---
title: "Security digest: April 8, 2026"
url: https://erroneo.us/security/2026-04-08/
description: "April 8, 2026 vulnerability digest: 1 CISA KEV addition (Ivanti); 5 critical advisories (PyPI, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-08
date_modified: 2026-04-08
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 8, 2026

1 known exploited (cisa kev) addition and 5 critical advisories.

## Take stock

- Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-11.
- PyPI: 4 critical advisories ( praisonaiagents , praisonai , PraisonAI , marimo ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( github.com/siyuan-note/siyuan/kernel ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-1340](https://erroneo.us/security/cve/CVE-2026-1340/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (CISA due 2026-04-11)

## Critical advisories

- [CVE-2026-39888](https://erroneo.us/security/cve/CVE-2026-39888/index.md) PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) — PyPI praisonaiagents <= 1.5.114 → 1.5.115
- [CVE-2026-39846](https://erroneo.us/security/cve/CVE-2026-39846/index.md) SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260407035653-2f416e5253f1 → 0.0.0-20260407035653-2f416e5253f1
- [CVE-2026-39890](https://erroneo.us/security/cve/CVE-2026-39890/index.md) PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading — PyPI praisonai <= 4.5.114 → 4.5.115
- [CVE-2026-40088](https://erroneo.us/security/cve/CVE-2026-40088/index.md) PraisonAI Vulnerable to OS Command Injection — PyPI PraisonAI < 4.5.121 → 4.5.121
- [CVE-2026-39987](https://erroneo.us/security/cve/CVE-2026-39987/index.md) Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass — PyPI marimo < 0.23.0 → 0.23.0

---
Source page: https://erroneo.us/security/2026-04-08/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt