---
title: "Security digest: March 9, 2026"
url: https://erroneo.us/security/2026-03-09/
description: "March 9, 2026 vulnerability digest: 3 CISA KEV additions (Ivanti, Omnissa, SolarWinds); 7 critical advisories (Go, npm, crates.io (Rust)…). What to patch…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-09
date_modified: 2026-03-09
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 9, 2026

3 known exploited (cisa kev) additions and 7 critical advisories.

## Take stock

- Do you run any of these? Ivanti Endpoint Manager (EPM), SolarWinds Web Help Desk, Omnissa Workspace One UEM. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-12.
- npm: 3 critical advisories ( parse-server , @oneuptime/common ). Check with npm audit (or: npm ls <package>) .
- Maven: 2 critical advisories ( org.apache.iotdb:iotdb-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Go: 1 critical advisory ( github.com/shi-gg/linkdave ). Check with govulncheck ./... .
- crates.io (Rust): 1 critical advisory ( rssn ). Check with cargo audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-1603](https://erroneo.us/security/cve/CVE-2026-1603/index.md) Ivanti  Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability (CISA due 2026-03-23)
- [CVE-2025-26399](https://erroneo.us/security/cve/CVE-2025-26399/index.md) SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (CISA due 2026-03-12)
- [CVE-2021-22054](https://erroneo.us/security/cve/CVE-2021-22054/index.md) Omnissa Workspace One UEM: Omnissa Workspace ONE Server-Side Request Forgery (CISA due 2026-03-23)

## Critical advisories

- [GHSA-xv8g-fj9h-6gmv](https://erroneo.us/security/ghsa/GHSA-xv8g-fj9h-6gmv/index.md) Linkdave Missing Authentication on REST and WebSocket endpoints — Go github.com/shi-gg/linkdave < 0.1.5 → 0.1.5
- [CVE-2026-30863](https://erroneo.us/security/cve/CVE-2026-30863/index.md) Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters — npm parse-server >= 9.0.0-alpha.1, < 9.5.0-alpha.11 → 9.5.0-alpha.11; npm parse-server < 8.6.10 → 8.6.10
- [CVE-2026-30956](https://erroneo.us/security/cve/CVE-2026-30956/index.md) OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover — npm @oneuptime/common < 10.0.21 → 10.0.21
- [CVE-2026-30957](https://erroneo.us/security/cve/CVE-2026-30957/index.md) OneUptime has Synthetic Monitor RCE via exposed Playwright browser object — npm @oneuptime/common < 10.0.21 → 10.0.21
- [CVE-2026-30960](https://erroneo.us/security/cve/CVE-2026-30960/index.md) RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface — crates.io (Rust) rssn < 0.2.9 → 0.2.9
- [CVE-2026-24015](https://erroneo.us/security/cve/CVE-2026-24015/index.md) Apache IoTDB has an Insecure Default Configuration Vulnerability — Maven org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.7 → 1.3.7; Maven org.apache.iotdb:iotdb-core >= 2.0.0, < 2.0.7 → 2.0.7
- [CVE-2026-24713](https://erroneo.us/security/cve/CVE-2026-24713/index.md) Apache IoTDB has an Improper Input Validation vulnerability — Maven org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.7 → 1.3.7; Maven org.apache.iotdb:iotdb-core >= 2.0.0, < 2.0.7 → 2.0.7

---
Source page: https://erroneo.us/security/2026-03-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt