Security Digest: March 13, 2026 - 15 Critical Vulnerabilities
Today's security landscape reveals 15 critical vulnerabilities affecting widespread systems such as npm, Go, and pip libraries. Immediate patching is required to prevent potential exploits that include remote code execution, data breaches, and denial of service attacks.
· 3 min read
Executive Summary
Today's security landscape reveals 15 critical vulnerabilities affecting widespread systems such as npm, Go, and pip libraries. Immediate patching is required to prevent potential exploits that include remote code execution, data breaches, and denial of service attacks.
Critical Vulnerabilities
- CVE-2026-32306: SQL Injection in npm oneuptime
Impact: Unauthorized SQL commands execution.
Affected Systems: npm oneuptime.
Immediate Action: Apply allowlists and validate inputs.
Mitigation: Use parameterized queries. - CVE-2026-32304: RCE in npm locutus
Impact: Full remote code execution.
Affected Systems: npm locutus v3.0.11.
Immediate Action: Upgrade to locutus@3.0.14.
Mitigation: Remove unsafe functions. - CVE-2026-32301: SSRF in go Centrifugo
Impact: Unauthorized internal network access.
Affected Systems: github.com/centrifugal/centrifugo/v6.
Immediate Action: Verify JWT signatures before claim extraction.
Mitigation: Restrict template variables usage. - CVE-2026-31886: Path Traversal in go dagu
Impact: Directory deletion or data corruption.
Affected Systems: github.com/dagu-org/dagu.
Immediate Action: Validate input paths.
Mitigation: Enforce path restrictions. - CVE-2026-32313: GCM Tag Validation in composer xmlseclibs
Impact: Encrypted XML data decryption.
Affected Systems: robrichards/xmlseclibs.
Immediate Action: Validate tag lengths.
Mitigation: Enforce tag length checks.
Previously Alerted
What to Do Now
- Review and apply patches for affected systems.
- Verify input validation mechanisms in place.
- Monitor network traffic for suspicious activity.