# What your agent missed in April 2026

In April 2026, CISA added 3 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog, GitHub published 8 critical advisories for widely used npm and PyPI packages, 3 release lines reached end of life and 3 new release lines shipped.

The ones to know first:

- **Apr 20, 2026**: CVE-2024-27199 added to CISA’s exploited list (TeamCity). JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199)
- **Apr 24, 2026**: litellm: SQL injection in proxy API key verification (critical). Fixed in 1.83.7. [GitHub Advisory Database](https://github.com/advisories/GHSA-r75f-5x8p-qvmc)
- **Apr 30, 2026**: Node.js 20 reached end of life. No more security fixes. Current LTS: Node.js 24. [endoflife.date](https://endoflife.date/nodejs)

## Exploited in the wild (3)

- **Apr 23, 2026**: CVE-2026-39987 added to CISA’s exploited list (Marimo). Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987)
- **Apr 20, 2026**: CVE-2024-27199 added to CISA’s exploited list (TeamCity). JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199)
- **Apr 16, 2026**: CVE-2026-34197 added to CISA’s exploited list (Apache ActiveMQ). Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197)

## Critical advisories (8)

- **Apr 29, 2026**: n8n: XML node prototype pollution that to RCE (critical). Fixed in 2.18.1 and 2.17.4. [GitHub Advisory Database](https://github.com/advisories/GHSA-hqr4-h3xv-9m3r)
- **Apr 29, 2026**: n8n: prototype pollution in XML webhook Body parser that Leads to RCE (critical). Fixed in 1.123.32 and 2.18.1. [GitHub Advisory Database](https://github.com/advisories/GHSA-q5f4-99jv-pgg5)
- **Apr 24, 2026**: litellm: SQL injection in proxy API key verification (critical). Fixed in 1.83.7. [GitHub Advisory Database](https://github.com/advisories/GHSA-r75f-5x8p-qvmc)
- **Apr 16, 2026**: @clerk/nextjs: middleware-based route protection bypass (critical). Fixed in 5.7.6 and 6.39.2. [GitHub Advisory Database](https://github.com/advisories/GHSA-vqx2-fgx2-5wq9)
- **Apr 3, 2026**: better-auth: two-Factor authentication bypass (critical). Fixed in 1.4.9. [GitHub Advisory Database](https://github.com/advisories/GHSA-xg6x-h9c9-2m83)
- **Apr 3, 2026**: litellm: authentication bypass via OIDC userinfo cache key collision (critical). Fixed in 1.83.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-jjhc-v7c2-5hh6)
- **Apr 3, 2026**: mlflow: FastAPI job endpoints under /ajax-api/3.0/jobs/\* are not protected (critical). [GitHub Advisory Database](https://github.com/advisories/GHSA-7qhf-v65m-g5f3)
- **Apr 1, 2026**: payload: pre-authentication account takeover (critical). Fixed in 3.79.1. [GitHub Advisory Database](https://github.com/advisories/GHSA-hp5w-3hxx-vmwf)

## Reached end of life (3)

- **Apr 30, 2026**: Node.js 20 reached end of life. No more security fixes. Current LTS: Node.js 24. [endoflife.date](https://endoflife.date/nodejs)
- **Apr 30, 2026**: MySQL 8.0 reached end of life. No more security fixes. Current LTS: MySQL 9.7. [endoflife.date](https://endoflife.date/mysql)
- **Apr 7, 2026**: Django 4.2 LTS reached end of life. No more security fixes. Current LTS: Django 5.2. [endoflife.date](https://endoflife.date/django)

## New release lines (3)

- **Apr 23, 2026**: Ubuntu 26.04 LTS released. Latest version: 26.04.1. [endoflife.date](https://endoflife.date/ubuntu)
- **Apr 22, 2026**: Kubernetes 1.36 released. Latest version: 1.36.5. [endoflife.date](https://endoflife.date/kubernetes)
- **Apr 21, 2026**: MySQL 9.7 released. Latest version: 9.7.2. [endoflife.date](https://endoflife.date/mysql)

## Which models can’t know this

Every model below has a knowledge cutoff before April 2026, so it can’t know about any of this unless a tool gives it live data.

- Gemini 3.8 Flash (Google): March 2026
- Gemini 4 Argon (Google): March 2026
- GPT-5.6 Sol (OpenAI): February 16, 2026
- Claude Fable 5 (Anthropic): January 2026
- Claude Opus 4.7 (Anthropic): January 2026
- Claude Opus 4.8 (Anthropic): January 2026
- Claude Sonnet 5 (Anthropic): January 2026
- Grok 4.6 (xAI): January 2026
- MAI-Code-1.1-Flash (Microsoft): December 2025
- GPT-5.5 (OpenAI): December 1, 2025
- Claude Sonnet 4.6 (Anthropic): August 2025
- GPT-5.3-Codex (OpenAI): August 31, 2025
- GPT-5.4 (OpenAI): August 31, 2025
- GPT-5.4 Mini (OpenAI): August 31, 2025
- Claude Opus 4.5 (Anthropic): May 2025
- Claude Opus 4.6 (Anthropic): May 2025
- Claude Haiku 4.5 (Anthropic): February 2025
- Claude Sonnet 4.5 (Anthropic): January 2025
- Gemini 2.5 Flash (Google): January 2025
- Gemini 2.5 Pro (Google): January 2025
- Gemini 3 Flash (Google): January 2025
- Gemini 3.1 Pro (Google): January 2025
- GPT-5 (OpenAI): September 30, 2024
- GPT-5-Codex (OpenAI): September 30, 2024
- GPT-5.1 (OpenAI): September 30, 2024
- Llama 4 Maverick (Meta): August 2024
- GPT-4.1 (OpenAI): June 1, 2024
- o3 (OpenAI): June 1, 2024
- GPT-5 Mini (OpenAI): May 31, 2024
- GPT-4o (OpenAI): October 1, 2023

---

Checked Oct 17, 2026 against [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [GitHub Advisory Database](https://github.com/advisories) and [endoflife.date](https://endoflife.date). Full report: https://stackprism.ai/reports/2026-04