---
title: "Security digest: March 12, 2026"
url: https://erroneo.us/security/2026-03-12/
description: "March 12, 2026 vulnerability digest: 7 critical advisories (PyPI, Composer (PHP), npm, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-12
date_modified: 2026-03-12
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 12, 2026

7 critical advisories.

## Take stock

- npm: 3 critical advisories ( @tinacms/cli , parse-server ). Check with npm audit (or: npm ls <package>) .
- PyPI: 2 critical advisories ( sglang ). Check with pip-audit (or: pip show <package>) .
- Composer (PHP): 1 critical advisory ( winter/wn-backend-module ). Check with composer audit .
- Go: 1 critical advisory ( github.com/AdguardTeam/AdGuardHome ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-3059](https://erroneo.us/security/cve/CVE-2026-3059/index.md) SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker — PyPI sglang <= 0.5.9 → 0.5.10
- [CVE-2026-27591](https://erroneo.us/security/cve/CVE-2026-27591/index.md) Winter vulnerable to privilege escalation by authenticated backend users — Composer (PHP) winter/wn-backend-module >= 1.2.0, < 1.2.12 → 1.2.12; Composer (PHP) winter/wn-backend-module >= 1.1.0, < 1.1.12 → 1.1.12; Composer (PHP) winter/wn-backend-module < 1.0.477 → 1.0.477
- [CVE-2026-3060](https://erroneo.us/security/cve/CVE-2026-3060/index.md) SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module — PyPI sglang <= 0.5.9 → 0.5.10
- [CVE-2026-28792](https://erroneo.us/security/cve/CVE-2026-28792/index.md) TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS — npm @tinacms/cli < 2.1.8 → 2.1.8
- [CVE-2026-32248](https://erroneo.us/security/cve/CVE-2026-32248/index.md) Parse Server: Account takeover via operator injection in authentication data identifier — npm parse-server >= 9.0.0, < 9.6.0-alpha.12 → 9.6.0-alpha.12; npm parse-server < 8.6.38 → 8.6.38
- [CVE-2026-32136](https://erroneo.us/security/cve/CVE-2026-32136/index.md) AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass — Go github.com/AdguardTeam/AdGuardHome < 0.107.73 → 0.107.73
- [CVE-2026-32242](https://erroneo.us/security/cve/CVE-2026-32242/index.md) Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance — npm parse-server >= 9.0.0, < 9.6.0-alpha.11 → 9.6.0-alpha.11; npm parse-server < 8.6.37 → 8.6.37

---
Source page: https://erroneo.us/security/2026-03-12/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt