# june 2026 > markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt). ![drybrush poster for june 2026, painted from 7,949 published cves](https://media.cvegen.art/posters/2026-06/1280.jpg?v=71cdae6fd2) what the poster shows: 30 days as bands of dry brush, the first day at the top. 19 ran above the 2025 average for their weekday and sweep fast and wide; the other 11 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else. the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-06.mp4?v=1ce63506a1) | fact | value | | --- | --- | | cves | 7,949 | | against an average 2025 month | 2.0× | | busiest day | jun 9, 718 | | rated critical, cvss 9 or higher | 929 | | critical with no login and no click | 603 | | used in real attacks | 26 | ## june 2026 in numbers june 2026 brought 7,949 cves, 2.0 times an average 2025 month. 19 of its 30 days ran above the 2025 average for that weekday. - 718 on jun 9, the busiest day. - 929 rated critical, cvss 9 or higher. 603 of them can be hit over the network with no login and nothing for a user to click. - 1,057 in browsers, 23 times their 2025 monthly average. no other kind of software grew as fast. - 1,049 came in three single drops: chrome 427 on jun 4, chrome 382 on jun 30, oracle 240 on jun 16. ## 26 already used in real attacks cisa kev, as of oct 24. ### by product - 2 cisco catalyst sd-wan manager, jun 4, 15 - 1 android framework, jun 1 - 1 cisco unified communications manager, jun 3 - 1 progress loadmaster, jun 4 - 1 solarwinds serv-u, jun 4 - 1 arista extensible operating system, jun 5 - 1 widget factory joomla content editor, jun 5 - 1 check point security gateway, jun 8 - 1 google chromium v8, jun 8 - 1 fortinet fortisandbox, jun 9 - 1 ivanti sentry, jun 9 - 1 splunk enterprise, jun 10 - 1 oracle peoplesoft enterprise peopletools, jun 11 - 1 simplehelp, jun 12 - 1 litespeed cpanel plugin, jun 14 - 1 zyxel gs1900 series switches, jun 16 - 1 ptc windchill and flexplm, jun 18 - 1 icagenda, jun 20 - 1 joomshaper sp page builder, jun 20 - 1 langflow, jun 23 - 1 linux kernel, jun 25 - 1 kestra oss, jun 26 - 1 joomlack page builder, jun 29 - 1 adobe coldfusion, jun 30 - 1 citrix netscaler adc and netscaler gateway, jun 30 ### every cve - jun 1, android framework, [cve-2025-48595](https://www.cve.org/CVERecord?id=CVE-2025-48595) - jun 3, cisco unified communications manager, [cve-2026-20230](https://www.cve.org/CVERecord?id=CVE-2026-20230) - jun 4, cisco catalyst sd-wan manager, [cve-2026-20245](https://www.cve.org/CVERecord?id=CVE-2026-20245) - jun 4, solarwinds serv-u, [cve-2026-28318](https://www.cve.org/CVERecord?id=CVE-2026-28318) - jun 4, progress loadmaster, [cve-2026-8037](https://www.cve.org/CVERecord?id=CVE-2026-8037) - jun 5, widget factory joomla content editor, [cve-2026-48907](https://www.cve.org/CVERecord?id=CVE-2026-48907) - jun 5, arista extensible operating system, [cve-2026-7473](https://www.cve.org/CVERecord?id=CVE-2026-7473) - jun 8, google chromium v8, [cve-2026-11645](https://www.cve.org/CVERecord?id=CVE-2026-11645) - jun 8, check point security gateway, [cve-2026-50751](https://www.cve.org/CVERecord?id=CVE-2026-50751) - jun 9, ivanti sentry, [cve-2026-10520](https://www.cve.org/CVERecord?id=CVE-2026-10520) - jun 9, fortinet fortisandbox, [cve-2026-25089](https://www.cve.org/CVERecord?id=CVE-2026-25089) - jun 10, splunk enterprise, [cve-2026-20253](https://www.cve.org/CVERecord?id=CVE-2026-20253) - jun 11, oracle peoplesoft enterprise peopletools, [cve-2026-35273](https://www.cve.org/CVERecord?id=CVE-2026-35273) - jun 12, simplehelp simplehelp, [cve-2026-48558](https://www.cve.org/CVERecord?id=CVE-2026-48558) - jun 14, litespeed cpanel plugin, [cve-2026-54420](https://www.cve.org/CVERecord?id=CVE-2026-54420) - jun 15, cisco catalyst sd-wan manager, [cve-2026-20262](https://www.cve.org/CVERecord?id=CVE-2026-20262) - jun 16, zyxel gs1900 series switches, [cve-2026-7273](https://www.cve.org/CVERecord?id=CVE-2026-7273) - jun 18, ptc windchill and flexplm, [cve-2026-12569](https://www.cve.org/CVERecord?id=CVE-2026-12569) - jun 20, joomshaper sp page builder, [cve-2026-48908](https://www.cve.org/CVERecord?id=CVE-2026-48908) - jun 20, icagenda icagenda, [cve-2026-48939](https://www.cve.org/CVERecord?id=CVE-2026-48939) - jun 23, langflow langflow, [cve-2026-55255](https://www.cve.org/CVERecord?id=CVE-2026-55255) - jun 25, linux kernel, [cve-2026-53266](https://www.cve.org/CVERecord?id=CVE-2026-53266) - jun 26, kestra kestra oss, [cve-2026-49869](https://www.cve.org/CVERecord?id=CVE-2026-49869) - jun 29, joomlack page builder, [cve-2026-56290](https://www.cve.org/CVERecord?id=CVE-2026-56290) - jun 30, adobe coldfusion, [cve-2026-48282](https://www.cve.org/CVERecord?id=CVE-2026-48282) - jun 30, citrix netscaler adc and netscaler gateway, [cve-2026-8452](https://www.cve.org/CVERecord?id=CVE-2026-8452) cisa keeps adding older cves when attacks come to light, so this list can still grow. ## this poster | fact | value | | --- | --- | | period | june 1 to 30, 2026 | | cves | 7,949 | | data | cve list v5, cisa kev, drawn 2026-10-24 | | format | 3:4, drawn for 45 × 60 cm | [download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-06/2000.jpg?v=71cdae6fd2) ## other months - before: [may 2026](https://cvegen.art/2026/05.md), 6,933 cves - after: [july 2026](https://cvegen.art/2026/07.md), 9,759 cves - [all months](https://cvegen.art/index.md)