Digest · Friday
Security digest: February 6, 2026
10 critical advisories.
All digests · RSS · Markdown
Take stock
- crates.io (Rust): 5 critical advisories (
uniswap-utils,finch-rust,evm-units,sha-rust,polymarket-clients-sdk). Check withcargo audit. - PyPI: 3 critical advisories (
keylime,dydx-v4-client,semantic-kernel). Check withpip-audit (or: pip show <package>). - Go: 1 critical advisory (
gogs.io/gogs). Check withgovulncheck ./.... - NuGet: 1 critical advisory (
Microsoft.SemanticKernel.Core). Check withdotnet list package --vulnerable --include-transitive. - Composer (PHP): 1 critical advisory (
devcode-it/openstamanager). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 10
GitHub-reviewed advisories rated critical, published this day (Pacific time).
crates.io (Rust) 5
Check: cargo audit
- `uniswap-utils` was removed from crates.io for malicious code GHSA-x468-phr8-h3p3
uniswap-utils>= 0 → no fix listed - `finch-rust` was removed from crates.io for malicious code GHSA-f8h5-x737-x4xr
finch-rust>= 0 → no fix listed - `evm-units` was removed from crates.io for malicious code GHSA-6662-54xr-8423
evm-units>= 0 → no fix listed - `sha-rust` was removed from crates.io for malicious code GHSA-3mmg-7c2q-8938
sha-rust>= 0 → no fix listed - `polymarket-clients-sdk` was removed from crates.io for malicious code GHSA-382q-fpqh-29f7
polymarket-clients-sdk>= 0 → no fix listed
PyPI 3
Check: pip-audit (or: pip show <package>)
- Keylime Missing Authentication for Critical Function and Improper Authentication CVE-2026-1709 CVSS 9.4 Critical
keylime>= 7.12.0, < 7.12.2 → fixed in 7.12.2;keylime= 7.13.0 → fixed in 7.13.1 - A single post-release of dydx-v4-client contained obfuscated multi-stage loader GHSA-4f84-67cv-qrv3 CVSS 9.3 Critical
dydx-v4-client= 1.1.5.post1 → fixed in 1.1.5 - Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK CVE-2026-25592 CVSS 9.9 Critical
semantic-kernel< 1.39.3 → fixed in 1.39.3;Microsoft.SemanticKernel.Core< 1.71.0 → fixed in 1.71.0
Composer (PHP) 1
Check: composer audit
- OpenSTAManager has an OS Command Injection in P7M File Processing CVE-2025-69212 CVSS 9.4 Critical
devcode-it/openstamanager<= 2.9.8 → no fix listed
Go 1
Check: govulncheck ./...
- Gogs's update .git/config file allows remote command execution CVE-2025-64111 CVSS 9.3 Critical
gogs.io/gogs<= 0.13.3 → fixed in 0.13.4
NuGet 1
Check: dotnet list package --vulnerable --include-transitive
- Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK CVE-2026-25592 CVSS 9.9 Critical
semantic-kernel< 1.39.3 → fixed in 1.39.3;Microsoft.SemanticKernel.Core< 1.71.0 → fixed in 1.71.0