Security Digest: March 27, 2026 - 19 Critical Vulnerabilities

Today's security landscape presents 19 critical vulnerabilities affecting widely used software, including Incus, Handlebars, and Docker. Immediate patching and mitigation are crucial to prevent exploitation.

· 3 min read

Today's Most Urgent Cybersecurity Threats

Executive Summary

Today's security landscape presents 19 critical vulnerabilities affecting widely used software, including Incus, Handlebars, and Docker. Immediate patching and mitigation are crucial to prevent exploitation. Ensure systems are updated and security configurations are reviewed.

Critical Vulnerabilities

  • CVE-2026-33945: Incus Privilege Escalation
    • Impact: Local privilege escalation via file overwrite.
    • Affected Systems: go github.com/lxc/incus/v6
    • Immediate Action: Restrict access to configuration options, apply patches.
    • Mitigation: Update Incus to the latest secure version.
  • CVE-2026-33937: Handlebars Remote Code Execution
    • Impact: Remote code execution through crafted ASTs.
    • Affected Systems: npm handlebars
    • Immediate Action: Validate inputs before using Handlebars.compile().
    • Mitigation: Use runtime-only builds if possible.
  • CVE-2026-34040: Docker AuthZ Bypass
    • Impact: Unauthorized access through AuthZ plugin bypass.
    • Affected Systems: go github.com/moby/moby
    • Immediate Action: Restrict Docker API access to trusted users only.
    • Mitigation: Update to patched Docker versions.
  • CVE-2026-27893: Remote Code Execution in vllm
    • Impact: Execute arbitrary Python code with malicious models.
    • Affected Systems: pip vllm
    • Immediate Action: Replace hardcoded values in the codebase.
    • Mitigation: Implement patches from the latest release.
  • CVE-2026-33980: adx-mcp-server KQL Injection
    • Impact: Arbitrary KQL execution against Azure clusters.
    • Affected Systems: pip adx-mcp-server
    • Immediate Action: Sanitize inputs to KQL queries.
    • Mitigation: Apply updates to sanitize query parameters.

Previously Alerted

What to Do Now

  1. Update affected systems immediately with the latest patches.
  2. Verify all configurations to ensure they reflect security best practices.
  3. Monitor network traffic for unusual activity, especially around Docker and Node.js related deployments.

Related Resources

Keep reading