Digest · Monday
Security digest: March 9, 2026
3 known exploited (cisa kev) additions and 7 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Ivanti Endpoint Manager (EPM), SolarWinds Web Help Desk, Omnissa Workspace One UEM. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-12.
- npm: 3 critical advisories (
parse-server,@oneuptime/common). Check withnpm audit (or: npm ls <package>). - Maven: 2 critical advisories (
org.apache.iotdb:iotdb-core). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - Go: 1 critical advisory (
github.com/shi-gg/linkdave). Check withgovulncheck ./.... - crates.io (Rust): 1 critical advisory (
rssn). Check withcargo audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 3
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-1603 | Ivanti Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | 2026-03-23 |
| CVE-2025-26399 | SolarWinds Web Help Desk SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability Ransomware | 2026-03-12 |
| CVE-2021-22054 | Omnissa Workspace One UEM Omnissa Workspace ONE Server-Side Request Forgery | 2026-03-23 |
Critical advisories by ecosystem 7
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 3
Check: npm audit (or: npm ls <package>)
- Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters CVE-2026-30863 CVSS 9.3 Critical
parse-server>= 9.0.0-alpha.1, < 9.5.0-alpha.11 → fixed in 9.5.0-alpha.11;parse-server< 8.6.10 → fixed in 8.6.10 - OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account… CVE-2026-30956 CVSS 9.9 Critical
@oneuptime/common< 10.0.21 → fixed in 10.0.21 - OneUptime has Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30957 CVSS 9.9 Critical
@oneuptime/common< 10.0.21 → fixed in 10.0.21
Maven 2
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Apache IoTDB has an Insecure Default Configuration Vulnerability CVE-2026-24015 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core>= 1.0.0, < 1.3.7 → fixed in 1.3.7;org.apache.iotdb:iotdb-core>= 2.0.0, < 2.0.7 → fixed in 2.0.7 - Apache IoTDB has an Improper Input Validation vulnerability CVE-2026-24713 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core>= 1.0.0, < 1.3.7 → fixed in 1.3.7;org.apache.iotdb:iotdb-core>= 2.0.0, < 2.0.7 → fixed in 2.0.7
Go 1
Check: govulncheck ./...
- Linkdave Missing Authentication on REST and WebSocket endpoints GHSA-xv8g-fj9h-6gmv CVSS 9.3 Critical
github.com/shi-gg/linkdave< 0.1.5 → fixed in 0.1.5
crates.io (Rust) 1
Check: cargo audit
- RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface CVE-2026-30960 CVSS 9.4 Critical
rssn< 0.2.9 → fixed in 0.2.9