SECURITY INTEL · MONTHLY

2026-06 CleanSource SCA Community Security Intelligence Monthly

Built on Sectrend's CSSA vulnerability intelligence and open-source registry poisoning monitoring, this report consolidates 138 security advisories from June 2026 across AI applications, web security, enterprise software, developer tools, cloud services, IoT devices and OS kernels — a full-picture view of supply chain risk with actionable guidance.

138Advisories

32CSSA Exclusives

35Curated CVEs

71Poisoning Events

01Monthly Overview

概览

138 advisories were published in June. Three key findings: AI component risk is highly concentrated, curated CVE hotspots are overwhelmingly critical, and npm poisoning erupted in dense waves.

CSSA Exclusives · 23.2%

Unauthorized access / path traversal / command injection / AI-agent privilege abuse

Curated CVEs · 25.4%

Remote code execution / auth bypass / SQL injection / privilege escalation

Supply Chain Poisoning · 51.4%

Malicious C2 domains / command execution / credential theft / typosquatting

02Four Key Trends

趋势

T1AI applications and agent frameworks are the top vulnerability hotspot

Over 40% of CSSA exclusive vulnerabilities (13 findings) carried the AI tag. Attack surfaces cluster around unauthorized access, prompt-injection privilege abuse, agent sandbox escape and MCP toolchain command injection.

LangflowDevikaDB-GPTPentAGICogneeAutoAgentPraisonAIhermes-agentsemantic-routercode-graph-rag-mcp+4

T2100% of curated CVEs rated critical — enterprise and cloud platforms hit first

All 35 curated CVEs scored CVSS ≥9.0, with 8 perfect 10.0s. Affected vendors include the Apache family (Camel/CXF/HTTP Server), Microsoft Dynamics 365, Oracle WebCenter, Azure Synapse, Google Chrome, JetBrains Hub and the Linux Kernel.

CVE-2026-49261MariaDBwsrep_notify_cmd command injection

CVE-2026-48303Adobe Campaign Classicauthorization error

CVE-2026-45833ChromaDBcode injection

CVE-2026-48907JCE Joomlaaccess control error

T3npm poisoning erupts in waves — AI and developer tools are the primary targets

62 npm poisoning events (87.3%), peaking Jun 23–29 with up to 12 per day. Three naming-based hunting patterns:

Impersonating AI packages

anthropic-claude-latestanthropic-toolkitanthropyollama-helpersgptminilivekit-agents

Impersonating mainstream dev tools

vitest-clichai-as-persistedchai-as-assuredexpress-mocha-testexpress-initial

Masquerading as Web3 / crypto

web3-token-helperpolymarket-stake-mathrainbownkitwagmi_utilbase58-corebase62-86x

T4Path traversal and missing authorization still dominate non-CVE findings

Among CSSA exclusives: 11 missing-authorization and 5 path-traversal findings — 50% combined, mapping to CWE-22 / CWE-306 / CWE-862 / CWE-863. Basic access control remains the most common weakness in open-source components.

03Deep Dive

分析

CSSA Exclusives · Vulnerability Type Distribution

Missing / broken authorization34.4%

Path traversal15.6%

Command injection9.4%

SQL injection9.4%

Arbitrary file upload6.3%

Prototype pollution6.3%

By component, AI agents and LLM orchestration frameworks account for 40% (web platforms 20%, developer tools & MCP components 15%, ERP/CMS 12%). Common traits: exploitable without authentication, CVSS typically ≥9.8, low attack complexity — and several 100k+ star flagship projects are affected (hermes-agent 186K, Langflow 149K).

Curated CVEs · Domain Distribution

Enterprise apps / office suites28%

OS kernel & network protocols20%

AI / ML infrastructure17%

Databases & middleware14%

Other (web / IoT / browser)21%

Core risk is dominated by remote code execution (~50%). Most CVEs have official patches; Oracle WebCenter / Dynamics 365 / Azure Synapse depend on vendor cadence, and Linux Kernel upgrades need window planning. Prioritize internet-facing services and assets with AI/ML backends.

Poisoning Landscape · Platform Distribution

npm 62 events · 87.3%PyPI 12.7%

The malicious trio: C2 communication with attacker domains, unauthorized command execution on developer machines, and theft of environment variables / tokens / SSH keys. Also observed: anomalous version numbers (99.0.0, 9999.0.0, 40.0.1) abusing dependency resolution for priority loading.

04Recommendations

建议

R1Urgent Triage & Remediation

Development

Audit dependency inventories; prioritize affected versions of Langflow / Flowise / Devika / DB-GPT / PentAGI / Cognee / AutoAgent / hermes-agent / mcp-toolbox / n8n
Upgrade first: Apache Camel 4.19.0, MariaDB 10.6.27+, MLflow 3.10.1+, Flowise 3.1.2+, Crawl4AI 0.8.7+, n8n 2.25.7+, Netty 4.1.135.Final+, Linux Kernel 6.6.141+
Sweep dependency trees for the 71 poisoned packages; remove on sight, reinstall dependencies and purge node_modules / venv caches
Add authentication middleware to critical APIs and enforce least-privilege access

Security

Deploy WAF/IDS rules at the perimeter for Apache HTTP Server WebDAV, Oracle T3/IIOP, SMB client and Windows HTTP.sys
Deploy registry proxies and malicious-package detection (e.g. CleanSource SCA) in dev environments
Temporarily restrict public AI inference services (Flowise / MLflow / DB-GPT / Langflow) to trusted internal IPs
Monitor developer workstations for anomalous egress, DNS queries and shell execution

R2Strengthen Secure Development & Compliance

Development

Secure-by-default for AI components / MCP tools: default auth, least privilege, CORS denial, debug ports off
Strict allowlist validation for path / command / SQL inputs; parameterized queries and array-style subprocess calls throughout
Route model tool calls through a policy gateway: tool-registration allowlists; disable shell / file-write defaults in production
Use SHA-256 / HMAC / Ed25519 for hashing and signing; ban truncated or weak hashes and hardcoded keys

Security

Wire SAST / DAST / IAST into CI/CD, focusing on CWE-22 / 78 / 89 / 306 / 434 / 863 / 918
Build an AI/LLM audit checklist: prompt injection, tool privilege abuse, sandbox escape, model-artifact poisoning
Subscribe to CleanSource SCA daily / weekly / monthly intelligence to shift response windows to community-disclosure time

R3Supply Chain Governance

Development

Pin exact dependency versions; ban ^ / ~ / latest floating ranges
Enforce npm ci / pip install --require-hashes strict modes with lockfile integrity checks
Operate internal mirror registries (Nexus / Artifactory / private registry)
Watch for dependency-confusion variants (anthropic-*, chai-as-*, express-* families)

Security

Deploy SCA tooling for continuous dependency scanning
Apply EDR and egress auditing on developer machines and build servers
Enable Dependabot / Renovate automated dependency governance
Establish a poisoned-package incident playbook: takedown, notification, rollback, credential rotation

R4Defense-in-Depth Architecture

Development

Strict sandboxing for AI agent runtimes: minimal container privileges, no host socket mounts, restricted egress
Isolated execution sandboxes (gVisor / Firecracker / E2B) and read-only filesystems for components that run external code
Unified mTLS, access control, rate limiting and auditing at the service mesh and API gateway layer
Layered encryption and least-visibility design for sensitive data, model artifacts and credentials

Security

Four-layer defense across perimeter-host-app-data: WAF+IDS, EDR+HIDS, RASP+WAAP, DLP+encryption
Stand up an LLM firewall / AI gateway: prompt-injection detection, rogue tool-call interception, sensitive-data masking
Sign and verify CI/CD artifacts (Sigstore / Cosign)
Run regular red-blue confrontation and purple-team exercises

Monthly Report · Straight to Your Inbox

Subscribe to Sectrend's monthly security intelligence report — one email a month, the full open-source supply chain risk picture in your inbox.

Subscribe →

Publisher: CleanSource Community | Published: 2026-07-01
Data: Sectrend CSSA vulnerability intelligence (270k+ advisories) · open-source registry poisoning monitoring | Please attribute when republishing