Digest · Friday

Security digest: June 12, 2026

1 known exploited (cisa kev) addition and 7 critical advisories.

Take stock

Do you run any of these? Oracle PeopleSoft Enterprise PeopleTools. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-15.
Maven: 5 critical advisories (org.apache.cxf:cxf-core, org.apache.cxf:cxf-integration-jca, org.apache.cxf:cxf-rt-rs-security-oauth2, org.apache.cxf:cxf-rt-transports-jms). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
npm: 1 critical advisory (@budibase/server). Check with npm audit (or: npm ls <package>).
PyPI: 1 critical advisory (chromadb). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-35273	Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Ransomware	2026-06-15

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Apache CXF has Improper Restriction of XML External Entity Reference CVE-2026-49875 CVSS 9.8 Critical
org.apache.cxf:cxf-core >= 4.2.0, < 4.2.2 → fixed in 4.2.2; org.apache.cxf:cxf-core < 4.1.7 → fixed in 4.1.7
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl CVE-2026-50633 CVSS 9.8 Critical
org.apache.cxf:cxf-integration-jca >= 4.2.0, < 4.2.2 → fixed in 4.2.2; org.apache.cxf:cxf-integration-jca < 4.1.7 → fixed in 4.1.7
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control CVE-2026-50628 CVSS 9.8 Critical
org.apache.cxf:cxf-rt-rs-security-oauth2 >= 4.2.0, < 4.2.2 → fixed in 4.2.2; org.apache.cxf:cxf-rt-rs-security-oauth2 < 4.1.7 → fixed in 4.1.7
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator CVE-2026-50627 CVSS 9.1 Critical
org.apache.cxf:cxf-rt-rs-security-oauth2 >= 4.2.0, < 4.2.2 → fixed in 4.2.2; org.apache.cxf:cxf-rt-rs-security-oauth2 < 4.1.7 → fixed in 4.1.7
Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory CVE-2026-50632 CVSS 9.8 Critical
org.apache.cxf:cxf-rt-transports-jms >= 4.2.0, < 4.2.2 → fixed in 4.2.2; org.apache.cxf:cxf-rt-transports-jms >= 4.1.0, < 4.1.7 → fixed in 4.1.7; org.apache.cxf:cxf-rt-transports-jms < 3.6.12 → fixed in 3.6.12

Check: npm audit (or: npm ls <package>)

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign CVE-2026-48150 CVSS 9.0 Critical
@budibase/server < 3.39.0 → fixed in 3.39.0

Check: pip-audit (or: pip show <package>)

ChromaDB has a code injection vulnerability CVE-2026-45833 CVSS 9.4 Critical
chromadb >= 0.4.17, <= 1.5.9 → no fix listed