Digest · Tuesday
Security digest: April 7, 2026
7 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 2 critical advisories (
github.com/jackc/pgx/v5). Check withgovulncheck ./.... - Maven: 2 critical advisories (
gov.nsa.emissary:emissary,org.openidentityplatform.openam:openam). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - PyPI: 1 critical advisory (
lollms). Check withpip-audit (or: pip show <package>). - npm: 1 critical advisory (
@delmaredigital/payload-puck). Check withnpm audit (or: npm ls <package>). - RubyGems: 1 critical advisory (
rack-session). Check withbundle audit check --update. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 7
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 2
Check: govulncheck ./...
- pgx contains memory-safety vulnerability CVE-2026-33815 CVSS 9.8 Critical
github.com/jackc/pgx/v5< 5.9.0 → fixed in 5.9.0 - Memory-safety vulnerability in github.com/jackc/pgx/v5. CVE-2026-33816 CVSS 9.8 Critical
github.com/jackc/pgx/v5< 5.9.0 → fixed in 5.9.0
Maven 2
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Emissary has GitHub Actions Shell Injection via Workflow Inputs CVE-2026-35580 CVSS 9.1 Critical
gov.nsa.emissary:emissary< 8.39.0 → fixed in 8.39.0 - OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVE-2026-33439 CVSS 9.3 Critical
org.openidentityplatform.openam:openam<= 16.0.5 → fixed in 16.0.6
npm 1
Check: npm audit (or: npm ls <package>)
- @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered… CVE-2026-39397 CVSS 9.4 Critical
@delmaredigital/payload-puck< 0.6.23 → fixed in 0.6.23
PyPI 1
Check: pip-audit (or: pip show <package>)
- LoLLMs is vulnerable to Improper Access Control through weak secret key CVE-2026-1114 CVSS 9.8 Critical
lollms< 2.2.0 → fixed in 2.2.0
RubyGems 1
Check: bundle audit check --update
- Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization CVE-2026-39324 CVSS 9.1 Critical
rack-session>= 2.0.0, < 2.1.2 → fixed in 2.1.2