---
title: "Security digest: September 18, 2026"
url: https://erroneo.us/security/2026-09-18/
description: "September 18, 2026 vulnerability digest: 1 brief (Linux Kernel: Five Exploited Root Bugs Added to…); 3 CISA KEV additions (Linux); 5 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-09-18
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 18, 2026

1 editorial brief, 3 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Patch this week: Linux Kernel: Five Exploited Root Bugs Added to CISA KEV . Anyone running Linux kernels older than their distribution's July to September 2026 security updates, most urgently where containers, CI jobs or untrusted users share a kernel.
- Do you run any of these? Linux Kernel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-21.
- PyPI: 3 critical advisories ( mnemosyne-memory , anyio , lmdeploy ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( github.com/kcp-dev/kcp ). Check with govulncheck ./... .
- Maven: 1 critical advisory ( org.xwiki.rendering:xwiki-rendering-xml ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [Linux Kernel: Five Exploited Root Bugs Added to CISA KEV](https://erroneo.us/security/briefs/linux-kernel-five-exploited-lpe-bugs-kev/index.md): Five local root bugs, all with fixes and most with public exploits, are now confirmed exploited; get every Linux host onto a current kernel and reboot this week, container hosts, CI runners and shared servers first.

## Known exploited (CISA KEV)

- [CVE-2026-53266](https://erroneo.us/security/cve/CVE-2026-53266/index.md) Linux Kernel: Linux Kernel Out-of-Bounds Write Vulnerability (CISA due 2026-09-21)
- [CVE-2025-39964](https://erroneo.us/security/cve/CVE-2025-39964/index.md) Linux Kernel: Linux Kernel Race Condition Vulnerability (CISA due 2026-09-21)
- [CVE-2025-39682](https://erroneo.us/security/cve/CVE-2025-39682/index.md) Linux Kernel: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (CISA due 2026-09-21)

## Critical advisories

- [CVE-2026-59163](https://erroneo.us/security/cve/CVE-2026-59163/index.md) Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass — PyPI mnemosyne-memory <= 3.10.0 → 3.10.1
- [CVE-2026-61682](https://erroneo.us/security/cve/CVE-2026-61682/index.md) kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace — Go github.com/kcp-dev/kcp < 0.31.4 → 0.31.4; Go github.com/kcp-dev/kcp >= 0.32.0, < 0.32.2 → 0.32.2
- [CVE-2026-63374](https://erroneo.us/security/cve/CVE-2026-63374/index.md) AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing — PyPI anyio < 4.14.2 → 4.14.2
- [CVE-2025-66455](https://erroneo.us/security/cve/CVE-2025-66455/index.md) LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py — PyPI lmdeploy >= 0.9.2, < 0.16.0 → 0.16.0
- [CVE-2025-53837](https://erroneo.us/security/cve/CVE-2025-53837/index.md) org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue — Maven org.xwiki.rendering:xwiki-rendering-xml < 14.10.2 → 14.10.2

---
Source page: https://erroneo.us/security/2026-09-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt