Digest · Sunday
Security digest: March 29, 2026
5 critical advisories.
All digests · RSS · Markdown
Take stock
- npm: 2 critical advisories (
@mikro-orm/core,mppx). Check withnpm audit (or: npm ls <package>). - PyPI: 1 critical advisory (
mlflow). Check withpip-audit (or: pip show <package>). - GitHub Actions: 1 critical advisory (
njzjz/wenxian). Check withgrep -rn 'uses: <owner>/<action>' .github/workflows. - crates.io (Rust): 1 critical advisory (
mpp). Check withcargo audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 5
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 2
Check: npm audit (or: npm ls <package>)
- MikroORM is vulnerable to SQL Injection via specially crafted object CVE-2026-34220 CVSS 9.3 Critical
@mikro-orm/core< 6.6.10 → fixed in 6.6.10;@mikro-orm/core>= 7.0.0-dev.0, < 7.0.6 → fixed in 7.0.6 - mppx has multiple payment bypass and griefing vulnerabilities GHSA-8x4m-qw58-3pcx CVSS 9.3 Critical
mppx< 0.4.8 → fixed in 0.4.8
GitHub Actions 1
Check: grep -rn 'uses: <owner>/<action>' .github/workflows
- wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body` CVE-2026-34243 CVSS 9.8 Critical
njzjz/wenxian<= 0.3.1 → no fix listed
PyPI 1
Check: pip-audit (or: pip show <package>)
- MLFlow path traversal vulnerability CVE-2025-15036 CVSS 9.6 Critical
mlflow< 3.9.0rc0 → fixed in 3.9.0rc0
crates.io (Rust) 1
Check: cargo audit
- mpp has multiple payment bypass and griefing vulnerabilities GHSA-fxc9-7j2w-vx54 CVSS 9.3 Critical
mpp< 0.8.0 → fixed in 0.8.0