--- title: "Security digest: April 15, 2026" url: https://erroneo.us/security/2026-04-15/ description: "April 15, 2026 vulnerability digest: 14 critical advisories (Maven, Composer (PHP), Go…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-04-15 date_modified: 2026-04-15 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: April 15, 2026 14 critical advisories. ## Take stock - Go: 3 critical advisories ( github.com/grafana/pyroscope , www.velocidex.com/golang/velociraptor , github.com/oauth2-proxy/oauth2-proxy/v7 ). Check with govulncheck ./... . - npm: 3 critical advisories ( @fastify/express , @fastify/reply-from , @fastify/http-proxy ). Check with npm audit (or: npm ls ) . - PyPI: 3 critical advisories ( uefi-firmware , upsonic ). Check with pip-audit (or: pip show ) . - Maven: 2 critical advisories ( org.thymeleaf:thymeleaf , org.thymeleaf:thymeleaf-spring5 , org.thymeleaf:thymeleaf-spring6 ). Check with mvn dependency:tree -Dincludes=: . - Composer (PHP): 2 critical advisories ( froxlor/froxlor ). Check with composer audit . - NuGet: 1 critical advisory ( Microsoft.Native.Quic.MsQuic.OpenSSL , Microsoft.Native.Quic.MsQuic.Schannel ). Check with dotnet list package --vulnerable --include-transitive . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-40478](https://erroneo.us/security/cve/CVE-2026-40478/index.md) Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf — Maven org.thymeleaf:thymeleaf <= 3.1.3.RELEASE → 3.1.4.RELEASE; Maven org.thymeleaf:thymeleaf-spring5 <= 3.1.3.RELEASE → 3.1.4.RELEASE; Maven org.thymeleaf:thymeleaf-spring6 <= 3.1.3.RELEASE → 3.1.4.RELEASE - [CVE-2026-41228](https://erroneo.us/security/cve/CVE-2026-41228/index.md) Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution — Composer (PHP) froxlor/froxlor <= 2.3.5 → 2.3.6 - [CVE-2026-40477](https://erroneo.us/security/cve/CVE-2026-40477/index.md) Improper restriction of the scope of accessible objects in Thymeleaf expressions — Maven org.thymeleaf:thymeleaf <= 3.1.3.RELEASE → 3.1.4.RELEASE; Maven org.thymeleaf:thymeleaf-spring5 <= 3.1.3.RELEASE → 3.1.4.RELEASE; Maven org.thymeleaf:thymeleaf-spring6 <= 3.1.3.RELEASE → 3.1.4.RELEASE - [CVE-2025-41118](https://erroneo.us/security/cve/CVE-2025-41118/index.md) Pyroscope Exposes Storage Secret — Go github.com/grafana/pyroscope < 1.15.2 → 1.15.2; Go github.com/grafana/pyroscope >= 1.16.0, < 1.16.1 → 1.16.1 - [CVE-2026-6290](https://erroneo.us/security/cve/CVE-2026-6290/index.md) Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token — Go www.velocidex.com/golang/velociraptor <= 0.76.2 → no fix - [CVE-2026-33807](https://erroneo.us/security/cve/CVE-2026-33807/index.md) @fastify/express's middleware path doubling causes authentication bypass in child plugin scopes — npm @fastify/express <= 4.0.4 → 4.0.5 - [CVE-2026-54334](https://erroneo.us/security/cve/CVE-2026-54334/index.md) UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen — PyPI uefi-firmware <= 1.12 → no fix - [CVE-2026-33805](https://erroneo.us/security/cve/CVE-2026-33805/index.md) Fastify's connection header abuse enables stripping of proxy-added headers — npm @fastify/reply-from <= 12.6.1 → 12.6.2; npm @fastify/http-proxy <= 11.4.3 → 11.4.4 - [CVE-2026-32179](https://erroneo.us/security/cve/CVE-2026-32179/index.md) MsQuic has a Remote Elevation of Privilege Vulnerability — NuGet Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.0-ci.532574, < 2.5.7 → 2.5.7; NuGet Microsoft.Native.Quic.MsQuic.Schannel >= 2.5.0-ci.532574, < 2.5.7 → 2.5.7; NuGet Microsoft.Native.Quic.MsQuic.Schannel < 2.4.18 → 2.4.18 - [CVE-2026-41229](https://erroneo.us/security/cve/CVE-2026-41229/index.md) Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) — Composer (PHP) froxlor/froxlor <= 2.3.5 → 2.3.6 - [CVE-2026-30625](https://erroneo.us/security/cve/CVE-2026-30625/index.md) Upsonic: remote code execution vulnerability in its MCP server/task creation functionality — PyPI upsonic < 0.72.0 → 0.72.0 - [CVE-2026-40575](https://erroneo.us/security/cve/CVE-2026-40575/index.md) OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing — Go github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2 → 7.15.2 - [CVE-2026-33808](https://erroneo.us/security/cve/CVE-2026-33808/index.md) @fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) — npm @fastify/express <= 4.0.4 → 4.0.5 - [CVE-2026-54333](https://erroneo.us/security/cve/CVE-2026-54333/index.md) UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable — PyPI uefi-firmware <= 1.12 → no fix --- Source page: https://erroneo.us/security/2026-04-15/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt