---
title: "Security digest: March 5, 2026"
url: https://erroneo.us/security/2026-03-05/
description: "March 5, 2026 vulnerability digest: 5 CISA KEV additions (Apple, Hikvision, Rockwell); 5 critical advisories (crates.io (Rust), Go). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-05
date_modified: 2026-03-05
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 5, 2026

5 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Do you run any of these? Apple Multiple Products, Apple iOS and iPadOS, Rockwell Multiple Products, Hikvision Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-26.
- crates.io (Rust): 3 critical advisories ( pingora-core , time-sync ). Check with cargo audit .
- Go: 2 critical advisories ( github.com/0xJacky/Nginx-UI , gogs.io/gogs ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2023-43000](https://erroneo.us/security/cve/CVE-2023-43000/index.md) Apple Multiple Products: Apple Multiple products Use-After-Free Vulnerability (CISA due 2026-03-26)
- [CVE-2023-41974](https://erroneo.us/security/cve/CVE-2023-41974/index.md) Apple iOS and iPadOS: Apple iOS and iPadOS Use-After-Free Vulnerability (CISA due 2026-03-26)
- [CVE-2021-30952](https://erroneo.us/security/cve/CVE-2021-30952/index.md) Apple Multiple Products: Apple Multiple Products Integer Overflow or Wraparound Vulnerability (CISA due 2026-03-26)
- [CVE-2021-22681](https://erroneo.us/security/cve/CVE-2021-22681/index.md) Rockwell Multiple Products: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability (CISA due 2026-03-26)
- [CVE-2017-7921](https://erroneo.us/security/cve/CVE-2017-7921/index.md) Hikvision Multiple Products: Hikvision Multiple Products Improper Authentication Vulnerability (CISA due 2026-03-26)

## Critical advisories

- [CVE-2026-2833](https://erroneo.us/security/cve/CVE-2026-2833/index.md) Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade — crates.io (Rust) pingora-core <= 0.7.0 → 0.8.0
- [GHSA-mh23-rw7f-v5pq](https://erroneo.us/security/ghsa/GHSA-mh23-rw7f-v5pq/index.md) `time-sync` was removed from crates.io due to malicious code — crates.io (Rust) time-sync >= 0 → no fix
- [CVE-2026-2835](https://erroneo.us/security/cve/CVE-2026-2835/index.md) Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing — crates.io (Rust) pingora-core <= 0.7.0 → 0.8.0
- [CVE-2026-27944](https://erroneo.us/security/cve/CVE-2026-27944/index.md) Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure — Go github.com/0xJacky/Nginx-UI < 2.3.3 → 2.3.3
- [CVE-2026-25921](https://erroneo.us/security/cve/CVE-2026-25921/index.md) Gogs: Cross-repository LFS object overwrite via missing content hash verification — Go gogs.io/gogs <= 0.14.1 → 0.14.2

---
Source page: https://erroneo.us/security/2026-03-05/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt