Digest · Wednesday
Security digest: June 17, 2026
6 critical advisories.
All digests · RSS · Markdown
Take stock
- Maven: 3 critical advisories (
org.apache.dolphinscheduler:dolphinscheduler-api,ca.uhn.hapi.fhir:org.hl7.fhir.utilities). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - PyPI: 2 critical advisories (
langflow,apache-airflow-providers-sftp). Check withpip-audit (or: pip show <package>). - RubyGems: 1 critical advisory (
avo). Check withbundle audit check --update. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 6
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 3
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure CVE-2026-32966 CVSS 9.8 Critical
org.apache.dolphinscheduler:dolphinscheduler-api< 3.4.2 → fixed in 3.4.2 - Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks CVE-2026-32967 CVSS 9.1 Critical
org.apache.dolphinscheduler:dolphinscheduler-api< 3.4.2 → fixed in 3.4.2 - HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory CVE-2026-55471 CVSS 9.2 Critical
ca.uhn.hapi.fhir:org.hl7.fhir.utilities<= 6.9.9 → fixed in 6.9.10
PyPI 2
Check: pip-audit (or: pip show <package>)
- Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak CVE-2026-55450 CVSS 9.3 Critical
langflow< 1.9.1 → fixed in 1.9.1 - Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory CVE-2026-50203 CVSS 9.1 Critical
apache-airflow-providers-sftp< 5.8.1 → fixed in 5.8.1
RubyGems 1
Check: bundle audit check --update
- Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation CVE-2026-55518 CVSS 9.6 Critical
avo<= 3.32.0 → fixed in 3.32.1;avo>= 4.0.0.beta.1, < 4.0.0.beta.51 → fixed in 4.0.0.beta.51