Digest · Wednesday
Security digest: May 6, 2026
1 known exploited (cisa kev) addition and 24 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-09.
- Go: 7 critical advisories (
github.com/gotenberg/gotenberg/v8,github.com/gtsteffaniak/filebrowser,github.com/getaxonflow/axonflow,github.com/rancher/fleet,github.com/0xJacky/nginx-ui,github.com/argoproj/argo-cd/v3). Check withgovulncheck ./.... - npm: 6 critical advisories (
vm2,fast-jwt). Check withnpm audit (or: npm ls <package>). - PyPI: 5 critical advisories (
pytorch-lightning,rucio,wger,misp-modules). Check withpip-audit (or: pip show <package>). - Maven: 3 critical advisories (
org.apache.wicket:wicket-auth-roles,com.ritense.valtimo:document,com.ritense.valtimo:case,com.ritense.valtimo:contract,org.springframework.cloud:spring-cloud-config-server). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - Composer (PHP): 3 critical advisories (
thorsten/phpmyfaq,phpmyfaq/phpmyfaq,dedoc/scramble). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-0300 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | 2026-05-09 |
Critical advisories by ecosystem 24
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 7
Check: govulncheck ./...
- Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection CVE-2026-42589 CVSS 9.8 Critical
github.com/gotenberg/gotenberg/v8= 8.29.1 → no fix listed - FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion CVE-2026-44542 CVSS 9.1 Critical
github.com/gtsteffaniak/filebrowser< 0.0.0-20260501183844-112740bdd41d → fixed in 0.0.0-20260501183844-112740bdd41d - Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening GHSA-9h64-2846-7x7f CVSS 9.1 Critical
github.com/getaxonflow/axonflow< 7.5.0 → fixed in 7.5.0 - Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVE-2026-41050 CVSS 9.9 Critical
github.com/rancher/fleet>= 0.15.0, < 0.15.1 → fixed in 0.15.1;github.com/rancher/fleet>= 0.14.0, < 0.14.5 → fixed in 0.14.5;github.com/rancher/fleet>= 0.13.0, < 0.13.10 → fixed in 0.13.10; +2 more packages - Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook CVE-2026-42596 CVSS 9.4 Critical
github.com/gotenberg/gotenberg/v8<= 8.30.1 → fixed in 8.32.0 - Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore CVE-2026-42238 CVSS 9.0 Critical
github.com/0xJacky/nginx-ui< 2.3.8 → fixed in 2.3.8 - ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVE-2026-42880 CVSS 9.6 Critical
github.com/argoproj/argo-cd/v3>= 3.2.0, < 3.2.11 → fixed in 3.2.11;github.com/argoproj/argo-cd/v3>= 3.3.0, < 3.3.9 → fixed in 3.3.9
npm 6
Check: npm audit (or: npm ls <package>)
- vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape CVE-2026-44005 CVSS 10.0 Critical
vm2>= 3.9.6, <= 3.10.5 → fixed in 3.11.0 - vm2 has a Sandbox Escape Vulnerability CVE-2026-44006 CVSS 10.0 Critical
vm2<= 3.10.5 → fixed in 3.11.0 - fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver CVE-2026-44351 CVSS 9.1 Critical
fast-jwt<= 6.2.3 → fixed in 6.2.4 - vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape CVE-2026-43999 CVSS 9.9 Critical
vm2= 3.10.5 → fixed in 3.11.0 - vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution CVE-2026-44007 CVSS 9.1 Critical
vm2<= 3.11.0 → fixed in 3.11.1 - vm2 Access to Host Object Enables Sandbox Escape CVE-2026-43997 CVSS 10.0 Critical
vm2<= 3.10.5 → fixed in 3.11.0
PyPI 5
Check: pip-audit (or: pip show <package>)
- Compromise of PyTorch Lightning PyPi Package Versions CVE-2026-44484 CVSS 9.3 Critical
pytorch-lightning= 2.6.2 → no fix listed;pytorch-lightning= 2.6.3 → no fix listed - Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API CVE-2026-29080 CVSS 9.4 Critical
rucio>= 1.27.0, < 35.8.5 → fixed in 35.8.5;rucio>= 36.0.0, < 38.5.5 → fixed in 38.5.5;rucio>= 39.0.0, < 39.4.2 → fixed in 39.4.2; +1 more packages - wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVE-2026-43948 CVSS 9.9 Critical
wger<= 2.5 → fixed in 2.6 - misp-modules website - Missing CSRF protection in the website home blueprint CVE-2026-44364 CVSS 9.3 Critical
misp-modules<= 3.0.7 → no fix listed - Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API CVE-2026-29090 CVSS 9.0 Critical
rucio>= 1.30.0, < 35.8.5 → fixed in 35.8.5;rucio>= 36.0.0, < 38.5.5 → fixed in 38.5.5;rucio>= 39.0.0, < 39.4.2 → fixed in 39.4.2; +1 more packages
Composer (PHP) 3
Check: composer audit
- phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id CVE-2026-45010 CVSS 9.1 Critical
thorsten/phpmyfaq<= 4.1.1 → fixed in 4.1.2;phpmyfaq/phpmyfaq<= 4.1.1 → fixed in 4.1.2 - Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules CVE-2026-44262 CVSS 9.4 Critical
dedoc/scramble>= 0.13.2, <= 0.13.21 → fixed in 0.13.22 - phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha CVE-2026-46364 CVSS 9.8 Critical
thorsten/phpmyfaq<= 4.1.1 → fixed in 4.1.2;phpmyfaq/phpmyfaq<= 4.1.1 → fixed in 4.1.2
Maven 3
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Apache Wicket has a Session Fixation issue CVE-2026-40010 CVSS 9.1 Critical
org.apache.wicket:wicket-auth-roles>= 8.0.0-M1, <= 8.17.0 → no fix listed;org.apache.wicket:wicket-auth-roles>= 9.0.0-M1, <= 9.22.0 → no fix listed;org.apache.wicket:wicket-auth-roles>= 10.0.0-M1, <= 10.8.0 → fixed in 10.9.0 - Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users CVE-2026-42555 CVSS 9.1 Critical
com.ritense.valtimo:document>= 12.0.0, < 12.32.0 → fixed in 12.32.0;com.ritense.valtimo:case>= 13.0.0, < 13.23.0 → fixed in 13.23.0;com.ritense.valtimo:contract>= 13.4.0, < 13.23.0 → fixed in 13.23.0 - Spring Cloud Config vulnerable to Path Traversal CVE-2026-40982 CVSS 9.1 Critical
org.springframework.cloud:spring-cloud-config-server>= 4.1.0, <= 4.1.9 → no fix listed;org.springframework.cloud:spring-cloud-config-server>= 4.2.0, <= 4.2.6 → no fix listed;org.springframework.cloud:spring-cloud-config-server>= 4.3.0, <= 4.3.2 → fixed in 4.3.3; +2 more packages