Digest · Wednesday

Security digest: March 18, 2026

2 known exploited (cisa kev) additions and 6 critical advisories.

Take stock

Do you run any of these? Microsoft SharePoint, Synacor Zimbra Collaboration Suite (ZCS). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-21.
Go: 2 critical advisories (google.golang.org/grpc, github.com/tektoncd/pipeline). Check with govulncheck ./....
PyPI: 2 critical advisories (mesop). Check with pip-audit (or: pip show <package>).
Maven: 1 critical advisory (ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.model, ca.uhn.hapi.fhir:org.hl7.fhir.r4 …). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
npm: 1 critical advisory (@apostrophecms/import-export). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-20963	Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	2026-03-21
CVE-2025-66376	Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability	2026-04-01

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

gRPC-Go has an authorization bypass via missing leading slash in :path CVE-2026-33186 CVSS 9.1 Critical
google.golang.org/grpc < 1.79.3 → fixed in 1.79.3
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod CVE-2026-33211 CVSS 9.6 Critical
github.com/tektoncd/pipeline >= 1.0.0, < 1.0.1 → fixed in 1.0.1; github.com/tektoncd/pipeline >= 1.1.0, < 1.3.3 → fixed in 1.3.3; github.com/tektoncd/pipeline >= 1.4.0, < 1.6.1 → fixed in 1.6.1; +2 more packages

Check: pip-audit (or: pip show <package>)

Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py CVE-2026-33057 CVSS 9.8 Critical
mesop <= 1.2.2 → fixed in 1.2.3
Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion CVE-2026-33054 CVSS 10.0 Critical
mesop <= 1.2.2 → fixed in 1.2.3

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

HAPI FHIR HTTP authentication leak in redirects CVE-2026-33180 CVSS 9.8 Critical
ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.9.0 → fixed in 6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.9.0 → fixed in 6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.9.0 → fixed in 6.9.0; +9 more packages

Check: npm audit (or: npm ls <package>)

ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVE-2026-32731 CVSS 9.9 Critical
@apostrophecms/import-export <= 3.5.2 → fixed in 3.5.3