--- title: "Security digest: May 4, 2026" url: https://erroneo.us/security/2026-05-04/ description: "May 4, 2026 vulnerability digest: 15 critical advisories (Maven, Go, crates.io (Rust)…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-05-04 date_modified: 2026-05-04 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: May 4, 2026 15 critical advisories. ## Take stock - Maven: 9 critical advisories ( org.openmrs.api:openmrs-api , org.apache.polaris:polaris-runtime-service , org.apache.polaris:polaris-core , org.apache.opennlp:opennlp-tools , org.thymeleaf:thymeleaf , org.thymeleaf:thymeleaf-spring5 , org.thymeleaf:thymeleaf-spring6 , org.openmrs.web:openmrs-web ). Check with mvn dependency:tree -Dincludes=: . - crates.io (Rust): 2 critical advisories ( sui-execution-cut , mysten-metrics ). Check with cargo audit . - Go: 1 critical advisory ( github.com/pelicanplatform/pelican ). Check with govulncheck ./... . - npm: 1 critical advisory ( vm2 ). Check with npm audit (or: npm ls ) . - Composer (PHP): 1 critical advisory ( nabeel/phpvms ). Check with composer audit . - PyPI: 1 critical advisory ( archivebox ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-41258](https://erroneo.us/security/cve/CVE-2026-41258/index.md) OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange — Maven org.openmrs.api:openmrs-api >= 2.7.0, < 2.7.9 → 2.7.9; Maven org.openmrs.api:openmrs-api >= 2.8.0, < 2.8.6 → 2.8.6 - [CVE-2026-42812](https://erroneo.us/security/cve/CVE-2026-42812/index.md) Apache Polaris has an Improper Input Validation issue — Maven org.apache.polaris:polaris-runtime-service >= 0.9.0, < 1.4.1 → 1.4.1 - [CVE-2026-42810](https://erroneo.us/security/cve/CVE-2026-42810/index.md) Apache Polaris has an Improper Input Validation Issue — Maven org.apache.polaris:polaris-core < 1.4.1 → 1.4.1 - [CVE-2026-42571](https://erroneo.us/security/cve/CVE-2026-42571/index.md) Pelican Web UI Affected by a Privilege Escalation Attack — Go github.com/pelicanplatform/pelican < 0.0.0-20260408120501-7f73b9c3e677 → 0.0.0-20260408120501-7f73b9c3e677 - [GHSA-qprh-m6p3-hwxc](https://erroneo.us/security/ghsa/GHSA-qprh-m6p3-hwxc/index.md) `sui-execution-cut` was removed from crates.io for malicious code — crates.io (Rust) sui-execution-cut >= 0 → no fix - [CVE-2026-24118](https://erroneo.us/security/cve/CVE-2026-24118/index.md) VM2 Sandbox Breakout Through __lookupGetter__ — npm vm2 <= 3.10.4 → 3.11.0 - [GHSA-g38r-8gmr-ghrf](https://erroneo.us/security/ghsa/GHSA-g38r-8gmr-ghrf/index.md) `mysten-metrics` was removed from crates.io for malicious code — crates.io (Rust) mysten-metrics >= 0 → no fix - [CVE-2026-42569](https://erroneo.us/security/cve/CVE-2026-42569/index.md) phpVMS has an /importer authorization bypass causing full database wipe — Composer (PHP) nabeel/phpvms < 7.0.6 → 7.0.6 - [CVE-2026-42811](https://erroneo.us/security/cve/CVE-2026-42811/index.md) Apache Polaris has an Improper Input Validation issue — Maven org.apache.polaris:polaris-core < 1.4.1 → 1.4.1 - [CVE-2026-42027](https://erroneo.us/security/cve/CVE-2026-42027/index.md) Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest — Maven org.apache.opennlp:opennlp-tools >= 3.0.0-M1, < 3.0.0-M3 → 3.0.0-M3; Maven org.apache.opennlp:opennlp-tools >= 2.0.0, < 2.5.9 → 2.5.9; Maven org.apache.opennlp:opennlp-tools < 1.9.5 → 1.9.5 - [CVE-2026-41901](https://erroneo.us/security/cve/CVE-2026-41901/index.md) Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns — Maven org.thymeleaf:thymeleaf <= 3.1.4.RELEASE → 3.1.5.RELEASE; Maven org.thymeleaf:thymeleaf-spring5 <= 3.1.4.RELEASE → 3.1.5.RELEASE; Maven org.thymeleaf:thymeleaf-spring6 <= 3.1.4.RELEASE → 3.1.5.RELEASE - [CVE-2026-42809](https://erroneo.us/security/cve/CVE-2026-42809/index.md) Apache Polaris has an Improper Input Validation Issue — Maven org.apache.polaris:polaris-runtime-service < 1.4.1 → 1.4.1 - [CVE-2026-40076](https://erroneo.us/security/cve/CVE-2026-40076/index.md) OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip) — Maven org.openmrs.web:openmrs-web <= 2.7.8 → no fix; Maven org.openmrs.web:openmrs-web >= 2.8.0, <= 2.8.5 → no fix - [CVE-2026-40682](https://erroneo.us/security/cve/CVE-2026-40682/index.md) Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing — Maven org.apache.opennlp:opennlp-tools >= 3.0.0-M1, < 3.0.0-M3 → 3.0.0-M3; Maven org.apache.opennlp:opennlp-tools >= 2.0.0, < 2.5.9 → 2.5.9; Maven org.apache.opennlp:opennlp-tools < 1.9.5 → 1.9.5 - [CVE-2026-42601](https://erroneo.us/security/cve/CVE-2026-42601/index.md) ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView — PyPI archivebox <= 0.8.6rc0 → no fix --- Source page: https://erroneo.us/security/2026-05-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt