Security Vulnerabilities - CVEs Published In June 2026
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVSS Score
4.3
EPSS Score
0.003
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVSS Score
4.3
EPSS Score
0.003
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
CVSS Score
2.6
EPSS Score
0.003
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVSS Score
4.3
EPSS Score
0.003
Published
2026-06-26
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVSS Score
3.1
EPSS Score
0.002
Published
2026-06-26
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
CVSS Score
6.7
EPSS Score
0.003
Published
2026-06-26
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.
CVSS Score
7.7
EPSS Score
0.004
Published
2026-06-26
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-06-26
The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests.
Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.
CVSS Score
8.3
EPSS Score
0.004
Published
2026-06-26
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS Score
3.3
EPSS Score
0.001
Published
2026-06-26