Digest · Friday
Security digest: July 31, 2026
5 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 2 critical advisories (
github.com/bank-vaults/vault-secrets-webhook,github.com/pterodactyl/wings). Check withgovulncheck ./.... - npm: 2 critical advisories (
@nocobase/plugin-notification-in-app-message,apostrophe). Check withnpm audit (or: npm ls <package>). - PyPI: 1 critical advisory (
sentence-transformers). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 5
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 2
Check: govulncheck ./...
- vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide… CVE-2026-54725 CVSS 9.6 Critical
github.com/bank-vaults/vault-secrets-webhook<= 1.22.2 → fixed in 1.23.1 - Wings exposes node configuration secrets through egg configuration-file templating CVE-2026-52855 CVSS 9.9 Critical
github.com/pterodactyl/wings< 1.12.3 → fixed in 1.12.3
npm 2
Check: npm audit (or: npm ls <package>)
- NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE CVE-2026-52887 CVSS 10.0 Critical
@nocobase/plugin-notification-in-app-message<= 2.0.60 → fixed in 2.0.61 - Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass CVE-2026-53609 CVSS 9.1 Critical
apostrophe<= 4.30.0 → fixed in 4.31.0
PyPI 1
Check: pip-audit (or: pip show <package>)
- sentence-transformers local model loading bypasses trust_remote_code and executes custom Python CVE-2026-68770 CVSS 9.3 Critical
sentence-transformers< 5.6.0 → fixed in 5.6.0