---
title: "Security digest: January 20, 2026"
url: https://erroneo.us/security/2026-01-20/
description: "January 20, 2026 vulnerability digest: 1 brief (Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw…); 6 critical advisories (Maven, npm, Go). What to patch and…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-01-20
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: January 20, 2026

1 editorial brief and 6 critical advisories.

## Take stock

- Act now: Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV . Anyone running Oracle HTTP Server or the WebLogic Server Proxy Plug-in 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0 in front of WebLogic, most urgently on internet-facing or DMZ hosts.
- Maven: 2 critical advisories ( fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker , fr.opensagres.xdocreport:fr.opensagres.xdocreport.document ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 2 critical advisories ( @orval/core , @lobehub/chat ). Check with npm audit (or: npm ls <package>) .
- Go: 2 critical advisories ( github.com/external-secrets/external-secrets , github.com/fleetdm/fleet ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV](https://erroneo.us/security/briefs/oracle-http-server-weblogic-proxy-cve-2026-21962/index.md): If an Oracle HTTP Server, Apache or IIS front end with the WebLogic proxy plug-in still lacks the January 2026 CPU, patch it now; exploit code has been public since January and the bug is now confirmed exploited.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-64087](https://erroneo.us/security/cve/CVE-2025-64087/index.md) XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability — Maven fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker < 2.2.0 → 2.2.0
- [CVE-2026-23947](https://erroneo.us/security/cve/CVE-2026-23947/index.md) Orval has a code injection via unsanitized x-enum-descriptions in enum generation — npm @orval/core >= 8.0.0-rc.0, < 8.0.2 → 8.0.2; npm @orval/core < 7.19.0 → 7.19.0
- [CVE-2025-65482](https://erroneo.us/security/cve/CVE-2025-65482/index.md) XDocReport affected by an XML External Entity (XXE) vulnerability — Maven fr.opensagres.xdocreport:fr.opensagres.xdocreport.document >= 0.9.2, < 2.0.4 → 2.0.4
- [CVE-2026-22822](https://erroneo.us/security/cve/CVE-2026-22822/index.md) External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function — Go github.com/external-secrets/external-secrets >= 0.20.2, < 1.2.0 → 1.2.0
- [CVE-2026-23518](https://erroneo.us/security/cve/CVE-2026-23518/index.md) Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment — Go github.com/fleetdm/fleet >= 4.78.0, < 4.78.3 → 4.78.3; Go github.com/fleetdm/fleet >= 4.77.0, < 4.77.1 → 4.77.1; Go github.com/fleetdm/fleet >= 4.76.0, < 4.76.2 → 4.76.2
- [CVE-2026-23733](https://erroneo.us/security/cve/CVE-2026-23733/index.md) Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) — npm @lobehub/chat <= 1.143.2 → no fix

---
Source page: https://erroneo.us/security/2026-01-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt