---
title: "Security digest: March 2, 2026"
url: https://erroneo.us/security/2026-03-02/
description: "March 2, 2026 vulnerability digest: 9 critical advisories (Composer (PHP), npm…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-02
date_modified: 2026-03-02
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 2, 2026

9 critical advisories.

## Take stock

- npm: 5 critical advisories ( @builder.io/qwik , @orpc/client , openclaw ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 3 critical advisories ( wwbn/avideo , idno/known ). Check with composer audit .
- crates.io (Rust): 1 critical advisory ( tracing-check ). Check with cargo audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-28502](https://erroneo.us/security/cve/CVE-2026-28502/index.md) AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction — Composer (PHP) wwbn/avideo < 21.0 → no fix
- [CVE-2026-28501](https://erroneo.us/security/cve/CVE-2026-28501/index.md) AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php — Composer (PHP) wwbn/avideo <= 21.0.0 → no fix
- [CVE-2026-27971](https://erroneo.us/security/cve/CVE-2026-27971/index.md) Qwik vulnerable to Unauthenticated RCE via server$ Deserialization — npm @builder.io/qwik <= 1.19.0 → 1.19.1
- [CVE-2026-28794](https://erroneo.us/security/cve/CVE-2026-28794/index.md) `@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization — npm @orpc/client <= 1.13.5 → 1.13.6
- [CVE-2026-28466](https://erroneo.us/security/cve/CVE-2026-28466/index.md) OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway — npm openclaw < 2026.2.14 → 2026.2.14
- [CVE-2026-32013](https://erroneo.us/security/cve/CVE-2026-32013/index.md) OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write — npm openclaw < 2026.2.25 → 2026.2.25
- [CVE-2026-28508](https://erroneo.us/security/cve/CVE-2026-28508/index.md) Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint — Composer (PHP) idno/known <= 1.6.3 → 1.6.4
- [CVE-2026-31999](https://erroneo.us/security/cve/CVE-2026-31999/index.md) CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths — npm openclaw >= 2026.2.26, < 2026.3.1 → 2026.3.1
- [GHSA-5pmp-jpcf-pwx6](https://erroneo.us/security/ghsa/GHSA-5pmp-jpcf-pwx6/index.md) `tracing-check` was removed from crates.io for malicious code — crates.io (Rust) tracing-check >= 0 → no fix

---
Source page: https://erroneo.us/security/2026-03-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt