Digest · Wednesday
Security digest: April 15, 2026
14 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 3 critical advisories (
github.com/grafana/pyroscope,www.velocidex.com/golang/velociraptor,github.com/oauth2-proxy/oauth2-proxy/v7). Check withgovulncheck ./.... - npm: 3 critical advisories (
@fastify/express,@fastify/reply-from,@fastify/http-proxy). Check withnpm audit (or: npm ls <package>). - PyPI: 3 critical advisories (
uefi-firmware,upsonic). Check withpip-audit (or: pip show <package>). - Maven: 2 critical advisories (
org.thymeleaf:thymeleaf,org.thymeleaf:thymeleaf-spring5,org.thymeleaf:thymeleaf-spring6). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - Composer (PHP): 2 critical advisories (
froxlor/froxlor). Check withcomposer audit. - NuGet: 1 critical advisory (
Microsoft.Native.Quic.MsQuic.OpenSSL,Microsoft.Native.Quic.MsQuic.Schannel). Check withdotnet list package --vulnerable --include-transitive. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 14
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 3
Check: govulncheck ./...
- Pyroscope Exposes Storage Secret CVE-2025-41118 CVSS 9.1 Critical
github.com/grafana/pyroscope< 1.15.2 → fixed in 1.15.2;github.com/grafana/pyroscope>= 1.16.0, < 1.16.1 → fixed in 1.16.1 - Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token CVE-2026-6290 CVSS 9.1 Critical
www.velocidex.com/golang/velociraptor<= 0.76.2 → no fix listed - OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing CVE-2026-40575 CVSS 9.1 Critical
github.com/oauth2-proxy/oauth2-proxy/v7>= 7.5.0, < 7.15.2 → fixed in 7.15.2
npm 3
Check: npm audit (or: npm ls <package>)
- @fastify/express's middleware path doubling causes authentication bypass in child plugin scopes CVE-2026-33807 CVSS 9.1 Critical
@fastify/express<= 4.0.4 → fixed in 4.0.5 - Fastify's connection header abuse enables stripping of proxy-added headers CVE-2026-33805 CVSS 9.0 Critical
@fastify/reply-from<= 12.6.1 → fixed in 12.6.2;@fastify/http-proxy<= 11.4.3 → fixed in 11.4.4 - @fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) CVE-2026-33808 CVSS 9.1 Critical
@fastify/express<= 4.0.4 → fixed in 4.0.5
PyPI 3
Check: pip-audit (or: pip show <package>)
- UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen CVE-2026-54334 CVSS 9.8 Critical
uefi-firmware<= 1.12 → no fix listed - Upsonic: remote code execution vulnerability in its MCP server/task creation functionality CVE-2026-30625 CVSS 9.8 Critical
upsonic< 0.72.0 → fixed in 0.72.0 - UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable CVE-2026-54333 CVSS 9.8 Critical
uefi-firmware<= 1.12 → no fix listed
Composer (PHP) 2
Check: composer audit
- Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution CVE-2026-41228 CVSS 9.9 Critical
froxlor/froxlor<= 2.3.5 → fixed in 2.3.6 - Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) CVE-2026-41229 CVSS 9.1 Critical
froxlor/froxlor<= 2.3.5 → fixed in 2.3.6
Maven 2
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf CVE-2026-40478 CVSS 9.0 Critical
org.thymeleaf:thymeleaf<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring5<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring6<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE - Improper restriction of the scope of accessible objects in Thymeleaf expressions CVE-2026-40477 CVSS 9.0 Critical
org.thymeleaf:thymeleaf<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring5<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring6<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE
NuGet 1
Check: dotnet list package --vulnerable --include-transitive
- MsQuic has a Remote Elevation of Privilege Vulnerability CVE-2026-32179 CVSS 9.8 Critical
Microsoft.Native.Quic.MsQuic.OpenSSL>= 2.5.0-ci.532574, < 2.5.7 → fixed in 2.5.7;Microsoft.Native.Quic.MsQuic.Schannel>= 2.5.0-ci.532574, < 2.5.7 → fixed in 2.5.7;Microsoft.Native.Quic.MsQuic.Schannel< 2.4.18 → fixed in 2.4.18; +1 more packages