Security Digest: March 12, 2026 - 15 Critical Vulnerabilities

Today's security overview reveals 15 critical vulnerabilities affecting various systems. Immediate action is required to patch these vulnerabilities.

· 3 min read

Daily Vulnerability Alert - March 12, 2026

Executive Summary

Today's security overview reveals 15 critical vulnerabilities affecting various systems, including HTTP/2 authentication bypass and path traversal issues in widely used tools. Immediate action is required to patch these vulnerabilities to prevent unauthorized access and data breaches.

Critical Vulnerabilities

  • CVE-2026-32136: HTTP/2 Cleartext Authentication Bypass
    • Impact: Unauthenticated API access, DNS hijacking
    • Affected Systems: AdGuardHome v0.107.72
    • Immediate Action: Move authentication middleware inside h2c handler
    • Mitigation: Remove h2c support if not needed
  • CVE-2026-28792: TinaCMS CLI Path Traversal
    • Impact: File system enumeration, arbitrary file write/delete
    • Affected Systems: tinaCMS CLI dev server
    • Immediate Action: Restrict CORS and sanitize paths
    • Mitigation: Implement path validation, restrict server exposure
  • CVE-2026-32246: OIDC TOTP Bypass
    • Impact: Bypass of two-factor authentication
    • Affected Systems: tinyauth with OIDC clients
    • Immediate Action: Update authorization checks to include TOTP status
    • Mitigation: Ensure TOTP verification is mandatory
  • CVE-2026-28793: TinaCMS CLI Path Traversal
    • Impact: Arbitrary file read/write
    • Affected Systems: tinaCMS CLI dev server
    • Immediate Action: Implement file path validation
    • Mitigation: Enforce directory constraints
  • CVE-2026-32110: SSRF in Network Proxy
    • Impact: Internal network scanning, cloud metadata access
    • Affected Systems: Siyuan kernel API
    • Immediate Action: Restrict forwarding to trusted destinations
    • Mitigation: Validate destination URLs

Previously Alerted

What to Do Now

  1. Apply patches for all affected software versions immediately.
  2. Restrict access to vulnerable endpoints and limit exposure.
  3. Monitor network traffic for suspicious activity related to these CVEs.
  4. Verify that all middleware and authentication checks are correctly implemented.

Related Resources

  • Official vendor advisories for each CVE (links pending)
  • Internal blog post on secure middleware design (coming soon)

Keep reading