Security Digest: March 11, 2026 - 11 Critical Vulnerabilities

Today's vulnerabilities range from direct remote code execution to unauthorized data access and denial of service.

· 6 min read

Today's Critical Security Threats

March 11, 2026, brings to light 11 critical vulnerabilities that require immediate attention. Urgent patches and mitigations are necessary to secure systems against potential exploitation.

Executive Summary

Today's vulnerabilities range from direct remote code execution to unauthorized data access and denial of service. Immediate patching and configuration adjustments are necessary to prevent potential breaches and service disruptions.

Critical Vulnerabilities

  • CVE-2026-30966: Parse Server Role Injection
    Impact: Attackers can manipulate role permissions.
    Affected Systems: Parse Server versions prior to 8.6.20 and 9.5.2-alpha.7.
    Immediate Action: Update to the latest Parse Server versions.
    Mitigation: No workarounds available.
  • CVE-2026-31975: Unauthenticated RCE via JWT in Claude Code UI
    Impact: Full remote code execution is possible.
    Affected Systems: Claude Code UI versions <= 1.24.0.
    Immediate Action: Enforce strong JWT secrets and update authentication logic.
    Mitigation: Replace default JWT secrets immediately.
  • CVE-2026-31862: OS Command Injection via Git API
    Impact: Remote code execution and data exfiltration.
    Affected Systems: Siteboon Claude Code UI.
    Immediate Action: Replace vulnerable execAsync calls with spawnAsync.
    Mitigation: Validate all input parameters strictly.
  • CVE-2026-31817: Directory Traversal in OliveTin
    Impact: Write files to arbitrary locations.
    Affected Systems: OliveTin systems with saveLogs enabled.
    Immediate Action: Sanitize UniqueTrackingId inputs.
    Mitigation: Validate input to prevent directory traversal.
  • CVE-2026-31824: TOCTOU Race Condition in Sylius
    Impact: Bypass promotion usage limits.
    Affected Systems: Sylius versions prior to specified patches.
    Immediate Action: Apply patches or use database-synchronized counters.
    Mitigation: Use atomic operations for usage counts.
  • CVE-2026-31801: Incorrect Authorization in zotregistry
    Impact: Unauthorized overwriting of tags.
    Affected Systems: Zotregistry deployments using latest tag.
    Immediate Action: Adjust authorization logic for latest tag.
    Mitigation: Remove special-case exemptions for latest.
  • CVE-2026-30951: SQL Injection in Sequelize
    Impact: Data exfiltration via JSON queries.
    Affected Systems: Sequelize versions 6.x.
    Immediate Action: Apply input validation or update to a secure version.
    Mitigation: Restrict JSON key manipulations.
  • CVE-2026-31830: Sigstore Verification Bypass
    Impact: Misleading verification success.
    Affected Systems: Sigstore RubyGem users.
    Immediate Action: Patch library to handle verification failures.
    Mitigation: Ensure all checks return correct status.
  • CVE-2026-31866: DoS via Flagd Evaluation Endpoint
    Impact: Service disruption through memory exhaustion.
    Affected Systems: Open-feature flagd.
    Immediate Action: Implement request size limits.
    Mitigation: Deploy behind authenticated proxies.
  • CVE-2026-30945: API Token Revocation IDOR in StudioCMS
    Impact: Unauthorized token deletions.
    Affected Systems: StudioCMS up to version 0.3.0.
    Immediate Action: Enforce ownership checks for token actions.
    Mitigation: Implement role-based access control.
  • CVE-2026-31829: SSRF in Flowise HTTP Node
    Impact: Access to internal networks via SSRF.
    Affected Systems: Flowise deployments.
    Immediate Action: Restrict HTTP node access to specific domains.
    Mitigation: Enable IP and host filtering.

What to Do Now

  1. Patch all affected systems immediately.
  2. Verify configurations to ensure default settings are secure.
  3. Monitor network traffic for unusual activities or attempted exploits.

Related Resources

Keep reading