordion above the table, and the search form now preselects the CVE Program source by default (#454).

New feeders: AVID and more CSAF vendors

A new feeder for the AVID (AI Vulnerability Database) brings AI-specific vulnerability advisories into the platform, with a dedicated advisory view, product search wiring and source registration. Contributed by @thunderstornX in #442.

We also added new CSAF feeders for the vendors whose public feeds actually deliver documents — audited from a much larger candidate list — wired into the web interface and README. Along the way: CERT@VDE trusted-provider metadata URLs were fixed for 12 vendors, the TuxCare feeder now points at its published provider metadata, Palo Alto advisory ids were namespaced so they no longer overwrite canonical CVE records, and the csaf_trend feeder was renamed to csaf_trendmicro (#448).

KEV catalog coverage visualisations

Building on the catalog coverage matrix introduced in 5.2.0, the KEV catalogs page gained a set of coverage visualisations:

• A coverage timeline chart with a blind-spots gap finder.
• Cross-catalog vulnerability search.
• Click-to-filter on the UpSet plot columns, plus a mean lead-time and same-day caption.
• First-listed/last-updated sort toggles on the coverage table and catalog pages.
• Catalog licence badges, and vendor/product shown in the coverage table.

2FA recovery codes

Accounts protected with two-factor authentication can now generate recovery codes for account recovery, and the profile page was restructured into themed cards (#435).

Favorite feed

Users can pick a favorite feed used as the default source on the recent vulnerabilities page, and toggle it directly from that page.

Readable RSS/Atom feeds

RSS/Atom feeds now render as readable pages when opened in a browser: server-side rendering via content negotiation, KEV Atom content emitted as XHTML, and the XSL stylesheet made XSLT 1.0 compatible and served as application/xslt+xml so Chromium-based browsers apply it.

API improvements

• Enrichment flags on the bulk vulnerability endpoint.
• CORS headers on /api endpoints for browser-based access.
• KEV entries resolvable by (origin_uuid, vulnId) for PUT/DELETE.

Other new features

• Sightings — Accept more vulnerability identifier patterns: CVE-UNASSIGNED, OpenVAS, SSV, Exploit-DB (EDB) and China National Vulnerability Database (CNVD).
• Performance — pg_trgm GIN indexes for sighting source/vulnerability search, with the author lookup split into a UNION leg so the indexes actually apply. Contributed by @DevamShah in #431 (#440).
• UI — Filtering, sorting and search on the CNA publications and vulnerability disclosures lists.

Changes

• EUVD — Added the EUVD ID data model and Kvrocks key conventions. Contributed by @archakisn in #452.
• UI — Continued the UI refresh: the About and About-this-instance pages, a soft azure underglow on the home hero signal line, Choices.js widgets themed with the design tokens, and a themed vendor autocomplete for the navbar search.
• Templates — Recent vulnerabilities page polish: a shortcut button to the local instance source, a link to the current source's recent vulnerabilities in the generic CSAF view, and vulnerability identifiers displayed in uppercase in the disclosures list.
• Configuration — Added unicode icons to the source names in SOURCES_TO_SHOW.
• Documentation — Improved the README, added documentation for running a minimal publication instance (#456), and documented the KEV catalog email subscriptions.
• Dependencies — Updated Python dependencies and bumped the pinned GitHub Actions.

Fixes

• API — GET /api/vulnerability/recent without a source again returns the most recent entries across all sources (the global index), consistent with /api/vulnerability/last and with the documented behavior. Since 3.0.0 (February 2026) it silently defaulted to the cvelistv5 source only; clients that came to rely on that must now pass source=cvelistv5 explicitly.
• Search — A vendor-only search now spans all sources instead of only cvelistv5, and a known-vendor query takes precedence over the linked-vulnerabilities fallback (#432).
• Notifications — Widened the notification query window and deduplicated already-sent notifications, so entries indexed with a source-side lastModified older than the wall-clock window are no longer silently skipped; the nvd source is now included and results are deduplicated across sources (#449).
• API — KEV endpoint hardening: BCP-07 conformant output, a unique tiebreaker in the list ordering so pagination no longer yields duplicate entries on tie-heavy sorts, unhandled 500 responses marked as no-store, and PUT now only moves first_seen_at/asserted_at backwards (#453).
• API — Sighting creation timestamps are set server-side, ILIKE wildcards are escaped in search filters, and the updated date sort uses the correct index key.
• Statistics — Current-year charts stop at the current month, bogus delta labels for unfinished months are suppressed (#433), and the selected multi-year window is preserved when switching sources (#436).
• Feeds — Aligned the recent feed sort order and timestamps with the /recent page (#443).
• KEV — UpSet plot rendering: widened the set-label gutter so long catalog names fit, reserved a numeric lane so totals are not clipped, and clarified the total vs exact-slice reading of the plot.
• UI — Stripped global-chrome bleed from the vulnogram editor and corrected its dialog button layout; aligned navbar link tooltips with their labels; showed the public Vulnerability Disclosures link to logged-in users; made vulnerability IDs clickable in the admin disclosures view (#438).
• Users — Avoided an N+1 query in the user directory and made the DB pool resilient.
• Docker — Read the PostgreSQL URI from website.py to avoid importing psycopg2.

Changelog

📂 For the full list of changes, check the GitHub release:
https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v5.3.0

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
https://social.circl.lu/@vulnerability_lookup/

Introduction

This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform's community.

It highlights the most frequently sighted vulnerabilities for June 2026, based on data aggregated from Vulnerability-Lookup, the CISA Known Exploited Vulnerabilities catalog, the CIRCL KEV catalog, the ENISA EUVD feed, honeypot observations from The Shadowserver Foundation, and contributor comments and bundles. Sightings come from MISP, Exploit-DB, Bluesky, Mastodon, Telegram, GitHub Gists, Nuclei, SPLOITUS, Metasploit, and more. For further details, please visit this page.

New in this report: the Shadowserver KEV catalog, built from honeypot-observed exploitation attempts, makes its first appearance in our monthly reports. A big thank you to The Shadowserver Foundation for making this data available to the community.

June's threat landscape was dominated by actively exploited flaws in enterprise infrastructure: remote-access and management software, network appliances, and identity-adjacent services. Nine of the ten most sighted vulnerabilities of the month are listed in the CISA KEV catalog (eight of them added during June), a strong signal that sighting activity closely tracked in-the-wild exploitation.

The Month at a Glance

7,454 CVEs were published in June 2026 (from the CVE List v5 source alone), up from 6,953 in May -- a 14.5% month-over-month increase and the highest monthly volume of the year so far. On top of that, Vulnerability-Lookup ingested 7,315 GitHub security advisories and 745 PySec advisories over the same period.

Vulnerability-Lookup collected 27,251 sightings during June 2026, including 18,123 "seen" observations, 8,542 exploitation-related sightings, and 71 "confirmed" sightings (mostly newly published Nuclei detection templates). No "patched" or "proof of concept" type sightings were recorded this month. Across the monitored KEV catalogs, 23 entries were added by CISA, 4 by CIRCL, 1 was reported through the ENISA / EU CSIRTs Network feed, and 6 new vulnerabilities appeared in The Shadowserver Foundation's honeypot-observed exploitation feed.

The most sighted vulnerability of the month was CVE-2026-35273, a missing-authentication flaw in Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management), added to the CISA KEV catalog on June 12 with known ransomware campaign use -- the only entry of the month with that flag.

Cisco had a particularly rough month, with three KEV-listed issues: an unauthenticated SSRF in Unified Communications Manager (CVE-2026-20230), a privilege escalation in Catalyst SD-WAN Controller (CVE-2026-20245) and a path traversal in Catalyst SD-WAN Manager (CVE-2026-20262) -- the SD-WAN line remaining a target for the second month in a row after May's Emergency-Directive flaw. Remote-access and remote-management tooling was the other clear cluster: unauthenticated root-level command injection in Ivanti Sentry (CVE-2026-10520, also observed against Shadowserver honeypots), an OIDC authentication bypass in SimpleHelp (CVE-2026-48558), an IKEv1 authentication bypass in Check Point Security Gateway (CVE-2026-50751, confirmed exploited by Check Point), and a pre-authentication RCE in BeyondTrust Remote Support / Privileged Remote Access (CVE-2026-1731) reported by NCSC-FI through the ENISA CNW feed.

Other notable KEV additions include a trio of Ubiquiti UniFi OS flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) added the same day, an unauthenticated arbitrary file creation/truncation in Splunk Enterprise via a PostgreSQL sidecar endpoint (CVE-2026-20253), and -- for the second month running -- an AI-stack entry, with a command injection in BerriAI LiteLLM (CVE-2026-42271) following May's LiteLLM SQL injection. On the client side, both Google Chrome (V8) (CVE-2026-11645) and Android Framework (CVE-2025-48595) were KEV-listed and appeared in the top 10. The high-sighting Windows Netlogon stack-based buffer overflow (CVE-2026-41089) rounded out the picture, and CISA also re-anchored legacy issues -- the Linux kernel cgroups v1 container-escape CVE-2022-0492 and Oracle WebLogic CVE-2024-21182 -- while Shadowserver honeypots still registered attacks against the 2017 HP iLO 4 authentication bypass (CVE-2017-12542).

Across the month's KEV additions, the dominant weakness patterns were missing authentication for critical functions (CWE-306: PeopleSoft, Splunk), authentication bypass and improper authentication (CWE-287/CWE-294: SimpleHelp, Check Point, PAN-OS GlobalProtect), OS command and code injection (CWE-77/78/94: Ivanti Sentry, Lantronix EDS5000, LiteLLM), path traversal (CWE-22: Ubiquiti UniFi OS, Cisco SD-WAN Manager, FortiSandbox), server-side request forgery (CWE-918: Cisco Unified CM), and memory corruption in widely deployed client software (CWE-787/CWE-190: Windows Netlogon, Chrome V8, Android Framework). In overall published volume, cross-site scripting (CWE-79) and SQL injection (CWE-89) once again topped the monthly CWE ranking (see the Top 10 Weaknesses chart below).

Top 10 Vendors of the Month

Top 10 Assigners of the Month

Top 10 Vulnerabilities of the Month

Vulnerability	Sighting Count	Vendor	Product	VLAI Severity
CVE-2026-35273	192	Oracle	PeopleSoft Enterprise PeopleTools	Critical (confidence: 0.9967)
CVE-2026-20245	183	Cisco	Catalyst SD-WAN Controller	High (confidence: 0.9894)
CVE-2026-50751	139	Check Point	Quantum Security Gateway	Critical (confidence: 0.7947)
CVE-2026-20230	138	Cisco	Unified Communications Manager	High (confidence: 0.6151)
CVE-2026-0257	125	Palo Alto Networks	PAN-OS (GlobalProtect)	Medium (confidence: 0.9371)
CVE-2026-20253	119	Splunk	Splunk Enterprise	Critical (confidence: 0.9624)
CVE-2026-41089	101	Microsoft	Windows (Netlogon)	Critical (confidence: 0.9326)
CVE-2026-10520	100	Ivanti	Sentry	Critical (confidence: 0.9849)
CVE-2025-48595	97	Google	Android (Framework)	High (confidence: 0.9277)
CVE-2026-11645	91	Google	Chrome (V8)	High (confidence: 0.9938)

Known Exploited Vulnerabilities

New entries have been added to the major Known Exploited Vulnerabilities catalogs during June.

Catalog coverage

30 distinct vulnerabilities entered at least one of the tracked KEV catalogs during June. The matrix below shows, for each of them, which catalogs cover it (as of publication) -- built with the new KEV catalog coverage feature of Vulnerability-Lookup. The KEVIntel catalog, the highest-volume of the tracked feeds with 335 new entries in June alone, covers 28 of the 30; conversely, two entries (HP iLO 4 and the MeiG router) are visible only through Shadowserver's honeypots, and the Ivanti Sentry command injection is the only vulnerability of the month present in four catalogs at once.

Vulnerability	First added	CISA	CIRCL	ENISA	KEVIntel	Shadowserver
CVE-2017-12542	2026-06-30					✓
CVE-2026-48558	2026-06-29	✓			✓
CVE-2026-20230	2026-06-25	✓			✓
CVE-2026-12569	2026-06-25	✓			✓
CVE-2026-34910	2026-06-23	✓			✓
CVE-2026-34909	2026-06-23	✓			✓
CVE-2026-34908	2026-06-23	✓			✓
CVE-2025-67038	2026-06-23	✓			✓
CVE-2026-39813	2026-06-22		✓		✓
CVE-2026-36356	2026-06-21					✓
CVE-2026-20253	2026-06-18	✓			✓
CVE-2026-48907	2026-06-16	✓			✓
CVE-2026-54420	2026-06-15	✓			✓
CVE-2026-20262	2026-06-15	✓			✓
CVE-2026-35273	2026-06-12	✓			✓
CVE-2026-10520	2026-06-10	✓	✓		✓	✓
CVE-2026-7473	2026-06-09	✓			✓
CVE-2026-20245	2026-06-09	✓	✓		✓
CVE-2026-11645	2026-06-09	✓			✓
CVE-2026-50751	2026-06-08	✓	✓		✓
CVE-2026-42271	2026-06-08	✓			✓
CVE-2026-24423	2026-06-08	✓			✓	✓
CVE-2024-8522	2026-06-08				✓	✓
CVE-2025-34033	2026-06-07				✓	✓
CVE-2026-28318	2026-06-05	✓			✓
CVE-2026-1731	2026-06-04	✓		✓	✓
CVE-2026-45247	2026-06-03	✓			✓
CVE-2025-48595	2026-06-02	✓			✓
CVE-2022-0492	2026-06-02	✓			✓
CVE-2024-21182	2026-06-01	✓			✓

CISA

The CISA KEV catalog added 23 entries in June. The Oracle PeopleSoft entry is flagged with known ransomware campaign use.

CVE ID	Date Added	Vendor	Product	VLAI Severity
CVE-2026-48558	2026-06-29	SimpleHelp	SimpleHelp	Critical (confidence: 0.9723)
CVE-2026-12569	2026-06-25	PTC	Windchill and FlexPLM	Critical (confidence: 0.9946)
CVE-2026-20230	2026-06-25	Cisco	Unified Communications Manager	High (confidence: 0.6151)
CVE-2025-67038	2026-06-23	Lantronix	EDS5000	Critical (confidence: 0.9956)
CVE-2026-34908	2026-06-23	Ubiquiti	UniFi OS	Critical (confidence: 0.9784)
CVE-2026-34909	2026-06-23	Ubiquiti	UniFi OS	Critical (confidence: 0.9783)
CVE-2026-34910	2026-06-23	Ubiquiti	UniFi OS	Critical (confidence: 0.9642)
CVE-2026-20253	2026-06-18	Splunk	Splunk Enterprise	Critical (confidence: 0.9624)
CVE-2026-48907	2026-06-16	Widget Factory	Joomla Content Editor (JCE)	Critical (confidence: 0.993)
CVE-2026-54420	2026-06-15	LiteSpeed	cPanel Plugin	High (confidence: 0.9896)
CVE-2026-20262	2026-06-15	Cisco	Catalyst SD-WAN Manager	Medium (confidence: 0.7478)
CVE-2026-35273	2026-06-12	Oracle	PeopleSoft Enterprise PeopleTools	Critical (confidence: 0.9967)
CVE-2026-10520	2026-06-11	Ivanti	Sentry	Critical (confidence: 0.9849)
CVE-2026-20245	2026-06-09	Cisco	Catalyst SD-WAN Controller	High (confidence: 0.9894)
CVE-2026-7473	2026-06-09	Arista	Extensible Operating System (EOS)	Medium (confidence: 0.5082)
CVE-2026-11645	2026-06-09	Google	Chromium V8	High (confidence: 0.9938)
CVE-2026-42271	2026-06-08	BerriAI	LiteLLM	High (confidence: 0.6121)
CVE-2026-50751	2026-06-08	Check Point	Security Gateway	Critical (confidence: 0.7947)
CVE-2026-28318	2026-06-05	SolarWinds	Serv-U	High (confidence: 0.9813)
CVE-2026-45247	2026-06-03	Mirasvit	Full Page Cache Warmer (Magento 2)	Critical (confidence: 0.9944)
CVE-2025-48595	2026-06-02	Google	Android Framework	High (confidence: 0.9277)
CVE-2022-0492	2026-06-02	Linux	Kernel (cgroups v1)	High (confidence: 0.9381)
CVE-2024-21182	2026-06-01	Oracle	WebLogic Server	High (confidence: 0.9972)

More KEV entries from the CISA Catalog.

CIRCL

The CIRCL KEV catalog added 4 entries during June. The Check Point IKEv1 authentication bypass was confirmed on the basis of Check Point's own report of active exploitation in the wild; the Cisco SD-WAN and Ivanti Sentry entries are marked as suspected exploitation.

CVE ID	Date Added	Vendor	Product	VLAI Severity
CVE-2026-20245	2026-06-25	Cisco	Catalyst SD-WAN Controller	High (confidence: 0.9894)
CVE-2026-39813	2026-06-22	Fortinet	FortiSandbox	Critical (confidence: 0.8265)
CVE-2026-10520	2026-06-12	Ivanti	Sentry	Critical (confidence: 0.9849)
CVE-2026-50751	2026-06-08	Check Point	Quantum Security Gateway	Critical (confidence: 0.7947)

More KEV entries from the CIRCL Catalog.

ENISA (EUVD)

A single new entry was reported through the ENISA / EU CSIRTs Network (CNW) KEV feed during June: a critical pre-authentication remote code execution in BeyondTrust Remote Support and Privileged Remote Access, reported by NCSC-FI.

CVE ID	Date Reported	Vendor	Product	VLAI Severity
CVE-2026-1731	2026-06-04	BeyondTrust	Remote Support (RS) / Privileged Remote Access (PRA)	Critical (confidence: 0.9813)

More KEV entries from the ENISA Catalog.

The Shadowserver Foundation

The Shadowserver KEV catalog is fed by honeypot-observed exploitation attempts. 6 vulnerabilities were observed for the first time during June, two of which are also in the CISA KEV catalog. Notably, the 2017 HP iLO 4 authentication bypass was still drawing attack traffic at the very end of the month.

CVE ID	First Seen	Vendor	Product	Severity (Shadowserver)
CVE-2017-12542	2026-06-30	HP	HP iLO 4	Critical (CVSS 10.0)
CVE-2026-36356	2026-06-21	MeiG	Smart FORGE_SLT711	Critical (CVSS 9.1)
CVE-2026-10520	2026-06-10	Ivanti	Sentry	Critical (CVSS 10.0)
CVE-2026-24423	2026-06-08	SmarterTools	SmarterMail	Critical (CVSS 9.8)
CVE-2024-8522	2026-06-08	WordPress	LearnPress plugin	High (CVSS 7.5)
CVE-2025-34033	2026-06-07	5VTechnologies	Blue Angel Software Suite	--

More KEV entries from the Shadowserver Catalog.

Top 10 Weaknesses of the Month

Insights from Contributors

Community contributions in June ranged from data-quality improvements to supply-chain research:

• Impact of MISP.disableUserSelfManagement on exploitability -- a practical exploitability note on GCVE-1-2026-20092 explaining that when MISP.disableUserSelfManagement is enabled on a MISP instance, non-admin users cannot reach the vulnerable endpoint -- a useful triage criterion for instance operators.
• CPE is missing -- a data-quality contribution on CVE-2021-35394, adding the correct Realtek Jungle SDK CPE identifier via the GCVE CPE registry.
• Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack -- a pointer to an academic analysis of CVE-2024-3094, reconstructing how the XZ Utils attackers manipulated the open-source development process itself -- community management, CI/CD configuration, and infrastructure contributions -- to plant and maintain a backdoor.

Contributors also curated vendor advisories into bundles during June:

• Remote Code Execution and Cross-Site Scripting in pgAdmin 4 | CCB Belgium (3 CVEs) -- pgAdmin 4 before 9.16 can be exploited to execute arbitrary commands and exfiltrate database credentials.
• Security Advisory Ivanti Sentry (2 CVEs) -- grouping the KEV-listed root-level command injection CVE-2026-10520 with CVE-2026-10523.
• NEWS for rsync 3.4.3 (7 CVEs) -- six new CVEs fixed in rsync 3.4.3, two of them reachable from a normal pull or an authenticated daemon connection.

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

Funding

The main objective of Federated European Team for Threat Analysis (FETTA) is improvement of Cyber Threat Intelligence (CTI) products available to the public and private sector in Poland, Luxembourg, and the European Union as a whole.
Developing actionable CTI products (reports, indicators, etc) is a complex task and requires an in-depth understanding of the threat landscape and the ability to analyse and interpret large amounts of data. Many SOCs and CSIRTs build their capabilities in this area independently, leading to a fragmented approach and duplication of work.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. The organization brings to the table its extensive experience in cybersecurity incident management, threat intelligence, and proactive response strategies. With a strong background in developing innovative open source cybersecurity tools and solutions, CIRCL's contribution to the FETTA project is instrumental in achieving enhanced collaboration and intelligence sharing across Europe.

Press release

Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities.

Although the family's current activity level and influence in DDoS attacks are not yet comparable to some mainstream botnets, its speed of technological evolution deserves significant attention. Research has found that the family is undergoing a comprehensive technological transition from C to Rust, and its anti-defense and traffic encryption techniques are also iterating rapidly. Based on the shift of its technology stack from C to Rust and the characteristic of early core payloads encrypting three duckdns C2 domains, we have named it RustDuck.

In terms of sample propagation, the spread chain of this family mainly covers IoT devices, web applications, and enterprise infrastructure. The attack methods primarily involve weak password brute-forcing (Telnet/SSH) and the exploitation of various RCE vulnerabilities, including device vulnerabilities in Android ADB, TVT API, Ruijie, TP-Link, ZTE, and others, as well as web/component vulnerabilities such as ThinkPHP, Jenkins, YARN. It also combines several historical CVEs (CVE-2025-29635, CVE-2017-17215, CVE-2018-8007, CVE-2024-1781) to expand the attack surface. Overall, it presents a combined propagation characteristic of "weak passwords + IoT vulnerabilities + Web RCE", capable of covering routers, cameras, Android terminals, and server environments, enabling large-scale automated intrusion and payload delivery. Currently, over 20 IPs have been observed participating in spreading the RustDuck botnet, with the most active implant source IP being: 176.65.139[.]204

We are excited to share the result of a fruitful collaboration with The Shadowserver Foundation: a new Known Exploited Vulnerabilities (KEV) Catalog (BCP-07 compliant) built directly from their global honeypot telemetry.

Most KEV catalogs tell you what is being exploited. This one is grounded in observed exploitation attempts captured across Shadowserver's worldwide honeypot sensor network. When a vulnerability is exploited against one of their honeypots, it becomes an attributable, structured GCVE-EU BCP-07 KEV assertion, complete with evidence typing (honeypot), exploitation signals (in_the_wild_attempts), and timestamps indicating when exploitation was first and last observed.

A huge thank-you to the Shadowserver team, and especially to Piotr Kijewski, for their support and collaboration.

Vulnerability-Lookup now provides a coverage matrix on its KEV catalogs page, showing which Known Exploited Vulnerability catalogs (e.g. EUVD KEV, CISA KEV, CIRCL KEV) reference the most recently updated vulnerabilities. Each row corresponds to a vulnerability and each column to a catalog, making it straightforward to identify overlaps and gaps between KEV sources. All catalogs follow the GCVE-BCP-07 standard for documenting actively exploited vulnerabilities.

The coverage matrix is available at:

https://vulnerability.circl.lu/kev-catalogs

If a Vulnerability-Lookup instance is pulling more KEV catalogs, more columns will be automatically shown in the table.