Security Digest: July 16, 2026 - 16 Critical Vulnerabilities

Today’s alert is urgent: multiple critical flaws allow remote code execution, admin takeover, cross-site scripting, privilege bypass, data exposure, and denial of service across collaboration tools, web frameworks, and observability libraries. The highest-risk items are the two Wekan flaws, the AVideo stored XSS chain, and the Wekan avatar upload RCE.

· 12 min read

Executive Summary

Today’s alert is urgent: multiple critical flaws allow remote code execution, admin takeover, cross-site scripting, privilege bypass, data exposure, and denial of service across collaboration tools, web frameworks, and observability libraries. The highest-risk items are the two Wekan flaws, the AVideo stored XSS chain, and the Wekan avatar upload RCE.

Act now: patch exposed systems immediately, restrict access to admin and local-only services, and assume any unpatched internet-facing deployment may already be at risk.

Critical Vulnerabilities

  • CVE-2026-52891: Wekan avatar upload command execution
    • Impact: A crafted avatar filename can trigger shell command execution on the server.
    • Affected Systems: Wekan versions prior to 9.07.
    • Immediate Action: Upgrade Wekan to 9.07 or later now; disable avatar uploads if you cannot patch immediately.
    • Mitigation: Remove any path that passes user-controlled filenames to shell commands; review server logs for suspicious avatar upload activity.
  • CVE-2026-55652: Wekan header-login trust bypass
    • Impact: An unauthenticated attacker can forge login tokens, including for admin accounts, by abusing trusted IP handling.
    • Affected Systems: Wekan versions prior to 9.46 with HEADER_LOGIN_TRUSTED_IPS enabled.
    • Immediate Action: Upgrade to 9.46 or later and disable header-based login until verified.
    • Mitigation: Do not trust client-supplied forwarded IP headers for authentication decisions; restrict access to reverse proxy trust chains.
  • CVE-2026-54458: AVideo YPTSocket stored XSS leading to admin takeover
    • Impact: An unauthenticated attacker can inject JavaScript into administrator sessions and steal tokens, CSRF data, or perform admin actions.
    • Affected Systems: WWBN AVideo versions prior to 29.0.
    • Immediate Action: Patch to the fixed release immediately; restrict access to admin dashboards until updated.
    • Mitigation: Apply the upstream patch commit and review any exposed debug or online-user panels.
  • CVE-2026-54504: MCP Documentation Server exposed unauthenticated API
    • Impact: Anyone on the network can read, add, search, and delete documents without credentials.
    • Affected Systems: @andrea9293/mcp-documentation-server v1.13.0 and deployments using default web UI binding.
    • Immediate Action: Turn off the web UI or firewall port 3080 now; upgrade as soon as a fix is available.
    • Mitigation: Bind to 127.0.0.1 only by default and require authentication for all document-management endpoints.
  • CVE-2026-54498: ViewComponent around_render XSS bypass
    • Impact: Unsafe HTML can bypass escaping and become trusted output, enabling XSS in apps using affected components.
    • Affected Systems: view_component Ruby gem, validated against commit eea79445.
    • Immediate Action: Audit any component using around_render; remove user-controlled HTML paths until patched.
    • Mitigation: Apply the upstream fix that normalizes around_render output before rendering.
  • CVE-2026-48795: AdonisJS bodyparser prototype pollution
    • Impact: Nested multipart data can pollute Object.prototype, potentially changing app behavior or enabling follow-on attacks.
    • Affected Systems: @adonisjs/bodyparser versions 10.1.3-10.1.5 and 11.0.3 before the fix.
    • Immediate Action: Upgrade to 10.1.5 or 11.0.3 immediately.
    • Mitigation: Reject nested multipart keys such as __proto__ and constructor.prototype at the edge.
  • CVE-2026-55234: Wekan board move access control bypass
    • Impact: Authenticated users can move cards, lists, or swimlanes into private boards they should not access.
    • Affected Systems: Wekan versions prior to 9.37.
    • Immediate Action: Upgrade to 9.37 or later and review board membership controls.
    • Mitigation: Revalidate destination board permissions on every update request.
  • CVE-2026-45313: Sandboxie-Plus host process code execution
    • Impact: A sandboxed process can execute arbitrary code in an unsandboxed host process running as SYSTEM.
    • Affected Systems: Sandboxie-Plus versions prior to 1.17.6.
    • Immediate Action: Upgrade to 1.17.6 immediately on Windows endpoints using Sandboxie.
    • Mitigation: Treat sandbox escape as host compromise; isolate sensitive systems until patched.
  • CVE-2026-50273: Datadog .NET baggage header denial of service
    • Impact: A crafted baggage header can exhaust CPU and memory on instrumented services.
    • Affected Systems: Datadog.Trace, Datadog.Trace.OpenTracing with affected .NET tracing versions; fixed in 3.43.0+.
    • Immediate Action: Upgrade to 3.43.0 or later; disable baggage extraction if you cannot patch.
    • Mitigation: Enforce upstream header size limits and remove baggage from propagation settings.
  • CVE-2026-50276: Datadog Ruby baggage header denial of service
    • Impact: Unbounded baggage parsing can crash or slow services through resource exhaustion.
    • Affected Systems: dd-trace-rb versions prior to 2.32.0.
    • Immediate Action: Upgrade to 2.32.0 or later.
    • Mitigation: Disable baggage extraction and cap request header sizes at the proxy.
  • CVE-2026-50285: Pomerium HPKE callback decompression bomb
    • Impact: A pre-auth callback request can trigger unbounded memory use and crash the proxy.
    • Affected Systems: Pomerium deployments using the hosted/stateless authenticate flow.
    • Immediate Action: Restrict access to /.pomerium/callback and patch immediately.
    • Mitigation: Add decompression limits and validate sender identity before decompression.
  • CVE-2026-50274: Datadog Go baggage header denial of service
    • Impact: Large baggage headers can drive unbounded CPU and memory use in Go services.
    • Affected Systems: github.com/DataDog/dd-trace-go and /v2 versions prior to 2.8.1.
    • Immediate Action: Upgrade to 2.8.1 or later.
    • Mitigation: Remove baggage from propagation configuration and enforce proxy header limits.
  • CVE-2026-50272: Datadog JavaScript baggage header denial of service
    • Impact: Attackers can overload instrumented Node.js services with oversized baggage headers.
    • Affected Systems: dd-trace-js versions prior to 5.100.0.
    • Immediate Action: Upgrade to 5.100.0 or later.
    • Mitigation: Disable baggage extraction and tighten request header limits.
  • CVE-2026-50271: Datadog Python baggage header denial of service
    • Impact: Oversized baggage headers can consume excessive resources in Python services.
    • Affected Systems: dd-trace-py versions prior to 4.8.2.
    • Immediate Action: Upgrade to 4.8.2 or later.
    • Mitigation: Remove baggage from propagation settings and cap header sizes upstream.
  • CVE-2026-50270: Datadog Java baggage header denial of service
    • Impact: Large baggage headers can degrade or crash Java services using Datadog tracing.
    • Affected Systems: dd-trace-java versions prior to 1.62.0; also affects com.datadoghq:dd-java-agent.
    • Immediate Action: Upgrade to 1.62.0 or later.
    • Mitigation: Disable baggage extraction and enforce strict request header limits.
  • CVE-2026-52890: Wekan attachment path traversal and special-file access
    • Impact: A logged-in board member can read arbitrary files or trigger denial of service through special files.
    • Affected Systems: Wekan versions prior to 9.31.
    • Immediate Action: Upgrade to 9.31 or later and audit attachment handling immediately.
    • Mitigation: Enforce storage-root containment checks and block unsafe attachment paths.

What to Do Now

  1. Patch the internet-facing apps first: Wekan, AVideo, Pomerium, Sandboxie-Plus, AdonisJS, ViewComponent, and the Datadog tracer packages.
  2. Disable risky features immediately: turn off Wekan header login, disable exposed local web UIs, remove baggage propagation where possible, and restrict admin panels to trusted networks.
  3. Assume exposure if defaults were used: services binding to 0.0.0.0, pre-auth callback routes, and unauthenticated internal APIs are especially dangerous.
  4. Verify versions and bindings:
    wekan >= 9.46
wekan >= 9.37
wekan >= 9.31
wekan >= 9.07
AVideo >= 29.0
@adonisjs/bodyparser >= 10.1.5 / 11.0.3
view_component patched release
Datadog tracers: .NET 3.43.0+, Ruby 2.32.0+, Go 2.8.1+, JS 5.100.0+, Python 4.8.2+, Java 1.62.0+
Sandboxie-Plus >= 1.17.6
  5. Monitor for abuse: look for suspicious avatar filenames, unexpected admin logins, abnormal WebSocket traffic, large baggage headers, repeated callback hits, and changes to documents or boards that users did not make.

Related Resources

  • Internal: add links to your organization’s incident response notes and patch tracking post for today’s advisories.
  • Official vendor advisories: Wekan release notes for 9.07, 9.31, 9.37, and 9.46; WWBN AVideo security patch commit 8be71e53ccbe9b84b30870db386fb4d2b11e1c16; Pomerium advisory and release notes; Sandboxie-Plus 1.17.6 release notes; Datadog tracer release advisories; AdonisJS bodyparser advisory; ViewComponent advisory; @andrea9293/mcp-documentation-server release notes.

Keep reading