Digest · Tuesday

Security digest: May 5, 2026

17 critical advisories.

Take stock

npm: 5 critical advisories (vm2, magicmirror). Check with npm audit (or: npm ls <package>).
Composer (PHP): 4 critical advisories (getgrav/grav, openmage/magento-lts). Check with composer audit.
PyPI: 4 critical advisories (firefighter-incident, langflow, django-s3file, codechecker). Check with pip-audit (or: pip show <package>).
Go: 2 critical advisories (github.com/oxyno-zeta/s3-proxy, github.com/l3montree-dev/devguard). Check with govulncheck ./....
Maven: 2 critical advisories (com.arcadedb:arcadedb-server, org.eclipse.basyx:basyx.sdk). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: npm audit (or: npm ls <package>)

VM2 Has Sandbox Breakout Through Inspect Function CVE-2026-24781 CVSS 9.8 Critical
vm2 <= 3.10.3 → fixed in 3.11.0
VM2 Has Sandbox Breakout Through Promise Species CVE-2026-24120 CVSS 9.8 Critical
vm2 <= 3.10.3 → fixed in 3.10.5
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint CVE-2026-42281 CVSS 9.2 Critical
magicmirror <= 2.35.0 → fixed in 2.36.0
VM2 Has a WASM Sandbox Escape CVE-2026-26956 CVSS 9.8 Critical
vm2 <= 3.10.4 → fixed in 3.10.5
VM2 Has a Sandbox Escape Issue via SuppressedError CVE-2026-26332 CVSS 9.8 Critical
vm2 <= 3.10.4 → fixed in 3.11.0

Check: composer audit

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature CVE-2026-42607 CVSS 9.1 Critical
getgrav/grav < 2.0.0-beta.2 → fixed in 2.0.0-beta.2
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass GHSA-vj3m-2g9h-vm4p
getgrav/grav < 2.0.0-beta.2 → fixed in 2.0.0-beta.2
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access CVE-2026-42613 CVSS 9.4 Critical
getgrav/grav < 2.0.0-beta.2 → fixed in 2.0.0-beta.2
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs CVE-2026-42155 CVSS 9.3 Critical
openmage/magento-lts <= 20.17.0 → fixed in 20.18.0

Check: pip-audit (or: pip show <package>)

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft CVE-2026-42864 CVSS 9.9 Critical
firefighter-incident < 0.0.54 → fixed in 0.0.54
Langflow Knowledge Bases API is Vulnerable to Path Traversal CVE-2026-42048 CVSS 9.6 Critical
langflow <= 1.8.4 → fixed in 1.9.0
django-s3file is vulnerable to relative path traversal CVE-2026-42196 CVSS 9.9 Critical
django-s3file <= 7.0.1 → fixed in 7.0.2
Codechecker has an authentication bypass for certain API calls CVE-2026-25660 CVSS 9.3 Critical
codechecker <= 6.27.3 → no fix listed

Check: govulncheck ./...

S3-Proxy has Security Issues in its Resource Path Matching Implementation CVE-2026-42882 CVSS 9.4 Critical
github.com/oxyno-zeta/s3-proxy < 0.0.0-20260424211602-1320e4abd46a → fixed in 0.0.0-20260424211602-1320e4abd46a
DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header CVE-2026-42300 CVSS 9.3 Critical
github.com/l3montree-dev/devguard < 1.2.2 → fixed in 1.2.2

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases CVE-2026-44221 CVSS 9.0 Critical
com.arcadedb:arcadedb-server >= 21.10.1, < 26.4.2 → fixed in 26.4.2
Eclipse BaSyx Java Server SDK vulnerable to Path Traversal CVE-2026-7411 CVSS 10.0 Critical
org.eclipse.basyx:basyx.sdk < 2.0.0-milestone-10 → fixed in 2.0.0-milestone-10