1 vulnerability across 1 product scored HIGH or above on June 30, 2026.

  • 🟠 HIGH: 1

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-52785 (opf/openproject) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-45405 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 12.8 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-54636 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 13.9 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-52884 (notepad-plus-plus/notepad) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-54825 (wpdatatables/wpdatatables) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-06-26 bulletin.
  • [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin.
  • [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin.
  • [UPGRADED] CVE-2026-52794 (sentry/sentry) — F1: exploitable → itw, AAS: 9.3 → 10.9 (HIGH → HIGH). Originally in 2026-06-24 bulletin.

🟠 [HIGH] linuxcnc/linuxcnc

1 CVE | CVSS 3.1: 8.4 | AAS 11.2

  • cpe:2.3:a:linuxcnc:linuxcnc:*:*:*:*:*:*:*:* (< 2.9.9)

LinuxCNC versions prior to 2.9.9 are affected by a high-severity privilege escalation vulnerability (CVE-2026-58302, CVSS 8.4) with a functional exploit available. The rtapi_app component in linuxcnc-uspace is installed SUID root and fails to properly validate module names passed to dlopen(), allowing a local attacker to use path traversal to load an arbitrary shared library and escalate privileges to root.

Organizations running LinuxCNC-controlled machinery should treat this as urgent given the public exploit availability and upgrade to version 2.9.9 or later immediately. Until patching is possible, restrict local shell access to LinuxCNC hosts and audit for unauthorized privilege escalation attempts.

Vendor Advisory