Security Digest: March 5, 2026 - 11 Critical Vulnerabilities

Today, 11 critical vulnerabilities have been identified across various platforms, with severe impacts ranging from supply-chain attacks to unauthorized session manipulation.

· 6 min read

Today's Critical Security Threats Demand Immediate Attention

Executive Summary

Today, 11 critical vulnerabilities have been identified across various platforms, with severe impacts ranging from supply-chain attacks to unauthorized session manipulation. Immediate patching and mitigation strategies are essential to protect your systems and data.

Critical Vulnerabilities

  • CVE-2026-25921: Gogs LFS Object Manipulation
    • Impact: Enables supply-chain attacks through malicious LFS object overwriting.
    • Affected Systems: Gogs version 0.13.0
    • Immediate Action: Implement SHA-256 verification for uploaded LFS objects.
    • Mitigation: Follow the provided fix example to secure LFS storage paths.
  • CVE-2026-28683: Gokapi SVG Hotlink XSS
    • Impact: Allows stored XSS via malicious SVG uploads.
    • Affected Systems: Gokapi
    • Immediate Action: Restrict or sanitize SVG uploads.
    • Mitigation: Update security policies to handle SVG content safely.
  • CVE-2026-26022: Gogs Data URI XSS
    • Impact: Permits stored XSS attacks via data URIs in comments.
    • Affected Systems: Gogs
    • Immediate Action: Disallow 'data:' URI schemes in HTML sanitizer.
    • Mitigation: Modify HTML sanitizer configurations immediately.
  • CVE-2026-30242: Plane Webhook SSRF
    • Impact: Enables SSRF attacks by bypassing URL validation.
    • Affected Systems: Plane
    • Immediate Action: Update webhook URL validation logic.
    • Mitigation: Block internal network access through webhooks.
  • CVE-2026-29093: AVideo Memcached Exposure
    • Impact: Allows session hijacking and data exposure.
    • Affected Systems: AVideo using Docker
    • Immediate Action: Remove memcached port mapping from Docker configuration.
    • Mitigation: Ensure memcached is only accessible internally.
  • CVE-2026-29186: TechDocs Node Code Execution
    • Impact: Enables arbitrary code execution via MkDocs.
    • Affected Systems: @backstage/plugin-techdocs-node
    • Immediate Action: Upgrade to version 1.14.3 or apply workarounds.
    • Mitigation: Implement Docker isolation and restrict access to MkDocs files.
  • CVE-2026-1605: Jetty GzipHandler Memory Leak
    • Impact: Causes potential DoS through memory exhaustion.
    • Affected Systems: Jetty 12.0.30
    • Immediate Action: Disable GzipHandler temporarily.
    • Mitigation: Monitor for patches and apply once available.
  • CVE-2026-30247: WeKnora SSRF through Redirects
    • Impact: Bypasses URL validation to attack internal services.
    • Affected Systems: WeKnora
    • Immediate Action: Implement strict redirect target validation.
    • Mitigation: Block Docker-specific internal addresses.
  • CVE-2026-30244: Plane Workspace Enumeration
    • Impact: Allows unauthorized disclosure of sensitive user information.
    • Affected Systems: Plane
    • Immediate Action: Apply permission fixes from v1.2.3 release.
    • Mitigation: Verify access controls on public endpoints.
  • CVE-2026-26276: Gogs Milestone XSS
    • Impact: Enables DOM-based XSS through milestone names.
    • Affected Systems: Gogs
    • Immediate Action: Apply the fix available in version 0.14.2.
    • Mitigation: Sanitize user input in milestone names.
  • CVE-2026-29778: Pyload-ng Directory Traversal
    • Impact: Permits unauthorized file writes outside of designated directories.
    • Affected Systems: Pyload-ng
    • Immediate Action: Strengthen path traversal protections.
    • Mitigation: Implement multi-pass sanitization checks.

Previously Alerted

What to Do Now

  1. Prioritize patching critical vulnerabilities on affected systems immediately.
  2. Verify the implementation of mitigations and workarounds.
  3. Establish continuous monitoring for suspicious activities and updates.

Related Resources

  • Vendor advisories and patches for detailed remediation.

Keep reading