---
title: "Security digest: January 26, 2026"
url: https://erroneo.us/security/2026-01-26/
description: "January 26, 2026 vulnerability digest: 5 CISA KEV additions (GNU, Linux, Microsoft, SmarterTools); 4 critical advisories (npm, PyPI, crates.io (Rust)…).…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-01-26
date_modified: 2026-01-26
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: January 26, 2026

5 known exploited (cisa kev) additions and 4 critical advisories.

## Take stock

- Do you run any of these? GNU InetUtils, SmarterTools SmarterMail, Microsoft Office, Linux Kernel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-16.
- npm: 3 critical advisories ( @saltcorn/server , vm2 , @phala/dcap-qvl , @phala/dcap-qvl-web , @phala/dcap-qvl-node ). Check with npm audit (or: npm ls <package>) .
- PyPI: 1 critical advisory ( dcap-qvl ). Check with pip-audit (or: pip show <package>) .
- crates.io (Rust): 1 critical advisory ( dcap-qvl ). Check with cargo audit .
- Maven: 1 critical advisory ( org.apache.continuum:continuum ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-24061](https://erroneo.us/security/cve/CVE-2026-24061/index.md) GNU InetUtils: GNU InetUtils Argument Injection Vulnerability (CISA due 2026-02-16)
- [CVE-2026-23760](https://erroneo.us/security/cve/CVE-2026-23760/index.md) SmarterTools SmarterMail: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability (CISA due 2026-02-16)
- [CVE-2026-21509](https://erroneo.us/security/cve/CVE-2026-21509/index.md) Microsoft Office: Microsoft Office Security Feature Bypass Vulnerability (CISA due 2026-02-16)
- [CVE-2025-52691](https://erroneo.us/security/cve/CVE-2025-52691/index.md) SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability (CISA due 2026-02-16)
- [CVE-2018-14634](https://erroneo.us/security/cve/CVE-2018-14634/index.md) Linux Kernel: Linux Kernel Integer Overflow Vulnerability (CISA due 2026-02-16)

## Critical advisories

- [GHSA-cr3w-cw5w-h3fj](https://erroneo.us/security/ghsa/GHSA-cr3w-cw5w-h3fj/index.md) Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE — npm @saltcorn/server >= 1.1.1, < 1.5.0-beta.19 → 1.5.0-beta.19
- [CVE-2026-22709](https://erroneo.us/security/cve/CVE-2026-22709/index.md) vm2 has a Sandbox Escape — npm vm2 <= 3.10.1 → 3.10.2
- [CVE-2026-22696](https://erroneo.us/security/cve/CVE-2026-22696/index.md) dcap-qvl has Missing Verification for QE Identity — crates.io (Rust) dcap-qvl < 0.3.9 → 0.3.9; npm @phala/dcap-qvl <= 0.3.0 → 0.3.9; npm @phala/dcap-qvl-web <= 0.3.3 → no fix
- [CVE-2016-15057](https://erroneo.us/security/cve/CVE-2016-15057/index.md) Apache Continuum vulnerable to Command Injection through Installations REST API — Maven org.apache.continuum:continuum <= 1.4.2 → no fix

---
Source page: https://erroneo.us/security/2026-01-26/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt