--- title: "Security digest: May 6, 2026" url: https://erroneo.us/security/2026-05-06/ description: "May 6, 2026 vulnerability digest: 1 CISA KEV addition (Palo Alto Networks); 24 critical advisories (PyPI, npm, Go, Maven…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-05-06 date_modified: 2026-05-06 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: May 6, 2026 1 known exploited (cisa kev) addition and 24 critical advisories. ## Take stock - Do you run any of these? Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-09. - Go: 7 critical advisories ( github.com/gotenberg/gotenberg/v8 , github.com/gtsteffaniak/filebrowser , github.com/getaxonflow/axonflow , github.com/rancher/fleet , github.com/0xJacky/nginx-ui , github.com/argoproj/argo-cd/v3 ). Check with govulncheck ./... . - npm: 6 critical advisories ( vm2 , fast-jwt ). Check with npm audit (or: npm ls ) . - PyPI: 5 critical advisories ( pytorch-lightning , rucio , wger , misp-modules ). Check with pip-audit (or: pip show ) . - Maven: 3 critical advisories ( org.apache.wicket:wicket-auth-roles , com.ritense.valtimo:document , com.ritense.valtimo:case , com.ritense.valtimo:contract , org.springframework.cloud:spring-cloud-config-server ). Check with mvn dependency:tree -Dincludes=: . - Composer (PHP): 3 critical advisories ( thorsten/phpmyfaq , phpmyfaq/phpmyfaq , dedoc/scramble ). Check with composer audit . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2026-0300](https://erroneo.us/security/cve/CVE-2026-0300/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability (CISA due 2026-05-09) ## Critical advisories - [CVE-2026-44484](https://erroneo.us/security/cve/CVE-2026-44484/index.md) Compromise of PyTorch Lightning PyPi Package Versions — PyPI pytorch-lightning = 2.6.2 → no fix; PyPI pytorch-lightning = 2.6.3 → no fix - [CVE-2026-44005](https://erroneo.us/security/cve/CVE-2026-44005/index.md) vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape — npm vm2 >= 3.9.6, <= 3.10.5 → 3.11.0 - [CVE-2026-29080](https://erroneo.us/security/cve/CVE-2026-29080/index.md) Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API — PyPI rucio >= 1.27.0, < 35.8.5 → 35.8.5; PyPI rucio >= 36.0.0, < 38.5.5 → 38.5.5; PyPI rucio >= 39.0.0, < 39.4.2 → 39.4.2 - [CVE-2026-42589](https://erroneo.us/security/cve/CVE-2026-42589/index.md) Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection — Go github.com/gotenberg/gotenberg/v8 = 8.29.1 → no fix - [CVE-2026-40010](https://erroneo.us/security/cve/CVE-2026-40010/index.md) Apache Wicket has a Session Fixation issue — Maven org.apache.wicket:wicket-auth-roles >= 8.0.0-M1, <= 8.17.0 → no fix; Maven org.apache.wicket:wicket-auth-roles >= 9.0.0-M1, <= 9.22.0 → no fix; Maven org.apache.wicket:wicket-auth-roles >= 10.0.0-M1, <= 10.8.0 → 10.9.0 - [CVE-2026-44006](https://erroneo.us/security/cve/CVE-2026-44006/index.md) vm2 has a Sandbox Escape Vulnerability — npm vm2 <= 3.10.5 → 3.11.0 - [CVE-2026-43948](https://erroneo.us/security/cve/CVE-2026-43948/index.md) wger: cross-tenant password reset and plaintext disclosure via gym=None bypass — PyPI wger <= 2.5 → 2.6 - [CVE-2026-42555](https://erroneo.us/security/cve/CVE-2026-42555/index.md) Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users — Maven com.ritense.valtimo:document >= 12.0.0, < 12.32.0 → 12.32.0; Maven com.ritense.valtimo:case >= 13.0.0, < 13.23.0 → 13.23.0; Maven com.ritense.valtimo:contract >= 13.4.0, < 13.23.0 → 13.23.0 - [CVE-2026-44364](https://erroneo.us/security/cve/CVE-2026-44364/index.md) misp-modules website - Missing CSRF protection in the website home blueprint — PyPI misp-modules <= 3.0.7 → no fix - [CVE-2026-44351](https://erroneo.us/security/cve/CVE-2026-44351/index.md) fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver — npm fast-jwt <= 6.2.3 → 6.2.4 - [CVE-2026-44542](https://erroneo.us/security/cve/CVE-2026-44542/index.md) FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion — Go github.com/gtsteffaniak/filebrowser < 0.0.0-20260501183844-112740bdd41d → 0.0.0-20260501183844-112740bdd41d - [CVE-2026-45010](https://erroneo.us/security/cve/CVE-2026-45010/index.md) phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id — Composer (PHP) thorsten/phpmyfaq <= 4.1.1 → 4.1.2; Composer (PHP) phpmyfaq/phpmyfaq <= 4.1.1 → 4.1.2 - [GHSA-9h64-2846-7x7f](https://erroneo.us/security/ghsa/GHSA-9h64-2846-7x7f/index.md) Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening — Go github.com/getaxonflow/axonflow < 7.5.0 → 7.5.0 - [CVE-2026-43999](https://erroneo.us/security/cve/CVE-2026-43999/index.md) vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape — npm vm2 = 3.10.5 → 3.11.0 - [CVE-2026-44007](https://erroneo.us/security/cve/CVE-2026-44007/index.md) vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution — npm vm2 <= 3.11.0 → 3.11.1 - [CVE-2026-41050](https://erroneo.us/security/cve/CVE-2026-41050/index.md) Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering — Go github.com/rancher/fleet >= 0.15.0, < 0.15.1 → 0.15.1; Go github.com/rancher/fleet >= 0.14.0, < 0.14.5 → 0.14.5; Go github.com/rancher/fleet >= 0.13.0, < 0.13.10 → 0.13.10 - [CVE-2026-29090](https://erroneo.us/security/cve/CVE-2026-29090/index.md) Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API — PyPI rucio >= 1.30.0, < 35.8.5 → 35.8.5; PyPI rucio >= 36.0.0, < 38.5.5 → 38.5.5; PyPI rucio >= 39.0.0, < 39.4.2 → 39.4.2 - [CVE-2026-40982](https://erroneo.us/security/cve/CVE-2026-40982/index.md) Spring Cloud Config vulnerable to Path Traversal — Maven org.springframework.cloud:spring-cloud-config-server >= 4.1.0, <= 4.1.9 → no fix; Maven org.springframework.cloud:spring-cloud-config-server >= 4.2.0, <= 4.2.6 → no fix; Maven org.springframework.cloud:spring-cloud-config-server >= 4.3.0, <= 4.3.2 → 4.3.3 - [CVE-2026-42596](https://erroneo.us/security/cve/CVE-2026-42596/index.md) Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook — Go github.com/gotenberg/gotenberg/v8 <= 8.30.1 → 8.32.0 - [CVE-2026-44262](https://erroneo.us/security/cve/CVE-2026-44262/index.md) Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules — Composer (PHP) dedoc/scramble >= 0.13.2, <= 0.13.21 → 0.13.22 - [CVE-2026-42238](https://erroneo.us/security/cve/CVE-2026-42238/index.md) Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore — Go github.com/0xJacky/nginx-ui < 2.3.8 → 2.3.8 - [CVE-2026-43997](https://erroneo.us/security/cve/CVE-2026-43997/index.md) vm2 Access to Host Object Enables Sandbox Escape — npm vm2 <= 3.10.5 → 3.11.0 - [CVE-2026-42880](https://erroneo.us/security/cve/CVE-2026-42880/index.md) ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction — Go github.com/argoproj/argo-cd/v3 >= 3.2.0, < 3.2.11 → 3.2.11; Go github.com/argoproj/argo-cd/v3 >= 3.3.0, < 3.3.9 → 3.3.9 - [CVE-2026-46364](https://erroneo.us/security/cve/CVE-2026-46364/index.md) phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha — Composer (PHP) thorsten/phpmyfaq <= 4.1.1 → 4.1.2; Composer (PHP) phpmyfaq/phpmyfaq <= 4.1.1 → 4.1.2 --- Source page: https://erroneo.us/security/2026-05-06/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt