Roundup
Kitakyushu's national health insurance slips go wrong for 44,000 homes
DevelopmentPrivacyJapanese Companies
Kitakyushu City found defects in the national health insurance payment slips it mailed out. Another person's slip was enclosed in some envelopes, and the barcodes for the January-March installments carried someone else's data. About 44,000 households are affected. The cause: a vendor program flaw in the system swapped in May, plus an error in the new envelope-stuffing machine. We break down what happened, why it slipped through, and what recipients should do.
2026.06.1740 views
News
Joomla JCE takeover flaw CVE-2026-48907: update to 2.9.99.9
DevelopmentSecurity
A critical flaw, CVE-2026-48907, in JCE, a hugely popular editor add-on used by many Joomla sites, lets attackers take over a server with no login. Severity is a perfect 10.0, exploit code is public, and automated attacks are underway. CISA has ordered urgent remediation. Here are the affected versions and what to do now.
2026.06.17140 views
News
Data-Theft Flaw in WordPress 'The Events Calendar', Fixed in 6.16.3
SecurityDevelopment
The Events Calendar, a WordPress plugin on 700,000+ sites, has a critical flaw (CVE-2026-49772, severity 9.3) that lets anyone read the database with no login. Here are the affected versions, how to check your site, and how to update to 6.16.3 now.
2026.06.1642 views
News
i18next Add-ons i18next-fs-backend and i18next-http-middleware: Two Unauthenticated Flaws, Fixed in 2.6.6 / 3.9.7
SecurityDevelopment
Two companion components of i18next, the JavaScript library widely used to translate web app UIs, have 9.1 flaws (CVE-2026-48713 / 48714). With no login, an attacker can poison the app's shared foundation, chaining to bypassed login checks or service outages. Update to 2.6.6 / 3.9.7.
2026.06.1646 views
News
WordPress Plugin Vulnerabilities: Easy Invoice and GeekyBot Are Fixed in the Latest Versions
DevelopmentSecurity
In June 2026, dozens of WordPress plugins disclosed critical flaws leading to site takeover or data theft. The invoicing plugin Easy Invoice and the chatbot GeekyBot are rated a maximum 10.0, and a dozen-plus form-integration plugins are exploitable with no login. If your site uses an affected plugin, update each one to the latest version now.
2026.06.1633 views
News
Spring AI Vector Store Query Injection: Affected Versions and the Safe Update
SecurityAIDevelopment
Spring AI, a popular Java framework for building generative-AI apps, has an 8.6 flaw (CVE-2026-47835) in its vector database integrations. Special characters let an attacker run unauthorized queries against Elasticsearch and others with no login, risking data exfiltration. Fixed in 1.0.9 / 1.1.8; developers should update now.
2026.06.1682 views
News
Max-Severity Takeover Flaw in a WooCommerce Invoice Plugin: CVE-2026-52704, Update to 2.0.9 Now
DevelopmentSecurity
WooCommerce PDF Invoice Builder, a popular plugin for generating invoice PDFs on WordPress stores, has a max-severity flaw (CVE-2026-52704, scored 10.0). With no login required, anyone can take over the shop's server over the internet. The fixed version 2.0.9 is out; update affected stores now.
2026.06.1637 views
News
sanitize-html's XSS Bypass and the Fix: Safe on 2.17.4 and Later
SecurityDevelopment
A vulnerability (CVE-2026-44990, CVSS 9.3) was found in sanitize-html, the go-to HTML sanitizer for preventing XSS, using the deprecated <xmp> tag to slip past sanitization. It is downloaded 7M+ times a week; the fix is updating to 2.17.4. Here is how it works and what to check.
2026.06.1368 views
News
Netty: 3 DNS Cache Poisoning Flaws and 20+ July CVEs, Fixed in 4.1.136
DevelopmentSecurityInfrastructure
Netty, the networking backbone used inside countless Java servers, has three DNS flaws that let attackers reroute an app's traffic to a fake server. The main one is CVE-2026-45674 (severity 8.7). Fixed in 4.1.135.Final (4.2.15.Final on the new line). It often hides as a transitive dependency inside Elasticsearch, gRPC and more, so check with mvn dependency:tree and update.
2026.06.13125 views
News
Eight Sandbox-Escape Flaws Hit vm2, Three Rated Max Severity — Patch to 3.11.4 Now (CVE-2026-47131)
DevelopmentSecurityAI
vm2, the Node.js library used to run untrusted code in a sandbox, has eight new escape flaws (three rated the maximum 10.0) that let attackers take over the host. Fixed in vm2 3.11.4 — but vm2 is discontinued, so the real fix is migrating to isolated-vm or container isolation. Run npm ls vm2 to check, and act fast if you run AI-generated code.
2026.06.1360 views
News
MariaDB Hit by Top-Severity RCE in Galera Clustering — wsrep Users Should Update Now (CVE-2026-49261)
SecurityDevelopmentInfrastructure
MariaDB, a staple database, has a maximum-severity 10.0 flaw, CVE-2026-49261. It affects Galera cluster setups (multiple servers syncing data) with the wsrep_notify_cmd notification feature enabled, where a node name can be used to take over the server. Single standalone servers are not affected. Galera users must update now to the fixed releases (10.6.27 / 10.11.18 / 11.4.12 / 11.8.8 / 12.3.2).
2026.06.1266 views
News
axios Proxy Vulnerabilities: You're Safe on 1.18.1 or Later (0.33.0 on the Old Line)
InfrastructureDevelopmentSecurity
axios, the HTTP client used by apps worldwide, has two flaws: an SSRF that leaks cloud credentials (CVE-2026-44492) and a prototype-pollution gadget that escalates to a full man-in-the-middle (CVE-2026-44494). Fixed in 1.16.0+ (0.32.0 on the old line), latest is 1.17.0. Old versions often hide as transitive dependencies, so check with npm ls axios and update.
2026.06.1259 views
