---
title: "Security digest: August 28, 2026"
url: https://erroneo.us/security/2026-08-28/
description: "August 28, 2026 vulnerability digest: 1 brief (JFrog Artifactory: Exploited Auth Bypass to…); 10 critical advisories (Go, PyPI, Composer (PHP)…). What to…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-28
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 28, 2026

1 editorial brief and 10 critical advisories.

## Take stock

- Act now: JFrog Artifactory: Exploited Auth Bypass to Admin (KEV) . Every team running self-managed JFrog Artifactory 7.x below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20, especially instances reachable from the internet or from untrusted build workloads.
- Go: 3 critical advisories ( github.com/free5gc/free5gc , github.com/klever-io/klever-go ). Check with govulncheck ./... .
- Maven: 3 critical advisories ( org.yamcs:yamcs-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 2 critical advisories ( plone.app.portlets , plone.app.event ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 2 critical advisories ( pimcore/pimcore ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [JFrog Artifactory: Exploited Auth Bypass to Admin (KEV)](https://erroneo.us/security/briefs/jfrog-artifactory-cve-2026-82329-auth-bypass-kev/index.md): If you run self-hosted Artifactory below the fixed builds, treat it as exploited until shown otherwise: upgrade, then hunt for rogue admins, Groovy plugins and stolen signing keys, because patching does not remove them.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-55068](https://erroneo.us/security/cve/CVE-2026-55068/index.md) free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints — Go github.com/free5gc/free5gc < 4.2.2 → 4.2.2
- [CVE-2026-55248](https://erroneo.us/security/cve/CVE-2026-55248/index.md) plone.app.portlets vulnerable to denial of service via RSS feed portlet — PyPI plone.app.portlets >= 7.0.0, <= 7.0.1 → 7.0.2; PyPI plone.app.portlets >= 6.0.0, < 6.0.4 → 6.0.4; PyPI plone.app.portlets < 5.0.8 → 5.0.8
- [CVE-2026-55220](https://erroneo.us/security/cve/CVE-2026-55220/index.md) Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) — Composer (PHP) pimcore/pimcore >= 2026.1.0, <= 2026.1.5 → 2026.1.6; Composer (PHP) pimcore/pimcore <= 12.3.9 → 12.3.10
- [CVE-2026-55247](https://erroneo.us/security/cve/CVE-2026-55247/index.md) plone.app.event vulnerable to denial of service via iCalendar import — PyPI plone.app.event < 5.2.4 → 5.2.4; PyPI plone.app.event >= 6.0.0a1, < 6.0.1 → 6.0.1
- [CVE-2026-54754](https://erroneo.us/security/cve/CVE-2026-54754/index.md) Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) — Go github.com/klever-io/klever-go < 1.7.19 → 1.7.19
- [CVE-2026-54755](https://erroneo.us/security/cve/CVE-2026-54755/index.md) Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) — Go github.com/klever-io/klever-go < 1.7.19 → 1.7.19
- [CVE-2026-55565](https://erroneo.us/security/cve/CVE-2026-55565/index.md) Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) — Maven org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1 → 5.13.2; Maven org.yamcs:yamcs-core <= 5.12.7 → 5.12.8
- [CVE-2026-55634](https://erroneo.us/security/cve/CVE-2026-55634/index.md) Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name — Composer (PHP) pimcore/pimcore <= 12.3.9 → 12.3.10; Composer (PHP) pimcore/pimcore >= 2026.1.0, <= 2026.1.5 → 2026.1.6
- [CVE-2026-55559](https://erroneo.us/security/cve/CVE-2026-55559/index.md) Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) — Maven org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1 → 5.13.2; Maven org.yamcs:yamcs-core <= 5.12.7 → 5.12.8
- [CVE-2026-55511](https://erroneo.us/security/cve/CVE-2026-55511/index.md) Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` — Maven org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1 → 5.13.2; Maven org.yamcs:yamcs-core <= 5.12.7 → 5.12.8

---
Source page: https://erroneo.us/security/2026-08-28/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt