Digest · Tuesday

Security digest: May 19, 2026

16 critical advisories.

Take stock

Go: 4 critical advisories (github.com/xyproto/algernon, github.com/Kuadrant/mcp-gateway, github.com/coder/coder/v2, github.com/coder/coder, github.com/kopia/kopia). Check with govulncheck ./....
PyPI: 4 critical advisories (guardrails-ai, zrok, apscheduler, mlflow). Check with pip-audit (or: pip show <package>).
npm: 4 critical advisories (9router, @beproduct/nestjs-auth, @haxtheweb/haxcms-nodejs, @opensearch-project/opensearch). Check with npm audit (or: npm ls <package>).
Maven: 3 critical advisories (org.glassfish.main.admingui:console-common, org.glassfish.jsftemplating:jsftemplating, org.apache.camel:camel-cxf-rest, org.glassfish.main.admingui:admingui). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
Composer (PHP): 1 critical advisory (mmc/ceselector). Check with composer audit.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

Algernon: handler.lua discovery walks parent directories above the server root CVE-2026-45721 CVSS 9.0 Critical
github.com/xyproto/algernon <= 1.17.6 → fixed in 1.17.7
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path GHSA-g53w-w6mj-hrpp CVSS 9.3 Critical
github.com/Kuadrant/mcp-gateway < 0.7.0 → fixed in 0.7.0
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVE-2026-46354 CVSS 9.1 Critical
github.com/coder/coder/v2 >= 2.33.0-rc.0, < 2.33.3 → fixed in 2.33.3; github.com/coder/coder/v2 >= 2.32.0-rc.0, < 2.32.2 → fixed in 2.32.2; github.com/coder/coder/v2 >= 2.31.0, < 2.31.12 → fixed in 2.31.12; +4 more packages
Kopia: RCE via SSH ProxyCommand Injection CVE-2026-45695 CVSS 9.8 Critical
github.com/kopia/kopia <= 0.22.3 → fixed in 0.23.0

Check: npm audit (or: npm ls <package>)

9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes CVE-2026-46339 CVSS 10.0 Critical
9router >= 0.4.30, < 0.4.37 → fixed in 0.4.37
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm CVE-2026-46412 CVSS 10.0 Critical
@beproduct/nestjs-auth >= 0.1.2, <= 0.1.19 → no fix listed
HAXcms: Private Key Disclosure via Broken HMAC Implementation CVE-2026-46395 CVSS 9.3 Critical
@haxtheweb/haxcms-nodejs <= 25.0.0 → fixed in 26.0.0
Malware in @opensearch-project/opensearch GHSA-27f5-xjrr-q9ff CVSS 9.6 Critical
@opensearch-project/opensearch = 3.5.3 → no fix listed; @opensearch-project/opensearch = 3.6.2 → no fix listed; @opensearch-project/opensearch = 3.7.0 → no fix listed; +1 more packages

Check: pip-audit (or: pip show <package>)

Malicious code in guardrails-ai 0.10.1 (supply chain compromise) CVE-2026-45758 CVSS 9.6 Critical
guardrails-ai = 0.10.1 → no fix listed
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths CVE-2026-45568 CVSS 9.9 Critical
zrok >= 0.4.47, <= 1.1.11 → no fix listed
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization CVE-2026-31072 CVSS 9.8 Critical
apscheduler >= 4.0.0a1, <= 4.0.0a6 → no fix listed
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution CVE-2026-2611 CVSS 9.6 Critical
mlflow = 3.9.0 → fixed in 3.10.0

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

GlassFish's Administration Console is Vulnerable to RCE CVE-2026-2586 CVSS 9.1 Critical
org.glassfish.main.admingui:console-common < 8.0.2 → fixed in 8.0.2; org.glassfish.jsftemplating:jsftemplating < 4.2.0 → fixed in 4.2.0
Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering CVE-2026-47323 CVSS 9.8 Critical
org.apache.camel:camel-cxf-rest >= 3.18.0, < 4.14.6 → fixed in 4.14.6; org.apache.camel:camel-cxf-rest >= 4.15.0, < 4.18.2 → fixed in 4.18.2
GlassFish's gadget handler is vulnerable to RCE CVE-2026-2587 CVSS 9.6 Critical
org.glassfish.main.admingui:admingui < 8.0.2 → fixed in 8.0.2; org.glassfish.jsftemplating:jsftemplating < 4.2.0 → fixed in 4.2.0

Check: composer audit

TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) CVE-2026-46725 CVSS 9.2 Critical
mmc/ceselector >= 6.0.0, < 6.0.1 → fixed in 6.0.1; mmc/ceselector >= 5.0.0, < 5.0.1 → fixed in 5.0.1; mmc/ceselector >= 4.0.0, < 4.0.2 → fixed in 4.0.2; +1 more packages