IT security 2026-06-25

Level Tense — 75/100 — 2026-06-25

Tense day: 20 stories ranked, 2 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (82/100).

1. Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability — 82/100 (CVE-2026-20230)
2. PTC Windchill and FlexPLM Improper Input Validation Vulnerability — 76/100 (CVE-2026-12569)
3. flowiseai flowise: Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthe… — 39/100 (CVE-2025-71338)
4. flowiseai flowise: Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachme… — 36/100 (CVE-2025-71333)
5. anysphere cursor: Cursor is a code editor built for programming with AI. — 36/100 (CVE-2026-50548)
6. anysphere cursor: Cursor is a code editor built for programming with AI. — 36/100 (CVE-2026-50549)
7. CVE-2026-54030 — LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. — 36/100 (CVE-2026-54030)
8. dest-unreach socat: socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malic… — 35/100 (CVE-2026-56123)
9. CVE-2026-8592 — OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux… — 30/100 (CVE-2026-8592)
10. CVE-2026-8660 — OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows re… — 30/100 (CVE-2026-8660)