---
title: "Security digest: May 18, 2026"
url: https://erroneo.us/security/2026-05-18/
description: "May 18, 2026 vulnerability digest: 7 critical advisories (Composer (PHP), PyPI, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-05-18
date_modified: 2026-05-18
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 18, 2026

7 critical advisories.

## Take stock

- PyPI: 5 critical advisories ( mistralai , sglang , chromadb ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 1 critical advisory ( verbb/formie ). Check with composer audit .
- Go: 1 critical advisory ( github.com/getarcaneapp/arcane/backend ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-45697](https://erroneo.us/security/cve/CVE-2026-45697/index.md) Formie: Pre-authenticated server-side template injection in Hidden fields — Composer (PHP) verbb/formie >= 3.0.0-beta.1, < 3.1.24 → 3.1.24; Composer (PHP) verbb/formie < 2.2.20 → 2.2.20
- [GHSA-wx9m-wx4f-4cmg](https://erroneo.us/security/ghsa/GHSA-wx9m-wx4f-4cmg/index.md) Malicious dropper in mistralai 2.4.6 PyPI package — PyPI mistralai = 2.4.6 → no fix
- [CVE-2026-7302](https://erroneo.us/security/cve/CVE-2026-7302/index.md) SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability — PyPI sglang >= 0.5.5, <= 0.5.12 → no fix
- [CVE-2026-7301](https://erroneo.us/security/cve/CVE-2026-7301/index.md) SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket — PyPI sglang >= 0.5.5, <= 0.5.12 → no fix
- [CVE-2026-45829](https://erroneo.us/security/cve/CVE-2026-45829/index.md) ChromaDB Python project has a pre-authentication code injection vulnerability — PyPI chromadb >= 1.0.0, <= 1.5.9 → no fix
- [CVE-2026-45625](https://erroneo.us/security/cve/CVE-2026-45625/index.md) Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs — Go github.com/getarcaneapp/arcane/backend <= 1.18.1 → 1.19.0
- [CVE-2026-7304](https://erroneo.us/security/cve/CVE-2026-7304/index.md) SGLang: Unauthenticated RCE via --enable-custom-logit-processor — PyPI sglang >= 0.4.1.post7, <= 0.5.12 → no fix

---
Source page: https://erroneo.us/security/2026-05-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt