---
title: "Security digest: July 7, 2026"
url: https://erroneo.us/security/2026-07-07/
description: "July 7, 2026 vulnerability digest: 4 CISA KEV additions (Adobe, JoomShaper, Joomlack, Langflow); 7 critical advisories (npm, Composer (PHP), Go, PyPI). What…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-07
date_modified: 2026-07-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 7, 2026

4 known exploited (cisa kev) additions and 7 critical advisories.

## Take stock

- Do you run any of these? Joomlack Page Builder, Langflow Langflow, JoomShaper SP Page Builder, Adobe ColdFusion. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-10.
- npm: 2 critical advisories ( better-auth , @better-auth/sso ). Check with npm audit (or: npm ls <package>) .
- Go: 2 critical advisories ( github.com/mudler/LocalAI , github.com/zhenorzz/goploy ). Check with govulncheck ./... .
- PyPI: 2 critical advisories ( cognee , apache-airflow ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 1 critical advisory ( egroupware/egroupware ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-56290](https://erroneo.us/security/cve/CVE-2026-56290/index.md) Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability (CISA due 2026-07-10)
- [CVE-2026-55255](https://erroneo.us/security/cve/CVE-2026-55255/index.md) Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability (CISA due 2026-07-10)
- [CVE-2026-48908](https://erroneo.us/security/cve/CVE-2026-48908/index.md) JoomShaper SP Page Builder: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability (CISA due 2026-07-10)
- [CVE-2026-48282](https://erroneo.us/security/cve/CVE-2026-48282/index.md) Adobe ColdFusion: Adobe ColdFusion Path Traversal Vulnerability (CISA due 2026-07-10)

## Critical advisories

- [CVE-2026-53512](https://erroneo.us/security/cve/CVE-2026-53512/index.md) Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins — npm better-auth < 1.6.11 → 1.6.11
- [CVE-2026-27823](https://erroneo.us/security/cve/CVE-2026-27823/index.md) EGroupware has a Remote Code Execution Vulnerability — Composer (PHP) egroupware/egroupware >= 26.0.20251208, < 26.2.20260224 → 26.2.20260224; Composer (PHP) egroupware/egroupware < 23.1.20260224 → 23.1.20260224
- [CVE-2026-59707](https://erroneo.us/security/cve/CVE-2026-59707/index.md) LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs — Go github.com/mudler/LocalAI < 1.40.1-0.20260703213242-2cbb3c96b34d → 1.40.1-0.20260703213242-2cbb3c96b34d
- [CVE-2026-53513](https://erroneo.us/security/cve/CVE-2026-53513/index.md) @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints — npm @better-auth/sso >= 0.1.0, < 1.6.11 → 1.6.11
- [CVE-2026-58473](https://erroneo.us/security/cve/CVE-2026-58473/index.md) Cognee allows non-superusers to overwrite global LLM configuration — PyPI cognee < 1.5.0 → 1.5.0
- [CVE-2026-33264](https://erroneo.us/security/cve/CVE-2026-33264/index.md) Apache Airflow allows code execution through unsafe serialized DAG deserialization — PyPI apache-airflow < 3.3.0 → 3.3.0
- [CVE-2026-53552](https://erroneo.us/security/cve/CVE-2026-53552/index.md) Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers — Go github.com/zhenorzz/goploy <= 1.17.5 → no fix

---
Source page: https://erroneo.us/security/2026-07-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt