Digest · Thursday
Security digest: April 2, 2026
1 known exploited (cisa kev) addition and 14 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? TrueConf Client. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-16.
- npm: 7 critical advisories (
better-auth,fast-jwt,openclaw,@usebruno/cli,@lightdash/cli). Check withnpm audit (or: npm ls <package>). - PyPI: 3 critical advisories (
pymetasploit3,kedro,agno). Check withpip-audit (or: pip show <package>). - Go: 3 critical advisories (
github.com/dgraph-io/dgraph/v25,github.com/dgraph-io/dgraph/v24,github.com/dgraph-io/dgraph,github.com/patrickhener/goshs). Check withgovulncheck ./.... - Composer (PHP): 1 critical advisory (
ci4-cms-erp/ci4ms). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-3502 | TrueConf Client TrueConf Client Download of Code Without Integrity Check Vulnerability | 2026-04-16 |
Critical advisories by ecosystem 14
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 7
Check: npm audit (or: npm ls <package>)
- Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) GHSA-xg6x-h9c9-2m83 CVSS 9.1 Critical
better-auth< 1.4.9 → fixed in 1.4.9 - fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) CVE-2026-35039 CVSS 9.1 Critical
fast-jwt>= 0.0.1, < 6.2.0 → fixed in 6.2.0 - fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key CVE-2026-34950 CVSS 9.1 Critical
fast-jwt<= 6.1.0 → fixed in 6.2.0 - OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation CVE-2026-41329 CVSS 9.0 Critical
openclaw<= 2026.3.28 → fixed in 2026.3.31 - OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile CVE-2026-41296 CVSS 9.4 Critical
openclaw<= 2026.3.28 → fixed in 2026.3.31 - Axios npm Supply Chain Incident Impacting @usebruno/cli CVE-2026-34841 CVSS 9.8 Critical
@usebruno/cli< 3.2.0 → fixed in 3.2.1 - Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions GHSA-3hfp-gqgh-xc5g CVSS 9.6 Critical
@lightdash/cli>= 0.1800.0, < 0.2695.1 → fixed in 0.2695.1
Go 3
Check: govulncheck ./...
- Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVE-2026-34976 CVSS 10.0 Critical
github.com/dgraph-io/dgraph/v25<= 25.3.0 → fixed in 25.3.1;github.com/dgraph-io/dgraph/v24<= 24.0.5 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVE-2026-35393 CVSS 9.8 Critical
github.com/patrickhener/goshs< 1.1.5-0.20260401172448-237f3af891a9 → fixed in 1.1.5-0.20260401172448-237f3af891a9 - goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVE-2026-35392 CVSS 9.8 Critical
github.com/patrickhener/goshs< 1.1.5-0.20260401172448-237f3af891a9 → fixed in 1.1.5-0.20260401172448-237f3af891a9
PyPI 3
Check: pip-audit (or: pip show <package>)
- pymetasploit3 vulnerable to command injection in console.run_module_with_output() CVE-2026-5463 CVSS 9.3 Critical
pymetasploit3<= 1.0.6 → no fix listed - Kedro has Arbitrary Code Execution via Malicious Logging Configuration CVE-2026-35171 CVSS 9.8 Critical
kedro< 1.3.0 → fixed in 1.3.0 - Agno is vulnerable to Eval Injection CVE-2026-35002 CVSS 9.3 Critical
agno< 2.3.24 → fixed in 2.3.24
Composer (PHP) 1
Check: composer audit
- CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34989 CVSS 9.4 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 31.0.0.0