Supply Chain · Watch Tuesday · 16 June 2026 End-of-day synthesis 4 watches · 41 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — The day escalated after dark: unauthenticated RCE in Rclone, an auth bypass in the LiteLLM proxy, a CVSS-10 unauthenticated browser-control hole and cross-tenant credential takeover in n8n, and a token-scope-bypass cluster across Gitea and Gogs piled onto the AI-development-stack mass disclosure and the IDE plugins caught stealing AI keys.

June 16 began as the AI-development stack's mass-disclosure day — pre-auth RCE in Crawl4AI and Langflow, a vLLM auth bypass, an ~18-CVE n8n batch, and Aikido's catch of 15+ JetBrains plugins quietly exfiltrating the AI keys developers paste into them — and the 18:00 synthesis closed on that shape.

Late escalation at 21:00 ET: a second wave hit self-hosted infrastructure after the synthesis locked. Rclone's remote-control server (`rcd --rc-serve`) takes unauthenticated RCE through inline remote config, bypassing the earlier CVE-2026-41179 fix (CVE-2026-49980, CVSS 9.8). The LiteLLM proxy can be reached on its management routes without auth via a Host-header trick (CVE-2026-49468) — the same URL-reconstruction class as the morning's vLLM bypass. n8n's security release kept expanding: a CVSS-10 unauthenticated browser-control exposure in `@n8n/mcp-browser` (CVE-2026-54309) and a cross-tenant credential takeover via the Dynamic-Credentials EE endpoints (CVE-2026-54305, CVSS 9.9). And the self-hosted forges piled on — Gitea shipped a 'maintainer-edit' authorization bypass that lets read-access users push arbitrary commits plus two token-scope bypasses (Basic-vs-Bearer mirror images of each other), and Gogs disclosed an authenticated path-traversal file-overwrite. yt-dlp's `--exec` metadata command injection rounds out the wave.

→ Operational priority for the night get any reachable Rclone `rcd --rc-serve` and n8n MCP-browser HTTP endpoint off the network now — both are unauthenticated code/control execution — then patch LiteLLM and the morning's Crawl4AI / Langflow / vLLM instances, upgrade Gitea and Gogs and re-issue every scoped forge token (scoping is unenforceable until you do), and finish rotating the AI provider keys exposed to third-party IDE plugins ahead of the June 19 Joomla/JCE KEV deadline.

21:00 ET · Last Watch

Critical · GHSA-qw24-gh76-8rvv / CVE-2026-49980 · 2026-06-16 ·added 21:00 ET

Rclone `rcd --rc-serve` allows unauthenticated RCE via inline remote config, bypassing the CVE-2026-41179 fix (CVSS 9.8)

`rclone rcd --rc-serve` parses a remote spec straight out of the request URL (`/[remote:path]/object`) and feeds it to normal backend initialization, so an attacker can inline-configure a backend whose options shell out to local commands — a single unauthenticated GET or HEAD then executes code as the rclone process. This bypasses the CVE-2026-41179 fix, so anyone who patched that one is still exposed. If you expose the rclone remote-control server, take `--rc-serve` off any reachable interface tonight and upgrade; never run `rcd` unauthenticated on a network others can reach.

Critical · GHSA-4xpc-pv4p-pm3w / CVE-2026-49468 · 2026-06-16 ·added 21:00 ET

LiteLLM proxy authentication bypass via Host-header injection on management routes (CVE-2026-49468)

LiteLLM's auth layer derives the route it is protecting from `request.url.path`, which Starlette reconstructs from the `Host` header, so a crafted `Host` can make the proxy mis-identify a protected management route and let an unauthenticated request through. This is the same URL-reconstruction class as today's vLLM bypass — an LLM gateway sitting in front of model credentials and spend controls is the worst place for an unauthenticated management reach. Upgrade LiteLLM, and if you front the proxy with a reverse proxy, normalize or pin the `Host` header before it reaches the app.

Critical · GHSA-qrx8-25qr-5r7v / CVE-2026-54309 · 2026-06-16 ·added 21:00 ET

n8n `@n8n/mcp-browser` HTTP transport accepts unauthenticated browser-control sessions (CVE-2026-54309, CVSS 10.0)

When `@n8n/mcp-browser` runs in HTTP transport mode the MCP endpoint accepts session initialization and tool invocation with no authentication, so any network-reachable client — or any website the user visits — can open an MCP session and drive the browser-control tools. With the AI Browser Bridge extension installed and a live browser connection that is full remote browser control from an unauthenticated origin, which is why it rates CVSS 10.0. Never expose the n8n MCP browser over HTTP transport on a reachable interface; restrict it to loopback or stdio transport and upgrade.

High · GHSA-2j5h-858j-5mpf / CVE-2026-54305 · 2026-06-16 ·added 21:00 ET

n8n cross-tenant credential takeover via Dynamic Credentials EE endpoints (CVE-2026-54305, CVSS 9.9)

Three enterprise Dynamic-Credentials endpoints accepted any authenticated n8n session without per-resource ownership or scope checks, so a user with no project membership or sharing relationship could enumerate and reference credential identifiers, names and types belonging to any private workflow on the instance. On a shared or multi-tenant n8n this is a tenant-isolation break that hands one tenant another's credentials. This lands in the same n8n security release as today's earlier batch — upgrade to the fixed 1.123.x / 2.25.x / 2.26.x line and rotate any credentials that may have been exposed.

High · GHSA-mm7c-rhg6-qr4r / CVE-2026-26231 · 2026-06-16 ·added 21:00 ET

Gitea: 'Allow edits from maintainers' lets any read-access user push arbitrary commits to a repo (CVE-2026-26231, CVSS 8.5)

Gitea's PR-create endpoint binds `allow_maintainer_edit=true` without verifying the submitter actually holds maintainer rights, so via a reverse-fork PR any authenticated low-privilege user with read access can push arbitrary commits straight into a repository, bypassing all write-access checks. For a self-hosted forge that is a direct integrity break on source — the exact thing a supply-chain reader cares about. Upgrade Gitea, and audit recent pushes on read-shared repositories for commits you did not expect.

High · GHSA-9r5x-wg6m-x2rc / CVE-2026-28699 · 2026-06-16 ·added 21:00 ET

Gitea: OAuth2 token scope enforcement bypassed when a token is sent via HTTP Basic instead of Bearer (CVE-2026-28699, CVSS 8.1)

A token granted only `read:user` can be replayed as `Authorization: Basic base64(<token>:x-oauth-basic)` and gain write actions — editing profiles, adding email addresses, creating repositories — because Gitea only enforces OAuth2 scopes on the Bearer path. Scoped tokens you handed out as read-only are effectively unscoped over Basic auth. Patch, and until you do, treat every narrowly-scoped Gitea token as potentially full-access.

High · GHSA-cc8w-r4qh-3v65 / CVE-2026-28744 · 2026-06-16 ·added 21:00 ET

Gitea: Git Smart HTTP skips repo-scoped token checks for Bearer tokens (CVE-2026-28744, CVSS 8.1)

`CheckRepoScopedToken()` returns early unless the request is HTTP Basic auth, so a repository-scoped access token sent as `Authorization: Bearer <token>` skips the scope check entirely on the Git Smart HTTP path and reaches repositories outside its scope. It is the mirror image of CVE-2026-28699 — the same scope enforcement is missing, just on the opposite auth path — so together they mean Gitea token scoping cannot be relied on over either Basic or Bearer until you are on the fixed release. Upgrade and re-issue scoped tokens.

High · GHSA-pm6v-2h4w-4rp2 / CVE-2026-52797 · 2026-06-16 ·added 21:00 ET

Gogs: authenticated path traversal lets a user overwrite arbitrary files via `git diff` output (CVE-2026-52797, CVSS 8.5)

An authorized Gogs user can control the value passed to the `git diff` command and, bypassing the path filter, write the diff output outside the target directory to an arbitrary file — overwriting critical files for a denial of service. It is the same self-hosted-forge night as the Gitea cluster above: if you run Gogs or Gitea this is the evening to get current. Upgrade Gogs and tighten who holds authenticated accounts on any internet-reachable instance.

High · GHSA-69qj-pvh9-c5wg · 2026-06-16 ·added 21:00 ET

yt-dlp `--exec` command injection via crafted video metadata (GHSA-69qj-pvh9-c5wg, CVSS 7.5)

yt-dlp's `--exec` option interpolates metadata fields like `%(title)s` straight into a shell command, so a video whose title carries quotes or shell metacharacters can inject arbitrary commands and reach RCE on the downloader's machine. Anyone running yt-dlp `--exec` in automation against untrusted URLs — CI pipelines, archival and ingest bots — is exposed. Upgrade yt-dlp and avoid `--exec` with unsanitized format strings; pass explicit argument arrays or post-process out of band instead.

19:00 ET · First Watch

Critical · CISA KEV · catalog 2026.06.16 ·added 19:00 ET

CISA KEV: Joomla Content Editor unauthenticated PHP upload-and-execute (CVE-2026-48907) — federal due date June 19

CISA's June 16 catalog added an improper-access-control flaw in Widget Factory's Joomla Content Editor (JCE) where an unauthenticated visitor can create editor profiles and upload-and-execute PHP — unauthenticated RCE on any Joomla site running the extension. A KEV listing means it is being exploited in the wild now, and CISA set a three-day clock (due June 19). If you run Joomla with JCE, update the extension immediately, disable unauthenticated editor-profile creation, and grep the webroot for recently-written .php files.

Critical · GHSA-qxjp-w3pj-48m7 + GHSA-365w-hqf6-vxfg / CVE-2026-53753 · crawl4ai · 2026-06-16 ·added 19:00 ET

Crawl4AI Docker server: pre-auth RCE via AST sandbox escape, plus arbitrary file write and SSRF (CVE-2026-53753, CVSS 9.8)

Crawl4AI's computed-fields _safe_eval_expression() validator only blocks attributes starting with an underscore, so generator/frame attributes like gi_frame.f_back.f_builtins walk straight out of the sandbox — an unauthenticated POST /crawl (JWT is off by default) yields arbitrary code execution. A companion advisory (GHSA-365w-hqf6-vxfg) catalogs more Docker-API holes in the same server: arbitrary file write via output_path on /screenshot and /pdf, SSRF, and auth bypass. Any Crawl4AI <=0.8.6 Docker server reachable on the network is pre-auth RCE; take it off the internet, upgrade, and enable JWT.

Critical · GHSA-v5ff-9q35-q26f / CVE-2026-48519 · langflow · 2026-06-16 ·added 19:00 ET

Langflow: unauthenticated RCE in Shareable Playground / public flows (CVE-2026-48519, CVSS 9.6)

Langflow's Shareable Playground exposes /api/v1/build_public_tmp so unauthenticated users can execute any public flow — and the JSON payload lets the caller supply arbitrary Python as a node's code, which Langflow runs. Merely sharing a flow turns the deployment into an unauthenticated RCE target. Upgrade past 1.9.1, disable public/shareable flows on any internet-facing Langflow, and treat exposed instances as already compromised.

Critical · Aikido · 2026-06-16 ·added 19:00 ET

At least 15 malicious JetBrains IDE plugins exfiltrate the AI API keys developers paste into them (Aikido)

Aikido found a coordinated campaign of 15+ plugins across seven vendor accounts in the JetBrains marketplace that steal the AI-provider API key you paste into their settings and ship it to an attacker endpoint. This is a live registry-poisoning attack aimed squarely at the build-with-AI boom: the IDE plugin marketplace is the supply chain, and the loot is your OpenAI/Anthropic key with billing attached. Audit installed JetBrains plugins against Aikido's named list, rotate any AI key entered into a third-party plugin, and prefer sourcing keys from the environment over pasting them into plugin settings.

High · GHSA-94f4-hr76-p5j6 / CVE-2026-48746 · vllm · 2026-06-16 ·added 19:00 ET

vLLM: OpenAI API authentication bypass via Starlette URL reconstruction (CVE-2026-48746, CVSS 9.1)

vLLM's OpenAI-compatible server derives the path for its AuthenticationMiddleware from a Starlette-reconstructed URL built off the ASGI scope, which a fronting server or proxy can manipulate so the path no longer matches the protected prefix — letting a caller reach the inference API without the configured VLLM_API_KEY. Any vLLM in the >=0.3.0,<0.22.0 range gating a paid model behind an API key is exposed to unauthenticated use. Upgrade to 0.22.0+, and don't rely on the app-layer key alone — enforce auth at the proxy too.

High · GHSA-xmwj-c75x-6346 / CVE-2026-54157 · @lobehub/lobehub · 2026-06-16 ·added 19:00 ET

LobeHub: unauthenticated SSRF in /webapi/proxy (CVE-2026-54157, CVSS 9.0)

LobeHub's /webapi/proxy fetches an attacker-supplied URL server-side with no checkAuth() wrapper — the one webapi route that was never secured — reprising the 2024 /api/proxy SSRF (CVE-2024-32964) one route over. An attacker can pivot through LobeHub's infrastructure, leak Vercel deployment metadata, and inject cookies on the lobehub.com origin. Upgrade past @lobehub/lobehub 2.1.56 and confirm every proxy route sits behind auth.

High · GHSA-pmqw-72cg-wx85 + ~17 · n8n · 2026-06-16 ·added 19:00 ET

n8n coordinated disclosure: ~18 advisories including Python-node sandbox-escape RCE and cross-user credential exfiltration (CVE-2026-54307 et al.)

n8n shipped a large coordinated batch across its workflow-automation surface: a Python Code Node sandbox escape to arbitrary code execution on the task-runner container (CVE-2026-49444), cross-user credential exfiltration via partially-enforced ownership checks on public API endpoints (CVE-2026-54307, CVSS 9.6), plus stored/same-origin XSS, prototype pollution, and SQL/NoSQL injection across the trigger and DB nodes. The through-line is multi-tenant n8n where editor-level users or shared workflows are the trust boundary — exactly the self-hosted automation hub that holds every other system's credentials. Upgrade to the fixed trains (1.123.55 / 2.25.7 / 2.26.2 and later), and restrict workflow-edit and sharing to fully trusted users until you have.

High · GHSA-vx4q-3cr2-7cg2 + 3 / CVE-2026-50574 · yt-dlp · 2026-06-16 ·added 19:00 ET

yt-dlp disclosure cluster: arbitrary code execution via aria2c manifest downloads, plus --exec command injection and a curl cookie leak (CVE-2026-50574 et al.)

yt-dlp disclosed a batch of input-handling bugs, the worst being arbitrary code execution when downloading manifests via the aria2c external downloader (CVE-2026-50574), alongside command injection when --exec runs over crafted yt-dlp output (GHSA-69qj-pvh9-c5wg), dangerous file-type creation from insufficient filename sanitization (CVE-2026-50023), and a cookie leak to the wrong host through the curl downloader (CVE-2026-50019). yt-dlp is buried in countless media pipelines and CI jobs where the 'URL' it is handed is often attacker-controlled. Upgrade yt-dlp, avoid aria2c and --exec on untrusted inputs, and scope any cookies you pass it.

High · GHSA-qrp7-cvwr-j2c6 + 4 · Caddy / Traefik · 2026-06-16 ·added 19:00 ET

Reverse-proxy authorization-bypass cluster: Caddy forward_auth/file_server bypasses and Traefik mTLS/SNI wildcard bypasses (CVE-2026-52844, CVE-2026-53622 et al.)

Caddy and Traefik both disclosed front-door authorization bypasses the same day: Caddy's forward_auth copy_headers can be smuggled past via FastCGI header normalization (CVE-2026-52845) and its Windows file_server authz checks fall to encoded-backslash path tricks (CVE-2026-52844), while Traefik's mTLS/SNI handling ignores wildcard TLSOptions mappings, letting a client domain-front past per-host TLS policy (CVE-2026-48491, CVE-2026-53622). This is the component everyone trusts to be the auth boundary, so a bypass here silently exposes whatever sits behind it. Upgrade both, then re-test that forward-auth and mTLS still reject the encoded and wildcard variants after patching.

Medium · GHSA-8xpq-cjcf-3wh9 + ~7 · deno · 2026-06-16 ·added 19:00 ET

Deno permission-model bypass cluster: fetch/WebSocket/TCP DNS-rebinding gaps, env and module-path escapes, Windows command injection (CVE-2026-49401 et al.)

Deno published a wide batch of permission-model weaknesses: fetch() and WebSocket skip a post-DNS-resolution check so --deny-net is evadable by DNS rebinding (CVE-2026-49859/49860), numeric hostname aliases dodge resolved-IP net denies (CVE-2026-49411), BYONM module resolution path-traverses out via package.json main (CVE-2026-49406), process.loadEnvFile() bypasses env permission checks (CVE-2026-49983), a macOS APFS Unicode-normalization mismatch defeats path allow-lists (CVE-2026-49401), and spawnSync/spawn allow command injection on Windows (CVE-2026-49402). None is a remote exploit alone, but together they erode the runtime guarantee people lean on when running semi-trusted code under Deno's flags. Upgrade Deno and don't treat --allow/--deny network or fs flags as a hard sandbox for hostile code.

12:00 ET · Forenoon Watch

Critical · BleepingComputer · 2026-06-15 ·added 12:00 ET

OptinMonster, TrustPulse and PushEngage WordPress plugins compromised via Awesome Motive CDN supply-chain attack

WordPress plugins OptinMonster, TrustPulse and PushEngage — all maintained by Awesome Motive — were compromised through their shared content-delivery network, so malicious code was served to sites running the plugins without any plugin update being pushed. This is the cleanest example of the CDN-as-distribution-channel attack this watch keeps flagging: the trust boundary isn't the plugin repo, it's every third-party origin the plugin loads at runtime. If you run any Awesome Motive plugin, pull the vendor advisory, check for unexpected outbound script loads, and treat sites that loaded the CDN during the exposure window as potentially compromised.

High · GHSA-999r-qq7v-r334 / CVE-2026-11417 · 2026-06-15 ·added 12:00 ET

aws-cdk-lib: OS command injection in NodejsFunction local bundling (CVE-2026-11417, CVSS 7.3)

OS command injection in the NodejsFunction local-bundling pipeline of aws-cdk-lib before 2.245.0 (2.246.0 on Windows): an attacker who controls any of the bundling properties (externalModules, define, loader, inject, esbuildArgs) can inject shell metacharacters that execute during synth on the host driving the CDK toolchain. The threat model is a CDK app that feeds attacker-influenced values into those props — generated stacks or config-driven pipelines — turning `cdk synth` into arbitrary command execution on the build runner. Upgrade aws-cdk-lib to 2.246.0+ and treat any externally-sourced bundling input as untrusted.

High · GHSA-pr59-h9ph-3fr8 / CVE-2026-54271 · 2026-06-15 ·added 12:00 ET

protobufjs-cli: code injection in pbjs static output from crafted JSON descriptors (CVE-2026-54271, CVSS 8.2)

An incomplete fix for an earlier pbjs name-handling bug (CVE-2026-44295) means protobufjs-cli can still emit attacker-controlled JavaScript when generating static / static-module output from crafted JSON descriptors. Parsing ordinary .proto files is unaffected; the risk is build pipelines that pass pre-parsed JSON descriptors into pbjs and then execute or import the generated file — a code-generation supply-chain shape. Upgrade protobufjs-cli past 2.4.2 / 1.3.1 and don't run codegen over untrusted descriptor input.

High · GHSA-2pvr-wf23-7pc7 + GHSA-8hv8-536x-4wqp · astro · 2026-06-16 ·added 12:00 ET

Astro double-disclosure: Host-header SSRF via prerendered error page (CVE-2026-54299) and reflected XSS via unescaped slot name (CVE-2026-50146)

Two Astro advisories landed together: a Host-header SSRF where SSR apps with a prerendered 404/500 page fetch that page using an origin taken from an unvalidated Host header (CVE-2026-54299, CVSS 7.5), and a reflected XSS where a client:* component interpolates an unescaped slot name into a data-astro-template attribute (CVE-2026-50146, CVSS 7.1). Both are the familiar 'trust the request envelope' mistake — one trusts the Host header, the other an attacker-supplied slot name. Upgrade Astro (>=6.4.6 for the SSRF, >=6.3.3 for the XSS) and set allowedDomains so the error-page fetch can't be steered off-origin.

High · GHSA-88fw-hqm2-52qc / CVE-2026-54290 · 2026-06-16 ·added 12:00 ET

hono: CORS middleware reflects any Origin with credentials under the default wildcard (CVE-2026-54290, CVSS 7.1)

With credentials:true and the default wildcard origin, Hono's CORS middleware reflects the request Origin and sends Access-Control-Allow-Credentials:true, so any site — including null — can make credentialed cross-origin requests and read the responses. This configuration used to fail closed because browsers reject `*` with credentials; the regression is that it now succeeds for every origin, quietly exposing cookie-authenticated endpoints. Upgrade Hono to 4.12.25 and set an explicit origin allowlist whenever credentials are enabled.

High · GHSA-p4gq-832x-fm9v / CVE-2026-54293 · 2026-06-16 ·added 12:00 ET

NLTK: URL-encoded path traversal in nltk.data.load() allows arbitrary local file read (CVE-2026-54293, CVSS 7.5)

nltk.data.load() runs its unsafe-path regex before url2pathname() decodes %xx sequences, so URL-encoded traversal (%2e%2e%2f, %2fetc%2fpasswd) slips past the check that blocks literal ../ and is then decoded into a real filesystem path — a textbook decode-after-check TOCTOU giving arbitrary local file read via the nltk: URL scheme. Affects any app that loads NLTK resources from attacker-influenceable identifiers. Upgrade NLTK past 3.9.4 and don't feed user input into nltk.data.load().

High · GHSA-mm7m-92g8-7m47 / CVE-2026-53721 · 2026-06-16 ·added 12:00 ET

Nuxt: routeRules middleware bypass via case-sensitivity mismatch with vue-router (CVE-2026-53721)

Nuxt's routeRules matcher (rou3) is case-sensitive while vue-router matches case-insensitively, so the two disagree on a path like /Admin/dashboard: vue-router still serves the page but the routeRules lookup returns no match, and any appMiddleware declared via routeRules — including auth — silently never runs. This is the same matcher-mismatch authz-bypass shape as this morning's NestJS-on-Fastify trailing-slash issue: route normalisation diverging from middleware enforcement. Upgrade Nuxt (>=3.21.7 or >=4.4.7) and don't rely on routeRules middleware as your only authorization gate.

High · GHSA-q6m5-f73j-m9mc / CVE-2026-54257 · 2026-06-15 ·added 12:00 ET

Electron: incorrect Buffer byte-length calculation causes heap under/overflow (CVE-2026-54257)

Electron's bundled Node Buffer performs incorrect byte-length calculations leading to heap under/overflow; the vendor flags the practical impact as crashes and occasional incorrect allocations (truncation or over-allocation) rather than a demonstrated RCE, with no workaround beyond upgrading. GHSA rates it critical on the memory-safety primitive, but treat it operationally as a stability/DoS fix unless your app feeds attacker-controlled lengths into Buffer. Upgrade Electron to 42.3.3.

Medium · Socket · 2026-06-16 ·added 12:00 ET

Socket ships Manifest Alerts: flags missing lockfiles and non-reproducible installs

Socket released Manifest Alerts, which detects supply-chain risk in project manifests starting with missing lockfiles that make dependency installs non-reproducible. A modest but useful defensive add: a missing or drifting lockfile is exactly the gap that lets a poisoned or substituted dependency slip in between commit and CI. Worth wiring into the same gate you already use for Socket's package alerts.

Context · The Hacker News · 2026-06-15 ·added 12:00 ET

Varonis 'SearchLeak': one-click Microsoft 365 Copilot chain exfiltrated email, files and MFA codes

Varonis chained three bugs into 'SearchLeak,' a one-click path that pulled emails, calendar entries and indexed files out of Microsoft 365 Copilot Enterprise Search — and because the link pointed at a real microsoft.com domain, URL filtering didn't flag it. Not a package-registry compromise, but it's the agentic-exfiltration shape this watch keeps an eye on: an AI assistant with broad data access becomes the exfil channel once a single trusted-looking link is clicked. Microsoft has remediated; a reminder that Copilot-class agents are now part of the data-exfiltration attack surface.

06:00 ET · Morning Watch

Critical · CISA KEV · catalog 2026.06.15 ·added 06:00 ET

CISA KEV: LiteSpeed cPanel plugin symlink-following (CVE-2026-54420) — federal due date June 18

CISA's June 15 catalog release added the LiteSpeed cPanel plugin UNIX symlink-following flaw, where a user with FTP or web-shell access on a shared CloudLinux/CageFS host can follow a symlink out of their jail and read or clobber files belonging to other tenants. On multi-tenant hosting this is a lateral-movement and tenant-isolation break, which is exactly why CISA set an aggressive three-day remediation clock. If you run shared hosting on LiteSpeed + cPanel, patch the plugin before the June 18 deadline and audit CageFS mounts for symlinks that escape the per-account root.

Critical · CISA KEV · catalog 2026.06.15 ·added 06:00 ET

CISA KEV: Cisco Catalyst SD-WAN Manager path traversal (CVE-2026-20262) — due June 29

Also catalogued June 15: an authenticated path-traversal in Cisco Catalyst SD-WAN Manager (vManage) that lets a remote attacker create or overwrite any file on the appliance filesystem. Arbitrary file write on the management plane of an SD-WAN fabric is a path to code execution and to tampering with the policies pushed to every edge router it controls. Patch vManage to the fixed train, and restrict management-plane reachability to the trusted admin network rather than relying on the authn boundary alone.

High · GHSA-c653-97m9-rcg9 / CVE-2026-50010 · 2026-06-15 ·added 06:00 ET

Netty silently disables TLS hostname verification when wrapping a plain X509TrustManager (CVE-2026-50010, CVSS 7.5)

Netty's SimpleTrustManagerFactory wraps any user-supplied plain X509TrustManager in an X509TrustManagerWrapper whose 3-arg checkServerTrusted discards the SSLEngine and falls through to the 2-arg delegate, so the JDK's built-in endpoint-identification (hostname verification) never runs. The result is a silent downgrade: TLS still validates the chain but stops checking that the certificate matches the host, reopening any Netty-based client to MITM by anyone holding a valid-but-unrelated cert. If you build clients on Netty with a custom trust manager, upgrade netty-handler and verify endpoint identification is actually being enforced on the wire.

High · GHSA-3x9g-8vmp-wqvf / CVE-2026-49853 · 2026-06-15 ·added 06:00 ET

Tornado forwards the Authorization header across cross-origin redirects (CVE-2026-49853, CVSS 7.7)

When SimpleAsyncHTTPClient follows a 3xx redirect it shallow-copies the request and strips only the Host header, leaving Authorization, auth_username and auth_password intact even when the redirect lands on a different origin. Any service that calls an attacker-influenceable URL with follow_redirects=True can be steered into handing its bearer token or basic-auth creds to a host of the attacker's choosing — the same credential-leak-on-redirect shape that has bitten curl and requests before. Upgrade Tornado, and audit outbound HTTP clients that attach static credentials and follow redirects automatically.

High · GHSA-wqp7-x3pw-xc5r / CVE-2026-48818 · 2026-06-15 ·added 06:00 ET

Starlette StaticFiles on Windows: UNC-path SSRF and NTLM credential theft (CVE-2026-48818, CVSS 7.5)

On Windows, StaticFiles resolves request paths with os.path.realpath; a UNC path like \\attacker.com\share that reaches the resolver makes the process open an SMB connection to the remote host over port 445, leaking the service account's NTLM hash to an attacker-controlled server. It is both an SSRF and a credential-disclosure primitive against any Windows-hosted Starlette/FastAPI app serving static files. Upgrade Starlette; if you can't immediately, block outbound 445 from app hosts and confirm StaticFiles isn't fed attacker-controlled path segments.

High · GHSA-5w86-c3rq-vjj7 + 4 · Netty / Tornado / Starlette / python-multipart · 2026-06-15 ·added 06:00 ET

Web-framework resource-exhaustion cluster: five unbounded-allocation DoS advisories land together (Netty, Tornado, Starlette, python-multipart)

A single batch of CVSS-7.5 denial-of-service disclosures hit the popular server frameworks at once, all the same memory-or-CPU exhaustion shape from untrusted input: Netty RedisArrayAggregator pre-allocates an ArrayList from an attacker-declared RESP array length (CVE-2026-50011) and the HTTP/3 QPACK decoder lets a client open unbounded blocked streams (CVE-2026-48748); Tornado's AsyncHTTPClient accumulates gzip-decompressed chunks with no total-size cap, a classic decompression bomb (CVE-2026-49855); Starlette silently ignores request.form() max_fields/max_part_size limits for urlencoded bodies (CVE-2026-54283); and python-multipart parses semicolon-separated querystrings in quadratic time (CVE-2026-53539). None is exotic, but together they're a reminder that every parser fed by the network needs a hard size/time bound. Bump netty-codec-redis/http3, tornado, starlette and python-multipart, and put a request-body size limit at the edge if you don't already have one.

Medium · GHSA-f8h2-vmm9-qhj6 / CVE-2026-45591 · 2026-06-15 ·added 06:00 ET

ASP.NET Core SignalR / Blazor Server DoS via deeply-nested MessagePack (CVE-2026-45591, CVSS 7.5)

Microsoft disclosed a DoS in the MessagePack hub protocol used by SignalR and Blazor Server, where a deeply-nested payload exhausts resources during deserialization. It only bites apps using the MessagePack hub protocol, but Blazor Server runs every interaction over that hub, so the blast radius for affected apps is the whole UI. Update the Microsoft.AspNetCore.App runtime and the SignalR MessagePack protocol package to the patched builds.

Medium · GHSA-6v32-fjc9-9qf6 / CVE-2026-54281 · 2026-06-15 ·added 06:00 ET

NestJS on Fastify: middleware bypass via trailing slash (CVE-2026-54281)

Middleware registered through MiddlewareConsumer.forRoutes() on @nestjs/platform-fastify can be bypassed by appending a trailing slash to the request path, so anything you enforce in middleware — including authentication — simply doesn't run for the slashed variant. This is the recurring framework-routing trap where the middleware matcher and the route matcher normalise paths differently. Upgrade the Fastify adapter, and don't rely on path-matched middleware as your only authz gate — enforce inside guards/handlers too.

Medium · GHSA-537c-gmf6-5ccf · pyca/cryptography · 2026-06-15 ·added 06:00 ET

pyca/cryptography wheels ship a vulnerable statically-linked OpenSSL (fixed in 48.0.1)

cryptography's binary wheels statically link OpenSSL, and wheels before 48.0.1 bundle a build affected by the June 9 OpenSSL advisory — so the exposure rides along even though nothing in your own code changed. This is the transitive-binary-dependency problem: pip-installed wheels carry their own C libraries that your SCA tooling may not flag. Upgrade cryptography to 48.0.1+ to pick up the patched OpenSSL; if you build from sdist you own the OpenSSL upgrade yourself.

Context · The Hacker News · 2026-06-16 ·added 06:00 ET

North Korean operators turn developer tooling into malware-delivery channels (Contagious Interview cluster)

Researchers flagged two campaigns tied to the North Korean Contagious Interview cluster (aka Famous Chollima) that lure developers into running malicious tooling as part of fake interview and coding tasks. Not a registry-poisoning event, but it rhymes directly with the npm/PyPI lures this watch tracks: the dev workstation and its tokens are the target, and the delivery vector is trust in the tooling. Reinforce that interview take-homes and unsolicited packages run in throwaway sandboxes, never on a machine holding cloud or registry credentials.

Context · The Hacker News · 2026-06-16 ·added 06:00 ET

ScarCruft (APT37) spoofs Microsoft account-security alerts to drop NarwhalRAT

The North Korean group ScarCruft / APT37 is running spear-phishing that impersonates Microsoft Account security notifications to deliver a RAT dubbed NarwhalRAT. It's a conventional phishing-to-RAT chain rather than a supply-chain compromise, but the identity-layer lure is the same pretext attackers use to harvest the MFA and OAuth grants that later get cashed in against CI and package registries. Worth the IOCs for blue teams; remind staff that Microsoft security alerts arriving as attachments or odd links are a red flag.

Context · The Hacker News · 2026-06-16 ·added 06:00 ET

China-linked group abused Google Workspace mail rules for year-long email theft

A China-linked espionage group sat inside North American medical, academic and military research networks for over a year, using Google Workspace mail-filtering rules to quietly siphon research and defense email. The supply-chain echo is the persistence mechanism: like malicious post-install scripts or rogue OAuth apps, attacker-created mail rules are durable, low-noise, and survive password resets. If you run Workspace, audit for filters/forwarding rules nobody recognises and alert on rule creation — it's a cheap detection for an expensive intrusion.