StackPrism

Monthly report

What your agent missed in April 2026

In April 2026, CISA added 3 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog, GitHub published 8 critical advisories for widely used npm and PyPI packages, 3 release lines reached end of life and 3 new release lines shipped.

  • 3Exploited in the wild
  • 8Critical advisories
  • 3Reached end of life
  • 3New release lines

The ones to know first

The most widely used software among this month’s items, one of each kind.

  • CVE-2024-27199 added to CISA’s exploited list (TeamCity)

    JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

    , CISA KEV

  • litellm: SQL injection in proxy API key verification (critical)

    Fixed in 1.83.7.

    , GitHub Advisory Database

  • Node.js 20 reached end of life

    No more security fixes. Current LTS: Node.js 24.

    , endoflife.date

Everything in April 2026

Exploited in the wild3

  • CVE-2026-39987 added to CISA’s exploited list (Marimo)

    Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

    , CISA KEV

  • CVE-2024-27199 added to CISA’s exploited list (TeamCity)

    JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

    , CISA KEV

  • CVE-2026-34197 added to CISA’s exploited list (Apache ActiveMQ)

    Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

    , CISA KEV

Critical advisories8

  • n8n: XML node prototype pollution that to RCE (critical)

    Fixed in 2.18.1 and 2.17.4.

    , GitHub Advisory Database

  • n8n: prototype pollution in XML webhook Body parser that Leads to RCE (critical)

    Fixed in 1.123.32 and 2.18.1.

    , GitHub Advisory Database

  • litellm: SQL injection in proxy API key verification (critical)

    Fixed in 1.83.7.

    , GitHub Advisory Database

  • @clerk/nextjs: middleware-based route protection bypass (critical)

    Fixed in 5.7.6 and 6.39.2.

    , GitHub Advisory Database

  • better-auth: two-Factor authentication bypass (critical)

    Fixed in 1.4.9.

    , GitHub Advisory Database

  • litellm: authentication bypass via OIDC userinfo cache key collision (critical)

    Fixed in 1.83.0.

    , GitHub Advisory Database

  • mlflow: FastAPI job endpoints under /ajax-api/3.0/jobs/* are not protected (critical)

    , GitHub Advisory Database

  • payload: pre-authentication account takeover (critical)

    Fixed in 3.79.1.

    , GitHub Advisory Database

Reached end of life3

  • Node.js 20 reached end of life

    No more security fixes. Current LTS: Node.js 24.

    , endoflife.date

  • MySQL 8.0 reached end of life

    No more security fixes. Current LTS: MySQL 9.7.

    , endoflife.date

  • Django 4.2 LTS reached end of life

    No more security fixes. Current LTS: Django 5.2.

    , endoflife.date

New release lines3

  • Ubuntu 26.04 LTS released

    Latest version: 26.04.1.

    , endoflife.date

  • Kubernetes 1.36 released

    Latest version: 1.36.5.

    , endoflife.date

  • MySQL 9.7 released

    Latest version: 9.7.2.

    , endoflife.date

Which models can’t know this

These models have a knowledge cutoff before April 2026, so none of them knows about any of this unless a tool gives it live data.

Google

OpenAI

Anthropic

xAI

Microsoft

Meta

Claude Fable 5.1, Claude Opus 5.5, Claude Sonnet 5.5, Claude Haiku 5.5, Claude Opus 5, GPT-6.1 Sol, GPT-6 Astra, GPT-6 Sol, GPT-6 Luna, Grok 4.7 have cutoffs in or after April 2026, so they may know some of it.

Last checked against CISA KEV, GitHub Advisory Database and endoflife.date.

What counts: vulnerabilities CISA confirms are exploited, in software web apps commonly run; critical GitHub advisories on widely used npm and PyPI packages; and release lines of popular runtimes, frameworks and databases reaching end of life or shipping. Also as Markdown.