---
title: "Security digest: April 3, 2026"
url: https://erroneo.us/security/2026-04-03/
description: "April 3, 2026 vulnerability digest: 8 critical advisories (npm, PyPI, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-03
date_modified: 2026-04-03
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 3, 2026

8 critical advisories.

## Take stock

- npm: 4 critical advisories ( signalk-server , @budibase/server , @budibase/backend-core , @nyariv/sandboxjs ). Check with npm audit (or: npm ls <package>) .
- PyPI: 3 critical advisories ( litellm , mlflow , pyload-ng ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( github.com/patrickhener/goshs ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-33950](https://erroneo.us/security/cve/CVE-2026-33950/index.md) Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity — npm signalk-server < 2.24.0-beta.4 → 2.24.0-beta.4
- [CVE-2026-35030](https://erroneo.us/security/cve/CVE-2026-35030/index.md) LiteLLM: Authentication bypass via OIDC userinfo cache key collision — PyPI litellm < 1.83.0 → 1.83.0
- [CVE-2026-35216](https://erroneo.us/security/cve/CVE-2026-35216/index.md) Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step — npm @budibase/server < 3.33.4 → 3.33.4
- [CVE-2026-31818](https://erroneo.us/security/cve/CVE-2026-31818/index.md) Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist — npm @budibase/backend-core < 3.33.4 → 3.33.4
- [CVE-2026-0545](https://erroneo.us/security/cve/CVE-2026-0545/index.md) mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization — PyPI mlflow <= 3.10.1 → no fix
- [CVE-2026-35459](https://erroneo.us/security/cve/CVE-2026-35459/index.md) pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992) — PyPI pyload-ng <= 0.5.0b3.dev96 → no fix
- [CVE-2026-35471](https://erroneo.us/security/cve/CVE-2026-35471/index.md) goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) — Go github.com/patrickhener/goshs < 1.1.5-0.20260401172448-237f3af891a9 → 1.1.5-0.20260401172448-237f3af891a9
- [CVE-2026-34208](https://erroneo.us/security/cve/CVE-2026-34208/index.md) SandboxJS: Sandbox integrity escape — npm @nyariv/sandboxjs < 0.8.36 → 0.8.36

---
Source page: https://erroneo.us/security/2026-04-03/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt