---
title: "Security digest: September 18, 2024"
url: https://erroneo.us/security/2024-09-18/
description: "September 18, 2024 vulnerability digest: 4 CISA KEV additions (Apache, Microsoft, Oracle); 2 critical advisories (PyPI, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-09-18
date_modified: 2024-09-18
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 18, 2024

4 known exploited (cisa kev) additions and 2 critical advisories.

## Take stock

- Do you run any of these? Apache HugeGraph-Server, Oracle ADF Faces, Oracle WebLogic Server, Microsoft SQL Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-10-09.
- PyPI: 1 critical advisory ( langchain-experimental ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( github.com/chaosblade-io/chaosblade ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2024-27348](https://erroneo.us/security/cve/CVE-2024-27348/index.md) Apache HugeGraph-Server: Apache HugeGraph-Server Improper Access Control Vulnerability (CISA due 2024-10-09)
- [CVE-2022-21445](https://erroneo.us/security/cve/CVE-2022-21445/index.md) Oracle ADF Faces: Oracle ADF Faces Deserialization of Untrusted Data Vulnerability (CISA due 2024-10-09)
- [CVE-2020-14644](https://erroneo.us/security/cve/CVE-2020-14644/index.md) Oracle WebLogic Server: Oracle WebLogic Server Remote Code Execution Vulnerability (CISA due 2024-10-09)
- [CVE-2020-0618](https://erroneo.us/security/cve/CVE-2020-0618/index.md) Microsoft SQL Server: Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability (CISA due 2024-10-09)

## Critical advisories

- [CVE-2024-46946](https://erroneo.us/security/cve/CVE-2024-46946/index.md) LangChain Experimental Eval Injection vulnerability — PyPI langchain-experimental >= 0.1.17, <= 0.3.0 → no fix
- [CVE-2023-47105](https://erroneo.us/security/cve/CVE-2023-47105/index.md) Chaosblade vulnerable to OS command execution — Go github.com/chaosblade-io/chaosblade >= 0.0.3, < 1.7.4 → 1.7.4

---
Source page: https://erroneo.us/security/2024-09-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt