Security Digest: May 6, 2026 - 26 Critical Vulnerabilities

Today we uncover 26 critical vulnerabilities affecting a wide range of applications from cloud services to web frameworks. Immediate patching and mitigation strategies are essential to prevent data breaches.

· 4 min read

Security Digest: May 6, 2026 - 26 Critical Vulnerabilities

Executive Summary

Today we uncover 26 critical vulnerabilities affecting a wide range of applications from cloud services to web frameworks. Immediate patching and mitigation strategies are essential to prevent data breaches, service disruptions, and unauthorized access.

Critical Vulnerabilities

  • CVE-2026-29090: SQL Injection in Rucio Metadata Plugin
    • Impact: Full database compromise, remote code execution.
    • Affected Systems: Rucio deployments with 'postgres_meta'.
    • Immediate Action: Disable the 'postgres_meta' plugin immediately.
    • Mitigation: Await patch scheduled for May 19, 2025.
  • CVE-2026-43948: Password Reset Vulnerability in wger
    • Impact: Account takeover through password reset.
    • Affected Systems: All wger instances with gym.manage_gym perms.
    • Immediate Action: Implement the provided patch in views/user.py.
    • Mitigation: Ensure gym associations are correctly checked.
  • CVE-2026-29080: SQL Injection in Rucio with Oracle
    • Impact: Database read and modification, potential RCE.
    • Affected Systems: Oracle-based Rucio deployments.
    • Immediate Action: Disable 'json_meta' plugin temporarily.
    • Mitigation: Use parameterized queries.
  • CVE-2026-44262: RCE in dedoc/scramble
    • Impact: Arbitrary PHP code execution.
    • Affected Systems: Versions 0.13.2 to 0.13.21.
    • Immediate Action: Upgrade to version 0.13.22.
    • Mitigation: Restrict access to documentation endpoints.
  • CVE-2026-44351: JWT Authentication Bypass in fast-jwt
    • Impact: Unauthorized access with forged JWTs.
    • Affected Systems: fast-jwt@6.2.3 and earlier.
    • Immediate Action: Apply patch to reject empty HMAC secrets.
    • Mitigation: Validate JWTs with a strong key management strategy.
  • CVE-2026-42555: RCE via SpEL in Valtimo
    • Impact: Remote code execution by admin users.
    • Affected Systems: Valtimo versions since 12.0.0.
    • Immediate Action: Replace StandardEvaluationContext with SimpleEvaluationContext.
    • Mitigation: Restrict admin access and validate SpEL expressions.

Previously Alerted

What to Do Now

  1. Immediately review and apply patches for all affected systems.
  2. Verify system integrity and monitor for unusual activity.
  3. Implement network segmentation to limit vulnerability exposure.
  4. Educate your security teams about these vulnerabilities and response strategies.

Related Resources

  • Vendor advisories and patches are available on their respective GitHub repositories.
  • Internal blog post covering the mitigation strategies (link not yet available).

Keep reading