---
title: "Security digest: May 22, 2026"
url: https://erroneo.us/security/2026-05-22/
description: "May 22, 2026 vulnerability digest: 1 CISA KEV addition (Drupal); 3 critical advisories (Go, Composer (PHP)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-05-22
date_modified: 2026-05-22
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 22, 2026

1 known exploited (cisa kev) addition and 3 critical advisories.

## Take stock

- Do you run any of these? Drupal Core. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-27.
- Go: 2 critical advisories ( github.com/gtsteffaniak/filebrowser/backend , github.com/nezhahq/nezha ). Check with govulncheck ./... .
- Composer (PHP): 1 critical advisory ( yeswiki/yeswiki ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-9082](https://erroneo.us/security/cve/CVE-2026-9082/index.md) Drupal Core: Drupal Core SQL Injection Vulnerability (CISA due 2026-05-27)

## Critical advisories

- [CVE-2026-48777](https://erroneo.us/security/cve/CVE-2026-48777/index.md) FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory — Go github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260518193514-28e9b81e438e → 0.0.0-20260518193514-28e9b81e438e
- [CVE-2026-46670](https://erroneo.us/security/cve/CVE-2026-46670/index.md) YesWiki: Unauthenticated SQL Injection — Composer (PHP) yeswiki/yeswiki < 4.6.4 → 4.6.4
- [CVE-2026-46716](https://erroneo.us/security/cve/CVE-2026-46716/index.md) Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron — Go github.com/nezhahq/nezha >= 1.4.0, < 1.14.15-0.20260517022419-d7526351cf97 → 1.14.15-0.20260517022419-d7526351cf97

---
Source page: https://erroneo.us/security/2026-05-22/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt