--- title: "Security digest: April 1, 2026" url: https://erroneo.us/security/2026-04-01/ description: "April 1, 2026 vulnerability digest: 1 CISA KEV addition (Google); 18 critical advisories (Composer (PHP), npm, Go, PyPI). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-04-01 date_modified: 2026-04-01 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: April 1, 2026 1 known exploited (cisa kev) addition and 18 critical advisories. ## Take stock - Do you run any of these? Google Dawn. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-15. - Composer (PHP): 11 critical advisories ( ci4-cms-erp/ci4ms ). Check with composer audit . - PyPI: 5 critical advisories ( praisonai , praisonaiagents ). Check with pip-audit (or: pip show ) . - npm: 1 critical advisory ( payload , @payloadcms/graphql ). Check with npm audit (or: npm ls ) . - Go: 1 critical advisory ( github.com/juju/juju ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2026-5281](https://erroneo.us/security/cve/CVE-2026-5281/index.md) Google Dawn: Google Dawn Use-After-Free Vulnerability (CISA due 2026-04-15) ## Critical advisories - [CVE-2026-34565](https://erroneo.us/security/cve/CVE-2026-34565/index.md) CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34568](https://erroneo.us/security/cve/CVE-2026-34568/index.md) CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34560](https://erroneo.us/security/cve/CVE-2026-34560/index.md) CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34567](https://erroneo.us/security/cve/CVE-2026-34567/index.md) CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34751](https://erroneo.us/security/cve/CVE-2026-34751/index.md) Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery — npm payload < 3.79.1 → 3.79.1; npm @payloadcms/graphql < 3.79.1 → 3.79.1 - [CVE-2026-4370](https://erroneo.us/security/cve/CVE-2026-4370/index.md) Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster — Go github.com/juju/juju <= 0.0.0-20260401092550-1c1ac1922b57 → no fix - [CVE-2026-34561](https://erroneo.us/security/cve/CVE-2026-34561/index.md) CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34564](https://erroneo.us/security/cve/CVE-2026-34564/index.md) CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34569](https://erroneo.us/security/cve/CVE-2026-34569/index.md) CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34571](https://erroneo.us/security/cve/CVE-2026-34571/index.md) CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34952](https://erroneo.us/security/cve/CVE-2026-34952/index.md) PraisonAI Has Missing Authentication in WebSocket Gateway — PyPI praisonai <= 4.5.96 → 4.5.97 - [CVE-2026-34935](https://erroneo.us/security/cve/CVE-2026-34935/index.md) PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() — PyPI praisonai >= 4.5.15, <= 4.5.68 → 4.5.69 - [CVE-2026-34934](https://erroneo.us/security/cve/CVE-2026-34934/index.md) PraisonAI Has Second-Order SQL Injection in `get_all_user_threads` — PyPI praisonai <= 4.5.89 → 4.5.90 - [CVE-2026-34953](https://erroneo.us/security/cve/CVE-2026-34953/index.md) PraisonAI Has Authentication Bypass via OAuthManager.validate_token() — PyPI praisonai <= 4.5.96 → 4.5.97 - [CVE-2026-34563](https://erroneo.us/security/cve/CVE-2026-34563/index.md) CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34938](https://erroneo.us/security/cve/CVE-2026-34938/index.md) PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code — PyPI praisonaiagents <= 1.5.89 → 1.5.90 - [CVE-2026-34566](https://erroneo.us/security/cve/CVE-2026-34566/index.md) CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 - [CVE-2026-34559](https://erroneo.us/security/cve/CVE-2026-34559/index.md) CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0 --- Source page: https://erroneo.us/security/2026-04-01/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt