---
title: "Security digest: July 20, 2026"
url: https://erroneo.us/security/2026-07-20/
description: "July 20, 2026 vulnerability digest: 1 brief (Zimbra CVE-2026-73570: Exploited SNMP Command…); 3 critical advisories (PyPI, npm). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-20
date_modified: 2026-09-30
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 20, 2026

1 editorial brief and 3 critical advisories.

## Take stock

- Check exposure: Zimbra CVE-2026-73570: Exploited SNMP Command Injection . Administrators of self-hosted Zimbra Collaboration before 10.1.20, most urgently internet-facing mail servers with zimbra-snmp installed and SNMP notifications enabled.
- PyPI: 2 critical advisories ( lightrag-hku ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( tar ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Zimbra CVE-2026-73570: Exploited SNMP Command Injection](https://erroneo.us/security/briefs/zimbra-snmp-command-injection-cve-2026-73570/index.md): If you run Zimbra below 10.1.20, check today whether the optional zimbra-snmp package is installed with SNMP notifications on; if it is, patch and hunt for web shells, because hundreds of such servers have been compromised.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-61740](https://erroneo.us/security/cve/CVE-2026-61740/index.md) LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection — PyPI lightrag-hku < 1.5.4 → 1.5.4
- [CVE-2026-61736](https://erroneo.us/security/cve/CVE-2026-61736/index.md) LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests — PyPI lightrag-hku <= 1.5.3 → 1.5.4
- [CVE-2026-59873](https://erroneo.us/security/cve/CVE-2026-59873/index.md) node-tar: Decompression/parse DoS via unlimited input — npm tar <= 7.5.18 → 7.5.19

---
Source page: https://erroneo.us/security/2026-07-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt