---
title: "Security digest: March 3, 2026"
url: https://erroneo.us/security/2026-03-03/
description: "March 3, 2026 vulnerability digest: 2 CISA KEV additions (Broadcom, Qualcomm); 11 critical advisories (PyPI, Composer (PHP), Go…). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-03
date_modified: 2026-03-03
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 3, 2026

2 known exploited (cisa kev) additions and 11 critical advisories.

## Take stock

- Do you run any of these? Broadcom VMware Aria Operations, Qualcomm Multiple Chipsets. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-24.
- Composer (PHP): 4 critical advisories ( craftcms/cms , wwbn/avideo , froxlor/froxlor , devcode-it/openstamanager ). Check with composer audit .
- PyPI: 3 critical advisories ( picklescan ). Check with pip-audit (or: pip show <package>) .
- Go: 3 critical advisories ( github.com/rancher/rancher ). Check with govulncheck ./... .
- Maven: 1 critical advisory ( org.apache.ranger:ranger-plugins-common ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-22719](https://erroneo.us/security/cve/CVE-2026-22719/index.md) Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability (CISA due 2026-03-24)
- [CVE-2026-21385](https://erroneo.us/security/cve/CVE-2026-21385/index.md) Qualcomm Multiple Chipsets: Qualcomm Multiple Chipsets Memory Corruption Vulnerability (CISA due 2026-03-24)

## Critical advisories

- [CVE-2026-3490](https://erroneo.us/security/cve/CVE-2026-3490/index.md) PickleScan's pkgutil.resolve_name has a universal blocklist bypass — PyPI picklescan < 1.0.4 → 1.0.4
- [CVE-2026-28697](https://erroneo.us/security/cve/CVE-2026-28697/index.md) Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates — Composer (PHP) craftcms/cms >= 5.0.0-RC1, < 5.9.0-beta.1 → 5.9.0-beta.1; Composer (PHP) craftcms/cms >= 4.0.0-RC1, < 4.17.0-beta.1 → 4.17.0-beta.1
- [CVE-2021-25320](https://erroneo.us/security/cve/CVE-2021-25320/index.md) Rancher cloud credentials can be used through proxy API by users without access — Go github.com/rancher/rancher >= 2.2.0, < 2.4.16 → 2.4.16; Go github.com/rancher/rancher >= 2.5.0, < 2.5.9 → 2.5.9
- [CVE-2026-56315](https://erroneo.us/security/cve/CVE-2026-56315/index.md) PickleScan has multiple stdlib modules with direct RCE not in blocklist — PyPI picklescan < 1.0.4 → 1.0.4
- [CVE-2025-59059](https://erroneo.us/security/cve/CVE-2025-59059/index.md) Apache Ranger has a Code Injection vulnerability — Maven org.apache.ranger:ranger-plugins-common < 2.8.0 → 2.8.0
- [CVE-2026-29058](https://erroneo.us/security/cve/CVE-2026-29058/index.md) WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php — Composer (PHP) wwbn/avideo < 7.0.0 → 7.0.0
- [CVE-2021-36783](https://erroneo.us/security/cve/CVE-2021-36783/index.md) Rancher doesn't properly sanitize credentials in cluster template answers — Go github.com/rancher/rancher >= 2.5.0, <= 2.5.12 → 2.5.13; Go github.com/rancher/rancher >= 2.6.0, <= 2.6.3 → 2.6.4
- [CVE-2026-53873](https://erroneo.us/security/cve/CVE-2026-53873/index.md) PickleScan's profile.run blocklist mismatch allows exec() bypass — PyPI picklescan < 1.0.4 → 1.0.4
- [CVE-2022-31247](https://erroneo.us/security/cve/CVE-2022-31247/index.md) Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) — Go github.com/rancher/rancher >= 2.5.0, <= 2.5.15 → 2.5.16; Go github.com/rancher/rancher >= 2.6.0, <= 2.6.6 → 2.6.7
- [CVE-2026-26279](https://erroneo.us/security/cve/CVE-2026-26279/index.md) Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection — Composer (PHP) froxlor/froxlor <= 2.3.3 → 2.3.4
- [CVE-2026-27012](https://erroneo.us/security/cve/CVE-2026-27012/index.md) OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php — Composer (PHP) devcode-it/openstamanager <= 2.9.8 → no fix

---
Source page: https://erroneo.us/security/2026-03-03/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt