Digest · Friday
Security digest: January 9, 2026
4 critical advisories.
All digests · RSS · Markdown
Take stock
- Maven: 2 critical advisories (
com.alibaba:fastjson,org.xwiki.contrib:macro-fullcalendar-pom). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - PyPI: 1 critical advisory (
uni2ts). Check withpip-audit (or: pip show <package>). - Go: 1 critical advisory (
github.com/Tencent/WeKnora). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 2
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- FASTJSON Includes Functionality from Untrusted Control Sphere CVE-2025-70974 CVSS 10.0 Critical
com.alibaba:fastjson< 1.2.48 → fixed in 1.2.48 - XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService CVE-2025-65091 CVSS 10.0 Critical
org.xwiki.contrib:macro-fullcalendar-pom<= 2.4.3 → fixed in 2.4.5
Go 1
Check: govulncheck ./...
- WeKnora has Command Injection in MCP stdio test CVE-2026-22688 CVSS 9.9 Critical
github.com/Tencent/WeKnora< 0.2.5 → fixed in 0.2.5
PyPI 1
Check: pip-audit (or: pip show <package>)
- Salesforce Uni2TS has a Code Injection vulnerability CVE-2026-22584 CVSS 9.8 Critical
uni2ts<= 1.2.0 → fixed in 2.0.0