---
title: "Security digest: June 4, 2026"
url: https://erroneo.us/security/2026-06-04/
description: "June 4, 2026 vulnerability digest: 1 brief (Progress LoadMaster CVE-2026-8037: Exploited…); 4 critical advisories (npm, Composer (PHP), Maven…). What to…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-04
date_modified: 2026-08-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 4, 2026

1 editorial brief and 4 critical advisories.

## Take stock

- Check exposure: Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE . Owners of Progress Kemp LoadMaster (GA 7.2.63.1 or older, LTSF 7.2.54.17 or older) or the ECS/Object Scale Connection Manager and MOVEit WAF builds based on it, with the API enabled.
- npm: 1 critical advisory ( @cap-js/openapi ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( WWBN/AVideo ). Check with composer audit .
- Maven: 1 critical advisory ( org.apache.fory:fory-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( stata-mcp ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE](https://erroneo.us/security/briefs/progress-loadmaster-cve-2026-8037-pre-auth-rce/index.md): Only LoadMaster-based appliances with the API enabled are exposed, but for those this is unauthenticated root RCE with a public exploit; if that's you and you're below 7.2.63.2 or 7.2.54.18, patch today.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [GHSA-jpvj-wpmj-h7rv](https://erroneo.us/security/ghsa/GHSA-jpvj-wpmj-h7rv/index.md) Supply chain compromise via malicious @cap-js/openapi — npm @cap-js/openapi = 1.4.1 → 1.4.2
- [CVE-2026-54458](https://erroneo.us/security/cve/CVE-2026-54458/index.md) WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin — Composer (PHP) WWBN/AVideo <= 29.0 → no fix
- [CVE-2026-50076](https://erroneo.us/security/cve/CVE-2026-50076/index.md) Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path — Maven org.apache.fory:fory-core < 1.1.0 → 1.1.0
- [CVE-2026-47708](https://erroneo.us/security/cve/CVE-2026-47708/index.md) MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper — PyPI stata-mcp < 1.17.3 → 1.17.3

---
Source page: https://erroneo.us/security/2026-06-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt