Digest · Thursday
Security digest: May 7, 2026
1 known exploited (cisa kev) addition and 9 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-10.
- npm: 4 critical advisories (
parse-ini,query-string-parser,intercom-client,@jswork/next-npm-version). Check withnpm audit (or: npm ls <package>). - crates.io (Rust): 3 critical advisories (
zebrad,zebra-script). Check withcargo audit. - Go: 1 critical advisory (
github.com/enchant97/note-mark/backend). Check withgovulncheck ./.... - Composer (PHP): 1 critical advisory (
intercom/intercom-php). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | 2026-05-10 |
Critical advisories by ecosystem 9
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 4
Check: npm audit (or: npm ls <package>)
- parse-ini is vulnerable to Prototype Pollution in index.js() CVE-2025-63703 CVSS 9.8 Critical
parse-ini= 1.0.6 → no fix listed - query-parser-string is vulnerable to Prototype Pollution CVE-2025-63704 CVSS 9.8 Critical
query-string-parser= 1.0.0 → no fix listed - Compromised version of intercom-client published to npm GHSA-54pg-9963-v8vg CVSS 9.3 Critical
intercom-client= 7.0.4 → no fix listed - next-npm-version is vulnerable to Command injection CVE-2025-63706 CVSS 9.8 Critical
@jswork/next-npm-version= 1.0.1 → no fix listed
crates.io (Rust) 3
Check: cargo audit
- Zebra's Block Validator Undercounts Coinbase and P2SH Sigops CVE-2026-44498 CVSS 9.2 Critical
zebrad< 4.4.0 → fixed in 4.4.0 - Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer CVE-2026-44497 CVSS 9.3 Critical
zebra-script<= 5.0.1 → fixed in 6.0.0;zebrad< 4.4.0 → fixed in 4.4.0 - Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs GHSA-cwfq-rfcr-8hmp CVSS 9.2 Critical
zebrad< 4.4.0 → fixed in 4.4.0
Composer (PHP) 1
Check: composer audit
- Compromised tag of intercom-php published via GitHub GHSA-gr3r-crp5-qrrm CVSS 9.3 Critical
intercom/intercom-php= 5.0.2 → no fix listed
Go 1
Check: govulncheck ./...
- Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery CVE-2026-44523 CVSS 10.0 Critical
github.com/enchant97/note-mark/backend< 0.0.0-20260501152247-18b587758667 → fixed in 0.0.0-20260501152247-18b587758667