Security Digest: April 14, 2026 - 10 Critical Vulnerabilities

Today, ten critical vulnerabilities have been identified, posing significant risks across various platforms and services. Immediate patching and mitigations are required to protect your systems from potential exploitation.

· 5 min read

Urgent Security Alert: Critical Vulnerabilities Discovered

Executive Summary

Today, ten critical vulnerabilities have been identified, posing significant risks across various platforms and services. Immediate patching and mitigations are required to protect your systems from potential exploitation.

Critical Vulnerabilities

  • CVE-2026-34457: OAuth2 Proxy Authentication Bypass
    • Impact: Unauthenticated access to protected resources.
    • Affected Systems: OAuth2 Proxy versions before v7.15.2.
    • Immediate Action: Upgrade to v7.15.2 or later. Disable --gcp-healthchecks and --ping-user-agent.
  • CVE-2026-40261: Composer Perforce Command Injection
    • Impact: Arbitrary command execution.
    • Affected Systems: Composer versions before 2.2.27 and 2.9.6.
    • Immediate Action: Update to Composer 2.2.27 or 2.9.6. Use --prefer-dist for installations.
  • CVE-2026-4789: Kyverno SSRF Vulnerability
    • Impact: Unauthorized internal network access and data exfiltration.
    • Affected Systems: Kyverno >= 1.16.0.
    • Immediate Action: Restrict URL access in policy configurations. Apply namespace boundaries.
  • CVE-2026-39884: MCP Server Kubernetes Command Injection
    • Impact: Exposing internal services to the network.
    • Affected Systems: MCP Server Kubernetes <= 3.4.0.
    • Immediate Action: Use array-based argument passing in command executions.
  • CVE-2026-40176: Composer Perforce Connection Parameter Injection
    • Impact: Command execution from malformed composer.json.
    • Affected Systems: Composer versions before 2.2.27 and 2.9.6.
    • Immediate Action: Update Composer to the latest version. Inspect composer.json files rigorously.
  • CVE-2026-33901: MVG Decoder Buffer Overflow
    • Impact: Out of bounds write in image processing.
    • Affected Systems: Various Magick.NET packages.
    • Immediate Action: Apply available patches immediately.
  • CVE-2026-40245: 5G UDR Information Disclosure
    • Impact: Unauthenticated retrieval of subscriber IDs.
    • Affected Systems: Free5GC UDR implementations.
    • Immediate Action: Apply patch to correct flow in api_datarepository.go.
  • CVE-2026-5795: Jetty JASPI Privilege Escalation
    • Impact: Unauthorized privilege inheritance.
    • Affected Systems: Jetty JASPI across multiple versions.
    • Immediate Action: Avoid using Jetty's JASPI until patched.
  • CVE-2026-39971: Serendipity SMTP Header Injection
    • Impact: SMTP header injection and email spoofing.
    • Affected Systems: Serendipity installations.
    • Immediate Action: Sanitize HTTP_HOST before use.
  • CVE-2026-40090: Zarf Package Arbitrary File Write
    • Impact: Attacker-controlled file writes.
    • Affected Systems: Zarf package inspection tools.
    • Immediate Action: Avoid inspecting untrusted packages. Update to v0.74.2.

Previously Alerted

What to Do Now

  1. Immediately update affected software to the latest patched versions.
  2. Implement recommended workarounds where patches are not yet available.
  3. Verify the integrity of all systems post-update.
  4. Enhance monitoring of network traffic and system logs for suspicious activities.

Related Resources

  • Visit the official vendor advisories for more detailed guidance on each CVE.
  • Stay tuned for our upcoming blog posts on best practices for vulnerability management.

Keep reading