Security Digest archive
March 2026
3 editorial briefs, 26 known exploited (cisa kev) additions and 168 critical advisories across 24 digest days.
Tuesday, March 31, 2026
- Check exposure axios 1.14.1 and 0.30.4: npm Hijack Drops North Korean RAT
- Critical 14 advisories: fastmcp, parse-server, ci4-cms-erp/ci4ms, github.com/siyuan-note/siyuan/kernel, mlflow, ci4-cms-erp/ci4ms, scitokens, baserproject/basercms, baserproject/basercms, openclaw, openssl-encrypt, openclaw …
Monday, March 30, 2026
- KEV CVE-2026-3055 Citrix NetScaler
- Critical 7 advisories: ca.uhn.hapi.fhir:org.hl7.fhir.validation, mlflow, @nocobase/plugin-workflow-javascript, github.com/0xJacky/Nginx-UI, github.com/0xJacky/Nginx-UI, telnyx, ci4-cms-erp/ci4ms
Sunday, March 29, 2026
- Critical 5 advisories: mlflow, njzjz/wenxian, @mikro-orm/core, mpp, mppx
Friday, March 27, 2026
- KEV CVE-2025-53521 F5 BIG-IP
- Critical 7 advisories: zebrad, github.com/lxc/incus/v6, pyload-ng, openclaw, openclaw, github.com/lxc/incus/v6, handlebars
Thursday, March 26, 2026
- KEV CVE-2026-33634 Aquasecurity Trivy
- Critical 12 advisories: langflow, n8n, openclaw, convict, com.splunk:splunk-otel-javaagent, org.springframework.ai:spring-ai-vector…, github.com/openbao/openbao, github.com/openbao/openbao, com.datadoghq:dd-java-agent, convict, wwbn/avideo, code.vikunja.io/api
Wednesday, March 25, 2026
- KEV CVE-2026-33017 Langflow Langflow
- Critical 10 advisories: io.opentelemetry.javaagent:opentelemetr…, github.com/siyuan-note/siyuan/kernel, pdf-image, thumbler, textract, wwbn/avideo, node-tesseract-ocr, litellm, n8n, github.com/siyuan-note/siyuan/kernel
Tuesday, March 24, 2026
- Critical 2 advisories: github.com/aquasecurity/trivy, scriban
Monday, March 23, 2026
- Critical 2 advisories: mantisbt/mantisbt, github.com/goharbor/harbor
Sunday, March 22, 2026
- Critical 1 advisory: jsrsasign
Friday, March 20, 2026
- KEV CVE-2025-54068 Laravel Livewire
- KEV CVE-2025-43520 Apple Multiple Products
- KEV CVE-2025-43510 Apple Multiple Products
- KEV CVE-2025-32432 Craft CMS Craft CMS
- KEV CVE-2025-31277 Apple Multiple Products
- Critical 6 advisories: github.com/ory/oathkeeper, github.com/minio/minio, SHAdd0WTAka/Zen-Ai-Pentest, wwbn/avideo, graphiti, wwbn/avideo
Thursday, March 19, 2026
- Check exposure Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets
- KEV CVE-2026-20131 Cisco Secure Firewall Management Center (FMC)
- Critical 8 advisories: mcp-bridge, github.com/smallstep/certificates, org.springframework.security:spring-sec…, wwbn/avideo, github.com/autobrr/qui, langflow, wwbn/avideo, github.com/minio/minio
Wednesday, March 18, 2026
- KEV CVE-2026-20963 Microsoft SharePoint
- KEV CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS)
- Critical 6 advisories: ca.uhn.hapi.fhir:org.hl7.fhir.utilities, google.golang.org/grpc, @apostrophecms/import-export, github.com/tektoncd/pipeline, mesop, mesop
Tuesday, March 17, 2026
- Critical 4 advisories: jspdf, langflow, github.com/siyuan-note/siyuan/kernel, github.com/siyuan-note/siyuan
Monday, March 16, 2026
- KEV CVE-2025-47813 Wing FTP Server Wing FTP Server
- Critical 6 advisories: authlib, admidio/admidio, Glances, github.com/siyuan-note/siyuan/kernel, io.spinnaker.clouddriver:clouddriver-ar…, github.com/filebrowser/filebrowser/v2
Friday, March 13, 2026
- KEV CVE-2026-3910 Google Chromium V8
- KEV CVE-2026-3909 Google Skia
- Critical 10 advisories: openclaw, locutus, openclaw, @apollo/federation-internals, oneuptime, github.com/dagu-org/dagu, github.com/centrifugal/centrifugo/v6, @nyariv/sandboxjs, github.com/emmansun/gmsm, openclaw
Thursday, March 12, 2026
- Critical 7 advisories: sglang, winter/wn-backend-module, sglang, @tinacms/cli, parse-server, github.com/AdguardTeam/AdGuardHome, parse-server
Wednesday, March 11, 2026
- KEV CVE-2025-68613 n8n n8n
- Critical 2 advisories: xygeni/xygeni-action, github.com/cosmos/evm
Tuesday, March 10, 2026
Monday, March 9, 2026
- KEV CVE-2026-1603 Ivanti Endpoint Manager (EPM)
- KEV CVE-2025-26399 SolarWinds Web Help Desk
- KEV CVE-2021-22054 Omnissa Workspace One UEM
- Critical 7 advisories: github.com/shi-gg/linkdave, parse-server, @oneuptime/common, @oneuptime/common, rssn, org.apache.iotdb:iotdb-core, org.apache.iotdb:iotdb-core
Friday, March 6, 2026
Thursday, March 5, 2026
- KEV CVE-2023-43000 Apple Multiple Products
- KEV CVE-2023-41974 Apple iOS and iPadOS
- KEV CVE-2021-30952 Apple Multiple Products
- KEV CVE-2021-22681 Rockwell Multiple Products
- KEV CVE-2017-7921 Hikvision Multiple Products
- Critical 5 advisories: pingora-core, time-sync, pingora-core, github.com/0xJacky/Nginx-UI, gogs.io/gogs
Wednesday, March 4, 2026
- Act now Cisco FMC CVE-2026-20079: Exploited Pre-Auth Root Bypass
- Critical 9 advisories: dnp3times, time_calibrators, github.com/zitadel/zitadel, org.pac4j:pac4j-jwt, org.apache.activemq:artemis-server, github.com/filebrowser/filebrowser/v2, time_calibrator, github.com/siyuan-note/siyuan/kernel, zeptoclaw
Tuesday, March 3, 2026
- KEV CVE-2026-22719 Broadcom VMware Aria Operations
- KEV CVE-2026-21385 Qualcomm Multiple Chipsets
- Critical 11 advisories: picklescan, craftcms/cms, github.com/rancher/rancher, picklescan, org.apache.ranger:ranger-plugins-common, wwbn/avideo, github.com/rancher/rancher, picklescan, github.com/rancher/rancher, froxlor/froxlor, devcode-it/openstamanager
Monday, March 2, 2026
- Critical 9 advisories: wwbn/avideo, wwbn/avideo, @builder.io/qwik, @orpc/client, openclaw, openclaw, idno/known, openclaw, tracing-check