23 vulnerabilities across 14 products scored HIGH or above on June 22, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 22

🔴 [CRITICAL] phpoffice/phpspreadsheet

1 CVE | CVSS 4.0: 9.2 | AAS 12.5

  • cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*

PHPOffice PhpSpreadsheet, a widely used PHP library for reading and writing spreadsheet files, is affected by a critical severity vulnerability (CVE-2026-45034, CVSS 9.2) that bypasses a prior security fix for stream wrapper restrictions. An attacker can craft malicious file paths with additional slashes to evade the wrapper prohibition check, potentially enabling exploitation through dangerous PHP stream wrappers such as phar://, php://, or expect://. A functional exploit is available, making this an urgent priority for any team running applications that use PhpSpreadsheet to process user-supplied files.

Organizations using PhpSpreadsheet should upgrade to version 1.30.5 or later immediately and review the vendor advisory at the link above for additional mitigation guidance.

Vendor Advisory

🟠 [HIGH] jupyter-server/jupyter_server

1 CVE | CVSS 4.0: 9.3 | AAS 11.3

  • cpe:2.3:a:jupyter-server:jupyter_server:*:*:*:*:*:*:*:*

Jupyter Server versions prior to 2.20 are affected by a high severity vulnerability (CVE-2026-44727, CVSS 9.3) in the nbconvert HTTP handlers, which render user-authored notebook HTML under the Jupyter origin without adequate Content-Security-Policy sandboxing. An attacker who can get a malicious notebook opened on a shared Jupyter instance can achieve stored cross-site scripting with full cookie access, API authority, and remote code execution through the kernel. This vulnerability is considered exploitable and poses serious risk to any organization running multi-user or shared Jupyter deployments.

Administrators should upgrade Jupyter Server to version 2.20 or later immediately and review the vendor commit linked in the advisory for details on the fix.

Vendor Advisory

🟠 [HIGH] ibm/langflow_oss

2 CVEs | CVSS 3.1: 10.0 | AAS 11.2

  • cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*

IBM Langflow OSS versions 1.0.0 through 1.9.3 are affected by two high severity vulnerabilities, including at least one rated CVSS 10.0, that chain an authentication bypass with improper isolation of Python execution. An unauthenticated remote attacker can exploit these flaws to execute arbitrary code on the host system, resulting in complete compromise without any credentials or user interaction. These vulnerabilities are considered exploitable and represent an immediate risk to any organization running exposed Langflow instances.

Administrators should consult the IBM support advisory and upgrade to a patched version as soon as possible, prioritizing any internet-facing deployments.

Vendor Advisory

🟠 [HIGH] jdx/mise

1 CVE | CVSS 3.1: 9.6 | AAS 10.9

  • cpe:2.3:a:jdx:mise:*:*:*:*:*:*:*:* (< 2025.2.6)

Mise, a developer toolchain version manager, is affected by a high severity vulnerability (CVE-2026-33646, CVSS 9.6) in which .tool-versions files are processed through the Tera template engine with the exec() function enabled but without the trust verification applied to .mise.toml files. An attacker can place a crafted .tool-versions file in a git repository, and any developer with mise activated who changes into that directory will have arbitrary commands executed automatically without a trust prompt. This is considered exploitable and poses a serious supply chain risk to any development team using mise in its default non-paranoid mode.

Developers and engineering teams should review the vendor advisory, upgrade to a patched version immediately, and consider enabling paranoid mode until a fix is applied.

Vendor Advisory

🟠 [HIGH] webp-sh/webp_server_go

1 CVE | CVSS 4.0: 8.7 | AAS 10.8

  • cpe:2.3:a:webp-sh:webp_server_go:*:*:*:*:*:*:*:* (< 0.14.5)

WebP Server Go versions through 0.14.4 are affected by a high severity path traversal vulnerability (CVE-2026-53779, CVSS 8.7) on Windows deployments, where unauthenticated attackers can read arbitrary files outside the configured image directory by sending requests containing percent-encoded backslashes that bypass Go’s forward-slash-only path sanitization. The flaw exploits the mismatch between Go’s path normalization and Windows file system APIs, which treat backslashes and forward slashes interchangeably, allowing access to sensitive files such as configuration data or credentials. This is considered exploitable and requires no authentication or user interaction.

Organizations running WebP Server Go on Windows should update immediately by applying the vendor’s fix and auditing access logs for requests containing encoded backslash sequences.

Vendor Advisory

🟠 [HIGH] gogs.io/gogs

5 CVEs | CVSS 3.1: 8.9 | AAS 10.6

  • cpe:2.3:a:gogs.io:gogs:*:*:*:*:*:*:*:*

Gogs version 0.14.1, the self-hosted Git service, is affected by five high severity vulnerabilities, including at least one rated CVSS 8.9, spanning missing CSRF protections on organization team management endpoints. An attacker can trick a logged-in organization owner into visiting a crafted link to silently add attacker-controlled accounts to the Owners team, granting full organization-level privileges without any user confirmation. These vulnerabilities are considered exploitable and affect any Gogs instance where organizations are in use.

Administrators running Gogs should review the vendor advisories for all five CVEs, apply patches or upgrade as soon as fixes are available, and audit organization membership for any unauthorized additions.

Vendor Advisory

🟠 [HIGH] @budibase/server

1 CVE | CVSS 3.1: 9.6 | AAS 10.5

  • cpe:2.3:a:budibase:server:*:*:*:*:*:*:*:*

Budibase Server is affected by a high severity vulnerability (CVE-2026-54352, CVSS 9.6) in the PWA zip processing endpoint, where a builder-uploaded zip archive containing symlinks with absolute targets can bypass the icon path validator. An attacker with builder access can craft a malicious zip to read arbitrary files from the server, which are then streamed into MinIO storage and served back through the public assets endpoint, potentially exposing sensitive configuration files, credentials, or secrets. This vulnerability is considered exploitable and impacts any Budibase deployment where builder-level access is available.

Administrators should review the vendor advisory, upgrade to a patched version as soon as one is available, and restrict builder access to trusted users in the interim.

Vendor Advisory

🟠 [HIGH] vllm-project/vllm

2 CVEs | CVSS 3.1: 9.1 | AAS 10.4

  • cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* (< 0.22.1)

vLLM, the widely adopted LLM inference and serving engine, is affected by two high severity vulnerabilities, including at least one rated CVSS 9.1, impacting versions 0.3.0 through 0.21.x. The most critical flaw enables a complete authentication bypass of the OpenAI API middleware, allowing unauthenticated attackers to use the API without providing the configured API key by exploiting trust assumptions between ASGI web servers and Starlette. These vulnerabilities are considered exploitable and pose an immediate risk to any organization exposing vLLM API endpoints, particularly internet-facing deployments.

Organizations running vLLM should upgrade to version 0.22.0 or later immediately and audit access logs for any unauthorized API usage during the exposure window.

Vendor Advisory

🟠 [HIGH] motioneye-project/motioneye

1 CVE | CVSS 3.1: 9.5 | AAS 10.3

  • cpe:2.3:a:motioneye-project:motioneye:*:*:*:*:*:*:*:*

motionEye, the popular web-based frontend for motion surveillance software, is affected by a high severity authentication bypass vulnerability (CVE-2026-46488, CVSS 9.5) caused by improper trust in client-controlled cookies. An unauthenticated attacker can craft cookie values containing a username and password-hash-derived token to impersonate any user, including administrators, without knowledge of the plaintext password, due to the absence of server-side session validation. This is considered exploitable and poses critical risk to any internet-exposed motionEye instance, potentially granting full access to camera feeds and system configuration.

Administrators should review the vendor advisory, apply patches as soon as they are available, and ensure motionEye instances are not directly exposed to the internet without additional access controls such as a VPN or reverse proxy with authentication.

Vendor Advisory

🟠 [HIGH] paymenter/paymenter

1 CVE | CVSS 3.1: 9.9 | AAS 10.2

  • cpe:2.3:a:paymenter:paymenter:*:*:*:*:*:*:*:*

Paymenter, an open-source billing and client management platform, is affected by a high severity arbitrary file upload vulnerability (CVE-2025-58048, CVSS 9.9) in the ticket attachments functionality. Any authenticated user can upload malicious files to achieve remote code execution on the server, enabling extraction of sensitive database contents, reading of credentials from configuration files, and execution of arbitrary system commands under the web server user context. This is considered exploitable and poses an immediate risk given that even low-privileged customer accounts can trigger the attack.

Administrators should review the vendor advisory, upgrade to a patched version immediately, and audit their systems for any suspicious file uploads or unauthorized access during the exposure period.

Vendor Advisory

🟠 [HIGH] chainlit/chainlit

1 CVE | CVSS 4.0: 9.1 | AAS 9.7

  • cpe:2.3:a:chainlit:chainlit:*:*:*:*:*:*:*:*

Chainlit, an open-source framework for building conversational AI applications, is affected by a high severity session hijacking vulnerability (CVE-2026-56104, CVSS 9.1) in versions prior to 2.10.1. An unauthenticated attacker who obtains or guesses a valid session ID can restore and fully inherit an authenticated user’s session through the WebSocket restoration path without any ownership verification, gaining the victim’s permissions, roles, and access to restricted tools and data. This is considered exploitable and is particularly dangerous for deployments where Chainlit applications handle sensitive data or expose privileged tool integrations.

Organizations using Chainlit should upgrade to version 2.10.1 or later immediately and review session logs for any signs of unauthorized session restoration activity.

Vendor Advisory

🟠 [HIGH] ibm/websphere_application_server

1 CVE | CVSS 3.1: 7.5 | AAS 9.3

  • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*

IBM WebSphere Application Server versions 8.5 and 9.0, along with WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.6, are affected by a high severity denial of service vulnerability (CVE-2026-9071, CVSS 7.5). A remote attacker can send specially crafted requests to cause excessive memory consumption on the server, potentially leading to service degradation or outage without requiring authentication. This is considered exploitable and poses significant risk to organizations relying on WebSphere for production workloads.

Administrators should consult the IBM support advisory and apply the appropriate fix pack or interim fix immediately, prioritizing any internet-facing WebSphere deployments.

Vendor Advisory

🟠 [HIGH] angular/angular

3 CVEs | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:*

Angular, the widely used web application framework, is affected by three high severity vulnerabilities, including at least one rated CVSS 8.8, impacting the server-side rendering component in @angular/platform-server. The most notable flaw is a server-side request forgery vulnerability where the SSR engine improperly processes absolute-form URLs passed to rendering entry points, allowing an attacker to force the server to make requests to arbitrary external or internal hosts. These vulnerabilities are considered exploitable and affect any Angular application using server-side rendering across versions prior to 19.2.22, 20.3.21, 21.2.13, and 22.0.0-next.12.

Teams running Angular SSR should upgrade to the patched version for their release branch immediately and review server logs for any unexpected outbound requests that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] nicolargo/glances

2 CVEs | CVSS 3.1: 7.8 | AAS 9.1

  • cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:* (>= 4.0.0, < 4.3.1)
  • cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:* (< 4.3.1)

Glances, the popular open-source system monitoring tool, is affected by two high severity vulnerabilities, including at least one rated CVSS 7.8, in the KVM/QEMU monitoring engine. VM domain names read from virsh output are passed unsanitized into shell command templates, allowing any user who can create or rename a virtual machine to inject arbitrary commands that execute with the privileges of the Glances process. These vulnerabilities are considered exploitable and pose a significant local privilege escalation risk in environments where multiple users manage KVM/QEMU virtual machines on monitored hosts.

Administrators should review the vendor advisory, upgrade Glances to a patched version as soon as one is available, and restrict VM creation and renaming privileges to trusted users in the interim.

Vendor Advisory