---
title: "Security digest: May 26, 2026"
url: https://erroneo.us/security/2026-05-26/
description: "May 26, 2026 vulnerability digest: 1 CISA KEV addition (LiteSpeed); 7 critical advisories (Maven, Composer (PHP), PyPI…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-05-26
date_modified: 2026-05-26
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 26, 2026

1 known exploited (cisa kev) addition and 7 critical advisories.

## Take stock

- Do you run any of these? LiteSpeed cPanel Plugin. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-29.
- Maven: 4 critical advisories ( org.xwiki.commons:xwiki-commons-classloader-api , org.xwiki.platform:xwiki-platform-rest-server , org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap , org.yamcs:yamcs-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 1 critical advisory ( dolibarr/dolibarr ). Check with composer audit .
- PyPI: 1 critical advisory ( mlflow ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( kubevirt.io/kubevirt ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-48172](https://erroneo.us/security/cve/CVE-2026-48172/index.md) LiteSpeed cPanel Plugin: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability (CISA due 2026-05-29)

## Critical advisories

- [CVE-2026-23734](https://erroneo.us/security/cve/CVE-2026-23734/index.md) XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash — Maven org.xwiki.commons:xwiki-commons-classloader-api >= 4.2-milestone-2, < 16.10.17 → 16.10.17; Maven org.xwiki.commons:xwiki-commons-classloader-api >= 17.0.0-rc-1, < 17.4.9 → 17.4.9; Maven org.xwiki.commons:xwiki-commons-classloader-api >= 17.5.0, < 17.10.3 → 17.10.3
- [CVE-2026-33137](https://erroneo.us/security/cve/CVE-2026-33137/index.md) XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} — Maven org.xwiki.platform:xwiki-platform-rest-server >= 15.10.6, < 16.10.17 → 16.10.17; Maven org.xwiki.platform:xwiki-platform-rest-server >= 17.0.0-rc-1, < 17.4.9 → 17.4.9; Maven org.xwiki.platform:xwiki-platform-rest-server >= 17.5.0, < 17.10.3 → 17.10.3
- [CVE-2026-44930](https://erroneo.us/security/cve/CVE-2026-44930/index.md) Apache CXF has an LDAP injection vulnerability — Maven org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap = 4.2.0 → 4.2.1; Maven org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap >= 4.1.0, < 4.1.6 → 4.1.6; Maven org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap < 3.6.11 → 3.6.11
- [CVE-2018-25357](https://erroneo.us/security/cve/CVE-2018-25357/index.md) Dolibarr ERP CRM contains a remote code evaluation vulnerability — Composer (PHP) dolibarr/dolibarr >= 7.0.0, <= 7.0.3 → 7.0.4; Composer (PHP) dolibarr/dolibarr < 6.0.8 → 6.0.8
- [CVE-2026-2651](https://erroneo.us/security/cve/CVE-2026-2651/index.md) MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled — PyPI mlflow < 3.10.0 → 3.10.0
- [CVE-2026-7374](https://erroneo.us/security/cve/CVE-2026-7374/index.md) KubeVirt has a Link Following vulnerability — Go kubevirt.io/kubevirt >= 1.8.0-alpha.0, < 1.8.3 → 1.8.3; Go kubevirt.io/kubevirt >= 1.7.0-alpha.0, < 1.7.4 → 1.7.4; Go kubevirt.io/kubevirt < 1.6.6 → 1.6.6
- [CVE-2026-44632](https://erroneo.us/security/cve/CVE-2026-44632/index.md) Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` — Maven org.yamcs:yamcs-core < 5.12.7 → 5.12.7

---
Source page: https://erroneo.us/security/2026-05-26/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt