Security Digest: March 1, 2026 - 5 Critical Vulnerabilities

Today, five critical vulnerabilities have been identified affecting widespread software components, including Gradio and Statamic CMS. Immediate patching and mitigation are essential to prevent exploitation, data exfiltration, and unauthorized access.

· 4 min read

Urgent Security Alert: March 1, 2026

Executive Summary

Today, five critical vulnerabilities have been identified affecting widespread software components, including Gradio and Statamic CMS. Immediate patching and mitigation are essential to prevent exploitation, data exfiltration, and unauthorized access.

Critical Vulnerabilities

  • CVE-2026-28426: Stored XSS in Statamic CMS
    • Impact: Authenticated users can inject malicious JavaScript affecting higher-privileged users.
    • Affected Systems: Statamic CMS 5.73.10 and below, 6.3.x and below.
    • Immediate Action: Upgrade to Statamic CMS 5.73.11 or 6.4.0.
    • Mitigation: Ensure only trusted users have access to the CMS.
  • CVE-2026-28416: SSRF in Gradio
    • Impact: Allows attackers to access internal networks and cloud metadata.
    • Affected Systems: Gradio applications using gr.load().
    • Immediate Action: Avoid loading untrusted Gradio Spaces.
    • Mitigation: Monitor network traffic for suspicious proxy requests.
  • CVE-2026-28406: Path Traversal in Kaniko
    • Impact: Potential code execution via unsafe tar extraction.
    • Affected Systems: Kaniko versions 1.25.4 to 1.25.9.
    • Immediate Action: Update to the latest Kaniko version with securejoin implemented.
    • Mitigation: Restrict build context contents to trusted sources.
  • CVE-2026-28425: RCE via Antlers in Statamic
    • Impact: Remote code execution through Antlers-enabled inputs.
    • Affected Systems: Statamic CMS with Antlers-enabled configurations.
    • Immediate Action: Upgrade to Statamic CMS 5.73.11 or 6.4.0.
    • Mitigation: Restrict Antlers usage to essential configurations only.
  • CVE-2026-28414: Path Traversal in Gradio on Windows
    • Impact: Unauthorized file access on Windows systems.
    • Affected Systems: Gradio on Windows with Python 3.13+.
    • Immediate Action: Apply patches as they become available. For now, monitor access logs for unusual file access patterns.
    • Mitigation: Implement strict access controls and monitor for unauthorized access attempts.

What to Do Now

  1. Immediately update affected systems to the patched versions where available.
  2. Review and tighten permissions on all affected applications.
  3. Set up monitoring to detect exploitation attempts and unusual network activity.

Related Resources

  • Visit the official Statamic and Gradio advisories for detailed patch information.
  • Refer to internal security blogs for further analysis and recommendations.

Keep reading