IT security 2026-06-26

Level Tense — 77/100 — 2026-06-26

Tense day: 26 stories ranked, 2 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (87/100).

  1. Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability — 87/100 (CVE-2026-20230)
  2. PTC Windchill and FlexPLM Improper Input Validation Vulnerability — 77/100 (CVE-2026-12569)
  3. CVE-2026-54636 — Dokku is a docker-powered PaaS. — 38/100 (CVE-2026-54636)
  4. CVE-2026-53914 — In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache m… — 38/100 (CVE-2026-53914)
  5. CVE-2026-54350 — Budibase is an open-source low-code platform. — 38/100 (CVE-2026-54350)
  6. CVE-2026-57926 — In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack — 38/100 (CVE-2026-57926)
  7. CVE-2026-12411 — Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest… — 37/100 (CVE-2026-12411)
  8. CVE-2026-54351 — Budibase is an open-source low-code platform. — 37/100 (CVE-2026-54351)
  9. daktronics dmp-5000 firmware: The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls,… — 36/100 (CVE-2026-31928)
  10. CVE-2026-50137 — Budibase is an open-source low-code platform. — 32/100 (CVE-2026-50137)