Security Advisory - Published 2026-06-20 - Mixed App / Gateway / Legacy Desktop
Mixed June CVEs: check gateways, self-hosted apps, and old updater services
This small batch covers different environments: Apache APISIX gateway authentication, Mercator server-side fetch behavior, Slopsmith file access, and legacy Comodo browser updater services on Windows. The common fix path is exposure reduction first, then logs and installed-service cleanup.
Affected systems
| CVE | Product | Affected | Review | CVSS |
|---|---|---|---|---|
| CVE-2016-20088 | Comodo Chromodo Browser | <= 52.15.25.664 | Windows services, old browser installs, and updater paths | 8.5 |
| CVE-2016-20090 | Comodo Dragon Browser | <= 52.15.25.663 | Windows services, old browser installs, and updater paths | 8.5 |
| CVE-2026-49290 | Slopsmith | before 0.2.9-alpha.5 | media library paths, container mounts, and access logs | 7.6 |
| CVE-2026-39999 | Apache APISIX | vendor advisory | gateway routes, authentication plugins, and unusual upstream access | 7.0 |
| CVE-2026-49345 | Mercator | before 2025.05.19 | outbound requests, Redis/internal access, and web logs | 5.3 |
Owner self-check
apisix version 2>/dev/null
grep -Rni 'auth\\|jwt\\|openid\\|consumer\\|route' /usr/local/apisix /etc/apisix 2>/dev/null
find . -type f -mtime -10 | egrep 'slopsmith|mercator|config|\\.log$|\\.php$|\\.py$|\\.js$'
powershell -NoProfile -Command "Get-CimInstance Win32_Service | Where-Object {$_.Name -match 'Dragon|Chromodo|Comodo'} | Select-Object Name,State,StartName,PathName"What to review
- APISIX routes and authentication plugins that protect internal or administrative upstreams.
- Mercator outbound requests, internal host access, Redis/internal service access, and web logs.
- Slopsmith media paths, container mounts, and files accessed outside normal music-library folders.
- Old Comodo browser updater services still installed on Windows workstations or jump boxes.
Safe fix path
- Patch the affected product where a vendor fix exists. Remove legacy software that is no longer needed.
- Restrict gateway and self-hosted app exposure while logs are reviewed.
- For Windows updater services, remove old browsers and verify service paths after uninstall.
- Rotate secrets if gateway logs, SSRF indicators, or unexpected file access suggest compromise.
Repair help
Use Ping7 CVE Repair when a gateway was exposed, internal services may have been reached, old Windows services remain installed, or app logs need a second pass.