---
title: "Security digest: June 16, 2026"
url: https://erroneo.us/security/2026-06-16/
description: "June 16, 2026 vulnerability digest: 1 brief (Zyxel GS1900 Switches: Exploited CGI Overflow…); 1 CISA KEV addition (Widget Factory); 7 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-16
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 16, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 7 critical advisories.

## Take stock

- Check exposure: Zyxel GS1900 Switches: Exploited CGI Overflow (KEV) . Owners of GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 or -48HPv2 switches on 2.90(xxxx.1)C0 or earlier, today if the web interface is reachable from the internet or untrusted networks.
- Do you run any of these? Widget Factory Joomla Content Editor. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-19.
- PyPI: 5 critical advisories ( langflow , crawl4ai , vllm , litellm ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( @lobehub/lobehub ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/rclone/rclone ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Zyxel GS1900 Switches: Exploited CGI Overflow (KEV)](https://erroneo.us/security/briefs/zyxel-gs1900-cve-2026-7273-cgi-buffer-overflow/index.md): Patch every GS1900 to the June firmware, but the urgency depends on reach: if the switch's web interface is exposed to the internet, a guest network or a flat LAN, treat it as compromised until checked; if only a locked-down admin VLAN can reach it, patch on a normal cycle this month.

## Known exploited (CISA KEV)

- [CVE-2026-48907](https://erroneo.us/security/cve/CVE-2026-48907/index.md) Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability (CISA due 2026-06-19)

## Critical advisories

- [CVE-2026-54157](https://erroneo.us/security/cve/CVE-2026-54157/index.md) LobeHub: Unauthenticated SSRF in `/webapi/proxy` — npm @lobehub/lobehub <= 2.1.56 → 2.1.57
- [CVE-2026-48519](https://erroneo.us/security/cve/CVE-2026-48519/index.md) Langflow: Unauthenticated RCE in Shareable Playgrounds — PyPI langflow <= 1.9.1 → 1.9.2
- [CVE-2026-53753](https://erroneo.us/security/cve/CVE-2026-53753/index.md) Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API — PyPI crawl4ai <= 0.8.6 → 0.8.7
- [CVE-2026-49980](https://erroneo.us/security/cve/CVE-2026-49980/index.md) Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix — Go github.com/rclone/rclone >= 1.46.0, <= 1.74.2 → 1.74.3
- [CVE-2026-48746](https://erroneo.us/security/cve/CVE-2026-48746/index.md) vLLM: OpenAI auth bypass — PyPI vllm >= 0.3.0, < 0.22.0 → 0.22.0
- [CVE-2026-49468](https://erroneo.us/security/cve/CVE-2026-49468/index.md) LiteLLM: Authentication Bypass via Host Header Injection — PyPI litellm < 1.84.0 → 1.84.0
- [CVE-2026-56266](https://erroneo.us/security/cve/CVE-2026-56266/index.md) Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution — PyPI crawl4ai <= 0.8.6 → 0.8.7

---
Source page: https://erroneo.us/security/2026-06-16/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt