14 vulnerabilities across 11 products scored HIGH or above on June 18, 2026.

  • 🟠 HIGH: 14

🟠 [HIGH] getkirby/cms

3 CVEs | CVSS 3.1: 9.5 | AAS 11.8

  • cpe:2.3:a:getkirby:cms:*:*:*:*:*:*:*:*

Kirby CMS by getkirby is affected by three vulnerabilities, including at least one rated HIGH severity with a CVSS score of 9.5. The most critical issue allows remote attackers to complete the Panel installation process and create an admin account on sites that have no configured users and sit behind a reverse proxy setting certain forwarded-for headers. Security teams managing Kirby CMS deployments, particularly those exposed to the internet behind reverse proxies, should review the vendor advisory at the linked GitHub Security Advisory and apply available patches immediately.

Vendor Advisory

🟠 [HIGH] github.com/docker/mcp-gateway

1 CVE | CVSS 3.1: 8.0 | AAS 11.8

  • cpe:2.3:a:github.com:docker_mcp-gateway:*:*:*:*:*:*:*:*

Docker MCP Gateway is affected by a HIGH severity vulnerability with a CVSS score of 8.0 that allows an attacker controlling a malicious OCI image to inject arbitrary arguments into the docker run command line, potentially mounting the host filesystem, escalating to root, and achieving full host compromise. This issue is considered exploitable, making it an immediate concern for any team using MCP Gateway to pull or run container images from untrusted or third-party sources. Administrators should review the vendor advisory at the linked GitHub Security Advisory, restrict image sources to trusted registries, and apply patches as soon as they are available.

Vendor Advisory

🟠 [HIGH] haproxy/haproxy

2 CVEs | CVSS 4.0: 9.0 | AAS 11.3

  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* (< 3.4.1)

HAProxy versions through 3.4.0 are affected by two vulnerabilities, including at least one rated HIGH severity with a CVSS score of 9.0. The most severe issue involves an integer overflow in the FastCGI connection parser that allows a malicious FastCGI backend to desynchronize FCGI framing, potentially leading to request routing errors, response smuggling, or memory safety issues. Organizations running HAProxy with FastCGI backends should update to a patched version beyond 3.4.0 and review the referenced commit for details.

Vendor Advisory

🟠 [HIGH] webmin/webmin

1 CVE | CVSS 4.0: 9.2 | AAS 11.2

  • cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*

Webmin’s built-in HTTP server (miniserv.pl) is affected by a HIGH severity authentication bypass vulnerability with a CVSS score of 9.2 that allows unauthenticated remote attackers to impersonate any user configured with an SSL client certificate by forging an HTTP header containing a spoofed certificate DN. This is a critical concern for any organization exposing Webmin to the network, as it requires no credentials and can grant full administrative access. Administrators should upgrade to Webmin 2.641 or later immediately and review access logs for signs of unauthorized authentication.

Vendor Advisory

🟠 [HIGH] ffmpeg/ffmpeg

1 CVE | CVSS 3.1: 8.8 | AAS 10.6

  • cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

FFmpeg versions prior to 8.1.2 are affected by a HIGH severity out-of-bounds write vulnerability in the MagicYUV decoder within libavcodec, with a CVSS score of 8.8. This issue is considered exploitable and can lead to denial of service or potentially remote code execution when processing crafted media files, making it a concern for any system or application that uses FFmpeg for media decoding. Teams should upgrade to FFmpeg 8.1.2 or later as soon as possible and review the vendor pull request for additional details.

Vendor Advisory

🟠 [HIGH] pip/jupyter-server

1 CVE | CVSS 3.1: 9.5 | AAS 10.6

  • cpe:2.3:a:pip:jupyter-server:*:*:*:*:*:*:*:*

Jupyter Server is affected by a HIGH severity stored cross-site scripting vulnerability with a CVSS score of 9.5, where the nbconvert HTML handler renders user-authored notebook content under the Jupyter origin without proper Content-Security-Policy sandbox directives. This issue is considered exploitable and allows an attacker who can plant a malicious notebook to achieve cookie theft, full Jupyter API access, and remote code execution via kernel control when an authenticated user views the converted HTML output. Organizations running Jupyter Server should review the vendor advisory at the linked GitHub Security Advisory, apply available patches immediately, and restrict access to untrusted notebooks.

Vendor Advisory

🟠 [HIGH] deepstreamio/deepstream.io

1 CVE | CVSS 3.1: 9.9 | AAS 10.2

  • cpe:2.3:a:deepstreamio:deepstream.io:*:*:*:*:*:*:*:* (< 10.0.5)

deepstream.io versions prior to 10.0.5 are affected by a HIGH severity prototype pollution vulnerability with a CVSS score of 9.9, which allows any authenticated user with write permission to any record to potentially escalate privileges on the server. This issue is considered exploitable and poses a serious risk to any deployment where untrusted or low-privilege users have record write access. Teams running deepstream.io should upgrade to version 10.0.5 or later immediately and review the vendor advisory for further guidance.

Vendor Advisory

🟠 [HIGH] microsoft/microsoft_365_copilot

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:microsoft:microsoft_365_copilot:*:*:*:*:*:*:*:*

Microsoft 365 Copilot is affected by a HIGH severity vulnerability with a CVSS score of 9.8 involving missing authentication on a critical function, which allows an unauthorized attacker to disclose sensitive information over the network without any credentials. This is a significant concern for any organization using Microsoft 365 Copilot, as the attack requires no authentication and is network-exploitable. Administrators should review the Microsoft Security Response Center advisory immediately and apply any available mitigations or updates provided by Microsoft.

Vendor Advisory

🟠 [HIGH] open-webui/open-webui

1 CVE | CVSS 3.1: 7.7 | AAS 9.5

  • cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*

Open WebUI versions prior to 0.9.6 are affected by a HIGH severity path traversal vulnerability with a CVSS score of 7.7 in the terminal-server reverse proxy, where an authenticated user with terminal server access can craft encoded directory traversal sequences to escape the intended path scope and reach unauthorized endpoints on the backend terminal server. This issue is considered exploitable and is relevant to any organization self-hosting Open WebUI with the terminal server feature enabled. Teams should upgrade to Open WebUI version 0.9.6 or later and review the vendor advisory at the linked GitHub Security Advisory for additional details.

Vendor Advisory

🟠 [HIGH] google/android

1 CVE | CVSS 4.0: 10.0 | AAS 9.4

  • cpe:2.3:a:google:android:*:*:*:*:*:*:*:*

Google Android versions 14 and 16 are affected by a HIGH severity vulnerability with a CVSS score of 10.0 involving a missing permission check in AndroidManifest.xml that allows persistent local denial of service without requiring any additional privileges or user interaction. This issue is particularly relevant to organizations managing Wear OS devices, as it is addressed in the June 2026 Android Wear security bulletin. Device administrators should apply the latest security patches from Google and review the vendor advisory for affected component details.

Vendor Advisory

🟠 [HIGH] microsoft/microsoft_dynamics_365

1 CVE | CVSS 3.1: 9.9 | AAS 9.2

  • cpe:2.3:a:microsoft:microsoft_dynamics_365:*:*:*:*:*:*:*:*

Microsoft Dynamics 365 is affected by a HIGH severity improper access control vulnerability with a CVSS score of 9.9 that allows an authorized attacker to escalate privileges over the network. Given the near-maximum severity rating, this is a critical concern for any organization running Dynamics 365, as even a low-privilege authenticated user could potentially gain elevated access across the environment. Administrators should review the Microsoft Security Response Center advisory immediately and apply all recommended patches or mitigations.

Vendor Advisory