Security Digest archive
May 2026
5 editorial briefs, 21 known exploited (cisa kev) additions and 203 critical advisories across 22 digest days.
Friday, May 29, 2026
- KEV CVE-2026-0257 Palo Alto Networks PAN-OS
- Critical 16 advisories: PraisonAI, vm2, vm2, vm2, stigmem-node, praisonai-platform, stigmem-node, praisonai-platform, stigmem-node, PraisonAI, PraisonAI, vm2 …
Thursday, May 28, 2026
Wednesday, May 27, 2026
- KEV CVE-2026-8398 Daemon Daemon Tools Lite
- KEV CVE-2026-48027 Nx Nx Console
- KEV CVE-2026-45321 TanStack TanStack
- Critical 5 advisories: org.yamcs:yamcs-core, langroid, liquidjs, github.com/googleapis/mcp-toolbox, org.yamcs:yamcs-core
Tuesday, May 26, 2026
- KEV CVE-2026-48172 LiteSpeed cPanel Plugin
- Critical 7 advisories: org.xwiki.commons:xwiki-commons-classlo…, org.xwiki.platform:xwiki-platform-rest…, org.apache.cxf.services.xkms:cxf-servic…, dolibarr/dolibarr, mlflow, kubevirt.io/kubevirt, org.yamcs:yamcs-core
Friday, May 22, 2026
- KEV CVE-2026-9082 Drupal Core
- Critical 3 advisories: github.com/gtsteffaniak/filebrowser/bac…, yeswiki/yeswiki, github.com/nezhahq/nezha
Thursday, May 21, 2026
- Patch this week Starlette BadHost: Host Header Auth Bypass in CISA KEV
- KEV CVE-2026-34926 Trend Micro Apex One
- KEV CVE-2025-34291 Langflow Langflow
- Critical 7 advisories: @hulumi/policies, pyfory, boxlite, boxlite, twig/twig, concrete5/concrete5, github.com/fission/fission
Wednesday, May 20, 2026
- KEV CVE-2026-45498 Microsoft Defender
- KEV CVE-2026-41091 Microsoft Defender
- KEV CVE-2010-0806 Microsoft Internet Explorer
- KEV CVE-2010-0249 Microsoft Internet Explorer
- KEV CVE-2009-3459 Adobe Acrobat and Reader
- KEV CVE-2009-1537 Microsoft DirectX
- KEV CVE-2008-4250 Microsoft Windows
- Critical 2 advisories: @cap-js/sqlite, drupal/core
Tuesday, May 19, 2026
Monday, May 18, 2026
- Critical 7 advisories: verbb/formie, mistralai, sglang, sglang, chromadb, github.com/getarcaneapp/arcane/backend, sglang
Friday, May 15, 2026
- KEV CVE-2026-42897 Microsoft Microsoft
Thursday, May 14, 2026
- KEV CVE-2026-20182 Cisco Catalyst SD-WAN
- Critical 18 advisories: deepseek-tui, n8n, com.amazon.redshift:redshift-jdbc42, @samanhappy/mcphub, Marten, github.com/portainer/portainer, sanitize-html, @strapi/strapi, electerm, github.com/openclaw/crabbox, n8n, flowise …
Wednesday, May 13, 2026
Tuesday, May 12, 2026
Monday, May 11, 2026
- Check exposure Mini Shai-Hulud: TanStack npm Worm With Valid Provenance
- Critical 9 advisories: io.unitycatalog:unitycatalog-server, angular-expressions, pgadmin4, torrentpier/torrentpier, @nyariv/sandboxjs, @tanstack/arktype-adapter, PraisonAI, @wdio/browserstack-service, github.com/cloudnative-pg/cloudnative-pg
Friday, May 8, 2026
- KEV CVE-2026-42208 BerriAI LiteLLM
- Critical 18 advisories: snipe/snipe-it, prestashop/prestashop, @profullstack/mcp-server, github.com/free5gc/nef, zebrad, electerm, electerm, github.com/free5gc/nef, vm2, vm2, github.com/free5gc/nef, cline …
Thursday, May 7, 2026
- KEV CVE-2026-6973 Ivanti Endpoint Manager Mobile (EPMM)
- Critical 9 advisories: parse-ini, github.com/enchant97/note-mark/backend, zebrad, intercom/intercom-php, zebra-script, zebrad, query-string-parser, intercom-client, @jswork/next-npm-version
Wednesday, May 6, 2026
- KEV CVE-2026-0300 Palo Alto Networks PAN-OS
- Critical 24 advisories: pytorch-lightning, vm2, rucio, github.com/gotenberg/gotenberg/v8, org.apache.wicket:wicket-auth-roles, vm2, wger, com.ritense.valtimo:document, misp-modules, fast-jwt, github.com/gtsteffaniak/filebrowser, thorsten/phpmyfaq …
Tuesday, May 5, 2026
- Critical 17 advisories: getgrav/grav, getgrav/grav, vm2, github.com/oxyno-zeta/s3-proxy, vm2, getgrav/grav, magicmirror, com.arcadedb:arcadedb-server, firefighter-incident, vm2, langflow, org.eclipse.basyx:basyx.sdk …
Monday, May 4, 2026
- Critical 15 advisories: org.openmrs.api:openmrs-api, org.apache.polaris:polaris-runtime-serv…, org.apache.polaris:polaris-core, github.com/pelicanplatform/pelican, sui-execution-cut, vm2, mysten-metrics, nabeel/phpvms, org.apache.polaris:polaris-core, org.apache.opennlp:opennlp-tools, org.thymeleaf:thymeleaf, org.apache.polaris:polaris-runtime-serv… …
Sunday, May 3, 2026
Saturday, May 2, 2026
- Check exposure Bleeding Llama: Unauthenticated Memory Leak in Ollama
Friday, May 1, 2026
- KEV CVE-2026-31431 Linux Kernel
- Critical 2 advisories: org.apache.mina:mina-core, org.apache.mina:mina-core