---
title: "Security digest: August 18, 2026"
url: https://erroneo.us/security/2026-08-18/
description: "August 18, 2026 vulnerability digest: 4 CISA KEV additions (Apple, Broadcom, Microsoft); 6 critical advisories (PyPI, Composer (PHP)…). What to patch and…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-18
date_modified: 2026-08-18
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 18, 2026

4 known exploited (cisa kev) additions and 6 critical advisories.

## Take stock

- Do you run any of these? Apple macOS, Broadcom VMware vCenter, Microsoft SharePoint, Microsoft Internet Key Exchange (IKE) Service Extensions. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-21.
- PyPI: 2 critical advisories ( surfio , resdata ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 2 critical advisories ( mtdowling/jmespath.php , froxlor/froxlor ). Check with composer audit .
- RubyGems: 1 critical advisory ( kobako ). Check with bundle audit check --update .
- Maven: 1 critical advisory ( org.keycloak:keycloak-services ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-65400](https://erroneo.us/security/cve/CVE-2026-65400/index.md) Apple macOS: Apple macOS Improper Authentication Vulnerability (CISA due 2026-08-21)
- [CVE-2026-59310](https://erroneo.us/security/cve/CVE-2026-59310/index.md) Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability (CISA due 2026-08-21)
- [CVE-2026-55040](https://erroneo.us/security/cve/CVE-2026-55040/index.md) Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability (CISA due 2026-08-21)
- [CVE-2026-33824](https://erroneo.us/security/cve/CVE-2026-33824/index.md) Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability (CISA due 2026-08-21)

## Critical advisories

- [CVE-2026-55211](https://erroneo.us/security/cve/CVE-2026-55211/index.md) surfio has an out-of-bounds read — PyPI surfio < 0.0.19 → 0.0.19
- [CVE-2026-55209](https://erroneo.us/security/cve/CVE-2026-55209/index.md) resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read — PyPI resdata < 6.2.9 → 6.2.9
- [CVE-2026-54133](https://erroneo.us/security/cve/CVE-2026-54133/index.md) jmespath.php has CompilerRuntime code injection via unescaped function names — Composer (PHP) mtdowling/jmespath.php < 2.9.1 → 2.9.1
- [CVE-2026-55107](https://erroneo.us/security/cve/CVE-2026-55107/index.md) kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) — RubyGems kobako >= 0.1.0, <= 0.9.0 → 0.9.1
- [CVE-2026-62988](https://erroneo.us/security/cve/CVE-2026-62988/index.md) Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints — Composer (PHP) froxlor/froxlor < 2.3.8 → 2.3.8
- [CVE-2026-18963](https://erroneo.us/security/cve/CVE-2026-18963/index.md) Keycloak: Unauthenticated account takeover via reset-credentials flow bypass — Maven org.keycloak:keycloak-services >= 26.0.0, < 26.4.15 → 26.4.15; Maven org.keycloak:keycloak-services >= 26.5.0, < 26.6.6 → 26.6.6; Maven org.keycloak:keycloak-services >= 26.7.0, < 26.7.2 → 26.7.2

---
Source page: https://erroneo.us/security/2026-08-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt