---
title: "Security digest: June 18, 2026"
url: https://erroneo.us/security/2026-06-18/
description: "June 18, 2026 vulnerability digest: 1 brief (TrueConf Server: Exploited Pre-Auth RCE Chain on…); 1 CISA KEV addition (Splunk); 25 critical advisories (PyPI…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-18
date_modified: 2026-08-20
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 18, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 25 critical advisories.

## Take stock

- Check exposure: TrueConf Server: Exploited Pre-Auth RCE Chain on Port 4307 . Anyone running TrueConf Server on Windows or Linux below 5.3.9, 5.4.9 or 5.5.5, and organizations whose staff join conferences on contractors' TrueConf servers.
- Do you run any of these? Splunk Enterprise. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-21.
- PyPI: 15 critical advisories ( praisonaiagents , python-statemachine , crawl4ai , praisonai , netlicensing-mcp , jupyter-server , praisonai-platform ). Check with pip-audit (or: pip show <package>) .
- npm: 6 critical advisories ( praisonai , @acastellon/auth , gemini-mcp-tool ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 2 critical advisories ( getkirby/cms , cotonti/cotonti ). Check with composer audit .
- Go: 2 critical advisories ( github.com/googleapis/mcp-toolbox ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [TrueConf Server: Exploited Pre-Auth RCE Chain on Port 4307](https://erroneo.us/security/briefs/trueconf-server-cve-2026-72529-72530-head-mare/index.md): Only organizations that run TrueConf Server, or whose staff join meetings on other companies' TrueConf servers, are exposed; for them an unpatched, reachable server should be treated as compromised, because the chain is unauthenticated, yields SYSTEM and was used to infect the server's own users.

## Known exploited (CISA KEV)

- [CVE-2026-20253](https://erroneo.us/security/cve/CVE-2026-20253/index.md) Splunk Enterprise: Splunk Enterprise Missing Authentication for Critical Function Vulnerability (CISA due 2026-06-21)

## Critical advisories

- [CVE-2026-57118](https://erroneo.us/security/cve/CVE-2026-57118/index.md) PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints — PyPI praisonaiagents < 1.6.59 → 1.6.59
- [CVE-2026-57123](https://erroneo.us/security/cve/CVE-2026-57123/index.md) PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in — PyPI praisonaiagents < 1.6.59 → 1.6.59
- [CVE-2026-54003](https://erroneo.us/security/cve/CVE-2026-54003/index.md) Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header — Composer (PHP) getkirby/cms <= 4.9.3 → 4.9.4; Composer (PHP) getkirby/cms >= 5.0.0-alpha.1, <= 5.4.3 → 5.4.4
- [CVE-2026-11718](https://erroneo.us/security/cve/CVE-2026-11718/index.md) googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) — Go github.com/googleapis/mcp-toolbox < 1.4.0 → 1.4.0
- [CVE-2026-57138](https://erroneo.us/security/cve/CVE-2026-57138/index.md) npm PraisonAI codeMode sandbox escape via Function constructor — npm praisonai >= 1.4.0, <= 1.7.1 → 1.7.2
- [CVE-2026-47103](https://erroneo.us/security/cve/CVE-2026-47103/index.md) python-statemachine SCXML <data expr> Eval Injection — PyPI python-statemachine >= 3.0.0, < 3.2.0 → 3.2.0
- [GHSA-r253-r9jw-qg44](https://erroneo.us/security/ghsa/GHSA-r253-r9jw-qg44/index.md) Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args — PyPI crawl4ai <= 0.8.9 → 0.9.0
- [CVE-2026-57124](https://erroneo.us/security/cve/CVE-2026-57124/index.md) PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai — PyPI praisonai <= 4.6.48 → 4.6.59
- [CVE-2026-57141](https://erroneo.us/security/cve/CVE-2026-57141/index.md) PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool — npm praisonai <= 1.7.1 → 1.7.2
- [CVE-2026-57127](https://erroneo.us/security/cve/CVE-2026-57127/index.md) praisonai: recipe serve auth middleware silently disables itself when no secret is set — PyPI praisonai <= 4.6.48 → 4.6.59
- [CVE-2026-57139](https://erroneo.us/security/cve/CVE-2026-57139/index.md) npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call — npm praisonai >= 1.5.0, <= 1.7.1 → 1.7.2
- [CVE-2026-57496](https://erroneo.us/security/cve/CVE-2026-57496/index.md) netlicensing-mcp: REST Path Traversal Bypasses Token Redaction — PyPI netlicensing-mcp < 0.1.8 → 0.1.8
- [CVE-2026-58399](https://erroneo.us/security/cve/CVE-2026-58399/index.md) @acastellon/auth: Authentication bypass via spoofable headers in validateToken() — npm @acastellon/auth < 2.3.0 → 2.3.0
- [CVE-2026-57131](https://erroneo.us/security/cve/CVE-2026-57131/index.md) PraisonAI: Jobs API exposes agent-execution endpoints with no authentication — PyPI praisonai < 4.6.59 → 4.6.59
- [CVE-2026-44727](https://erroneo.us/security/cve/CVE-2026-44727/index.md) Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP — PyPI jupyter-server <= 2.19.0 → 2.20.0
- [CVE-2026-57148](https://erroneo.us/security/cve/CVE-2026-57148/index.md) praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) — PyPI praisonai-platform <= 0.1.4 → 0.1.6
- [CVE-2026-57147](https://erroneo.us/security/cve/CVE-2026-57147/index.md) praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery — PyPI praisonai-platform <= 0.1.4 → 0.1.6
- [CVE-2026-57140](https://erroneo.us/security/cve/CVE-2026-57140/index.md) npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation — npm praisonai >= 1.6.0, <= 1.7.1 → 1.7.2
- [CVE-2026-11717](https://erroneo.us/security/cve/CVE-2026-11717/index.md) googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) — Go github.com/googleapis/mcp-toolbox < 1.4.0 → 1.4.0
- [CVE-2026-57116](https://erroneo.us/security/cve/CVE-2026-57116/index.md) PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation — PyPI praisonai >= 4.2.1, <= 4.6.57 → 4.6.59
- [CVE-2026-55742](https://erroneo.us/security/cve/CVE-2026-55742/index.md) Cotonti: Cross-Site Request Forgery in the administration rights handler — Composer (PHP) cotonti/cotonti <= 1.0.0 → no fix
- [CVE-2026-0755](https://erroneo.us/security/cve/CVE-2026-0755/index.md) gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755) — npm gemini-mcp-tool >= 1.1.2, < 1.1.6 → 1.1.6
- [CVE-2026-57125](https://erroneo.us/security/cve/CVE-2026-57125/index.md) PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass — PyPI praisonai <= 4.6.48 → 4.6.59; PyPI praisonaiagents < 1.6.59 → 1.6.59
- [GHSA-2jq4-q6vv-4cp3](https://erroneo.us/security/ghsa/GHSA-2jq4-q6vv-4cp3/index.md) Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE — PyPI crawl4ai <= 0.8.9 → 0.9.0
- [CVE-2026-57145](https://erroneo.us/security/cve/CVE-2026-57145/index.md) PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation — PyPI praisonai < 4.6.61 → 4.6.61

---
Source page: https://erroneo.us/security/2026-06-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt