---
title: "Security digest: July 2, 2026"
url: https://erroneo.us/security/2026-07-02/
description: "July 2, 2026 vulnerability digest: 9 critical advisories (npm, PyPI, crates.io (Rust)…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-02
date_modified: 2026-07-02
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 2, 2026

9 critical advisories.

## Take stock

- npm: 3 critical advisories ( openclaw , 9router ). Check with npm audit (or: npm ls <package>) .
- PyPI: 2 critical advisories ( fast-mcp-telegram , mcp-memory-service ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 2 critical advisories ( mautic/core ). Check with composer audit .
- crates.io (Rust): 1 critical advisory ( zebra-script , zebrad ). Check with cargo audit .
- Maven: 1 critical advisory ( pro.gravit.launcher:launchserver-api ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [GHSA-w4v6-g3wm-w36c](https://erroneo.us/security/ghsa/GHSA-w4v6-g3wm-w36c/index.md) OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy — npm openclaw < 2026.4.29 → 2026.4.29
- [CVE-2026-52830](https://erroneo.us/security/cve/CVE-2026-52830/index.md) fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection — PyPI fast-mcp-telegram <= 0.19.0 → 0.19.1
- [CVE-2026-49352](https://erroneo.us/security/cve/CVE-2026-49352/index.md) 9router's Hardcoded Default fallback JWT Secret  Allows Authentication Bypass — npm 9router >= 0.2.21, <= 0.4.41 → 0.4.45
- [CVE-2026-52735](https://erroneo.us/security/cve/CVE-2026-52735/index.md) zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser — crates.io (Rust) zebra-script <= 6.0.1 → 7.0.0; crates.io (Rust) zebrad <= 4.4.1 → 4.5.0
- [CVE-2026-59800](https://erroneo.us/security/cve/CVE-2026-59800/index.md) 9router: Missing Authorization and OS Command Injection — npm 9router < 0.4.44 → 0.4.44
- [CVE-2026-9558](https://erroneo.us/security/cve/CVE-2026-9558/index.md) Mautic has Server-Side Template Injection (SSTI) in Theme Templates — Composer (PHP) mautic/core >= 1.3.0, < 4.4.13 → no fix; Composer (PHP) mautic/core >= 5.0.0, < 5.2.11 → 5.2.11; Composer (PHP) mautic/core >= 6.0.0, < 6.0.9 → 6.0.9
- [CVE-2026-50027](https://erroneo.us/security/cve/CVE-2026-50027/index.md) mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete — PyPI mcp-memory-service < 10.67.1 → 10.67.1
- [CVE-2026-9559](https://erroneo.us/security/cve/CVE-2026-9559/index.md) Mautic vulnerable to Path Traversal via Campaign Import — Composer (PHP) mautic/core >= 7.0.0, < 7.1.2 → 7.1.2
- [CVE-2026-54617](https://erroneo.us/security/cve/CVE-2026-54617/index.md) LaunchServer FileServerHandler has an unauthenticated path traversal issue — Maven pro.gravit.launcher:launchserver-api <= 5.7.11 → no fix

---
Source page: https://erroneo.us/security/2026-07-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt