---
title: "Security digest: April 7, 2026"
url: https://erroneo.us/security/2026-04-07/
description: "April 7, 2026 vulnerability digest: 7 critical advisories (Go, PyPI, npm, Maven, RubyGems). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-07
date_modified: 2026-04-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 7, 2026

7 critical advisories.

## Take stock

- Go: 2 critical advisories ( github.com/jackc/pgx/v5 ). Check with govulncheck ./... .
- Maven: 2 critical advisories ( gov.nsa.emissary:emissary , org.openidentityplatform.openam:openam ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( lollms ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( @delmaredigital/payload-puck ). Check with npm audit (or: npm ls <package>) .
- RubyGems: 1 critical advisory ( rack-session ). Check with bundle audit check --update .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-33815](https://erroneo.us/security/cve/CVE-2026-33815/index.md) pgx contains memory-safety vulnerability — Go github.com/jackc/pgx/v5 < 5.9.0 → 5.9.0
- [CVE-2026-33816](https://erroneo.us/security/cve/CVE-2026-33816/index.md) Memory-safety vulnerability in github.com/jackc/pgx/v5. — Go github.com/jackc/pgx/v5 < 5.9.0 → 5.9.0
- [CVE-2026-1114](https://erroneo.us/security/cve/CVE-2026-1114/index.md) LoLLMs is vulnerable to Improper Access Control through weak secret key — PyPI lollms < 2.2.0 → 2.2.0
- [CVE-2026-39397](https://erroneo.us/security/cve/CVE-2026-39397/index.md) @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections — npm @delmaredigital/payload-puck < 0.6.23 → 0.6.23
- [CVE-2026-35580](https://erroneo.us/security/cve/CVE-2026-35580/index.md) Emissary has GitHub Actions Shell Injection via Workflow Inputs — Maven gov.nsa.emissary:emissary < 8.39.0 → 8.39.0
- [CVE-2026-39324](https://erroneo.us/security/cve/CVE-2026-39324/index.md) Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization — RubyGems rack-session >= 2.0.0, < 2.1.2 → 2.1.2
- [CVE-2026-33439](https://erroneo.us/security/cve/CVE-2026-33439/index.md) OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM — Maven org.openidentityplatform.openam:openam <= 16.0.5 → 16.0.6

---
Source page: https://erroneo.us/security/2026-04-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt