Digest · Wednesday

Security digest: April 8, 2026

1 known exploited (cisa kev) addition and 5 critical advisories.

Take stock

Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-11.
PyPI: 4 critical advisories (praisonaiagents, praisonai, PraisonAI, marimo). Check with pip-audit (or: pip show <package>).
Go: 1 critical advisory (github.com/siyuan-note/siyuan/kernel). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-1340	Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability	2026-04-11

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: pip-audit (or: pip show <package>)

PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) CVE-2026-39888 CVSS 9.9 Critical
praisonaiagents <= 1.5.114 → fixed in 1.5.115
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading CVE-2026-39890 CVSS 9.8 Critical
praisonai <= 4.5.114 → fixed in 4.5.115
PraisonAI Vulnerable to OS Command Injection CVE-2026-40088 CVSS 9.6 Critical
PraisonAI < 4.5.121 → fixed in 4.5.121
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass CVE-2026-39987 CVSS 9.3 Critical
marimo < 0.23.0 → fixed in 0.23.0

Check: govulncheck ./...

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions CVE-2026-39846 CVSS 9.0 Critical
github.com/siyuan-note/siyuan/kernel < 0.0.0-20260407035653-2f416e5253f1 → fixed in 0.0.0-20260407035653-2f416e5253f1