---
title: "Security digest: March 18, 2026"
url: https://erroneo.us/security/2026-03-18/
description: "March 18, 2026 vulnerability digest: 2 CISA KEV additions (Microsoft, Synacor); 6 critical advisories (Maven, Go, npm, PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-18
date_modified: 2026-03-18
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 18, 2026

2 known exploited (cisa kev) additions and 6 critical advisories.

## Take stock

- Do you run any of these? Microsoft SharePoint, Synacor Zimbra Collaboration Suite (ZCS). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-21.
- Go: 2 critical advisories ( google.golang.org/grpc , github.com/tektoncd/pipeline ). Check with govulncheck ./... .
- PyPI: 2 critical advisories ( mesop ). Check with pip-audit (or: pip show <package>) .
- Maven: 1 critical advisory ( ca.uhn.hapi.fhir:org.hl7.fhir.utilities , ca.uhn.hapi.fhir:org.hl7.fhir.convertors , ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 , ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 , ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support , ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may , ca.uhn.hapi.fhir:org.hl7.fhir.model , ca.uhn.hapi.fhir:org.hl7.fhir.r4 …). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 1 critical advisory ( @apostrophecms/import-export ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-20963](https://erroneo.us/security/cve/CVE-2026-20963/index.md) Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CISA due 2026-03-21)
- [CVE-2025-66376](https://erroneo.us/security/cve/CVE-2025-66376/index.md) Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability (CISA due 2026-04-01)

## Critical advisories

- [CVE-2026-33180](https://erroneo.us/security/cve/CVE-2026-33180/index.md) HAPI FHIR HTTP authentication leak in redirects — Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.9.0 → 6.9.0; Maven ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.9.0 → 6.9.0; Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.9.0 → 6.9.0
- [CVE-2026-33186](https://erroneo.us/security/cve/CVE-2026-33186/index.md) gRPC-Go has an authorization bypass via missing leading slash in :path — Go google.golang.org/grpc < 1.79.3 → 1.79.3
- [CVE-2026-32731](https://erroneo.us/security/cve/CVE-2026-32731/index.md) ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction — npm @apostrophecms/import-export <= 3.5.2 → 3.5.3
- [CVE-2026-33211](https://erroneo.us/security/cve/CVE-2026-33211/index.md) Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod — Go github.com/tektoncd/pipeline >= 1.0.0, < 1.0.1 → 1.0.1; Go github.com/tektoncd/pipeline >= 1.1.0, < 1.3.3 → 1.3.3; Go github.com/tektoncd/pipeline >= 1.4.0, < 1.6.1 → 1.6.1
- [CVE-2026-33057](https://erroneo.us/security/cve/CVE-2026-33057/index.md) Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py — PyPI mesop <= 1.2.2 → 1.2.3
- [CVE-2026-33054](https://erroneo.us/security/cve/CVE-2026-33054/index.md) Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion — PyPI mesop <= 1.2.2 → 1.2.3

---
Source page: https://erroneo.us/security/2026-03-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt