Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 8 to 14 June 2026 (week 24)
Final report, published . It does not change.
In the week of 8 to 14 June 2026, 7 vulnerabilities were newly recorded as exploited in the wild, 7 of them critical. The technology hit most was Arista EOS (1), followed by Berriai LiteLLM (1) and Check Point Mobile Access VPN (1).
- Newly exploited
- 7
- Critical
- 7
- Technologies hit
- 13
Newly exploited this week
- CVE-2026-35273: Oracle PeopleSoft PeopleTools compromise in Updates Environment ManagementcriticalCVSS 9.8Exploited since Published Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-10520: Ivanti Sentry OS command injection allows remote code executioncriticalCVSS 10Exploited since Published Ivanti Sentry
- CVE-2026-11645: Google Chrome V8 out of bounds read and writecriticalCVSS 8.8Exploited since Published Google Chrome, Google Chromium V8, Microsoft Edge
- CVE-2026-7473: Arista EOS improper tunnel protocol verification in decapsulationcriticalCVSS 5.8Exploited since Published Arista EOS, Arista EOS
- CVE-2026-20245: Cisco Catalyst SD-WAN Manager privilege escalation in CLIcriticalCVSS 7.8Exploited since Published Cisco Catalyst SD-WAN Manager
- CVE-2026-50751: Check Point VPN authentication bypass in IKEv1 key exchangecriticalCVSS 9.8Exploited since Published Check Point Mobile Access VPN, Check Point Remote Access VPN, Check Point Security Gateway
- CVE-2026-42271: BerriAI LiteLLM OS command injection in MCP test endpointscriticalCVSS 8.8Exploited since Published Berriai LiteLLM, litellm (PyPI)
Technologies hit most
- 1.Arista EOS1 vulnerability
- 2.Berriai LiteLLM1 vulnerability
- 3.Check Point Mobile Access VPN1 vulnerability
- 4.Check Point Remote Access VPN1 vulnerability
- 5.Check Point Security Gateway1 vulnerability
- 6.Cisco Catalyst SD-WAN Manager1 vulnerability
- 7.Google Chrome1 vulnerability
- 8.Google Chromium V81 vulnerability
- 9.Ivanti Sentry1 vulnerability
- 10.litellm (PyPI)1 vulnerability
- 11.Microsoft Edge1 vulnerability
- 12.Opera Software Opera-Browser1 vulnerability
- 13.Oracle PeopleSoft Enterprise PeopleTools1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-06-08.json, and this page as text at https://junglewise.ai/threats/exploited/2026-06-08.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 8 to 14 June 2026 (week 24)", https://junglewise.ai/threats/exploited/2026-06-08, 2 October 2026.