Security Digest: April 6, 2026 - 9 Critical Vulnerabilities
Today's security landscape reveals nine critical vulnerabilities affecting a wide range of systems. Immediate action is required to patch these vulnerabilities and mitigate potential exploits.
· 6 min read
Today's Critical Threats to Your Systems
Executive Summary
Today's security landscape reveals nine critical vulnerabilities affecting a wide range of systems, from web applications to AI platforms. Immediate action is required to patch these vulnerabilities and mitigate potential exploits.
Critical Vulnerabilities
- CVE-2026-35035: Persistent DOM XSS via Unsanitized Inputs
- Impact: Allows execution of arbitrary JavaScript in visitors' browsers, leading to potential account takeovers.
- Affected Systems: composer ci4-cms-erp/ci4ms
- Immediate Action: Apply strict HTML encoding and sanitation practices. Implement Content Security Policy (CSP).
- Mitigation: Ensure HttpOnly, SameSite, and Secure flags are set on cookies.
- CVE-2026-39305: Path Traversal in Action Orchestrator
- Impact: Enables arbitrary file writes, potentially leading to Remote Code Execution (RCE).
- Affected Systems: pip PraisonAI
- Immediate Action: Validate path inputs to ensure they stay within the configured workspace directory.
- Mitigation: Update to the latest version that addresses this vulnerability.
- CVE-2026-39307: Zip Slip Vulnerability in Template Installer
- Impact: Allows overwriting of arbitrary files, leading to system compromise.
- Affected Systems: pip PraisonAI
- Immediate Action: Use safe extraction methods that validate archive paths before extraction.
- Mitigation: Upgrade to a patched version that handles this safely.
- CVE-2026-33540: Credential Disclosure in Token Auth Endpoints
- Impact: Potential credential exfiltration via attacker-controlled realm URLs.
- Affected Systems: go github.com/distribution/distribution/v3
- Immediate Action: Ensure token realm URLs are within trusted domains before credential association.
- Mitigation: Apply patches from the official advisory.
- CVE-2026-35523: WebSocket Authentication Bypass
- Impact: Allows unauthenticated access to WebSocket endpoints.
- Affected Systems: pip strawberry-graphql
- Immediate Action: Disable the legacy graphql-ws subprotocol.
- Mitigation: Upgrade to the latest version with this vulnerability fixed.
- CVE-2026-35172: Repository Authorization Bypass
- Impact: Restores unauthorized access to deleted blobs.
- Affected Systems: go github.com/distribution/distribution
- Immediate Action: Revise cache invalidation to ensure repository membership is correctly revoked.
- Mitigation: Follow official advisory for patching instructions.
- CVE-2026-35526: Uncontrolled Resource Consumption in WebSocket Handlers
- Impact: Leads to memory exhaustion and potential server crash.
- Affected Systems: pip strawberry-graphql
- Immediate Action: Implement limits on active subscriptions per connection.
- Mitigation: Update to the latest patched version.
- CVE-2026-39306: Path Traversal in Recipe Registry Pull
- Impact: Allows files to be written outside the intended directory.
- Affected Systems: pip PraisonAI
- Immediate Action: Validate tar archive contents before extraction.
- Mitigation: Patch the application using the latest update.
- CVE-2026-39308: Path Traversal in Recipe Registry Publish
- Impact: Writes files outside registry root, compromising integrity.
- Affected Systems: pip PraisonAI
- Immediate Action: Validate manifest fields and their paths before any filesystem operation.
- Mitigation: Upgrade to a version that addresses this issue.
Previously Alerted
What to Do Now
- Immediately apply patches available for each affected system.
- Implement suggested mitigations where patches are not available.
- Verify system integrity post-update and monitor for unusual activity.
Related Resources
- Look out for upcoming internal blog posts for detailed analysis.
- Refer to official vendor advisories for each vulnerability.