---
title: "Security digest: June 15, 2026"
url: https://erroneo.us/security/2026-06-15/
description: "June 15, 2026 vulnerability digest: 2 briefs (SP Page Builder CVE-2026-48908: Exploited Joomla…); 2 CISA KEV additions (Cisco, LiteSpeed); 8 critical…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-15
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 15, 2026

2 editorial briefs, 2 known exploited (cisa kev) additions and 8 critical advisories.

## Take stock

- Act now: SP Page Builder CVE-2026-48908: Exploited Joomla RCE . Owners, agencies and hosts of Joomla sites that run JoomShaper's SP Page Builder below 6.6.2, and anyone who updated late and never checked for web shells or rogue Super Users.
- Check exposure: iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE . Owners of Joomla 6 sites (6.0.0 to 6.1.1) that ran iCagenda 4.0.7 or earlier at any point since June 15, 2026, and agencies managing fleets of Joomla sites.
- Do you run any of these? LiteSpeed cPanel Plugin, Cisco Catalyst SD-WAN Manager. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-18.
- npm: 5 critical advisories ( electron , @vitest/browser , vite-plus , remotion , youtransfer ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 2 critical advisories ( shlinkio/shlink , grumpydictator/firefly-iii ). Check with composer audit .
- Maven: 1 critical advisory ( org.snmp4j:snmp4j-agent ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [SP Page Builder CVE-2026-48908: Exploited Joomla RCE](https://erroneo.us/security/briefs/sp-page-builder-cve-2026-48908-unauthenticated-upload-rce/index.md): Any Joomla site still on SP Page Builder 6.6.1 or older should be updated today and treated as compromised, because automated attacks have been planting web shells and admin accounts since June.
- **Check exposure** [iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE](https://erroneo.us/security/briefs/icagenda-joomla-cve-2026-48939-file-upload-rce/index.md): Only Joomla 6.0.0-6.1.1 sites running iCagenda before 4.0.8 were open to web shells; those sites need a web-shell hunt, while everyone else on iCagenda simply updates.

## Known exploited (CISA KEV)

- [CVE-2026-54420](https://erroneo.us/security/cve/CVE-2026-54420/index.md) LiteSpeed cPanel Plugin: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability (CISA due 2026-06-18)
- [CVE-2026-20262](https://erroneo.us/security/cve/CVE-2026-20262/index.md) Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability (CISA due 2026-06-29)

## Critical advisories

- [CVE-2026-54257](https://erroneo.us/security/cve/CVE-2026-54257/index.md) Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow — npm electron >= 42.3.1, < 42.3.3 → 42.3.3
- [CVE-2026-50887](https://erroneo.us/security/cve/CVE-2026-50887/index.md) shlink has a Server-Side Request Forgery issue — Composer (PHP) shlinkio/shlink <= 5.0.1 → no fix
- [CVE-2026-53633](https://erroneo.us/security/cve/CVE-2026-53633/index.md) Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE — npm @vitest/browser >= 5.0.0-beta.0, <= 5.0.0-beta.3 → 5.0.0-beta.4; npm @vitest/browser >= 4.0.0, <= 4.1.7 → 4.1.8; npm @vitest/browser >= 3.0.0, <= 3.2.4 → 3.2.5
- [CVE-2026-30121](https://erroneo.us/security/cve/CVE-2026-30121/index.md) Remotion: arbitrary file write vulnerability — npm remotion < 4.0.410 → 4.0.410
- [CVE-2026-50886](https://erroneo.us/security/cve/CVE-2026-50886/index.md) Project Firefly III has incorrect access control in the webhook management component — Composer (PHP) grumpydictator/firefly-iii <= 6.5.9 → no fix
- [CVE-2026-39006](https://erroneo.us/security/cve/CVE-2026-39006/index.md) SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component — Maven org.snmp4j:snmp4j-agent <= 3.8.3 → no fix
- [CVE-2026-50880](https://erroneo.us/security/cve/CVE-2026-50880/index.md) YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution — npm youtransfer <= 1.0.6 → no fix
- [CVE-2026-30120](https://erroneo.us/security/cve/CVE-2026-30120/index.md) Remotion: remote code execution (RCE) vulnerability — npm remotion < 4.0.410 → 4.0.410

---
Source page: https://erroneo.us/security/2026-06-15/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt