---
title: "Security digest: July 15, 2026"
url: https://erroneo.us/security/2026-07-15/
description: "July 15, 2026 vulnerability digest: 2 CISA KEV additions (KNX Association, Oracle); 5 critical advisories (npm, Composer (PHP), PyPI). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-15
date_modified: 2026-07-15
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 15, 2026

2 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Do you run any of these? Oracle E-Business Suite, KNX Association KNX Protocol Connection Authorization Option 1. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-18.
- Composer (PHP): 3 critical advisories ( mantisbt/mantisbt ). Check with composer audit .
- npm: 1 critical advisory ( websocket-driver ). Check with npm audit (or: npm ls <package>) .
- PyPI: 1 critical advisory ( gpt-researcher ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-46817](https://erroneo.us/security/cve/CVE-2026-46817/index.md) Oracle E-Business Suite: Oracle E-Business Suite Improper Privilege Management Vulnerability (CISA due 2026-07-18)
- [CVE-2023-4346](https://erroneo.us/security/cve/CVE-2023-4346/index.md) KNX Association KNX Protocol Connection Authorization Option 1: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability (CISA due 2026-07-29)

## Critical advisories

- [CVE-2026-54466](https://erroneo.us/security/cve/CVE-2026-54466/index.md) websocket-driver: Message corruption via abuse of protocol length headers — npm websocket-driver < 0.7.5 → 0.7.5
- [CVE-2026-52881](https://erroneo.us/security/cve/CVE-2026-52881/index.md) MantisBT: Reflected XSS in admin/install.php via unescaped printf — Composer (PHP) mantisbt/mantisbt <= 2.28.3 → 2.28.4
- [CVE-2026-47156](https://erroneo.us/security/cve/CVE-2026-47156/index.md) MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator — Composer (PHP) mantisbt/mantisbt <= 2.28.3 → 2.28.4
- [CVE-2025-65720](https://erroneo.us/security/cve/CVE-2025-65720/index.md) GPT Researcher MCP STDIO configuration allows remote command execution — PyPI gpt-researcher >= 0.14.5, <= 0.14.7 → no fix
- [CVE-2026-52847](https://erroneo.us/security/cve/CVE-2026-52847/index.md) MantisBT: Reflected XSS in admin/install.php — Composer (PHP) mantisbt/mantisbt <= 2.28.3 → 2.28.4

---
Source page: https://erroneo.us/security/2026-07-15/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt