Digest · Thursday

Security digest: July 2, 2026

9 critical advisories.

Take stock

npm: 3 critical advisories (openclaw, 9router). Check with npm audit (or: npm ls <package>).
PyPI: 2 critical advisories (fast-mcp-telegram, mcp-memory-service). Check with pip-audit (or: pip show <package>).
Composer (PHP): 2 critical advisories (mautic/core). Check with composer audit.
crates.io (Rust): 1 critical advisory (zebra-script, zebrad). Check with cargo audit.
Maven: 1 critical advisory (pro.gravit.launcher:launchserver-api). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: npm audit (or: npm ls <package>)

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy GHSA-w4v6-g3wm-w36c CVSS 9.3 Critical
openclaw < 2026.4.29 → fixed in 2026.4.29
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass CVE-2026-49352 CVSS 9.8 Critical
9router >= 0.2.21, <= 0.4.41 → fixed in 0.4.45
9router: Missing Authorization and OS Command Injection CVE-2026-59800 CVSS 9.2 Critical
9router < 0.4.44 → fixed in 0.4.44

Check: composer audit

Mautic has Server-Side Template Injection (SSTI) in Theme Templates CVE-2026-9558 CVSS 9.9 Critical
mautic/core >= 1.3.0, < 4.4.13 → no fix listed; mautic/core >= 5.0.0, < 5.2.11 → fixed in 5.2.11; mautic/core >= 6.0.0, < 6.0.9 → fixed in 6.0.9; +1 more packages
Mautic vulnerable to Path Traversal via Campaign Import CVE-2026-9559 CVSS 9.9 Critical
mautic/core >= 7.0.0, < 7.1.2 → fixed in 7.1.2

Check: pip-audit (or: pip show <package>)

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection CVE-2026-52830 CVSS 9.4 Critical
fast-mcp-telegram <= 0.19.0 → fixed in 0.19.1
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete CVE-2026-50027 CVSS 9.8 Critical
mcp-memory-service < 10.67.1 → fixed in 10.67.1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

LaunchServer FileServerHandler has an unauthenticated path traversal issue CVE-2026-54617 CVSS 9.8 Critical
pro.gravit.launcher:launchserver-api <= 5.7.11 → no fix listed

Check: cargo audit

zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser CVE-2026-52735 CVSS 9.3 Critical
zebra-script <= 6.0.1 → fixed in 7.0.0; zebrad <= 4.4.1 → fixed in 4.5.0