Digest · Tuesday
Security digest: March 3, 2026
2 known exploited (cisa kev) additions and 11 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Broadcom VMware Aria Operations, Qualcomm Multiple Chipsets. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-24.
- Composer (PHP): 4 critical advisories (
craftcms/cms,wwbn/avideo,froxlor/froxlor,devcode-it/openstamanager). Check withcomposer audit. - PyPI: 3 critical advisories (
picklescan). Check withpip-audit (or: pip show <package>). - Go: 3 critical advisories (
github.com/rancher/rancher). Check withgovulncheck ./.... - Maven: 1 critical advisory (
org.apache.ranger:ranger-plugins-common). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 2
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-22719 | Broadcom VMware Aria Operations Broadcom VMware Aria Operations Command Injection Vulnerability | 2026-03-24 |
| CVE-2026-21385 | Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Memory Corruption Vulnerability | 2026-03-24 |
Critical advisories by ecosystem 11
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Composer (PHP) 4
Check: composer audit
- Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates CVE-2026-28697 CVSS 9.4 Critical
craftcms/cms>= 5.0.0-RC1, < 5.9.0-beta.1 → fixed in 5.9.0-beta.1;craftcms/cms>= 4.0.0-RC1, < 4.17.0-beta.1 → fixed in 4.17.0-beta.1 - WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php CVE-2026-29058 CVSS 9.8 Critical
wwbn/avideo< 7.0.0 → fixed in 7.0.0 - Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection CVE-2026-26279 CVSS 9.1 Critical
froxlor/froxlor<= 2.3.3 → fixed in 2.3.4 - OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php CVE-2026-27012 CVSS 9.8 Critical
devcode-it/openstamanager<= 2.9.8 → no fix listed
Go 3
Check: govulncheck ./...
- Rancher cloud credentials can be used through proxy API by users without access CVE-2021-25320 CVSS 9.9 Critical
github.com/rancher/rancher>= 2.2.0, < 2.4.16 → fixed in 2.4.16;github.com/rancher/rancher>= 2.5.0, < 2.5.9 → fixed in 2.5.9 - Rancher doesn't properly sanitize credentials in cluster template answers CVE-2021-36783 CVSS 9.9 Critical
github.com/rancher/rancher>= 2.5.0, <= 2.5.12 → fixed in 2.5.13;github.com/rancher/rancher>= 2.6.0, <= 2.6.3 → fixed in 2.6.4 - Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) CVE-2022-31247 CVSS 9.1 Critical
github.com/rancher/rancher>= 2.5.0, <= 2.5.15 → fixed in 2.5.16;github.com/rancher/rancher>= 2.6.0, <= 2.6.6 → fixed in 2.6.7
PyPI 3
Check: pip-audit (or: pip show <package>)
- PickleScan's pkgutil.resolve_name has a universal blocklist bypass CVE-2026-3490 CVSS 10.0 Critical
picklescan< 1.0.4 → fixed in 1.0.4 - PickleScan has multiple stdlib modules with direct RCE not in blocklist CVE-2026-56315 CVSS 9.8 Critical
picklescan< 1.0.4 → fixed in 1.0.4 - PickleScan's profile.run blocklist mismatch allows exec() bypass CVE-2026-53873 CVSS 9.8 Critical
picklescan< 1.0.4 → fixed in 1.0.4
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Apache Ranger has a Code Injection vulnerability CVE-2025-59059 CVSS 9.8 Critical
org.apache.ranger:ranger-plugins-common< 2.8.0 → fixed in 2.8.0