---
title: "Security digest: June 22, 2026"
url: https://erroneo.us/security/2026-06-22/
description: "June 22, 2026 vulnerability digest: 11 critical advisories (npm, Maven, PyPI, crates.io…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-22
date_modified: 2026-06-22
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 22, 2026

11 critical advisories.

## Take stock

- Maven: 4 critical advisories ( com.xwiki.pro:xwiki-pro-macros , org.webjars.npm:expr-eval , org.openidentityplatform.openam:openam-oauth2 , org.openidentityplatform.opendj:opendj-server-legacy ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 3 critical advisories ( @budibase/server , expr-eval , scim-patch ). Check with npm audit (or: npm ls <package>) .
- PyPI: 2 critical advisories ( motioneye , chainlit ). Check with pip-audit (or: pip show <package>) .
- crates.io (Rust): 1 critical advisory ( mise ). Check with cargo audit .
- Go: 1 critical advisory ( github.com/ubuntu/adsys ). Check with govulncheck ./... .
- Composer (PHP): 1 critical advisory ( paymenter/paymenter ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-54352](https://erroneo.us/security/cve/CVE-2026-54352/index.md) Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload — npm @budibase/server < 3.39.9 → 3.39.9
- [CVE-2026-44179](https://erroneo.us/security/cve/CVE-2026-44179/index.md) xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro — Maven com.xwiki.pro:xwiki-pro-macros >= 1.13, < 1.14.5 → 1.14.5
- [CVE-2026-46488](https://erroneo.us/security/cve/CVE-2026-46488/index.md) motionEye: Authentication possible via password hash — PyPI motioneye < 0.44.0 → 0.44.0
- [CVE-2026-12866](https://erroneo.us/security/cve/CVE-2026-12866/index.md) expr-eval vulnerable to Code Execution — npm expr-eval <= 2.0.2 → no fix; Maven org.webjars.npm:expr-eval <= 2.0.2 → no fix
- [CVE-2026-44203](https://erroneo.us/security/cve/CVE-2026-44203/index.md) OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) — Maven org.openidentityplatform.openam:openam-oauth2 >= 13.0.0, < 16.1.1 → 16.1.1
- [CVE-2026-33646](https://erroneo.us/security/cve/CVE-2026-33646/index.md) Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass) — crates.io (Rust) mise < 2026.3.10 → 2026.3.10
- [CVE-2026-12249](https://erroneo.us/security/cve/CVE-2026-12249/index.md) Canonical ADSys Uses a Less Trusted Source — Go github.com/ubuntu/adsys < 0.16.3-0.20250318112551-8b1939f96d38 → 0.16.3-0.20250318112551-8b1939f96d38
- [CVE-2026-56104](https://erroneo.us/security/cve/CVE-2026-56104/index.md) Chainlit contains a session hijacking vulnerability — PyPI chainlit < 2.10.1 → 2.10.1
- [CVE-2026-48170](https://erroneo.us/security/cve/CVE-2026-48170/index.md) scimPatch vulnerable to prototype pollution via unfiltered keys in patch — npm scim-patch <= 0.9.0 → 0.9.1
- [CVE-2025-58048](https://erroneo.us/security/cve/CVE-2025-58048/index.md) Paymenter vulnerable to Remote Code Execution via public file uploads — Composer (PHP) paymenter/paymenter < 1.2.11 → 1.2.11
- [CVE-2026-46495](https://erroneo.us/security/cve/CVE-2026-46495/index.md) OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI — Maven org.openidentityplatform.opendj:opendj-server-legacy <= 5.1.0 → 5.1.1

---
Source page: https://erroneo.us/security/2026-06-22/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt