Digest · Friday
Security digest: January 16, 2026
4 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 2 critical advisories (
crawl4ai,Crawl4AI). Check withpip-audit (or: pip show <package>). - crates.io (Rust): 1 critical advisory (
deno). Check withcargo audit. - npm: 1 critical advisory (
@mcpjam/inspector). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 2
Check: pip-audit (or: pip show <package>)
- Crawl4AI Has Local File Inclusion in Docker API via file:// URLs CVE-2026-26217 CVSS 9.2 Critical
crawl4ai< 0.8.0 → fixed in 0.8.0 - Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter CVE-2026-26216 CVSS 10.0 Critical
Crawl4AI< 0.8.0 → fixed in 0.8.0
npm 1
Check: npm audit (or: npm ls <package>)
- REC in MCPJam inspector due to HTTP Endpoint exposes CVE-2026-23744 CVSS 9.8 Critical
@mcpjam/inspector<= 1.4.2 → fixed in 1.4.3
crates.io (Rust) 1
Check: cargo audit
- Deno node:crypto doesn't finalize cipher CVE-2026-22863 CVSS 9.2 Critical
deno<= 2.5.6 → fixed in 2.6.0