---
title: "Security digest: March 10, 2026"
url: https://erroneo.us/security/2026-03-10/
description: "March 10, 2026 vulnerability digest: 11 critical advisories (PyPI, npm, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-10
date_modified: 2026-03-10
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 10, 2026

11 critical advisories.

## Take stock

- npm: 9 critical advisories ( @feathersjs/authentication-oauth , simple-git , parse-server , @feathersjs/mongodb , @siteboon/claudecodeui ). Check with npm audit (or: npm ls <package>) .
- PyPI: 1 critical advisory ( mcp-atlassian ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( github.com/arslanbekov/terraform-provider-sendgrid ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-27825](https://erroneo.us/security/cve/CVE-2026-27825/index.md) MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment — PyPI mcp-atlassian < 0.17.0 → 0.17.0
- [CVE-2026-29792](https://erroneo.us/security/cve/CVE-2026-29792/index.md) Feathers has an OAuth Callback Account Takeover issue — npm @feathersjs/authentication-oauth >= 5.0.0, <= 5.0.41 → 5.0.42
- [CVE-2026-28292](https://erroneo.us/security/cve/CVE-2026-28292/index.md) simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE — npm simple-git >= 3.15.0, < 3.32.3 → 3.32.3
- [CVE-2026-31840](https://erroneo.us/security/cve/CVE-2026-31840/index.md) Parse Server: SQL injection via dot-notation field name in PostgreSQL — npm parse-server >= 9.0.0, < 9.6.0-alpha.2 → 9.6.0-alpha.2; npm parse-server < 8.6.28 → 8.6.28
- [CVE-2026-31856](https://erroneo.us/security/cve/CVE-2026-31856/index.md) Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL — npm parse-server >= 9.0.0-alpha.1, < 9.6.0-alpha.3 → 9.6.0-alpha.3; npm parse-server < 8.6.29 → 8.6.29
- [CVE-2026-29793](https://erroneo.us/security/cve/CVE-2026-29793/index.md) Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter — npm @feathersjs/mongodb >= 5.0.0, <= 5.0.41 → 5.0.42
- [GHSA-j443-wcqq-xprh](https://erroneo.us/security/ghsa/GHSA-j443-wcqq-xprh/index.md) Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go — Go github.com/arslanbekov/terraform-provider-sendgrid <= 1.1.3-0.20250606002314-b4a2dfeb7b0f → no fix
- [CVE-2026-31871](https://erroneo.us/security/cve/CVE-2026-31871/index.md) Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL — npm parse-server >= 9.0.0-alpha.1, < 9.6.0-alpha.5 → 9.6.0-alpha.5; npm parse-server < 8.6.31 → 8.6.31
- [CVE-2026-31862](https://erroneo.us/security/cve/CVE-2026-31862/index.md) @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters — npm @siteboon/claudecodeui <= 1.23.0 → 1.24.0
- [CVE-2026-30965](https://erroneo.us/security/cve/CVE-2026-30965/index.md) Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter — npm parse-server >= 9.0.0-alpha.1, < 9.5.2-alpha.8 → 9.5.2-alpha.8; npm parse-server < 8.6.21 → 8.6.21
- [CVE-2026-30966](https://erroneo.us/security/cve/CVE-2026-30966/index.md) Parse Server has role escalation and CLP bypass via direct `_Join` table write — npm parse-server >= 9.0.0-alpha.1, < 9.5.2-alpha.7 → 9.5.2-alpha.7; npm parse-server < 8.6.20 → 8.6.20

---
Source page: https://erroneo.us/security/2026-03-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt