Digest · Friday

Security digest: March 6, 2026

7 critical advisories.

Take stock

Go: 5 critical advisories (github.com/Tencent/WeKnora, github.com/charmbracelet/soft-serve, github.com/siyuan-note/siyuan/kernel). Check with govulncheck ./....
npm: 2 critical advisories (@oneuptime/common). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation CVE-2026-30861 CVSS 10.0 Critical
github.com/Tencent/WeKnora >= 0.2.5, < 0.2.10 → fixed in 0.2.10
WeKnora Vulnerable to Broken Access Control in Tenant Management CVE-2026-30855 CVSS 9.8 Critical
github.com/Tencent/WeKnora <= 0.3.1 → fixed in 0.3.2
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool CVE-2026-30860 CVSS 10.0 Critical
github.com/Tencent/WeKnora <= 0.2.11 → fixed in 0.2.12
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import CVE-2026-30832 CVSS 9.1 Critical
github.com/charmbracelet/soft-serve >= 0.6.0, < 0.11.4 → fixed in 0.11.4
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage CVE-2026-30869 CVSS 9.3 Critical
github.com/siyuan-note/siyuan/kernel <= 3.5.9 → fixed in 3.5.10

Check: npm audit (or: npm ls <package>)

OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE CVE-2026-30887 CVSS 9.9 Critical
@oneuptime/common < 10.0.18 → fixed in 10.0.18
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30921 CVSS 9.9 Critical
@oneuptime/common < 10.0.20 → fixed in 10.0.20