---
title: "Security digest: April 2, 2026"
url: https://erroneo.us/security/2026-04-02/
description: "April 2, 2026 vulnerability digest: 1 CISA KEV addition (TrueConf); 14 critical advisories (npm, Composer (PHP), PyPI, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-02
date_modified: 2026-04-02
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 2, 2026

1 known exploited (cisa kev) addition and 14 critical advisories.

## Take stock

- Do you run any of these? TrueConf Client. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-16.
- npm: 7 critical advisories ( better-auth , fast-jwt , openclaw , @usebruno/cli , @lightdash/cli ). Check with npm audit (or: npm ls <package>) .
- PyPI: 3 critical advisories ( pymetasploit3 , kedro , agno ). Check with pip-audit (or: pip show <package>) .
- Go: 3 critical advisories ( github.com/dgraph-io/dgraph/v25 , github.com/dgraph-io/dgraph/v24 , github.com/dgraph-io/dgraph , github.com/patrickhener/goshs ). Check with govulncheck ./... .
- Composer (PHP): 1 critical advisory ( ci4-cms-erp/ci4ms ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-3502](https://erroneo.us/security/cve/CVE-2026-3502/index.md) TrueConf Client: TrueConf Client Download of Code Without Integrity Check Vulnerability (CISA due 2026-04-16)

## Critical advisories

- [GHSA-xg6x-h9c9-2m83](https://erroneo.us/security/ghsa/GHSA-xg6x-h9c9-2m83/index.md) Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) — npm better-auth < 1.4.9 → 1.4.9
- [CVE-2026-34989](https://erroneo.us/security/cve/CVE-2026-34989/index.md) CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 31.0.0.0
- [CVE-2026-35039](https://erroneo.us/security/cve/CVE-2026-35039/index.md) fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) — npm fast-jwt >= 0.0.1, < 6.2.0 → 6.2.0
- [CVE-2026-5463](https://erroneo.us/security/cve/CVE-2026-5463/index.md) pymetasploit3 vulnerable to command injection in console.run_module_with_output() — PyPI pymetasploit3 <= 1.0.6 → no fix
- [CVE-2026-34976](https://erroneo.us/security/cve/CVE-2026-34976/index.md) Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization — Go github.com/dgraph-io/dgraph/v25 <= 25.3.0 → 25.3.1; Go github.com/dgraph-io/dgraph/v24 <= 24.0.5 → no fix; Go github.com/dgraph-io/dgraph <= 1.2.8 → no fix
- [CVE-2026-34950](https://erroneo.us/security/cve/CVE-2026-34950/index.md) fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key — npm fast-jwt <= 6.1.0 → 6.2.0
- [CVE-2026-35393](https://erroneo.us/security/cve/CVE-2026-35393/index.md) goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload — Go github.com/patrickhener/goshs < 1.1.5-0.20260401172448-237f3af891a9 → 1.1.5-0.20260401172448-237f3af891a9
- [CVE-2026-35392](https://erroneo.us/security/cve/CVE-2026-35392/index.md) goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload — Go github.com/patrickhener/goshs < 1.1.5-0.20260401172448-237f3af891a9 → 1.1.5-0.20260401172448-237f3af891a9
- [CVE-2026-41329](https://erroneo.us/security/cve/CVE-2026-41329/index.md) OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation — npm openclaw <= 2026.3.28 → 2026.3.31
- [CVE-2026-41296](https://erroneo.us/security/cve/CVE-2026-41296/index.md) OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile — npm openclaw <= 2026.3.28 → 2026.3.31
- [CVE-2026-35171](https://erroneo.us/security/cve/CVE-2026-35171/index.md) Kedro has Arbitrary Code Execution via Malicious Logging Configuration — PyPI kedro < 1.3.0 → 1.3.0
- [CVE-2026-35002](https://erroneo.us/security/cve/CVE-2026-35002/index.md) Agno is vulnerable to Eval Injection — PyPI agno < 2.3.24 → 2.3.24
- [CVE-2026-34841](https://erroneo.us/security/cve/CVE-2026-34841/index.md) Axios npm Supply Chain Incident Impacting @usebruno/cli — npm @usebruno/cli < 3.2.0 → 3.2.1
- [GHSA-3hfp-gqgh-xc5g](https://erroneo.us/security/ghsa/GHSA-3hfp-gqgh-xc5g/index.md) Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions — npm @lightdash/cli >= 0.1800.0, < 0.2695.1 → 0.2695.1

---
Source page: https://erroneo.us/security/2026-04-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt