IT security 2026-06-27

Level Calm — 30/100 — 2026-06-27

Calm day: 10 stories ranked, 0 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: CVE-2026-54350 — Budibase is an open-source low-code platform. (30/100).

  1. CVE-2026-54350 — Budibase is an open-source low-code platform. — 30/100 (CVE-2026-54350)
  2. CVE-2026-57926 — In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack — 30/100 (CVE-2026-57926)
  3. nodejs node.js: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebindi… — 30/100 (CVE-2026-48930)
  4. CVE-2026-2053 — The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently v… — 30/100 (CVE-2026-2053)
  5. CVE-2026-54636 — Dokku is a docker-powered PaaS. — 30/100 (CVE-2026-54636)
  6. CVE-2026-54351 — Budibase is an open-source low-code platform. — 29/100 (CVE-2026-54351)
  7. CVE-2026-53914 — In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache m… — 29/100 (CVE-2026-53914)
  8. daktronics dmp-5000 firmware: The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls,… — 28/100 (CVE-2026-31928)
  9. CVE-2026-12411 — Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest… — 28/100 (CVE-2026-12411)
  10. CVE-2026-50137 — Budibase is an open-source low-code platform. — 25/100 (CVE-2026-50137)