Digest · Thursday
Security digest: March 12, 2026
7 critical advisories.
All digests · RSS · Markdown
Take stock
- npm: 3 critical advisories (
@tinacms/cli,parse-server). Check withnpm audit (or: npm ls <package>). - PyPI: 2 critical advisories (
sglang). Check withpip-audit (or: pip show <package>). - Composer (PHP): 1 critical advisory (
winter/wn-backend-module). Check withcomposer audit. - Go: 1 critical advisory (
github.com/AdguardTeam/AdGuardHome). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 7
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 3
Check: npm audit (or: npm ls <package>)
- TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVE-2026-28792 CVSS 9.6 Critical
@tinacms/cli< 2.1.8 → fixed in 2.1.8 - Parse Server: Account takeover via operator injection in authentication data identifier CVE-2026-32248 CVSS 9.3 Critical
parse-server>= 9.0.0, < 9.6.0-alpha.12 → fixed in 9.6.0-alpha.12;parse-server< 8.6.38 → fixed in 8.6.38 - Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance CVE-2026-32242 CVSS 9.1 Critical
parse-server>= 9.0.0, < 9.6.0-alpha.11 → fixed in 9.6.0-alpha.11;parse-server< 8.6.37 → fixed in 8.6.37
PyPI 2
Check: pip-audit (or: pip show <package>)
- SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker CVE-2026-3059 CVSS 9.8 Critical
sglang<= 0.5.9 → fixed in 0.5.10 - SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module CVE-2026-3060 CVSS 9.8 Critical
sglang<= 0.5.9 → fixed in 0.5.10
Composer (PHP) 1
Check: composer audit
- Winter vulnerable to privilege escalation by authenticated backend users CVE-2026-27591 CVSS 9.9 Critical
winter/wn-backend-module>= 1.2.0, < 1.2.12 → fixed in 1.2.12;winter/wn-backend-module>= 1.1.0, < 1.1.12 → fixed in 1.1.12;winter/wn-backend-module< 1.0.477 → fixed in 1.0.477
Go 1
Check: govulncheck ./...
- AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass CVE-2026-32136 CVSS 9.8 Critical
github.com/AdguardTeam/AdGuardHome< 0.107.73 → fixed in 0.107.73