---
title: "Security digest: May 27, 2026"
url: https://erroneo.us/security/2026-05-27/
description: "May 27, 2026 vulnerability digest: 3 CISA KEV additions (Daemon, Nx, TanStack); 5 critical advisories (Maven, PyPI, npm, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-05-27
date_modified: 2026-05-27
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 27, 2026

3 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Do you run any of these? Daemon Daemon Tools Lite, Nx Nx Console, TanStack TanStack. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-30.
- Maven: 2 critical advisories ( org.yamcs:yamcs-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( langroid ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( liquidjs ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/googleapis/mcp-toolbox ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-8398](https://erroneo.us/security/cve/CVE-2026-8398/index.md) Daemon Daemon Tools Lite: Daemon Tools Lite Embedded Malicious Code Vulnerability (CISA due 2026-05-30)
- [CVE-2026-48027](https://erroneo.us/security/cve/CVE-2026-48027/index.md) Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability (CISA due 2026-06-10)
- [CVE-2026-45321](https://erroneo.us/security/cve/CVE-2026-45321/index.md) TanStack TanStack: TanStack Unspecified Vulnerability (CISA due 2026-06-10)

## Critical advisories

- [CVE-2026-46562](https://erroneo.us/security/cve/CVE-2026-46562/index.md) Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override — Maven org.yamcs:yamcs-core < 5.12.7 → 5.12.7
- [CVE-2026-25879](https://erroneo.us/security/cve/CVE-2026-25879/index.md) Langroid has Prompt to SQL Injection, Leading to RCE — PyPI langroid < 0.63.0 → 0.63.0
- [CVE-2026-45618](https://erroneo.us/security/cve/CVE-2026-45618/index.md) LiquidJS is Vulnerable to Remote Code Execution — npm liquidjs < 10.26.0 → 10.26.0
- [CVE-2026-9739](https://erroneo.us/security/cve/CVE-2026-9739/index.md) MCP Toolbox for Databases vulnerable to DNS rebinding attacks — Go github.com/googleapis/mcp-toolbox < 1.2.0 → 1.2.0
- [CVE-2026-46621](https://erroneo.us/security/cve/CVE-2026-46621/index.md) Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection — Maven org.yamcs:yamcs-core < 5.12.7 → 5.12.7

---
Source page: https://erroneo.us/security/2026-05-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt