---
title: "Security digest: July 21, 2026"
url: https://erroneo.us/security/2026-07-21/
description: "July 21, 2026 vulnerability digest: 4 CISA KEV additions (DD-WRT, Langflow, WordPress); 8 critical advisories (Go, npm, PyPI). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-21
date_modified: 2026-07-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 21, 2026

4 known exploited (cisa kev) additions and 8 critical advisories.

## Take stock

- Do you run any of these? WordPress Core, Langflow Langflow, DD-WRT DD-WRT. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-24.
- Go: 5 critical advisories ( code.gitea.io/gitea ). Check with govulncheck ./... .
- npm: 2 critical advisories ( @sigstore/oci , @vitest/browser ). Check with npm audit (or: npm ls <package>) .
- PyPI: 1 critical advisory ( homeassistant ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-63030](https://erroneo.us/security/cve/CVE-2026-63030/index.md) WordPress Core: WordPress Core Interpretation Conflict Vulnerability (CISA due 2026-07-24)
- [CVE-2026-60137](https://erroneo.us/security/cve/CVE-2026-60137/index.md) WordPress Core: WordPress Core SQL Injection Vulnerability (CISA due 2026-08-04)
- [CVE-2026-0770](https://erroneo.us/security/cve/CVE-2026-0770/index.md) Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CISA due 2026-07-24)
- [CVE-2021-27137](https://erroneo.us/security/cve/CVE-2021-27137/index.md) DD-WRT DD-WRT: DD-WRT Stack-Based Buffer Overflow Vulnerability (CISA due 2026-07-24)

## Critical advisories

- [CVE-2026-58443](https://erroneo.us/security/cve/CVE-2026-58443/index.md) Gitea: Public-only repository tokens can update private PR head branches — Go code.gitea.io/gitea < 1.27.0 → 1.27.0
- [CVE-2026-56750](https://erroneo.us/security/cve/CVE-2026-56750/index.md) Gitea Remember-Me Token Theft Not Invalidating Attacker Session — Go code.gitea.io/gitea < 1.27.0 → 1.27.0
- [CVE-2026-59891](https://erroneo.us/security/cve/CVE-2026-59891/index.md) Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry — npm @sigstore/oci < 0.7.1 → 0.7.1
- [CVE-2026-73653](https://erroneo.us/security/cve/CVE-2026-73653/index.md) @vitest/browser: Browser Mode provider commands bypass the file-access permission gate — npm @vitest/browser >= 4.0.0, < 4.1.10 → 4.1.10; npm @vitest/browser < 3.2.7 → 3.2.7; npm @vitest/browser >= 5.0.0-beta.1, < 5.0.0-beta.6 → 5.0.0-beta.6
- [CVE-2026-58426](https://erroneo.us/security/cve/CVE-2026-58426/index.md) Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write — Go code.gitea.io/gitea >= 1.22.0, < 1.26.2 → 1.26.2
- [CVE-2026-20896](https://erroneo.us/security/cve/CVE-2026-20896/index.md) Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` — Go code.gitea.io/gitea < 1.26.3 → 1.26.3
- [CVE-2026-64825](https://erroneo.us/security/cve/CVE-2026-64825/index.md) Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding — PyPI homeassistant < 2026.6.0 → 2026.6.0
- [CVE-2026-22874](https://erroneo.us/security/cve/CVE-2026-22874/index.md) Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter — Go code.gitea.io/gitea < 1.26.3 → 1.26.3

---
Source page: https://erroneo.us/security/2026-07-21/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt