---
title: "Security digest: March 30, 2026"
url: https://erroneo.us/security/2026-03-30/
description: "March 30, 2026 vulnerability digest: 1 CISA KEV addition (Citrix); 7 critical advisories (Maven, PyPI, npm, Go…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-30
date_modified: 2026-03-30
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 30, 2026

1 known exploited (cisa kev) addition and 7 critical advisories.

## Take stock

- Do you run any of these? Citrix NetScaler. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-02.
- PyPI: 2 critical advisories ( mlflow , telnyx ). Check with pip-audit (or: pip show <package>) .
- Go: 2 critical advisories ( github.com/0xJacky/Nginx-UI ). Check with govulncheck ./... .
- Maven: 1 critical advisory ( ca.uhn.hapi.fhir:org.hl7.fhir.validation ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 1 critical advisory ( @nocobase/plugin-workflow-javascript ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( ci4-cms-erp/ci4ms ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-3055](https://erroneo.us/security/cve/CVE-2026-3055/index.md) Citrix NetScaler: Citrix NetScaler Out-of-Bounds Read Vulnerability (CISA due 2026-04-02)

## Critical advisories

- [CVE-2026-34361](https://erroneo.us/security/cve/CVE-2026-34361/index.md) FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft — Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.9.4 → 6.9.4
- [CVE-2025-15379](https://erroneo.us/security/cve/CVE-2025-15379/index.md) MLflow Command Injection vulnerability — PyPI mlflow < 3.8.1 → 3.8.1
- [CVE-2026-34156](https://erroneo.us/security/cve/CVE-2026-34156/index.md) NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node — npm @nocobase/plugin-workflow-javascript <= 2.0.27 → 2.0.28
- [CVE-2026-33032](https://erroneo.us/security/cve/CVE-2026-33032/index.md) nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover — Go github.com/0xJacky/Nginx-UI <= 1.99 → no fix
- [CVE-2026-33026](https://erroneo.us/security/cve/CVE-2026-33026/index.md) nginx-ui Backup Restore Allows Tampering with Encrypted Backups — Go github.com/0xJacky/Nginx-UI < 1.9.10-0.20260315015203-f61bcec547c0 → 1.9.10-0.20260315015203-f61bcec547c0
- [GHSA-955r-262c-33jc](https://erroneo.us/security/ghsa/GHSA-955r-262c-33jc/index.md) Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2 — PyPI telnyx >= 4.87.1, <= 4.87.2 → no fix
- [CVE-2026-27599](https://erroneo.us/security/cve/CVE-2026-27599/index.md) ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — Composer (PHP) ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0

---
Source page: https://erroneo.us/security/2026-03-30/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt