---
title: "Security digest: April 6, 2026"
url: https://erroneo.us/security/2026-04-06/
description: "April 6, 2026 vulnerability digest: 1 CISA KEV addition (Fortinet); 4 critical advisories (PyPI, Composer (PHP)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-06
date_modified: 2026-04-06
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 6, 2026

1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Do you run any of these? Fortinet FortiClient EMS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-09.
- PyPI: 3 critical advisories ( changedetection.io , PraisonAI ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 1 critical advisory ( ci4-cms-erp/ci4ms ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-35616](https://erroneo.us/security/cve/CVE-2026-35616/index.md) Fortinet FortiClient EMS: Fortinet FortiClient EMS Improper Access Control Vulnerability (CISA due 2026-04-09)

## Critical advisories

- [CVE-2026-35490](https://erroneo.us/security/cve/CVE-2026-35490/index.md) changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering — PyPI changedetection.io <= 0.54.7 → 0.54.8
- [CVE-2026-39305](https://erroneo.us/security/cve/CVE-2026-39305/index.md) PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator — PyPI PraisonAI <= 4.5.112 → 4.5.113
- [CVE-2026-35615](https://erroneo.us/security/cve/CVE-2026-35615/index.md) PraisonAI Has Path Traversal in FileTools — PyPI PraisonAI <= 1.5.112 → 1.5.113
- [CVE-2026-35035](https://erroneo.us/security/cve/CVE-2026-35035/index.md) CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.31.1.0 → 0.31.2.0

---
Source page: https://erroneo.us/security/2026-04-06/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt