Digest · Friday
Security digest: March 20, 2026
5 known exploited (cisa kev) additions and 6 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Laravel Livewire, Apple Multiple Products, Craft CMS Craft CMS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-03.
- Go: 2 critical advisories (
github.com/ory/oathkeeper,github.com/minio/minio). Check withgovulncheck ./.... - Composer (PHP): 2 critical advisories (
wwbn/avideo). Check withcomposer audit. - GitHub Actions: 1 critical advisory (
SHAdd0WTAka/Zen-Ai-Pentest). Check withgrep -rn 'uses: <owner>/<action>' .github/workflows. - RubyGems: 1 critical advisory (
graphiti). Check withbundle audit check --update. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 5
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2025-54068 | Laravel Livewire Laravel Livewire Code Injection Vulnerability | 2026-04-03 |
| CVE-2025-43520 | Apple Multiple Products Apple Multiple Products Classic Buffer Overflow Vulnerability | 2026-04-03 |
| CVE-2025-43510 | Apple Multiple Products Apple Multiple Products Improper Locking Vulnerability | 2026-04-03 |
| CVE-2025-32432 | Craft CMS Craft CMS Craft CMS Code Injection Vulnerability | 2026-04-03 |
| CVE-2025-31277 | Apple Multiple Products Apple Multiple Products Buffer Overflow Vulnerability | 2026-04-03 |
Critical advisories by ecosystem 6
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Composer (PHP) 2
Check: composer audit
- AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection CVE-2026-33478 CVSS 10.0 Critical
wwbn/avideo<= 26.0 → no fix listed - AVideo has Unauthenticated SSRF via plugin/Live/test.php CVE-2026-33502 CVSS 9.3 Critical
wwbn/avideo<= 26.0 → no fix listed
Go 2
Check: govulncheck ./...
- Ory Oathkeeper has a path traversal authorization bypass CVE-2026-33494 CVSS 10.0 Critical
github.com/ory/oathkeeper< 0.40.10-0.20260320084758-8e0002140491 → fixed in 0.40.10-0.20260320084758-8e0002140491 - MinIO LDAP login brute-force via user enumeration and missing rate limit CVE-2026-33419 CVSS 9.1 Critical
github.com/minio/minio<= 0.0.0-20260212201848-7aac2a2c5b7c → no fix listed
GitHub Actions 1
Check: grep -rn 'uses: <owner>/<action>' .github/workflows
- Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow GHSA-f67f-hcr6-94mf CVSS 10.0 Critical
SHAdd0WTAka/Zen-Ai-Pentest<= 3.0.0 → no fix listed
RubyGems 1
Check: bundle audit check --update
- Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names CVE-2026-33286 CVSS 9.1 Critical
graphiti<= 1.10.1 → fixed in 1.10.2