---
title: "Security digest: July 10, 2026"
url: https://erroneo.us/security/2026-07-10/
description: "July 10, 2026 vulnerability digest: 2 CISA KEV additions (Balbooa, iCagenda); 11 critical advisories (Go, PyPI, Composer (PHP)…). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-10
date_modified: 2026-07-10
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 10, 2026

2 known exploited (cisa kev) additions and 11 critical advisories.

## Take stock

- Do you run any of these? Balbooa Forms, iCagenda iCagenda. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-13.
- Go: 8 critical advisories ( github.com/filebrowser/filebrowser/v2 , github.com/siyuan-note/siyuan/kernel , github.com/authorizerdev/authorizer , github.com/almeidapaulopt/tsdproxy ). Check with govulncheck ./... .
- PyPI: 1 critical advisory ( mcp-server-kubernetes ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 1 critical advisory ( prestashop/ps_facetedsearch ). Check with composer audit .
- crates.io (Rust): 1 critical advisory ( exploration ). Check with cargo audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-56291](https://erroneo.us/security/cve/CVE-2026-56291/index.md) Balbooa Forms: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability (CISA due 2026-07-13)
- [CVE-2026-48939](https://erroneo.us/security/cve/CVE-2026-48939/index.md) iCagenda iCagenda: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability (CISA due 2026-07-13)

## Critical advisories

- [CVE-2026-54089](https://erroneo.us/security/cve/CVE-2026-54089/index.md) File Browser: Authentication Bypass via Proxy Auth Header Forgery — Go github.com/filebrowser/filebrowser/v2 >= 2.0.0-rc.1, <= 2.63.18 → no fix
- [CVE-2026-61459](https://erroneo.us/security/cve/CVE-2026-61459/index.md) mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials — PyPI mcp-server-kubernetes < 3.9.0 → 3.9.0
- [CVE-2026-54067](https://erroneo.us/security/cve/CVE-2026-54067/index.md) SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4
- [CVE-2026-54088](https://erroneo.us/security/cve/CVE-2026-54088/index.md) File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) — Go github.com/filebrowser/filebrowser/v2 <= 2.63.5 → 2.63.6
- [CVE-2026-54159](https://erroneo.us/security/cve/CVE-2026-54159/index.md) prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE — Composer (PHP) prestashop/ps_facetedsearch >= 3.0.0, < 4.0.4 → 4.0.4
- [CVE-2026-54069](https://erroneo.us/security/cve/CVE-2026-54069/index.md) SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4
- [CVE-2026-54072](https://erroneo.us/security/cve/CVE-2026-54072/index.md) Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL — Go github.com/authorizerdev/authorizer < 0.0.0-20260409051328-bd3f5baf6d3d → 0.0.0-20260409051328-bd3f5baf6d3d
- [GHSA-g936-7jqj-mwv8](https://erroneo.us/security/ghsa/GHSA-g936-7jqj-mwv8/index.md) TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation — Go github.com/almeidapaulopt/tsdproxy < 1.4.4-0.20260603142855-434819b4421e → 1.4.4-0.20260603142855-434819b4421e
- [GHSA-99j7-fhr2-xfj4](https://erroneo.us/security/ghsa/GHSA-99j7-fhr2-xfj4/index.md) `exploration` was removed from crates.io for malicious code — crates.io (Rust) exploration >= 0 → no fix
- [CVE-2026-54158](https://erroneo.us/security/cve/CVE-2026-54158/index.md) SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4
- [CVE-2026-50551](https://erroneo.us/security/cve/CVE-2026-50551/index.md) SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4

---
Source page: https://erroneo.us/security/2026-07-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt