Digest · Monday
Security digest: January 26, 2026
5 known exploited (cisa kev) additions and 4 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? GNU InetUtils, SmarterTools SmarterMail, Microsoft Office, Linux Kernel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-16.
- npm: 3 critical advisories (
@saltcorn/server,vm2,@phala/dcap-qvl,@phala/dcap-qvl-web,@phala/dcap-qvl-node). Check withnpm audit (or: npm ls <package>). - PyPI: 1 critical advisory (
dcap-qvl). Check withpip-audit (or: pip show <package>). - crates.io (Rust): 1 critical advisory (
dcap-qvl). Check withcargo audit. - Maven: 1 critical advisory (
org.apache.continuum:continuum). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 5
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-24061 | GNU InetUtils GNU InetUtils Argument Injection Vulnerability | 2026-02-16 |
| CVE-2026-23760 | SmarterTools SmarterMail SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability Ransomware | 2026-02-16 |
| CVE-2026-21509 | Microsoft Office Microsoft Office Security Feature Bypass Vulnerability | 2026-02-16 |
| CVE-2025-52691 | SmarterTools SmarterMail SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability Ransomware | 2026-02-16 |
| CVE-2018-14634 | Linux Kernel Linux Kernel Integer Overflow Vulnerability | 2026-02-16 |
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 3
Check: npm audit (or: npm ls <package>)
- Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE GHSA-cr3w-cw5w-h3fj CVSS 9.6 Critical
@saltcorn/server>= 1.1.1, < 1.5.0-beta.19 → fixed in 1.5.0-beta.19 - vm2 has a Sandbox Escape CVE-2026-22709 CVSS 9.8 Critical
vm2<= 3.10.1 → fixed in 3.10.2 - dcap-qvl has Missing Verification for QE Identity CVE-2026-22696 CVSS 9.3 Critical
dcap-qvl< 0.3.9 → fixed in 0.3.9;@phala/dcap-qvl<= 0.3.0 → fixed in 0.3.9;@phala/dcap-qvl-web<= 0.3.3 → no fix listed; +2 more packages
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Apache Continuum vulnerable to Command Injection through Installations REST API CVE-2016-15057 CVSS 9.9 Critical
org.apache.continuum:continuum<= 1.4.2 → no fix listed
PyPI 1
Check: pip-audit (or: pip show <package>)
- dcap-qvl has Missing Verification for QE Identity CVE-2026-22696 CVSS 9.3 Critical
dcap-qvl< 0.3.9 → fixed in 0.3.9;@phala/dcap-qvl<= 0.3.0 → fixed in 0.3.9;@phala/dcap-qvl-web<= 0.3.3 → no fix listed; +2 more packages
crates.io (Rust) 1
Check: cargo audit
- dcap-qvl has Missing Verification for QE Identity CVE-2026-22696 CVSS 9.3 Critical
dcap-qvl< 0.3.9 → fixed in 0.3.9;@phala/dcap-qvl<= 0.3.0 → fixed in 0.3.9;@phala/dcap-qvl-web<= 0.3.3 → no fix listed; +2 more packages