Digest · Tuesday
Security digest: June 23, 2026
4 known exploited (cisa kev) additions and 6 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Ubiquiti UniFi OS, Lantronix EDS5000. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-26.
- Go: 3 critical advisories (
gogs.io/gogs). Check withgovulncheck ./.... - PyPI: 2 critical advisories (
motioneye). Check withpip-audit (or: pip show <package>). - npm: 1 critical advisory (
@budibase/server). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 4
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-34910 | Ubiquiti UniFi OS Ubiquiti UniFi OS Improper Input Validation Vulnerability | 2026-06-26 |
| CVE-2026-34909 | Ubiquiti UniFi OS Ubiquiti UniFi OS Path Traversal Vulnerability | 2026-06-26 |
| CVE-2026-34908 | Ubiquiti UniFi OS Ubiquiti UniFi OS Improper Access Control Vulnerability | 2026-06-26 |
| CVE-2025-67038 | Lantronix EDS5000 Lantronix EDS5000 Code Injection Vulnerability | 2026-06-26 |
Critical advisories by ecosystem 6
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 3
Check: govulncheck ./...
- Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge CVE-2026-52806 CVSS 9.9 Critical
gogs.io/gogs< 0.14.3 → fixed in 0.14.3 - Gogs has Path Traversal in organization name that results in RCE through Git hooks CVE-2026-52813 CVSS 10.0 Critical
gogs.io/gogs< 0.14.3 → fixed in 0.14.3 - Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym CVE-2026-52811 CVSS 9.0 Critical
gogs.io/gogs< 0.14.3 → fixed in 0.14.3
PyPI 2
Check: pip-audit (or: pip show <package>)
- motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE) GHSA-qxvg-h7q2-hcxh CVSS 9.8 Critical
motioneye< 0.44.0 → fixed in 0.44.0 - motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal GHSA-phv5-334h-mxcw CVSS 10.0 Critical
motioneye< 0.44.0 → fixed in 0.44.0
npm 1
Check: npm audit (or: npm ls <package>)
- Budibase has nonymous NoSQL operator injection via published-app query templates CVE-2026-54350 CVSS 10.0 Critical
@budibase/server< 3.39.12 → fixed in 3.39.12