--- title: "Security digest: April 16, 2026" url: https://erroneo.us/security/2026-04-16/ description: "April 16, 2026 vulnerability digest: 1 CISA KEV addition (Apache); 14 critical advisories (npm, NuGet, Composer (PHP), Go). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-04-16 date_modified: 2026-04-16 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: April 16, 2026 1 known exploited (cisa kev) addition and 14 critical advisories. ## Take stock - Do you run any of these? Apache ActiveMQ. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-30. - npm: 11 critical advisories ( protobufjs , electerm , @paperclipai/server , @clerk/nextjs , @clerk/nuxt , @clerk/astro , @clerk/shared , @saltcorn/server …). Check with npm audit (or: npm ls ) . - NuGet: 1 critical advisory ( HotChocolate.Language ). Check with dotnet list package --vulnerable --include-transitive . - Composer (PHP): 1 critical advisory ( goodoneuz/pay-uz ). Check with composer audit . - Go: 1 critical advisory ( github.com/dgraph-io/dgraph/v25 , github.com/dgraph-io/dgraph/v24 , github.com/dgraph-io/dgraph ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2026-34197](https://erroneo.us/security/cve/CVE-2026-34197/index.md) Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability (CISA due 2026-04-30) ## Critical advisories - [CVE-2026-41242](https://erroneo.us/security/cve/CVE-2026-41242/index.md) Arbitrary code execution in protobufjs — npm protobufjs >= 8.0.0, < 8.0.1 → 8.0.1; npm protobufjs < 7.5.5 → 7.5.5 - [CVE-2026-41500](https://erroneo.us/security/cve/CVE-2026-41500/index.md) electerm: electerm_install_script_CommandInjection Vulnerability Report — npm electerm < 3.3.8 → 3.3.8 - [GHSA-vr7g-88fq-vhq3](https://erroneo.us/security/ghsa/GHSA-vr7g-88fq-vhq3/index.md) Paperclip: OS Command Injection via Execution Workspace cleanupCommand — npm @paperclipai/server < 2026.416.0 → 2026.416.0 - [CVE-2026-41248](https://erroneo.us/security/cve/CVE-2026-41248/index.md) Official Clerk JavaScript SDKs: Middleware-based route protection bypass — npm @clerk/nextjs >= 5.0.0, < 5.7.6 → 5.7.6; npm @clerk/nuxt >= 1.1.0, < 1.13.28 → 1.13.28; npm @clerk/astro >= 0.0.1, < 1.5.7 → 1.5.7 - [CVE-2026-40324](https://erroneo.us/security/cve/CVE-2026-40324/index.md) ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents — NuGet HotChocolate.Language < 12.22.7 → 12.22.7; NuGet HotChocolate.Language >= 13.0.0, < 13.9.16 → 13.9.16; NuGet HotChocolate.Language >= 14.0.0, < 14.3.1 → 14.3.1 - [CVE-2026-31843](https://erroneo.us/security/cve/CVE-2026-31843/index.md) goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files — Composer (PHP) goodoneuz/pay-uz <= 2.2.24 → 3.0.0 - [CVE-2026-41478](https://erroneo.us/security/cve/CVE-2026-41478/index.md) Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) — npm @saltcorn/server < 1.4.6 → 1.4.6; npm @saltcorn/server >= 1.5.0-beta.0, < 1.5.6 → 1.5.6; npm @saltcorn/server >= 1.6.0-alpha.0, < 1.6.0-beta.5 → 1.6.0-beta.5 - [CVE-2026-40933](https://erroneo.us/security/cve/CVE-2026-40933/index.md) Flowise: Authenticated RCE Via MCP Adapters — npm flowise <= 3.0.13 → 3.1.0; npm flowise-components <= 3.0.13 → 3.1.0 - [CVE-2026-41137](https://erroneo.us/security/cve/CVE-2026-41137/index.md) Flowise: Code Injection in CSVAgent leads to Authenticated RCE — npm flowise <= 3.0.13 → 3.1.0; npm flowise-components <= 3.0.13 → 3.1.0 - [CVE-2026-40173](https://erroneo.us/security/cve/CVE-2026-40173/index.md) Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints — Go github.com/dgraph-io/dgraph/v25 < 25.3.2 → 25.3.2; Go github.com/dgraph-io/dgraph/v24 <= 24.1.7 → no fix; Go github.com/dgraph-io/dgraph <= 1.2.8 → no fix - [CVE-2026-41428](https://erroneo.us/security/cve/CVE-2026-41428/index.md) Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints — npm @budibase/backend-core <= 3.35.3 → no fix - [CVE-2026-6270](https://erroneo.us/security/cve/CVE-2026-6270/index.md) @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes — npm @fastify/middie <= 9.3.1 → 9.3.2 - [GHSA-47wq-cj9q-wpmp](https://erroneo.us/security/ghsa/GHSA-47wq-cj9q-wpmp/index.md) Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys — npm @paperclipai/server < 2026.416.0 → 2026.416.0 - [GHSA-3xx2-mqjm-hg9x](https://erroneo.us/security/ghsa/GHSA-3xx2-mqjm-hg9x/index.md) Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise — npm @paperclipai/server < 2026.416.0 → 2026.416.0 --- Source page: https://erroneo.us/security/2026-04-16/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt