Security Digest: March 20, 2026 - 28 Critical Vulnerabilities

Today, 28 critical vulnerabilities have been identified, posing significant risks including remote code execution, SQL injection, and unauthorized data access. Immediate patching and mitigation strategies are essential.

2026-03-20 · 3 min read

Today's Critical Threats: Immediate Actions Required

Executive Summary

Critical Vulnerabilities

CVE-2026-33478: AVideo CloneSite Plugin Remote Code Execution
- Impact: Full server compromise via unauthenticated access.
- Affected Systems: AVideo installations using CloneSite plugin.
- Immediate Action: Disable the CloneSite plugin and implement authentication on exposed endpoints.
- Mitigation: Apply patches to enforce proper authentication and command sanitization.
CVE-2026-33286: Graphiti JSONAPI Arbitrary Method Execution
- Impact: Unauthorized execution of destructive operations.
- Affected Systems: Graphiti v1.10.1 and earlier.
- Immediate Action: Restrict write access and apply strong authentication.
- Mitigation: Upgrade to Graphiti v1.10.2 immediately.
CVE-2026-33502: AVideo Live Plugin SSRF Vulnerability
- Impact: Unauthorized internal network probing.
- Affected Systems: AVideo installations with Live plugin.
- Immediate Action: Restrict endpoint access to trusted IPs and require admin authentication.
- Mitigation: Remove or restrict access to the test.php endpoint.
CVE-2026-33507: AVideo Plugin Import CSRF to RCE
- Impact: Remote code execution via CSRF attack.
- Affected Systems: AVideo installations with plugin import functionality.
- Immediate Action: Implement CSRF protection on import endpoints.
- Mitigation: Require CSRF tokens and sanitize all input parameters.

Previously Alerted

CVE-2026-33494: Security Alert

What to Do Now

Immediately apply available patches for all affected systems.
Verify systems are not exposed to known risks by checking configurations and access controls.
Monitor systems for unusual activity and potential breaches.