---
title: "Security digest: March 19, 2026"
url: https://erroneo.us/security/2026-03-19/
description: "March 19, 2026 vulnerability digest: 1 brief (Trivy / TeamPCP compromise); 1 CISA KEV addition (Cisco); 8 critical advisories (npm, Go, Maven, Composer…).…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 19, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 8 critical advisories.

## Take stock

- Check exposure: Trivy / TeamPCP compromise . Teams whose CI ran aquasecurity/trivy-action by tag on March 19-20, 2026, setup-trivy unpinned, Trivy 0.69.4 from any channel or Docker Hub 0.69.5/0.69.6/latest on March 22-23, or the Checkmarx actions and Open VSX extensions on March 23.
- Do you run any of these? Cisco Secure Firewall Management Center (FMC). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-22.
- Go: 3 critical advisories ( github.com/smallstep/certificates , github.com/autobrr/qui , github.com/minio/minio ). Check with govulncheck ./... .
- Composer (PHP): 2 critical advisories ( wwbn/avideo ). Check with composer audit .
- npm: 1 critical advisory ( mcp-bridge ). Check with npm audit (or: npm ls <package>) .
- Maven: 1 critical advisory ( org.springframework.security:spring-security-web ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( langflow ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets](https://erroneo.us/security/briefs/trivy-action-teampcp-supply-chain-compromise/index.md): If any pipeline ran trivy-action by tag, setup-trivy, or Trivy 0.69.4 to 0.69.6 during the March 19-23, 2026 windows, every secret that job could see is burned; if you pinned SHAs, digests or 0.69.3, you were fine.

## Known exploited (CISA KEV)

- [CVE-2026-20131](https://erroneo.us/security/cve/CVE-2026-20131/index.md) Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability (CISA due 2026-03-22)

## Critical advisories

- [GHSA-wvr4-3wq4-gpc5](https://erroneo.us/security/ghsa/GHSA-wvr4-3wq4-gpc5/index.md) MCP Connect has unauthenticated remote OS command execution via /bridge endpoint — npm mcp-bridge <= 2.0.0 → no fix
- [CVE-2026-30836](https://erroneo.us/security/cve/CVE-2026-30836/index.md) step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) — Go github.com/smallstep/certificates < 0.30.0 → 0.30.0
- [CVE-2026-22732](https://erroneo.us/security/cve/CVE-2026-22732/index.md) Spring Security HTTP Headers Are not Written Under Some Conditions — Maven org.springframework.security:spring-security-web <= 5.7.14 → no fix; Maven org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16 → no fix; Maven org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10 → no fix
- [CVE-2026-33352](https://erroneo.us/security/cve/CVE-2026-33352/index.md) AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) — Composer (PHP) wwbn/avideo <= 26.0 → no fix
- [CVE-2026-30924](https://erroneo.us/security/cve/CVE-2026-30924/index.md) qui CORS Misconfiguration: Arbitrary Origins Trusted — Go github.com/autobrr/qui < 1.15.0 → 1.15.0
- [CVE-2026-33309](https://erroneo.us/security/cve/CVE-2026-33309/index.md) Langflow has an Arbitrary File Write (RCE) via v2 API — PyPI langflow >= 1.2.0, < 1.9.0 → 1.9.0
- [CVE-2026-33351](https://erroneo.us/security/cve/CVE-2026-33351/index.md) AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass — Composer (PHP) wwbn/avideo <= 26.0 → no fix
- [CVE-2026-33322](https://erroneo.us/security/cve/CVE-2026-33322/index.md) MinIO has JWT Algorithm Confusion in OIDC Authentication — Go github.com/minio/minio <= 0.0.0-20260212201848-7aac2a2c5b7c → no fix

---
Source page: https://erroneo.us/security/2026-03-19/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt