Digest · Friday
Security digest: July 10, 2026
2 known exploited (cisa kev) additions and 11 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Balbooa Forms, iCagenda iCagenda. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-13.
- Go: 8 critical advisories (
github.com/filebrowser/filebrowser/v2,github.com/siyuan-note/siyuan/kernel,github.com/authorizerdev/authorizer,github.com/almeidapaulopt/tsdproxy). Check withgovulncheck ./.... - PyPI: 1 critical advisory (
mcp-server-kubernetes). Check withpip-audit (or: pip show <package>). - Composer (PHP): 1 critical advisory (
prestashop/ps_facetedsearch). Check withcomposer audit. - crates.io (Rust): 1 critical advisory (
exploration). Check withcargo audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 2
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-56291 | Balbooa Forms Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-07-13 |
| CVE-2026-48939 | iCagenda iCagenda iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-07-13 |
Critical advisories by ecosystem 11
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 8
Check: govulncheck ./...
- File Browser: Authentication Bypass via Proxy Auth Header Forgery CVE-2026-54089 CVSS 9.1 Critical
github.com/filebrowser/filebrowser/v2>= 2.0.0-rc.1, <= 2.63.18 → no fix listed - SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() CVE-2026-54067 CVSS 9.9 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4 - File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) CVE-2026-54088 CVSS 9.3 Critical
github.com/filebrowser/filebrowser/v2<= 2.63.5 → fixed in 2.63.6 - SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist CVE-2026-54069 CVSS 9.2 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4 - Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL CVE-2026-54072 CVSS 9.3 Critical
github.com/authorizerdev/authorizer< 0.0.0-20260409051328-bd3f5baf6d3d → fixed in 0.0.0-20260409051328-bd3f5baf6d3d - TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation GHSA-g936-7jqj-mwv8 CVSS 9.0 Critical
github.com/almeidapaulopt/tsdproxy< 1.4.4-0.20260603142855-434819b4421e → fixed in 1.4.4-0.20260603142855-434819b4421e - SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() CVE-2026-54158 CVSS 9.9 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4 - SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content CVE-2026-50551 CVSS 9.9 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4
Composer (PHP) 1
Check: composer audit
- prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE CVE-2026-54159 CVSS 10.0 Critical
prestashop/ps_facetedsearch>= 3.0.0, < 4.0.4 → fixed in 4.0.4
PyPI 1
Check: pip-audit (or: pip show <package>)
- mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials CVE-2026-61459 CVSS 9.3 Critical
mcp-server-kubernetes< 3.9.0 → fixed in 3.9.0
crates.io (Rust) 1
Check: cargo audit
- `exploration` was removed from crates.io for malicious code GHSA-99j7-fhr2-xfj4
exploration>= 0 → no fix listed