Digest · Wednesday
Security digest: May 20, 2026
7 known exploited (cisa kev) additions and 2 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Microsoft Defender, Microsoft Internet Explorer, Adobe Acrobat and Reader, Microsoft DirectX, Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-03.
- npm: 1 critical advisory (
@cap-js/sqlite,@cap-js/postgres,@cap-js/db-service). Check withnpm audit (or: npm ls <package>). - Composer (PHP): 1 critical advisory (
drupal/core). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 7
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-45498 | Microsoft Defender Microsoft Defender Denial of Service Vulnerability | 2026-06-03 |
| CVE-2026-41091 | Microsoft Defender Microsoft Defender Link Following Vulnerability | 2026-06-03 |
| CVE-2010-0806 | Microsoft Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-06-03 |
| CVE-2010-0249 | Microsoft Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-06-03 |
| CVE-2009-3459 | Adobe Acrobat and Reader Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 2026-06-03 |
| CVE-2009-1537 | Microsoft DirectX Microsoft DirectX NULL Byte Overwrite Vulnerability | 2026-06-03 |
| CVE-2008-4250 | Microsoft Windows Microsoft Windows Buffer Overflow Vulnerability | 2026-06-03 |
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Composer (PHP) 1
Check: composer audit
- Drupal Core has a SQL Injection issue CVE-2026-9082 CVSS 9.8 Critical
drupal/core>= 8.9.0, < 10.4.10 → fixed in 10.4.10;drupal/core>= 10.5.0, < 10.5.10 → fixed in 10.5.10;drupal/core>= 10.6.0, < 10.6.9 → fixed in 10.6.9; +3 more packages
npm 1
Check: npm audit (or: npm ls <package>)
- Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service) CVE-2026-46421
@cap-js/sqlite= 2.2.2 → fixed in 2.3.0;@cap-js/postgres= 2.2.2 → fixed in 2.3.0;@cap-js/db-service= 2.10.1 → fixed in 2.11.0