---
title: "Security digest: April 22, 2026"
url: https://erroneo.us/security/2026-04-22/
description: "April 22, 2026 vulnerability digest: 1 CISA KEV addition (Microsoft); 8 critical advisories (Composer (PHP), Go, npm…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-22
date_modified: 2026-04-22
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 22, 2026

1 known exploited (cisa kev) addition and 8 critical advisories.

## Take stock

- Do you run any of these? Microsoft Defender. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-06.
- Go: 4 critical advisories ( github.com/rclone/rclone , github.com/orneryd/nornicdb , github.com/jkroepke/openvpn-auth-oauth2 ). Check with govulncheck ./... .
- Composer (PHP): 2 critical advisories ( ci4-cms-erp/ci4ms ). Check with composer audit .
- npm: 1 critical advisory ( @evomap/evolver ). Check with npm audit (or: npm ls <package>) .
- crates.io (Rust): 1 critical advisory ( nimiq-block ). Check with cargo audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-33825](https://erroneo.us/security/cve/CVE-2026-33825/index.md) Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability (CISA due 2026-05-06)

## Critical advisories

- [CVE-2026-41203](https://erroneo.us/security/cve/CVE-2026-41203/index.md) CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE — Composer (PHP) ci4-cms-erp/ci4ms < 0.31.5.0 → 0.31.5.0
- [CVE-2026-41202](https://erroneo.us/security/cve/CVE-2026-41202/index.md) CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE — Composer (PHP) ci4-cms-erp/ci4ms < 0.31.5.0 → 0.31.5.0
- [CVE-2026-41179](https://erroneo.us/security/cve/CVE-2026-41179/index.md) RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution — Go github.com/rclone/rclone >= 1.48.0, <= 1.73.4 → 1.73.5
- [CVE-2026-42076](https://erroneo.us/security/cve/CVE-2026-42076/index.md) Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution — npm @evomap/evolver < 1.69.3 → 1.69.3
- [CVE-2026-33471](https://erroneo.us/security/cve/CVE-2026-33471/index.md) nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation — crates.io (Rust) nimiq-block <= 0.2.0 → no fix
- [CVE-2026-42072](https://erroneo.us/security/cve/CVE-2026-42072/index.md) NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access — Go github.com/orneryd/nornicdb < 1.0.42-hotfix → 1.0.42-hotfix
- [CVE-2026-41176](https://erroneo.us/security/cve/CVE-2026-41176/index.md) Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution — Go github.com/rclone/rclone >= 1.45.0, < 1.73.5 → 1.73.5
- [CVE-2026-41070](https://erroneo.us/security/cve/CVE-2026-41070/index.md) openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access — Go github.com/jkroepke/openvpn-auth-oauth2 >= 1.26.3, < 1.27.3 → 1.27.3

---
Source page: https://erroneo.us/security/2026-04-22/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt