Digest · Friday
Security digest: May 29, 2026
1 known exploited (cisa kev) addition and 16 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-01.
- PyPI: 11 critical advisories (
PraisonAI,stigmem-node,praisonai-platform,praisonaiagents,redshift-connector). Check withpip-audit (or: pip show <package>). - npm: 5 critical advisories (
vm2). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-0257 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Ransomware | 2026-06-01 |
Critical advisories by ecosystem 16
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 11
Check: pip-audit (or: pip show <package>)
- PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution CVE-2026-47391 CVSS 9.8 Critical
PraisonAI<= 4.6.39 → fixed in 4.6.40 - stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation GHSA-jmfc-hfjq-pxcp CVSS 9.1 Critical
stigmem-node< 0.9.0a2 → fixed in 0.9.0a2 - PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation CVE-2026-47407 CVSS 9.4 Critical
praisonai-platform<= 0.1.2 → fixed in 0.1.4 - stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback GHSA-fp6w-8wpg-74g5 CVSS 9.2 Critical
stigmem-node< 0.9.0a2 → fixed in 0.9.0a2 - praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id} CVE-2026-47416 CVSS 9.6 Critical
praisonai-platform<= 0.1.2 → fixed in 0.1.4 - stigmem-node's federation peer registration lacked explicit out-of-band approval GHSA-9vp8-3hmv-8fgh CVSS 9.1 Critical
stigmem-node< 0.9.0a2 → fixed in 0.9.0a2 - PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset CVE-2026-47396 CVSS 9.8 Critical
PraisonAI<= 4.6.39 → fixed in 4.6.40 - PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default CVE-2026-47393 CVSS 9.8 Critical
PraisonAI<= 4.6.39 → fixed in 4.6.40 - PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) CVE-2026-47392 CVSS 9.9 Critical
praisonaiagents<= 1.6.39 → fixed in 1.6.40;PraisonAI<= 4.6.39 → fixed in 4.6.40 - praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is… CVE-2026-47410 CVSS 9.8 Critical
praisonai-platform<= 0.1.2 → fixed in 0.1.4 - amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection CVE-2026-8838 CVSS 9.3 Critical
redshift-connector<= 2.1.13 → fixed in 2.1.14
npm 5
Check: npm audit (or: npm ls <package>)
- vm2 has a Sandbox Escape issue CVE-2026-47131 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - NodeVM builtin denylist bypass via process and inspector/promises allows host code execution CVE-2026-47140 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE CVE-2026-47137 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - vm2 is Vulnerable to Sandbox Breakout Through Promise Species CVE-2026-47208 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass CVE-2026-47210 CVSS 9.8 Critical
vm2<= 3.11.3 → fixed in 3.11.4