Digest · Thursday
Security digest: April 16, 2026
1 known exploited (cisa kev) addition and 14 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Apache ActiveMQ. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-30.
- npm: 11 critical advisories (
protobufjs,electerm,@paperclipai/server,@clerk/nextjs,@clerk/nuxt,@clerk/astro,@clerk/shared,@saltcorn/server…). Check withnpm audit (or: npm ls <package>). - NuGet: 1 critical advisory (
HotChocolate.Language). Check withdotnet list package --vulnerable --include-transitive. - Composer (PHP): 1 critical advisory (
goodoneuz/pay-uz). Check withcomposer audit. - Go: 1 critical advisory (
github.com/dgraph-io/dgraph/v25,github.com/dgraph-io/dgraph/v24,github.com/dgraph-io/dgraph). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-34197 | Apache ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability | 2026-04-30 |
Critical advisories by ecosystem 14
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 11
Check: npm audit (or: npm ls <package>)
- Arbitrary code execution in protobufjs CVE-2026-41242 CVSS 9.4 Critical
protobufjs>= 8.0.0, < 8.0.1 → fixed in 8.0.1;protobufjs< 7.5.5 → fixed in 7.5.5 - electerm: electerm_install_script_CommandInjection Vulnerability Report CVE-2026-41500 CVSS 9.8 Critical
electerm< 3.3.8 → fixed in 3.3.8 - Paperclip: OS Command Injection via Execution Workspace cleanupCommand GHSA-vr7g-88fq-vhq3 CVSS 9.8 Critical
@paperclipai/server< 2026.416.0 → fixed in 2026.416.0 - Official Clerk JavaScript SDKs: Middleware-based route protection bypass CVE-2026-41248 CVSS 9.1 Critical
@clerk/nextjs>= 5.0.0, < 5.7.6 → fixed in 5.7.6;@clerk/nuxt>= 1.1.0, < 1.13.28 → fixed in 1.13.28;@clerk/astro>= 0.0.1, < 1.5.7 → fixed in 1.5.7; +8 more packages - Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) CVE-2026-41478 CVSS 9.9 Critical
@saltcorn/server< 1.4.6 → fixed in 1.4.6;@saltcorn/server>= 1.5.0-beta.0, < 1.5.6 → fixed in 1.5.6;@saltcorn/server>= 1.6.0-alpha.0, < 1.6.0-beta.5 → fixed in 1.6.0-beta.5 - Flowise: Authenticated RCE Via MCP Adapters CVE-2026-40933 CVSS 9.9 Critical
flowise<= 3.0.13 → fixed in 3.1.0;flowise-components<= 3.0.13 → fixed in 3.1.0 - Flowise: Code Injection in CSVAgent leads to Authenticated RCE CVE-2026-41137 CVSS 9.4 Critical
flowise<= 3.0.13 → fixed in 3.1.0;flowise-components<= 3.0.13 → fixed in 3.1.0 - Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints CVE-2026-41428 CVSS 9.1 Critical
@budibase/backend-core<= 3.35.3 → no fix listed - @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVE-2026-6270 CVSS 9.1 Critical
@fastify/middie<= 9.3.1 → fixed in 9.3.2 - Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys GHSA-47wq-cj9q-wpmp CVSS 9.9 Critical
@paperclipai/server< 2026.416.0 → fixed in 2026.416.0 - Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise GHSA-3xx2-mqjm-hg9x CVSS 9.9 Critical
@paperclipai/server< 2026.416.0 → fixed in 2026.416.0
Composer (PHP) 1
Check: composer audit
- goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files CVE-2026-31843 CVSS 10.0 Critical
goodoneuz/pay-uz<= 2.2.24 → fixed in 3.0.0
Go 1
Check: govulncheck ./...
- Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints CVE-2026-40173 CVSS 9.4 Critical
github.com/dgraph-io/dgraph/v25< 25.3.2 → fixed in 25.3.2;github.com/dgraph-io/dgraph/v24<= 24.1.7 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed
NuGet 1
Check: dotnet list package --vulnerable --include-transitive
- ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents CVE-2026-40324 CVSS 9.1 Critical
HotChocolate.Language< 12.22.7 → fixed in 12.22.7;HotChocolate.Language>= 13.0.0, < 13.9.16 → fixed in 13.9.16;HotChocolate.Language>= 14.0.0, < 14.3.1 → fixed in 14.3.1; +1 more packages