Digest · Friday
Security digest: March 13, 2026
2 known exploited (cisa kev) additions and 10 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Google Chromium V8, Google Skia. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-27.
- npm: 7 critical advisories (
openclaw,locutus,@apollo/federation-internals,@apollo/gateway,@apollo/query-planner,oneuptime,@nyariv/sandboxjs). Check withnpm audit (or: npm ls <package>). - Go: 3 critical advisories (
github.com/dagu-org/dagu,github.com/centrifugal/centrifugo/v6,github.com/centrifugal/centrifugo,github.com/centrifugal/centrifugo/v3,github.com/centrifugal/centrifugo/v4,github.com/centrifugal/centrifugo/v5,github.com/emmansun/gmsm). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 2
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-3910 | Google Chromium V8 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | 2026-03-27 |
| CVE-2026-3909 | Google Skia Google Skia Out-of-Bounds Write Vulnerability | 2026-03-27 |
Critical advisories by ecosystem 10
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 7
Check: npm audit (or: npm ls <package>)
- OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes CVE-2026-32916 CVSS 9.4 Critical
openclaw>= 2026.3.7, < 2026.3.11 → fixed in 2026.3.11 - Locutus vulnerable to RCE via unsanitized input in create_function() CVE-2026-32304 CVSS 9.8 Critical
locutus<= 3.0.13 → fixed in 3.0.14 - OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes CVE-2026-22172 CVSS 9.9 Critical
openclaw<= 2026.3.11 → fixed in 2026.3.12 - Apollo Federation vulnerable to prototype pollution via incomplete key sanitization CVE-2026-32621 CVSS 9.9 Critical
@apollo/federation-internals< 2.9.6 → fixed in 2.9.6;@apollo/federation-internals>= 2.10.0, < 2.10.5 → fixed in 2.10.5;@apollo/federation-internals>= 2.11.0, < 2.11.6 → fixed in 2.11.6; +12 more packages - OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVE-2026-32306 CVSS 9.9 Critical
oneuptime< 10.0.23 → fixed in 10.0.23 - SandboxJS affected by a Sandbox Escape CVE-2026-26954 CVSS 10.0 Critical
@nyariv/sandboxjs<= 0.8.33 → fixed in 0.8.34 - OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE GHSA-4jpw-hj22-2xmc CVSS 9.9 Critical
openclaw< 2026.3.11 → fixed in 2026.3.11
Go 3
Check: govulncheck ./...
- Dagu: Path Traversal via `dagRunId` in Inline DAG Execution CVE-2026-31886 CVSS 9.1 Critical
github.com/dagu-org/dagu<= 2.2.4 → no fix listed - Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL CVE-2026-32301 CVSS 9.3 Critical
github.com/centrifugal/centrifugo/v6<= 6.6.2 → fixed in 6.7.0;github.com/centrifugal/centrifugo<= 2.4.0 → no fix listed;github.com/centrifugal/centrifugo/v3<= 3.2.3 → no fix listed; +2 more packages - SM9 Infinity-Point Ciphertext Forgery Vulnerability CVE-2026-32614 CVSS 9.2 Critical
github.com/emmansun/gmsm< 0.41.1 → fixed in 0.41.1