Digest · Tuesday

Security digest: July 28, 2026

5 critical advisories.

Take stock

Go: 2 critical advisories (github.com/patrickhener/goshs/v2, goshs.de/goshs/v2, goshs.de/goshs, github.com/patrickhener/goshs). Check with govulncheck ./....
npm: 1 critical advisory (@hypequery/clickhouse). Check with npm audit (or: npm ls <package>).
crates.io (Rust): 1 critical advisory (lettre). Check with cargo audit.
Composer (PHP): 1 critical advisory (poweradmin/poweradmin). Check with composer audit.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) CVE-2026-62325 CVSS 9.1 Critical
github.com/patrickhener/goshs/v2 = 2.1.3 → fixed in 2.1.4; goshs.de/goshs/v2 = 2.1.3 → fixed in 2.1.4
goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite CVE-2026-64863 CVSS 9.1 Critical
goshs.de/goshs/v2 <= 2.1.3 → fixed in 2.1.4; github.com/patrickhener/goshs/v2 <= 2.1.3 → fixed in 2.1.4; goshs.de/goshs <= 1.1.4 → no fix listed; +1 more packages

Check: composer audit

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. CVE-2026-54588 CVSS 9.6 Critical
poweradmin/poweradmin < 4.2.4 → fixed in 4.2.4; poweradmin/poweradmin >= 4.3.0, < 4.3.3 → fixed in 4.3.3

Check: npm audit (or: npm ls <package>)

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution CVE-2026-54658 CVSS 9.8 Critical
@hypequery/clickhouse < 2.0.2 → fixed in 2.5.1

Check: cargo audit

lettre has TLS hostname verification disabled when using Boring TLS backend CVE-2026-46428 CVSS 9.1 Critical
lettre >= 0.10.1, < 0.11.22 → fixed in 0.11.22