---
title: "Security digest: January 29, 2026"
url: https://erroneo.us/security/2026-01-29/
description: "January 29, 2026 vulnerability digest: 1 brief (Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and…); 1 CISA KEV addition (Ivanti); 3 critical advisories (PyPI…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-01-29
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: January 29, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 3 critical advisories.

## Take stock

- Act now: Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340 . Every organization running on-premises Ivanti Endpoint Manager Mobile (EPMM) 12.5, 12.6 or 12.7, especially where the server is internet-facing, as it normally is for device enrollment.
- Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-01.
- PyPI: 1 critical advisory ( dfir-unfurl ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( github.com/siyuan-note/siyuan/kernel ). Check with govulncheck ./... .
- npm: 1 critical advisory ( deephas ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340](https://erroneo.us/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/index.md): On-premises Ivanti EPMM was open to unauthenticated remote command execution, exploited before disclosure and with a public PoC a day later; patch, confirm the RPM survived any later upgrade, and hunt for compromise.

## Known exploited (CISA KEV)

- [CVE-2026-1281](https://erroneo.us/security/cve/CVE-2026-1281/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (CISA due 2026-02-01)

## Critical advisories

- [GHSA-vg9h-jx4v-cwx2](https://erroneo.us/security/ghsa/GHSA-vg9h-jx4v-cwx2/index.md) Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure) — PyPI dfir-unfurl <= 20250810 → no fix
- [CVE-2026-25539](https://erroneo.us/security/cve/CVE-2026-25539/index.md) SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE — Go github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260126094835-d5d10dd41b0c → no fix
- [CVE-2026-25047](https://erroneo.us/security/cve/CVE-2026-25047/index.md) deepHas vulnerable to Prototype Pollution via constructor.prototype — npm deephas < 1.0.8 → 1.0.8

---
Source page: https://erroneo.us/security/2026-01-29/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt