Digest · Friday
Security digest: April 24, 2026
4 known exploited (cisa kev) additions and 7 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? D-Link DIR-823X, Samsung MagicINFO 9 Server, SimpleHelp SimpleHelp. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-05-08.
- Go: 4 critical advisories (
github.com/woven-planet/go-zserio,github.com/dgraph-io/dgraph/v25,github.com/dgraph-io/dgraph/v24,github.com/dgraph-io/dgraph). Check withgovulncheck ./.... - npm: 2 critical advisories (
@google/gemini-cli,electerm). Check withnpm audit (or: npm ls <package>). - GitHub Actions: 1 critical advisory (
google-github-actions/run-gemini-cli). Check withgrep -rn 'uses: <owner>/<action>' .github/workflows. - PyPI: 1 critical advisory (
litellm). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 4
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2025-29635 | D-Link DIR-823X D-Link DIR-823X Command Injection Vulnerability | 2026-05-08 |
| CVE-2024-7399 | Samsung MagicINFO 9 Server Samsung MagicINFO 9 Server Path Traversal Vulnerability | 2026-05-08 |
| CVE-2024-57728 | SimpleHelp SimpleHelp SimpleHelp Path Traversal Vulnerability Ransomware | 2026-05-08 |
| CVE-2024-57726 | SimpleHelp SimpleHelp SimpleHelp Missing Authorization Vulnerability Ransomware | 2026-05-08 |
Critical advisories by ecosystem 7
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 4
Check: govulncheck ./...
- go-zserio has Unbounded Memory Allocation for All Platforms GHSA-xhj4-g6w8-2xjw CVSS 9.8 Critical
github.com/woven-planet/go-zserio< 0.9.1 → fixed in 0.9.1 - Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVE-2026-41328 CVSS 9.1 Critical
github.com/dgraph-io/dgraph/v25< 25.3.3 → fixed in 25.3.3;github.com/dgraph-io/dgraph/v24<= 24.1.8 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars CVE-2026-41492 CVSS 9.8 Critical
github.com/dgraph-io/dgraph/v25< 25.3.3 → fixed in 25.3.3;github.com/dgraph-io/dgraph/v24<= 24.1.8 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVE-2026-41327 CVSS 9.1 Critical
github.com/dgraph-io/dgraph/v25< 25.3.3 → fixed in 25.3.3;github.com/dgraph-io/dgraph/v24<= 24.1.8 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed
npm 2
Check: npm audit (or: npm ls <package>)
- Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses CVE-2026-12537 CVSS 10.0 Critical
@google/gemini-cli< 0.39.1 → fixed in 0.39.1;@google/gemini-cli= 0.40.0-preview.2 → fixed in 0.40.0-preview.3;google-github-actions/run-gemini-cli< 0.1.22 → fixed in 0.1.22 - electerm has Command Injection via runLinux funtion CVE-2026-41501 CVSS 9.8 Critical
electerm< 3.3.8 → fixed in 3.3.8
GitHub Actions 1
Check: grep -rn 'uses: <owner>/<action>' .github/workflows
- Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses CVE-2026-12537 CVSS 10.0 Critical
@google/gemini-cli< 0.39.1 → fixed in 0.39.1;@google/gemini-cli= 0.40.0-preview.2 → fixed in 0.40.0-preview.3;google-github-actions/run-gemini-cli< 0.1.22 → fixed in 0.1.22
PyPI 1
Check: pip-audit (or: pip show <package>)
- LiteLLM has SQL Injection in Proxy API key verification CVE-2026-42208 CVSS 9.3 Critical
litellm>= 1.81.16, < 1.83.7 → fixed in 1.83.7