Digest · Monday
Security digest: April 13, 2026
7 known exploited (cisa kev) additions and 3 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Adobe Acrobat and Reader, Fortinet FortiClient EMS, Microsoft Windows, Microsoft Exchange Server, Adobe Acrobat, Microsoft Visual Basic for Applications (VBA). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-16.
- PyPI: 2 critical advisories (
google-adk,excel-mcp-server). Check withpip-audit (or: pip show <package>). - RubyGems: 1 critical advisory (
decidim-core). Check withbundle audit check --update. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 7
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-34621 | Adobe Acrobat and Reader Adobe Acrobat and Reader Prototype Pollution Vulnerability | 2026-04-27 |
| CVE-2026-21643 | Fortinet FortiClient EMS Fortinet FortiClient EMS SQL Injection Vulnerability | 2026-04-16 |
| CVE-2025-60710 | Microsoft Windows Microsoft Windows Link Following Vulnerability Ransomware | 2026-04-27 |
| CVE-2023-36424 | Microsoft Windows Microsoft Windows Out-of-Bounds Read Vulnerability | 2026-04-27 |
| CVE-2023-21529 | Microsoft Exchange Server Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Ransomware | 2026-04-27 |
| CVE-2020-9715 | Adobe Acrobat Adobe Acrobat Use-After-Free Vulnerability | 2026-04-27 |
| CVE-2012-1854 | Microsoft Visual Basic for Applications (VBA) Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | 2026-04-27 |
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 2
Check: pip-audit (or: pip show <package>)
- Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability CVE-2026-4810 CVSS 9.3 Critical
google-adk>= 2.0.0a1, < 2.0.0a2 → fixed in 2.0.0a2;google-adk>= 1.7.0, < 1.28.1 → fixed in 1.28.1 - excel-mcp-server has a Path Traversal issue CVE-2026-40576 CVSS 9.4 Critical
excel-mcp-server<= 0.1.7 → fixed in 0.1.8
RubyGems 1
Check: bundle audit check --update
- Decidim has a cross-site scripting (XSS) in user name CVE-2026-23891 CVSS 9.3 Critical
decidim-core>= 0.31.0.rc1, < 0.31.0 → fixed in 0.31.1;decidim-core< 0.30.5 → fixed in 0.30.5