Digest · Wednesday
Security digest: April 22, 2026
1 known exploited (cisa kev) addition and 8 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Microsoft Defender. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-06.
- Go: 4 critical advisories (
github.com/rclone/rclone,github.com/orneryd/nornicdb,github.com/jkroepke/openvpn-auth-oauth2). Check withgovulncheck ./.... - Composer (PHP): 2 critical advisories (
ci4-cms-erp/ci4ms). Check withcomposer audit. - npm: 1 critical advisory (
@evomap/evolver). Check withnpm audit (or: npm ls <package>). - crates.io (Rust): 1 critical advisory (
nimiq-block). Check withcargo audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-33825 | Microsoft Defender Microsoft Defender Insufficient Granularity of Access Control Vulnerability Ransomware | 2026-05-06 |
Critical advisories by ecosystem 8
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 4
Check: govulncheck ./...
- RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution CVE-2026-41179 CVSS 9.2 Critical
github.com/rclone/rclone>= 1.48.0, <= 1.73.4 → fixed in 1.73.5 - NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access CVE-2026-42072 CVSS 9.8 Critical
github.com/orneryd/nornicdb< 1.0.42-hotfix → fixed in 1.0.42-hotfix - Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution CVE-2026-41176 CVSS 9.2 Critical
github.com/rclone/rclone>= 1.45.0, < 1.73.5 → fixed in 1.73.5 - openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access CVE-2026-41070 CVSS 10.0 Critical
github.com/jkroepke/openvpn-auth-oauth2>= 1.26.3, < 1.27.3 → fixed in 1.27.3
Composer (PHP) 2
Check: composer audit
- CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE CVE-2026-41203 CVSS 9.4 Critical
ci4-cms-erp/ci4ms< 0.31.5.0 → fixed in 0.31.5.0 - CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE CVE-2026-41202 CVSS 9.4 Critical
ci4-cms-erp/ci4ms< 0.31.5.0 → fixed in 0.31.5.0
npm 1
Check: npm audit (or: npm ls <package>)
- Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution CVE-2026-42076 CVSS 9.8 Critical
@evomap/evolver< 1.69.3 → fixed in 1.69.3
crates.io (Rust) 1
Check: cargo audit
- nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation CVE-2026-33471 CVSS 9.6 Critical
nimiq-block<= 0.2.0 → no fix listed