---
title: "Security digest: July 31, 2026"
url: https://erroneo.us/security/2026-07-31/
description: "July 31, 2026 vulnerability digest: 5 critical advisories (Go, npm, PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-31
date_modified: 2026-07-31
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 31, 2026

5 critical advisories.

## Take stock

- Go: 2 critical advisories ( github.com/bank-vaults/vault-secrets-webhook , github.com/pterodactyl/wings ). Check with govulncheck ./... .
- npm: 2 critical advisories ( @nocobase/plugin-notification-in-app-message , apostrophe ). Check with npm audit (or: npm ls <package>) .
- PyPI: 1 critical advisory ( sentence-transformers ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-54725](https://erroneo.us/security/cve/CVE-2026-54725/index.md) vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API — Go github.com/bank-vaults/vault-secrets-webhook <= 1.22.2 → 1.23.1
- [CVE-2026-52855](https://erroneo.us/security/cve/CVE-2026-52855/index.md) Wings exposes node configuration secrets through egg configuration-file templating — Go github.com/pterodactyl/wings < 1.12.3 → 1.12.3
- [CVE-2026-52887](https://erroneo.us/security/cve/CVE-2026-52887/index.md) NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE — npm @nocobase/plugin-notification-in-app-message <= 2.0.60 → 2.0.61
- [CVE-2026-68770](https://erroneo.us/security/cve/CVE-2026-68770/index.md) sentence-transformers local model loading bypasses trust_remote_code and executes custom Python — PyPI sentence-transformers < 5.6.0 → 5.6.0
- [CVE-2026-53609](https://erroneo.us/security/cve/CVE-2026-53609/index.md) Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass — npm apostrophe <= 4.30.0 → 4.31.0

---
Source page: https://erroneo.us/security/2026-07-31/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt