Digest · Monday

Security digest: May 18, 2026

7 critical advisories.

Take stock

PyPI: 5 critical advisories (mistralai, sglang, chromadb). Check with pip-audit (or: pip show <package>).
Composer (PHP): 1 critical advisory (verbb/formie). Check with composer audit.
Go: 1 critical advisory (github.com/getarcaneapp/arcane/backend). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: pip-audit (or: pip show <package>)

Malicious dropper in mistralai 2.4.6 PyPI package GHSA-wx9m-wx4f-4cmg CVSS 9.6 Critical
mistralai = 2.4.6 → no fix listed
SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability CVE-2026-7302 CVSS 9.1 Critical
sglang >= 0.5.5, <= 0.5.12 → no fix listed
SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket CVE-2026-7301 CVSS 9.8 Critical
sglang >= 0.5.5, <= 0.5.12 → no fix listed
ChromaDB Python project has a pre-authentication code injection vulnerability CVE-2026-45829 CVSS 9.3 Critical
chromadb >= 1.0.0, <= 1.5.9 → no fix listed
SGLang: Unauthenticated RCE via --enable-custom-logit-processor CVE-2026-7304 CVSS 9.8 Critical
sglang >= 0.4.1.post7, <= 0.5.12 → no fix listed

Check: composer audit

Formie: Pre-authenticated server-side template injection in Hidden fields CVE-2026-45697 CVSS 9.8 Critical
verbb/formie >= 3.0.0-beta.1, < 3.1.24 → fixed in 3.1.24; verbb/formie < 2.2.20 → fixed in 2.2.20

Check: govulncheck ./...

Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and… CVE-2026-45625 CVSS 9.9 Critical
github.com/getarcaneapp/arcane/backend <= 1.18.1 → fixed in 1.19.0