Morning Brief — 2026-06-09

2 federal patching priority, 10 emerging critical cves, 10 supply chain, 3 ransomware activity, and 69 ioc volume. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2026-42271 — BerriAI LiteLLM

BerriAI LiteLLM Command Injection Vulnerability

• Added: 2026-06-08 · Federal due: 2026-06-22 · EPSS 88.8th pct (score 0.041)
• ransomware use: Unknown

BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.

CVE-2026-50751 — Check Point Security Gateway

Check Point Security Gateway Improper Authentication Vulnerability

• Added: 2026-06-08 · Federal due: 2026-06-11 · EPSS 1.2th pct (score 0.000)
• ransomware use: Unknown

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-44748 · CRITICAL (9.9) · 2026-06-09 — SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in…
• CVE-2026-27671 · CRITICAL (9.8) · 2026-06-09 — Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in…
• CVE-2026-11671 · CRITICAL (9.6) · 2026-06-09 — Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
• CVE-2026-11651 · CRITICAL (9.6) · 2026-06-09 — Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
• CVE-2026-11638 · CRITICAL (9.6) · 2026-06-09 — Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
• CVE-2026-11634 · CRITICAL (9.6) · 2026-06-09 — Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
• CVE-2026-40128 · CRITICAL (9.0) · 2026-06-09 — SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the i…
• CVE-2026-11699 · HIGH (8.8) · 2026-06-09 — Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
• CVE-2026-11698 · HIGH (8.8) · 2026-06-09 — Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
• CVE-2026-11688 · HIGH (8.8) · 2026-06-09 — Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Supply Chain

GHSA-2vqw-3mp8-cgmx · CVE-2026-47737 (rubygems)

• HIGH · CVSS 7.5 · 2026-06-09
• Affected: puma, puma
• https://github.com/advisories/GHSA-2vqw-3mp8-cgmx

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

GHSA-qpgp-93vx-g8v8 · CVE-2026-47736 (rubygems)

• HIGH · CVSS 7.5 · 2026-06-08
• Affected: puma, puma
• https://github.com/advisories/GHSA-qpgp-93vx-g8v8

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

GHSA-p2j4-c4g6-rpf5 · CVE-2026-47735 (go)

• HIGH · 2026-06-08
• Affected: github.com/basekick-labs/arc
• https://github.com/advisories/GHSA-p2j4-c4g6-rpf5

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

GHSA-qm33-p5p9-f8vg · CVE-2026-47726 (go)

• HIGH · 2026-06-08
• Affected: github.com/juev/nebula-mesh
• https://github.com/advisories/GHSA-qm33-p5p9-f8vg

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

GHSA-273q-qgh5-wrj6 · CVE-2026-47725 (go)

• HIGH · 2026-06-08
• Affected: github.com/juev/nebula-mesh
• https://github.com/advisories/GHSA-273q-qgh5-wrj6

nebula-mesh’s web UI lacks CSRF tokens on /ui/* mutating endpoints

GHSA-598g-h2vc-h5vg · CVE-2026-47724 (go)

• CRITICAL · CVSS 9.9 · 2026-06-08
• Affected: github.com/juev/nebula-mesh
• https://github.com/advisories/GHSA-598g-h2vc-h5vg

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

GHSA-w7w5-5gcp-38rw · CVE-2026-47723 (go)

• HIGH · 2026-06-08
• Affected: github.com/juev/nebula-mesh
• https://github.com/advisories/GHSA-w7w5-5gcp-38rw

nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

GHSA-7hp6-g3pq-3pc3 · CVE-2026-47722 (go)

• HIGH · 2026-06-08
• Affected: github.com/juev/nebula-mesh
• https://github.com/advisories/GHSA-7hp6-g3pq-3pc3

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

GHSA-w86f-rf9w-h3x6 · CVE-2026-47719 (npm)

• HIGH · CVSS 8.2 · 2026-06-08
• Affected: fuxa-server
• https://github.com/advisories/GHSA-w86f-rf9w-h3x6

FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

GHSA-hrj8-hjv8-mgwc · CVE-2026-47252 (go)

• CRITICAL · CVSS 9.0 · 2026-06-08
• Affected: github.com/julien040/anyquery/plugins/chrome, github.com/julien040/anyquery/plugins/brave, github.com/julien040/anyquery/plugins/edge
• https://github.com/advisories/GHSA-hrj8-hjv8-mgwc

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

Ransomware Activity

3 new victim postings across 2 groups.

IOC Volume

69 new IOCs in this window. Top families:

Cross-Reference

No recent SEC filings to cross-reference.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.