8 vulnerabilities across 6 products scored HIGH or above on June 29, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 7

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-52785 (opf/openproject) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-45405 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 12.8 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-54636 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 13.9 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-52884 (notepad-plus-plus/notepad) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-54825 (wpdatatables/wpdatatables) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin.
  • [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin.
  • [UPGRADED] CVE-2026-52794 (sentry/sentry) — F1: exploitable → itw, AAS: 9.3 → 10.9 (HIGH → HIGH). Originally in 2026-06-24 bulletin.

🔴 [CRITICAL] coollabsio/coolify

3 CVEs | CVSS 3.1: 9.6 | AAS 12.7

  • cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*

Coolify, the open-source self-hosted server and application management platform by coollabsio, is affected by three vulnerabilities, including multiple critical-severity issues with a CVSS score of 9.6. The most severe flaw allows cross-team resource deployment through Livewire web UI components that accept server and destination identifiers from URL query parameters without validating team ownership, bypassing authorization controls that are properly enforced on the API side. Functional exploit code is available. Organizations running Coolify should upgrade to version 4.0.0-beta.474 or later immediately and review deployment logs for any unauthorized cross-team activity.

Vendor Advisory

🟠 [HIGH] rancher/rancher

1 CVE | CVSS 4.0: 9.4 | AAS 11.5

  • cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*

Rancher, the widely deployed Kubernetes management platform by SUSE, is affected by a high-severity privilege escalation vulnerability with a CVSS score of 9.4. The flaw allows users with the Project Owner role to escalate their privileges through improper privilege handling, and proof-of-concept exploit code is available. Organizations running Rancher versions 2.12 before 2.12.10, 2.13 before 2.13.6, or 2.14 before 2.14.2 should upgrade to the corresponding patched releases immediately and audit cluster access logs for signs of unauthorized privilege escalation.

Vendor Advisory

🟠 [HIGH] zephyrproject/zephyr

1 CVE | CVSS 3.1: 8.1 | AAS 11.4

  • cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*

Zephyr, the open-source real-time operating system widely used in IoT and embedded devices, is affected by a high-severity vulnerability in its IPv6 Neighbor Discovery implementation with a CVSS score of 8.1. A logic error in the validity checks for Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement handlers causes RFC 4861 validation to be effectively bypassed, allowing an attacker on an adjacent network to inject crafted ND messages and manipulate routing or neighbor tables. Functional exploit code is available. Organizations deploying Zephyr-based firmware should apply the vendor patch immediately and assess whether affected devices are exposed to untrusted network segments.

Vendor Advisory

🟠 [HIGH] gorse-io/gorse

1 CVE | CVSS 4.0: 9.3 | AAS 11.2

  • cpe:2.3:a:gorse-io:gorse:*:*:*:*:*:*:*:*

Gorse, an open-source recommendation engine by gorse-io, is affected by a high-severity authentication bypass vulnerability with a CVSS score of 9.3. When the admin API key is left at its default empty value, unauthenticated attackers can access the dump and restore endpoints to exfiltrate the entire database, including user records and personally identifiable information, or completely overwrite the dataset. Proof-of-concept exploit code is available. Organizations running Gorse versions before 0.5.10 should upgrade immediately and ensure a strong admin_api_key is configured, and review access logs for any unauthorized calls to the dump or restore endpoints.

Vendor Advisory

🟠 [HIGH] openwrt/luci-proto-openvpn

1 CVE | CVSS 4.0: 8.7 | AAS 11.1

  • cpe:2.3:a:openwrt:luci-proto-openvpn:*:*:*:*:*:*:*:*

luci-proto-openvpn, the OpenVPN protocol handler for the LuCI web interface on OpenWrt routers, is affected by a high-severity command injection vulnerability with a CVSS score of 8.7. An authenticated LuCI user with OpenVPN configuration access can inject arbitrary shell metacharacters through the cl_meta parameter in the generateKey ubus method, achieving root-level command execution on the router. Proof-of-concept exploit code is available. Organizations and individuals running luci-proto-openvpn version 0.11.1 or earlier should update to the patched commit immediately and review router logs for any suspicious OpenVPN key generation activity.

Vendor Advisory

🟠 [HIGH] anthropics/claude-code

1 CVE | CVSS 4.0: 7.7 | AAS 10.4

  • cpe:2.3:a:anthropics:claude-code:*:*:*:*:*:*:*:*

Claude Code, Anthropic’s agentic coding tool, is affected by a high-severity sandbox escape vulnerability with a CVSS score of 7.7. Versions 2.1.38 through 2.1.163 improperly handle git worktree operations, allowing an attacker to create worktrees named “.git” and exploit symlink manipulation combined with git fsmonitor execution to overwrite files in the user’s home directory, such as .zshenv, achieving code execution outside of seatbelt sandbox restrictions. Proof-of-concept exploit code is available. Users running affected versions should upgrade to Claude Code 2.1.163 or later immediately and inspect home directory dotfiles for any unauthorized modifications.

Vendor Advisory