---
title: "Security digest: April 13, 2026"
url: https://erroneo.us/security/2026-04-13/
description: "April 13, 2026 vulnerability digest: 7 CISA KEV additions (Adobe, Fortinet, Microsoft); 3 critical advisories (PyPI, RubyGems). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-13
date_modified: 2026-04-13
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 13, 2026

7 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Do you run any of these? Adobe Acrobat and Reader, Fortinet FortiClient EMS, Microsoft Windows, Microsoft Exchange Server, Adobe Acrobat, Microsoft Visual Basic for Applications (VBA). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-16.
- PyPI: 2 critical advisories ( google-adk , excel-mcp-server ). Check with pip-audit (or: pip show <package>) .
- RubyGems: 1 critical advisory ( decidim-core ). Check with bundle audit check --update .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-34621](https://erroneo.us/security/cve/CVE-2026-34621/index.md) Adobe Acrobat and Reader: Adobe Acrobat and Reader Prototype Pollution Vulnerability (CISA due 2026-04-27)
- [CVE-2026-21643](https://erroneo.us/security/cve/CVE-2026-21643/index.md) Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability (CISA due 2026-04-16)
- [CVE-2025-60710](https://erroneo.us/security/cve/CVE-2025-60710/index.md) Microsoft Windows: Microsoft Windows Link Following Vulnerability (CISA due 2026-04-27)
- [CVE-2023-36424](https://erroneo.us/security/cve/CVE-2023-36424/index.md) Microsoft Windows: Microsoft Windows Out-of-Bounds Read Vulnerability (CISA due 2026-04-27)
- [CVE-2023-21529](https://erroneo.us/security/cve/CVE-2023-21529/index.md) Microsoft Exchange Server: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability (CISA due 2026-04-27)
- [CVE-2020-9715](https://erroneo.us/security/cve/CVE-2020-9715/index.md) Adobe Acrobat: Adobe Acrobat Use-After-Free Vulnerability (CISA due 2026-04-27)
- [CVE-2012-1854](https://erroneo.us/security/cve/CVE-2012-1854/index.md) Microsoft Visual Basic for Applications (VBA): Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability (CISA due 2026-04-27)

## Critical advisories

- [CVE-2026-4810](https://erroneo.us/security/cve/CVE-2026-4810/index.md) Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability — PyPI google-adk >= 2.0.0a1, < 2.0.0a2 → 2.0.0a2; PyPI google-adk >= 1.7.0, < 1.28.1 → 1.28.1
- [CVE-2026-40576](https://erroneo.us/security/cve/CVE-2026-40576/index.md) excel-mcp-server has a Path Traversal issue — PyPI excel-mcp-server <= 0.1.7 → 0.1.8
- [CVE-2026-23891](https://erroneo.us/security/cve/CVE-2026-23891/index.md) Decidim has a cross-site scripting (XSS) in user name — RubyGems decidim-core >= 0.31.0.rc1, < 0.31.0 → 0.31.1; RubyGems decidim-core < 0.30.5 → 0.30.5

---
Source page: https://erroneo.us/security/2026-04-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt