Digest · Tuesday

Security digest: May 26, 2026

1 known exploited (cisa kev) addition and 7 critical advisories.

Take stock

Do you run any of these? LiteSpeed cPanel Plugin. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-29.
Maven: 4 critical advisories (org.xwiki.commons:xwiki-commons-classloader-api, org.xwiki.platform:xwiki-platform-rest-server, org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap, org.yamcs:yamcs-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
Composer (PHP): 1 critical advisory (dolibarr/dolibarr). Check with composer audit.
PyPI: 1 critical advisory (mlflow). Check with pip-audit (or: pip show <package>).
Go: 1 critical advisory (kubevirt.io/kubevirt). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-48172	LiteSpeed cPanel Plugin LiteSpeed cPanel Plugin Privilege Escalation Vulnerability	2026-05-29

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash CVE-2026-23734 CVSS 9.3 Critical
org.xwiki.commons:xwiki-commons-classloader-api >= 4.2-milestone-2, < 16.10.17 → fixed in 16.10.17; org.xwiki.commons:xwiki-commons-classloader-api >= 17.0.0-rc-1, < 17.4.9 → fixed in 17.4.9; org.xwiki.commons:xwiki-commons-classloader-api >= 17.5.0, < 17.10.3 → fixed in 17.10.3; +1 more packages
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} CVE-2026-33137 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-rest-server >= 15.10.6, < 16.10.17 → fixed in 16.10.17; org.xwiki.platform:xwiki-platform-rest-server >= 17.0.0-rc-1, < 17.4.9 → fixed in 17.4.9; org.xwiki.platform:xwiki-platform-rest-server >= 17.5.0, < 17.10.3 → fixed in 17.10.3; +1 more packages
Apache CXF has an LDAP injection vulnerability CVE-2026-44930 CVSS 9.8 Critical
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap = 4.2.0 → fixed in 4.2.1; org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap >= 4.1.0, < 4.1.6 → fixed in 4.1.6; org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap < 3.6.11 → fixed in 3.6.11
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` CVE-2026-44632 CVSS 9.1 Critical
org.yamcs:yamcs-core < 5.12.7 → fixed in 5.12.7

Check: composer audit

Dolibarr ERP CRM contains a remote code evaluation vulnerability CVE-2018-25357 CVSS 9.3 Critical
dolibarr/dolibarr >= 7.0.0, <= 7.0.3 → fixed in 7.0.4; dolibarr/dolibarr < 6.0.8 → fixed in 6.0.8

Check: govulncheck ./...

KubeVirt has a Link Following vulnerability CVE-2026-7374 CVSS 9.9 Critical
kubevirt.io/kubevirt >= 1.8.0-alpha.0, < 1.8.3 → fixed in 1.8.3; kubevirt.io/kubevirt >= 1.7.0-alpha.0, < 1.7.4 → fixed in 1.7.4; kubevirt.io/kubevirt < 1.6.6 → fixed in 1.6.6

Check: pip-audit (or: pip show <package>)

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled CVE-2026-2651 CVSS 9.0 Critical
mlflow < 3.10.0 → fixed in 3.10.0