Digest · Wednesday
Security digest: May 13, 2026
4 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 2 critical advisories (
github.com/obot-platform/obot,github.com/siyuan-note/siyuan/kernel). Check withgovulncheck ./.... - npm: 1 critical advisory (
@strapi/content-type-builder,@strapi/plugin-content-type-builder). Check withnpm audit (or: npm ls <package>). - Maven: 1 critical advisory (
io.goobi.viewer:viewer-core). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 2
Check: govulncheck ./...
- Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server GHSA-vw82-7fv8-r6gp CVSS 9.6 Critical
github.com/obot-platform/obot<= 0.21.0 → fixed in 0.21.1 - SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution CVE-2026-45375 CVSS 9.0 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260421031503-96dfe0bea474 → no fix listed
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy CVE-2026-45083 CVSS 9.8 Critical
io.goobi.viewer:viewer-core>= 4.8.0, <= 26.04 → no fix listed
npm 1
Check: npm audit (or: npm ls <package>)
- Strapi Vulnerable to SQL Injection in Content Type Builder CVE-2026-22599 CVSS 9.3 Critical
@strapi/content-type-builder>= 5.0.0, < 5.33.2 → fixed in 5.33.2;@strapi/plugin-content-type-builder>= 4.0.0, < 4.26.1 → fixed in 4.26.1