---
title: "Security digest: June 10, 2026"
url: https://erroneo.us/security/2026-06-10/
description: "June 10, 2026 vulnerability digest: 1 brief (Oracle PeopleSoft CVE-2026-35273: ShinyHunters…); 8 critical advisories (Go, npm). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-10
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 10, 2026

1 editorial brief and 8 critical advisories.

## Take stock

- Act now: Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day . PeopleSoft customers on PeopleTools 8.61 or 8.62, above all universities running Campus Solutions and any organization with PeopleSoft exposed to the internet.
- Go: 7 critical advisories ( github.com/kubev2v/migration-planner , github.com/dhax/go-base , github.com/kubev2v/assisted-migration-agent ). Check with govulncheck ./... .
- npm: 1 critical advisory ( baileys , @whiskeysockets/baileys ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day](https://erroneo.us/security/briefs/oracle-peoplesoft-cve-2026-35273-shinyhunters/index.md): If you run PeopleTools 8.61 or 8.62 with PIA reachable from the internet, apply Oracle's fix and lock down the EMHub/PSIGW paths today, then hunt back to May 27, 2026.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-53474](https://erroneo.us/security/cve/CVE-2026-53474/index.md) Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands — Go github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5
- [CVE-2026-53470](https://erroneo.us/security/cve/CVE-2026-53470/index.md) Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs — Go github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5
- [CVE-2026-48063](https://erroneo.us/security/cve/CVE-2026-48063/index.md) Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload — npm baileys < 6.7.22 → 6.7.22; npm @whiskeysockets/baileys < 6.7.22 → 6.7.22; npm baileys >= 7.0.0-rc.1, < 7.0.0-rc12 → 7.0.0-rc12
- [CVE-2026-48031](https://erroneo.us/security/cve/CVE-2026-48031/index.md) Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery — Go github.com/dhax/go-base < 0.0.0-20260517152733-cc82b9740fa6 → 0.0.0-20260517152733-cc82b9740fa6
- [CVE-2026-53475](https://erroneo.us/security/cve/CVE-2026-53475/index.md) Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication — Go github.com/kubev2v/assisted-migration-agent < 0.16.0 → 0.16.0
- [CVE-2026-53476](https://erroneo.us/security/cve/CVE-2026-53476/index.md) Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution — Go github.com/kubev2v/assisted-migration-agent < 0.16.0 → 0.16.0
- [CVE-2026-53469](https://erroneo.us/security/cve/CVE-2026-53469/index.md) Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API — Go github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5
- [CVE-2026-53471](https://erroneo.us/security/cve/CVE-2026-53471/index.md) Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation — Go github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5

---
Source page: https://erroneo.us/security/2026-06-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt