Digest · Monday

Security digest: June 22, 2026

11 critical advisories.

Take stock

Maven: 4 critical advisories (com.xwiki.pro:xwiki-pro-macros, org.webjars.npm:expr-eval, org.openidentityplatform.openam:openam-oauth2, org.openidentityplatform.opendj:opendj-server-legacy). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
npm: 3 critical advisories (@budibase/server, expr-eval, scim-patch). Check with npm audit (or: npm ls <package>).
PyPI: 2 critical advisories (motioneye, chainlit). Check with pip-audit (or: pip show <package>).
crates.io (Rust): 1 critical advisory (mise). Check with cargo audit.
Go: 1 critical advisory (github.com/ubuntu/adsys). Check with govulncheck ./....
Composer (PHP): 1 critical advisory (paymenter/paymenter). Check with composer audit.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro CVE-2026-44179 CVSS 9.9 Critical
com.xwiki.pro:xwiki-pro-macros >= 1.13, < 1.14.5 → fixed in 1.14.5
expr-eval vulnerable to Code Execution CVE-2026-12866 CVSS 9.2 Critical
expr-eval <= 2.0.2 → no fix listed; org.webjars.npm:expr-eval <= 2.0.2 → no fix listed
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) CVE-2026-44203 CVSS 9.3 Critical
org.openidentityplatform.openam:openam-oauth2 >= 13.0.0, < 16.1.1 → fixed in 16.1.1
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI CVE-2026-46495 CVSS 9.2 Critical
org.openidentityplatform.opendj:opendj-server-legacy <= 5.1.0 → fixed in 5.1.1

Check: npm audit (or: npm ls <package>)

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload CVE-2026-54352 CVSS 9.6 Critical
@budibase/server < 3.39.9 → fixed in 3.39.9
expr-eval vulnerable to Code Execution CVE-2026-12866 CVSS 9.2 Critical
expr-eval <= 2.0.2 → no fix listed; org.webjars.npm:expr-eval <= 2.0.2 → no fix listed
scimPatch vulnerable to prototype pollution via unfiltered keys in patch CVE-2026-48170 CVSS 9.1 Critical
scim-patch <= 0.9.0 → fixed in 0.9.1

Check: pip-audit (or: pip show <package>)

motionEye: Authentication possible via password hash CVE-2026-46488 CVSS 9.1 Critical
motioneye < 0.44.0 → fixed in 0.44.0
Chainlit contains a session hijacking vulnerability CVE-2026-56104 CVSS 9.1 Critical
chainlit < 2.10.1 → fixed in 2.10.1

Check: composer audit

Paymenter vulnerable to Remote Code Execution via public file uploads CVE-2025-58048 CVSS 9.9 Critical
paymenter/paymenter < 1.2.11 → fixed in 1.2.11

Check: govulncheck ./...

Canonical ADSys Uses a Less Trusted Source CVE-2026-12249 CVSS 9.0 Critical
github.com/ubuntu/adsys < 0.16.3-0.20250318112551-8b1939f96d38 → fixed in 0.16.3-0.20250318112551-8b1939f96d38

Check: cargo audit

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass) CVE-2026-33646 CVSS 9.6 Critical
mise < 2026.3.10 → fixed in 2026.3.10