---
title: "Security digest: June 23, 2026"
url: https://erroneo.us/security/2026-06-23/
description: "June 23, 2026 vulnerability digest: 4 CISA KEV additions (Lantronix, Ubiquiti); 6 critical advisories (PyPI, Go, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-23
date_modified: 2026-06-23
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 23, 2026

4 known exploited (cisa kev) additions and 6 critical advisories.

## Take stock

- Do you run any of these? Ubiquiti UniFi OS, Lantronix EDS5000. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-26.
- Go: 3 critical advisories ( gogs.io/gogs ). Check with govulncheck ./... .
- PyPI: 2 critical advisories ( motioneye ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( @budibase/server ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-34910](https://erroneo.us/security/cve/CVE-2026-34910/index.md) Ubiquiti UniFi OS: Ubiquiti UniFi OS Improper Input Validation Vulnerability (CISA due 2026-06-26)
- [CVE-2026-34909](https://erroneo.us/security/cve/CVE-2026-34909/index.md) Ubiquiti UniFi OS: Ubiquiti UniFi OS Path Traversal Vulnerability (CISA due 2026-06-26)
- [CVE-2026-34908](https://erroneo.us/security/cve/CVE-2026-34908/index.md) Ubiquiti UniFi OS: Ubiquiti UniFi OS Improper Access Control Vulnerability (CISA due 2026-06-26)
- [CVE-2025-67038](https://erroneo.us/security/cve/CVE-2025-67038/index.md) Lantronix EDS5000: Lantronix EDS5000 Code Injection Vulnerability (CISA due 2026-06-26)

## Critical advisories

- [GHSA-qxvg-h7q2-hcxh](https://erroneo.us/security/ghsa/GHSA-qxvg-h7q2-hcxh/index.md) motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE) — PyPI motioneye < 0.44.0 → 0.44.0
- [CVE-2026-52806](https://erroneo.us/security/cve/CVE-2026-52806/index.md) Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge — Go gogs.io/gogs < 0.14.3 → 0.14.3
- [GHSA-phv5-334h-mxcw](https://erroneo.us/security/ghsa/GHSA-phv5-334h-mxcw/index.md) motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal — PyPI motioneye < 0.44.0 → 0.44.0
- [CVE-2026-52813](https://erroneo.us/security/cve/CVE-2026-52813/index.md) Gogs has Path Traversal in organization name that results in RCE through Git hooks — Go gogs.io/gogs < 0.14.3 → 0.14.3
- [CVE-2026-54350](https://erroneo.us/security/cve/CVE-2026-54350/index.md) Budibase has nonymous NoSQL operator injection via published-app query templates — npm @budibase/server < 3.39.12 → 3.39.12
- [CVE-2026-52811](https://erroneo.us/security/cve/CVE-2026-52811/index.md) Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym — Go gogs.io/gogs < 0.14.3 → 0.14.3

---
Source page: https://erroneo.us/security/2026-06-23/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt