Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 1 to 7 June 2026 (week 23)
Final report, published . It does not change.
In the week of 1 to 7 June 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Android Laravel Framework (1), followed by Google Android Framework (1) and Linux Kernel (1).
- Newly exploited
- 6
- Critical
- 6
- Technologies hit
- 7
Newly exploited this week
- CVE-2026-28318: SolarWinds Serv-U denial of service via crafted POST requestcriticalCVSS 7.5Exploited since Published SolarWinds Serv-U
- CVE-2010-0249: Microsoft Internet Explorer use-after-free in HTML object handlingcriticalCVSS 9.3Exploited since Published Microsoft Internet Explorer
- CVE-2026-45247: Mirasvit Full Page Cache Warmer PHP object injection in cookiecriticalCVSS 9.8Exploited since Published Mirasvit Full Page Cache Warmer, Mirasvit Full Page Cache Warmer
- CVE-2022-0492: Linux Kernel privilege escalation in cgroups v1 release_agentcriticalCVSS 7.8Exploited since Published Linux Kernel
- CVE-2025-48595: Google Android Framework privilege escalation via integer overflowcriticalCVSS 7.8Exploited since Published Google Android Framework, Android Laravel Framework
- CVE-2024-21182: Oracle WebLogic Server unspecified vulnerability in Core componentcriticalCVSS 7.5Exploited since Published Oracle WebLogic Server
Technologies hit most
- 1.Android Laravel Framework1 vulnerability
- 2.Google Android Framework1 vulnerability
- 3.Linux Kernel1 vulnerability
- 4.Microsoft Internet Explorer1 vulnerability
- 5.Mirasvit Full Page Cache Warmer1 vulnerability
- 6.Oracle WebLogic Server1 vulnerability
- 7.SolarWinds Serv-U1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-06-01.json, and this page as text at https://junglewise.ai/threats/exploited/2026-06-01.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 1 to 7 June 2026 (week 23)", https://junglewise.ai/threats/exploited/2026-06-01, 2 October 2026.