---
title: "Security digest: May 7, 2026"
url: https://erroneo.us/security/2026-05-07/
description: "May 7, 2026 vulnerability digest: 1 CISA KEV addition (Ivanti); 9 critical advisories (npm, Go, crates.io (Rust)…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-05-07
date_modified: 2026-05-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 7, 2026

1 known exploited (cisa kev) addition and 9 critical advisories.

## Take stock

- Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-10.
- npm: 4 critical advisories ( parse-ini , query-string-parser , intercom-client , @jswork/next-npm-version ). Check with npm audit (or: npm ls <package>) .
- crates.io (Rust): 3 critical advisories ( zebrad , zebra-script ). Check with cargo audit .
- Go: 1 critical advisory ( github.com/enchant97/note-mark/backend ). Check with govulncheck ./... .
- Composer (PHP): 1 critical advisory ( intercom/intercom-php ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-6973](https://erroneo.us/security/cve/CVE-2026-6973/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (CISA due 2026-05-10)

## Critical advisories

- [CVE-2025-63703](https://erroneo.us/security/cve/CVE-2025-63703/index.md) parse-ini is vulnerable to Prototype Pollution in index.js() — npm parse-ini = 1.0.6 → no fix
- [CVE-2026-44523](https://erroneo.us/security/cve/CVE-2026-44523/index.md) Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery — Go github.com/enchant97/note-mark/backend < 0.0.0-20260501152247-18b587758667 → 0.0.0-20260501152247-18b587758667
- [CVE-2026-44498](https://erroneo.us/security/cve/CVE-2026-44498/index.md) Zebra's Block Validator Undercounts Coinbase and P2SH Sigops — crates.io (Rust) zebrad < 4.4.0 → 4.4.0
- [GHSA-gr3r-crp5-qrrm](https://erroneo.us/security/ghsa/GHSA-gr3r-crp5-qrrm/index.md) Compromised tag of intercom-php published via GitHub — Composer (PHP) intercom/intercom-php = 5.0.2 → no fix
- [CVE-2026-44497](https://erroneo.us/security/cve/CVE-2026-44497/index.md) Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer — crates.io (Rust) zebra-script <= 5.0.1 → 6.0.0; crates.io (Rust) zebrad < 4.4.0 → 4.4.0
- [GHSA-cwfq-rfcr-8hmp](https://erroneo.us/security/ghsa/GHSA-cwfq-rfcr-8hmp/index.md) Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs — crates.io (Rust) zebrad < 4.4.0 → 4.4.0
- [CVE-2025-63704](https://erroneo.us/security/cve/CVE-2025-63704/index.md) query-parser-string is vulnerable to Prototype Pollution — npm query-string-parser = 1.0.0 → no fix
- [GHSA-54pg-9963-v8vg](https://erroneo.us/security/ghsa/GHSA-54pg-9963-v8vg/index.md) Compromised version of intercom-client published to npm — npm intercom-client = 7.0.4 → no fix
- [CVE-2025-63706](https://erroneo.us/security/cve/CVE-2025-63706/index.md) next-npm-version is vulnerable to Command injection — npm @jswork/next-npm-version = 1.0.1 → no fix

---
Source page: https://erroneo.us/security/2026-05-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt