Digest · Thursday
Security digest: April 23, 2026
1 known exploited (cisa kev) addition and 5 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Marimo Marimo. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-07.
- RubyGems: 2 critical advisories (
openc3). Check withbundle audit check --update. - Go: 1 critical advisory (
heckel.io/ntfy/v2). Check withgovulncheck ./.... - PyPI: 1 critical advisory (
pipecat-ai). Check withpip-audit (or: pip show <package>). - NuGet: 1 critical advisory (
Microsoft.AspNetCore.DataProtection). Check withdotnet list package --vulnerable --include-transitive. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-39987 | Marimo Marimo Marimo Remote Code Execution Vulnerability | 2026-05-07 |
Critical advisories by ecosystem 5
GitHub-reviewed advisories rated critical, published this day (Pacific time).
RubyGems 2
Check: bundle audit check --update
- OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database CVE-2026-42087 CVSS 9.6 Critical
openc3>= 6.7.0, < 7.0.0-rc3 → fixed in 7.0.0-rc3 - OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool GHSA-2wvh-87g2-89hr CVSS 9.6 Critical
openc3< 7.0.0-rc3 → fixed in 7.0.0-rc3
Go 1
Check: govulncheck ./...
- ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function CVE-2026-39087 CVSS 9.8 Critical
heckel.io/ntfy/v2< 2.22.0 → fixed in 2.22.0
NuGet 1
Check: dotnet list package --vulnerable --include-transitive
- Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege CVE-2026-40372 CVSS 9.1 Critical
Microsoft.AspNetCore.DataProtection>= 10.0.0, <= 10.0.6 → fixed in 10.0.7
PyPI 1
Check: pip-audit (or: pip show <package>)
- Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer CVE-2025-62373 CVSS 9.8 Critical
pipecat-ai>= 0.0.41, < 0.0.94 → fixed in 0.0.94