Security Digest: April 29, 2026 - 16 Critical Vulnerabilities

Today's security landscape presents 16 critical vulnerabilities that demand your immediate attention. Key threats include prototype pollution in n8n, DoS vulnerabilities in PhpSpreadsheet, and security bypasses in Admidio.

· 4 min read

Today's Security Threats: Immediate Actions Required

Executive Summary

Today's security landscape presents 16 critical vulnerabilities that demand your immediate attention. Key threats include prototype pollution in n8n, DoS vulnerabilities in PhpSpreadsheet, and security bypasses in Admidio. Immediate patching and configuration updates are crucial to mitigate these risks.

Critical Vulnerabilities

  • CVE-2026-42231: n8n Prototype Pollution
    • Impact: Allows remote code execution via prototype pollution.
    • Affected Systems: n8n versions before 1.123.32, 2.17.4, and 2.18.1.
    • Immediate Action: Upgrade to n8n version 1.123.32, 2.17.4, or 2.18.1 immediately.
    • Mitigation: Restrict workflow creation to trusted users as a temporary measure.
  • CVE-2026-42352: pygeoapi Internal Request Exposure
    • Impact: Unauthorized requests to internal services.
    • Affected Systems: pygeoapi versions before 0.23.3.
    • Immediate Action: Upgrade to pygeoapi 0.23.3.
    • Mitigation: Disable process-based resources until patched.
  • CVE-2026-41669: Admidio SAML Signature Bypass
    • Impact: Allows processing of unsigned SAML requests.
    • Affected Systems: Admidio with SAML SSO enabled.
    • Immediate Action: Apply code fixes to enforce signature validation.
    • Mitigation: Review SAML configuration for signature enforcement.
  • CVE-2026-42353: i18next SSRF and Path Traversal
    • Impact: Enables SSRF and arbitrary file access.
    • Affected Systems: i18next-http-middleware versions before 3.9.3.
    • Immediate Action: Upgrade to version 3.9.3.
    • Mitigation: Implement WAF rules to block unsafe requests.
  • CVE-2026-41680: Marked DoS Vulnerability
    • Impact: Causes application crash via memory exhaustion.
    • Affected Systems: marked@18.0.0.
    • Immediate Action: Avoid processing untrusted input with marked.
    • Mitigation: Upgrade to a version where this issue is fixed.

Previously Alerted

What to Do Now

  1. Upgrade affected systems immediately to patched versions.
  2. Apply temporary mitigations where upgrades cannot be performed.
  3. Verify that all configurations adhere to security best practices.
  4. Monitor systems for unusual activity post-patch implementation.

Related Resources

  • Internal blog posts on securing n8n and Admidio configurations
  • Vendor advisories for each affected software

Keep reading