# Newly exploited vulnerabilities: week of 1 to 7 June 2026 (week 23)

Source: https://junglewise.ai/threats/exploited/2026-06-01  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 20:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-06-01.json  
License: CC BY 4.0 with a link back

In the week of 1 to 7 June 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Android Laravel Framework (1), followed by Google Android Framework (1) and Linux Kernel (1).

## Newly exploited this week

- [CVE-2026-28318: SolarWinds Serv-U denial of service via crafted POST request](https://junglewise.ai/threats/cve-2026-28318-solarwinds-serv-u-denial-of-service-via-crafted-post-request) (critical, exploited in the wild, CVSS 7.5, exploited since 5 Jun 2026, published 4 Jun 2026)
- [CVE-2010-0249: Microsoft Internet Explorer use-after-free in HTML object handling](https://junglewise.ai/threats/cve-2010-0249-microsoft-internet-explorer-use-after-free-in-html-object-handling) (critical, exploited in the wild, CVSS 9.3, exploited since 3 Jun 2026, published 3 Jun 2026)
- [CVE-2026-45247: Mirasvit Full Page Cache Warmer PHP object injection in cookie](https://junglewise.ai/threats/cve-2026-45247-mirasvit-full-page-cache-warmer-php-object-injection-in-cookie) (critical, exploited in the wild, CVSS 9.8, exploited since 3 Jun 2026, published 26 May 2026)
- [CVE-2022-0492: Linux Kernel privilege escalation in cgroups v1 release_agent](https://junglewise.ai/threats/cve-2022-0492-linux-kernel-privilege-escalation-in-cgroups-v1-release-agent) (critical, exploited in the wild, CVSS 7.8, exploited since 2 Jun 2026, published 2 Jun 2026)
- [CVE-2025-48595: Google Android Framework privilege escalation via integer overflow](https://junglewise.ai/threats/cve-2025-48595-google-android-framework-privilege-escalation-via-integer) (critical, exploited in the wild, CVSS 7.8, exploited since 2 Jun 2026, published 1 Jun 2026)
- [CVE-2024-21182: Oracle WebLogic Server unspecified vulnerability in Core component](https://junglewise.ai/threats/cve-2024-21182-oracle-weblogic-server-unspecified-vulnerability-in-core) (critical, exploited in the wild, CVSS 7.5, exploited since 1 Jun 2026, published 1 Jun 2026)

## Technologies hit most

1. [Android Laravel Framework](https://junglewise.ai/threats/technologies/framework): 1 vulnerability
2. [Google Android Framework](https://junglewise.ai/threats/technologies/android-framework): 1 vulnerability
3. [Linux Kernel](https://junglewise.ai/threats/technologies/kernel): 1 vulnerability
4. [Microsoft Internet Explorer](https://junglewise.ai/threats/technologies/internet-explorer): 1 vulnerability
5. Mirasvit Full Page Cache Warmer: 1 vulnerability
6. [Oracle WebLogic Server](https://junglewise.ai/threats/technologies/weblogic-server): 1 vulnerability
7. [SolarWinds Serv-U](https://junglewise.ai/threats/technologies/serv-u): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 1 to 7 June 2026 (week 23)", https://junglewise.ai/threats/exploited/2026-06-01, 2 October 2026.