erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: July 7, 2026

4 known exploited (cisa kev) additions and 7 critical advisories.

All digests · RSS · Markdown

Take stock

  • Do you run any of these? Joomlack Page Builder, Langflow Langflow, JoomShaper SP Page Builder, Adobe ColdFusion. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-10.
  • npm: 2 critical advisories (better-auth, @better-auth/sso). Check with npm audit (or: npm ls <package>).
  • Go: 2 critical advisories (github.com/mudler/LocalAI, github.com/zhenorzz/goploy). Check with govulncheck ./....
  • PyPI: 2 critical advisories (cognee, apache-airflow). Check with pip-audit (or: pip show <package>).
  • Composer (PHP): 1 critical advisory (egroupware/egroupware). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 4

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-56290Joomlack Page Builder
Joomlack Page Builder Improper Access Control Vulnerability		2026-07-10
CVE-2026-55255Langflow Langflow
Langflow Authorization Bypass Through User-Controlled Key Vulnerability		2026-07-10
CVE-2026-48908JoomShaper SP Page Builder
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability		2026-07-10
CVE-2026-48282Adobe ColdFusion
Adobe ColdFusion Path Traversal Vulnerability		2026-07-10

Critical advisories by ecosystem 7

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 2

Check: govulncheck ./...

npm 2

Check: npm audit (or: npm ls <package>)

PyPI 2

Check: pip-audit (or: pip show <package>)

Composer (PHP) 1

Check: composer audit