---
title: "Security digest: July 28, 2026"
url: https://erroneo.us/security/2026-07-28/
description: "July 28, 2026 vulnerability digest: 5 critical advisories (Go, npm, crates.io (Rust)…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-28
date_modified: 2026-07-28
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 28, 2026

5 critical advisories.

## Take stock

- Go: 2 critical advisories ( github.com/patrickhener/goshs/v2 , goshs.de/goshs/v2 , goshs.de/goshs , github.com/patrickhener/goshs ). Check with govulncheck ./... .
- npm: 1 critical advisory ( @hypequery/clickhouse ). Check with npm audit (or: npm ls <package>) .
- crates.io (Rust): 1 critical advisory ( lettre ). Check with cargo audit .
- Composer (PHP): 1 critical advisory ( poweradmin/poweradmin ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-62325](https://erroneo.us/security/cve/CVE-2026-62325/index.md) goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) — Go github.com/patrickhener/goshs/v2 = 2.1.3 → 2.1.4; Go goshs.de/goshs/v2 = 2.1.3 → 2.1.4
- [CVE-2026-64863](https://erroneo.us/security/cve/CVE-2026-64863/index.md) goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite — Go goshs.de/goshs/v2 <= 2.1.3 → 2.1.4; Go github.com/patrickhener/goshs/v2 <= 2.1.3 → 2.1.4; Go goshs.de/goshs <= 1.1.4 → no fix
- [CVE-2026-54658](https://erroneo.us/security/cve/CVE-2026-54658/index.md) @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution — npm @hypequery/clickhouse < 2.0.2 → 2.5.1
- [CVE-2026-46428](https://erroneo.us/security/cve/CVE-2026-46428/index.md) lettre has TLS hostname verification disabled when using Boring TLS backend — crates.io (Rust) lettre >= 0.10.1, < 0.11.22 → 0.11.22
- [CVE-2026-54588](https://erroneo.us/security/cve/CVE-2026-54588/index.md) Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. — Composer (PHP) poweradmin/poweradmin < 4.2.4 → 4.2.4; Composer (PHP) poweradmin/poweradmin >= 4.3.0, < 4.3.3 → 4.3.3

---
Source page: https://erroneo.us/security/2026-07-28/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt