Security Digest archive
April 2026
4 editorial briefs, 31 known exploited (cisa kev) additions and 173 critical advisories across 23 digest days.
Thursday, April 30, 2026
- KEV CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared)
- Critical 4 advisories: sentry, github.com/gotenberg/gotenberg/v8, github.com/go-pkgz/auth, com.shopizer:shopizer
Wednesday, April 29, 2026
Tuesday, April 28, 2026
- KEV CVE-2026-32202 Microsoft Windows
- KEV CVE-2024-1708 ConnectWise ScreenConnect
- Critical 2 advisories: github.com/gravitl/netmaker, nvflare
Monday, April 27, 2026
Saturday, April 25, 2026
- Critical 1 advisory: github.com/enchant97/note-mark/backend
Friday, April 24, 2026
- KEV CVE-2025-29635 D-Link DIR-823X
- KEV CVE-2024-7399 Samsung MagicINFO 9 Server
- KEV CVE-2024-57728 SimpleHelp SimpleHelp
- KEV CVE-2024-57726 SimpleHelp SimpleHelp
- Critical 7 advisories: github.com/woven-planet/go-zserio, github.com/dgraph-io/dgraph/v25, @google/gemini-cli, github.com/dgraph-io/dgraph/v25, litellm, github.com/dgraph-io/dgraph/v25, electerm
Thursday, April 23, 2026
- KEV CVE-2026-39987 Marimo Marimo
- Critical 5 advisories: openc3, heckel.io/ntfy/v2, pipecat-ai, Microsoft.AspNetCore.DataProtection, openc3
Wednesday, April 22, 2026
- KEV CVE-2026-33825 Microsoft Defender
- Critical 8 advisories: ci4-cms-erp/ci4ms, ci4-cms-erp/ci4ms, github.com/rclone/rclone, @evomap/evolver, nimiq-block, github.com/orneryd/nornicdb, github.com/rclone/rclone, github.com/jkroepke/openvpn-auth-oauth2
Tuesday, April 21, 2026
- Critical 4 advisories: io.spinnaker.clouddriver:clouddriver-ar…, brillig, io.spinnaker.echo:echo-pipelinetriggers, flowise
Monday, April 20, 2026
- KEV CVE-2026-20133 Cisco Catalyst SD-WAN Manager
- KEV CVE-2026-20128 Cisco Catalyst SD-WAN Manager
- KEV CVE-2026-20122 Cisco Catalyst SD-WAN Manger
- KEV CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS)
- KEV CVE-2025-32975 Quest KACE Systems Management Appliance (SMA)
- KEV CVE-2025-2749 Kentico Kentico Xperience
- KEV CVE-2024-27199 JetBrains TeamCity
- KEV CVE-2023-27351 PaperCut NG/MF
- Critical 1 advisory: org.apache.kafka:kafka-clients
Friday, April 17, 2026
- Critical 13 advisories: openclaw, charm.land/wish/v2, openclaw, dolibarr/dolibarr, flowise, math-codegen, openviking, sentry, praisonai, zebrad, github.com/nhost/nhost, org.bouncycastle:bcprov-jdk14 …
Thursday, April 16, 2026
- KEV CVE-2026-34197 Apache ActiveMQ
- Critical 14 advisories: protobufjs, electerm, @paperclipai/server, @clerk/nextjs, HotChocolate.Language, goodoneuz/pay-uz, @saltcorn/server, flowise, flowise, github.com/dgraph-io/dgraph/v25, @budibase/backend-core, @fastify/middie …
Wednesday, April 15, 2026
- Critical 14 advisories: org.thymeleaf:thymeleaf, froxlor/froxlor, org.thymeleaf:thymeleaf, github.com/grafana/pyroscope, www.velocidex.com/golang/velociraptor, @fastify/express, uefi-firmware, @fastify/reply-from, Microsoft.Native.Quic.MsQuic.OpenSSL, froxlor/froxlor, upsonic, github.com/oauth2-proxy/oauth2-proxy/v7 …
Tuesday, April 14, 2026
- Act now FortiSandbox: Two Exploited Pre-Auth Command Injections
- Check exposure Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE
- KEV CVE-2026-32201 Microsoft SharePoint Server
- KEV CVE-2009-0238 Microsoft Office
- Critical 7 advisories: @openai/codex, wwbn/avideo, github.com/oxia-db/oxia, github.com/patrickhener/goshs, @vendure/core, io.openremote:openremote-manager, github.com/oauth2-proxy/oauth2-proxy/v7
Monday, April 13, 2026
- KEV CVE-2026-34621 Adobe Acrobat and Reader
- KEV CVE-2026-21643 Fortinet FortiClient EMS
- KEV CVE-2025-60710 Microsoft Windows
- KEV CVE-2023-36424 Microsoft Windows
- KEV CVE-2023-21529 Microsoft Exchange Server
- KEV CVE-2020-9715 Adobe Acrobat
- KEV CVE-2012-1854 Microsoft Visual Basic for Applications (VBA)
- Critical 3 advisories: google-adk, excel-mcp-server, decidim-core
Friday, April 10, 2026
Thursday, April 9, 2026
- Check exposure Tomcat CVE-2026-34486: Cluster EncryptInterceptor Bypass
- Critical 3 advisories: wasmtime, apache-airflow, org.apache.tomcat:tomcat
Wednesday, April 8, 2026
- KEV CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM)
- Critical 5 advisories: praisonaiagents, github.com/siyuan-note/siyuan/kernel, praisonai, PraisonAI, marimo
Tuesday, April 7, 2026
Monday, April 6, 2026
- KEV CVE-2026-35616 Fortinet FortiClient EMS
- Critical 4 advisories: changedetection.io, PraisonAI, PraisonAI, ci4-cms-erp/ci4ms
Friday, April 3, 2026
- Critical 8 advisories: signalk-server, litellm, @budibase/server, @budibase/backend-core, mlflow, pyload-ng, github.com/patrickhener/goshs, @nyariv/sandboxjs
Thursday, April 2, 2026
- KEV CVE-2026-3502 TrueConf Client
- Critical 14 advisories: better-auth, ci4-cms-erp/ci4ms, fast-jwt, pymetasploit3, github.com/dgraph-io/dgraph/v25, fast-jwt, github.com/patrickhener/goshs, github.com/patrickhener/goshs, openclaw, openclaw, kedro, agno …
Wednesday, April 1, 2026
- KEV CVE-2026-5281 Google Dawn
- Critical 18 advisories: ci4-cms-erp/ci4ms, ci4-cms-erp/ci4ms, ci4-cms-erp/ci4ms, ci4-cms-erp/ci4ms, payload, github.com/juju/juju, ci4-cms-erp/ci4ms, ci4-cms-erp/ci4ms, ci4-cms-erp/ci4ms, ci4-cms-erp/ci4ms, praisonai, praisonai …