--- title: "Security digest: May 20, 2026" url: https://erroneo.us/security/2026-05-20/ description: "May 20, 2026 vulnerability digest: 7 CISA KEV additions (Adobe, Microsoft); 2 critical advisories (npm, Composer (PHP)). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-05-20 date_modified: 2026-05-20 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: May 20, 2026 7 known exploited (cisa kev) additions and 2 critical advisories. ## Take stock - Do you run any of these? Microsoft Defender, Microsoft Internet Explorer, Adobe Acrobat and Reader, Microsoft DirectX, Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-03. - npm: 1 critical advisory ( @cap-js/sqlite , @cap-js/postgres , @cap-js/db-service ). Check with npm audit (or: npm ls ) . - Composer (PHP): 1 critical advisory ( drupal/core ). Check with composer audit . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2026-45498](https://erroneo.us/security/cve/CVE-2026-45498/index.md) Microsoft Defender: Microsoft Defender Denial of Service Vulnerability (CISA due 2026-06-03) - [CVE-2026-41091](https://erroneo.us/security/cve/CVE-2026-41091/index.md) Microsoft Defender: Microsoft Defender Link Following Vulnerability (CISA due 2026-06-03) - [CVE-2010-0806](https://erroneo.us/security/cve/CVE-2010-0806/index.md) Microsoft Internet Explorer: Microsoft Internet Explorer Use-After-Free Vulnerability (CISA due 2026-06-03) - [CVE-2010-0249](https://erroneo.us/security/cve/CVE-2010-0249/index.md) Microsoft Internet Explorer: Microsoft Internet Explorer Use-After-Free Vulnerability (CISA due 2026-06-03) - [CVE-2009-3459](https://erroneo.us/security/cve/CVE-2009-3459/index.md) Adobe Acrobat and Reader: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (CISA due 2026-06-03) - [CVE-2009-1537](https://erroneo.us/security/cve/CVE-2009-1537/index.md) Microsoft DirectX: Microsoft DirectX NULL Byte Overwrite Vulnerability (CISA due 2026-06-03) - [CVE-2008-4250](https://erroneo.us/security/cve/CVE-2008-4250/index.md) Microsoft Windows: Microsoft Windows Buffer Overflow Vulnerability (CISA due 2026-06-03) ## Critical advisories - [CVE-2026-46421](https://erroneo.us/security/cve/CVE-2026-46421/index.md) Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service) — npm @cap-js/sqlite = 2.2.2 → 2.3.0; npm @cap-js/postgres = 2.2.2 → 2.3.0; npm @cap-js/db-service = 2.10.1 → 2.11.0 - [CVE-2026-9082](https://erroneo.us/security/cve/CVE-2026-9082/index.md) Drupal Core has a SQL Injection issue — Composer (PHP) drupal/core >= 8.9.0, < 10.4.10 → 10.4.10; Composer (PHP) drupal/core >= 10.5.0, < 10.5.10 → 10.5.10; Composer (PHP) drupal/core >= 10.6.0, < 10.6.9 → 10.6.9 --- Source page: https://erroneo.us/security/2026-05-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt