erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: March 5, 2026

5 known exploited (cisa kev) additions and 5 critical advisories.

All digests · RSS · Markdown

Take stock

  • Do you run any of these? Apple Multiple Products, Apple iOS and iPadOS, Rockwell Multiple Products, Hikvision Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-26.
  • crates.io (Rust): 3 critical advisories (pingora-core, time-sync). Check with cargo audit.
  • Go: 2 critical advisories (github.com/0xJacky/Nginx-UI, gogs.io/gogs). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 5

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2023-43000Apple Multiple Products
Apple Multiple products Use-After-Free Vulnerability		2026-03-26
CVE-2023-41974Apple iOS and iPadOS
Apple iOS and iPadOS Use-After-Free Vulnerability		2026-03-26
CVE-2021-30952Apple Multiple Products
Apple Multiple Products Integer Overflow or Wraparound Vulnerability		2026-03-26
CVE-2021-22681Rockwell Multiple Products
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability		2026-03-26
CVE-2017-7921Hikvision Multiple Products
Hikvision Multiple Products Improper Authentication Vulnerability		2026-03-26

Critical advisories by ecosystem 5

GitHub-reviewed advisories rated critical, published this day (Pacific time).

crates.io (Rust) 3

Check: cargo audit

Go 2

Check: govulncheck ./...