Security Digest: March 17, 2026 - 12 Critical Vulnerabilities

Today's security landscape reveals 12 critical vulnerabilities demanding immediate attention. The most severe, CVE-2026-31938, allows injection of arbitrary HTML into browser contexts through jspdf, while CVE-2026-33039 exposes internal services via SSRF in AVideo.

· 4 min read

Today's Critical Security Threats

Executive Summary

Today's security landscape reveals 12 critical vulnerabilities demanding immediate attention. The most severe, CVE-2026-31938, allows injection of arbitrary HTML into browser contexts through jspdf, while CVE-2026-33039 exposes internal services via SSRF in AVideo. Immediate patching and input validation are essential.

Critical Vulnerabilities

  • CVE-2026-31938: Arbitrary HTML Injection in jspdf
    • Impact: Allows script injection in browser contexts.
    • Affected Systems: npm jspdf versions before 4.2.1
    • Immediate Action: Upgrade to jspdf@4.2.1.
    • Mitigation: Sanitize user input before processing.
  • CVE-2026-33039: SSRF via Redirect in AVideo
    • Impact: Access internal services through redirects.
    • Affected Systems: composer wwbn/avideo
    • Immediate Action: Apply SSRF validation to redirect targets.
    • Mitigation: Disable redirects or re-validate post-redirect URLs.
  • CVE-2026-33043: Cross-Origin Session Theft in AVideo
    • Impact: Allows session hijacking via CORS.
    • Affected Systems: composer wwbn/avideo
    • Immediate Action: Restrict CORS to trusted origins only.
    • Mitigation: Update CORS policies to disallow credentialed requests from untrusted origins.
  • CVE-2026-31898: PDF Object Injection via jsPDF
    • Impact: Inject arbitrary PDF objects with potential JavaScript actions.
    • Affected Systems: npm jspdf versions before 4.2.1
    • Immediate Action: Upgrade to jspdf@4.2.1.
    • Mitigation: Sanitize inputs for PDF generation functions.
  • CVE-2026-31891: SQL Injection in Cockpit CMS
    • Impact: Extract unauthorized data via SQL injection.
    • Affected Systems: Cockpit CMS 2.13.4 and earlier
    • Immediate Action: Upgrade to version 2.13.5.
    • Mitigation: Ensure field name sanitization in queries.
  • CVE-2026-32256: Infinite Loop in music-metadata
    • Impact: Causes application hang via crafted ASF files.
    • Affected Systems: npm music-metadata
    • Immediate Action: Apply available patches or input validation.
  • CVE-2026-33012: DoS in Micronaut HTTP Server
    • Impact: Unbounded heap growth leading to DoS.
    • Affected Systems: io.micronaut:micronaut-http-server 4.7.0 to 4.10.7
    • Immediate Action: Upgrade to the latest patch version.

What to Do Now

  1. Immediately update all affected packages to the latest patched versions.
  2. Sanitize all user inputs across applications to prevent injection attacks.
  3. Restrict CORS policies to trusted origins only and re-evaluate SSRF protections.
  4. Monitor systems for unusual activity and apply security patches promptly.

Related Resources

  • Official vendor advisories for security patches.
  • Internal blog posts on secure coding practices (forthcoming).

Keep reading