--- title: "Security digest: May 19, 2026" url: https://erroneo.us/security/2026-05-19/ description: "May 19, 2026 vulnerability digest: 16 critical advisories (Go, PyPI, npm, Maven…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-05-19 date_modified: 2026-05-19 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: May 19, 2026 16 critical advisories. ## Take stock - Go: 4 critical advisories ( github.com/xyproto/algernon , github.com/Kuadrant/mcp-gateway , github.com/coder/coder/v2 , github.com/coder/coder , github.com/kopia/kopia ). Check with govulncheck ./... . - PyPI: 4 critical advisories ( guardrails-ai , zrok , apscheduler , mlflow ). Check with pip-audit (or: pip show ) . - npm: 4 critical advisories ( 9router , @beproduct/nestjs-auth , @haxtheweb/haxcms-nodejs , @opensearch-project/opensearch ). Check with npm audit (or: npm ls ) . - Maven: 3 critical advisories ( org.glassfish.main.admingui:console-common , org.glassfish.jsftemplating:jsftemplating , org.apache.camel:camel-cxf-rest , org.glassfish.main.admingui:admingui ). Check with mvn dependency:tree -Dincludes=: . - Composer (PHP): 1 critical advisory ( mmc/ceselector ). Check with composer audit . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-45721](https://erroneo.us/security/cve/CVE-2026-45721/index.md) Algernon: handler.lua discovery walks parent directories above the server root — Go github.com/xyproto/algernon <= 1.17.6 → 1.17.7 - [CVE-2026-45758](https://erroneo.us/security/cve/CVE-2026-45758/index.md) Malicious code in guardrails-ai 0.10.1 (supply chain compromise) — PyPI guardrails-ai = 0.10.1 → no fix - [CVE-2026-45568](https://erroneo.us/security/cve/CVE-2026-45568/index.md) rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths — PyPI zrok >= 0.4.47, <= 1.1.11 → no fix - [GHSA-g53w-w6mj-hrpp](https://erroneo.us/security/ghsa/GHSA-g53w-w6mj-hrpp/index.md) MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path — Go github.com/Kuadrant/mcp-gateway < 0.7.0 → 0.7.0 - [CVE-2026-46339](https://erroneo.us/security/cve/CVE-2026-46339/index.md) 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes — npm 9router >= 0.4.30, < 0.4.37 → 0.4.37 - [CVE-2026-31072](https://erroneo.us/security/cve/CVE-2026-31072/index.md) APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization — PyPI apscheduler >= 4.0.0a1, <= 4.0.0a6 → no fix - [CVE-2026-2586](https://erroneo.us/security/cve/CVE-2026-2586/index.md) GlassFish's Administration Console is Vulnerable to RCE — Maven org.glassfish.main.admingui:console-common < 8.0.2 → 8.0.2; Maven org.glassfish.jsftemplating:jsftemplating < 4.2.0 → 4.2.0 - [CVE-2026-46725](https://erroneo.us/security/cve/CVE-2026-46725/index.md) TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) — Composer (PHP) mmc/ceselector >= 6.0.0, < 6.0.1 → 6.0.1; Composer (PHP) mmc/ceselector >= 5.0.0, < 5.0.1 → 5.0.1; Composer (PHP) mmc/ceselector >= 4.0.0, < 4.0.2 → 4.0.2 - [CVE-2026-47323](https://erroneo.us/security/cve/CVE-2026-47323/index.md) Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering — Maven org.apache.camel:camel-cxf-rest >= 3.18.0, < 4.14.6 → 4.14.6; Maven org.apache.camel:camel-cxf-rest >= 4.15.0, < 4.18.2 → 4.18.2 - [CVE-2026-46412](https://erroneo.us/security/cve/CVE-2026-46412/index.md) Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm — npm @beproduct/nestjs-auth >= 0.1.2, <= 0.1.19 → no fix - [CVE-2026-46354](https://erroneo.us/security/cve/CVE-2026-46354/index.md) Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft — Go github.com/coder/coder/v2 >= 2.33.0-rc.0, < 2.33.3 → 2.33.3; Go github.com/coder/coder/v2 >= 2.32.0-rc.0, < 2.32.2 → 2.32.2; Go github.com/coder/coder/v2 >= 2.31.0, < 2.31.12 → 2.31.12 - [CVE-2026-46395](https://erroneo.us/security/cve/CVE-2026-46395/index.md) HAXcms: Private Key Disclosure via Broken HMAC Implementation — npm @haxtheweb/haxcms-nodejs <= 25.0.0 → 26.0.0 - [CVE-2026-2611](https://erroneo.us/security/cve/CVE-2026-2611/index.md) MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution — PyPI mlflow = 3.9.0 → 3.10.0 - [CVE-2026-45695](https://erroneo.us/security/cve/CVE-2026-45695/index.md) Kopia: RCE via SSH ProxyCommand Injection — Go github.com/kopia/kopia <= 0.22.3 → 0.23.0 - [CVE-2026-2587](https://erroneo.us/security/cve/CVE-2026-2587/index.md) GlassFish's gadget handler is vulnerable to RCE — Maven org.glassfish.main.admingui:admingui < 8.0.2 → 8.0.2; Maven org.glassfish.jsftemplating:jsftemplating < 4.2.0 → 4.2.0 - [GHSA-27f5-xjrr-q9ff](https://erroneo.us/security/ghsa/GHSA-27f5-xjrr-q9ff/index.md) Malware in @opensearch-project/opensearch — npm @opensearch-project/opensearch = 3.5.3 → no fix; npm @opensearch-project/opensearch = 3.6.2 → no fix; npm @opensearch-project/opensearch = 3.7.0 → no fix --- Source page: https://erroneo.us/security/2026-05-19/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt