---
title: "Security digest: August 21, 2026"
url: https://erroneo.us/security/2026-08-21/
description: "August 21, 2026 vulnerability digest: 1 CISA KEV addition (Synacor); 6 critical advisories (PyPI, Maven, Composer (PHP)…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-21
date_modified: 2026-08-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 21, 2026

1 known exploited (cisa kev) addition and 6 critical advisories.

## Take stock

- Do you run any of these? Synacor Zimbra Collaboration Suite (ZCS). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-24.
- npm: 3 critical advisories ( jsonata ). Check with npm audit (or: npm ls <package>) .
- PyPI: 1 critical advisory ( xinference ). Check with pip-audit (or: pip show <package>) .
- Maven: 1 critical advisory ( org.geotools.jdbc:gt-jdbc-postgis ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 1 critical advisory ( phalcon/cphalcon ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-73570](https://erroneo.us/security/cve/CVE-2026-73570/index.md) Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (CISA due 2026-08-24)

## Critical advisories

- [CVE-2026-61539](https://erroneo.us/security/cve/CVE-2026-61539/index.md) Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing — PyPI xinference <= 2.5.0 → 2.7.0
- [CVE-2026-76904](https://erroneo.us/security/cve/CVE-2026-76904/index.md) GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers — Maven org.geotools.jdbc:gt-jdbc-postgis = 35.0 → 35.1; Maven org.geotools.jdbc:gt-jdbc-postgis >= 34.0, < 34.5 → 34.5; Maven org.geotools.jdbc:gt-jdbc-postgis >= 30.5, < 33.6 → 33.6
- [CVE-2026-59989](https://erroneo.us/security/cve/CVE-2026-59989/index.md) Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) — Composer (PHP) phalcon/cphalcon <= 5.15.0 → 5.16.0
- [CVE-2026-77413](https://erroneo.us/security/cve/CVE-2026-77413/index.md) JSONata: Arbitrary Code Execution via crafted JSONata expressions — npm jsonata <= 1.8.7 → 1.8.8; npm jsonata >= 2.0.0, < 2.2.0 → 2.2.0
- [CVE-2026-77415](https://erroneo.us/security/cve/CVE-2026-77415/index.md) JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions — npm jsonata >= 2.0.0, < 2.2.1 → 2.2.1; npm jsonata < 1.8.8 → 1.8.8
- [CVE-2026-77414](https://erroneo.us/security/cve/CVE-2026-77414/index.md) JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions — npm jsonata >= 2.0.0, < 2.2.1 → 2.2.1; npm jsonata < 1.8.8 → 1.8.8

---
Source page: https://erroneo.us/security/2026-08-21/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt