---
title: "Security digest: March 27, 2026"
url: https://erroneo.us/security/2026-03-27/
description: "March 27, 2026 vulnerability digest: 1 CISA KEV addition (F5); 7 critical advisories (crates.io (Rust), Go, PyPI…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-27
date_modified: 2026-03-27
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 27, 2026

1 known exploited (cisa kev) addition and 7 critical advisories.

## Take stock

- Do you run any of these? F5 BIG-IP. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-30.
- npm: 3 critical advisories ( openclaw , handlebars ). Check with npm audit (or: npm ls <package>) .
- Go: 2 critical advisories ( github.com/lxc/incus/v6 , github.com/lxc/incus ). Check with govulncheck ./... .
- crates.io (Rust): 1 critical advisory ( zebrad , zebra-chain ). Check with cargo audit .
- PyPI: 1 critical advisory ( pyload-ng ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-53521](https://erroneo.us/security/cve/CVE-2025-53521/index.md) F5 BIG-IP: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability (CISA due 2026-03-30)

## Critical advisories

- [CVE-2026-34202](https://erroneo.us/security/cve/CVE-2026-34202/index.md) Zebra node crash — V5 transaction hash panic (P2P reachable) — crates.io (Rust) zebrad < 4.3.0 → 4.3.0; crates.io (Rust) zebra-chain < 6.0.1 → 6.0.1
- [CVE-2026-33945](https://erroneo.us/security/cve/CVE-2026-33945/index.md) Incus has an abitrary file write through its systemd-creds options — Go github.com/lxc/incus/v6 < 6.23.0 → 6.23.0
- [CVE-2026-33992](https://erroneo.us/security/cve/CVE-2026-33992/index.md) pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration — PyPI pyload-ng <= 0.5.0b3.dev96 → no fix
- [GHSA-fqw4-mph7-2vr8](https://erroneo.us/security/ghsa/GHSA-fqw4-mph7-2vr8/index.md) OpenClaw: Silent privilege escalation via gateway shared-auth reconnect — npm openclaw <= 2026.3.24 → no fix
- [CVE-2026-35663](https://erroneo.us/security/cve/CVE-2026-35663/index.md) OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin — npm openclaw <= 2026.3.24 → no fix
- [CVE-2026-33897](https://erroneo.us/security/cve/CVE-2026-33897/index.md) Incus vulnerable to arbitrary file read and write through pongo templates — Go github.com/lxc/incus/v6 < 6.23.0 → 6.23.0; Go github.com/lxc/incus <= 0.7.0 → no fix
- [CVE-2026-33937](https://erroneo.us/security/cve/CVE-2026-33937/index.md) Handlebars.js has JavaScript Injection via AST Type Confusion — npm handlebars >= 4.0.0, <= 4.7.8 → 4.7.9

---
Source page: https://erroneo.us/security/2026-03-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt