CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- openclaw OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper 7.0 High
- openclaw OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization 8.5 High
- openclaw OpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use Ranges 5.1 Medium
- openclaw OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions 5.3 Medium
- openclaw OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard 7.1 High
- openclaw OpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter 5.3 Medium
- openclaw OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist 5.8 Medium
- openclaw OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass 7.1 High
- openclaw OpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades 8.7 High
- openclaw OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter 6.0 Medium
- openclaw OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands 8.7 High
- openclaw OpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding 7.4 High
- openclaw OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3 8.2 High
- miguelgrinberg flask-httpauth Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client 6.5 Medium
- filebrowser File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection 6.9 Medium
- code-projects bloodbank managing system code-projects BloodBank Managing System admin_state.php cross site scripting 5.3 Medium
- itsourcecode payroll management system itsourcecode Payroll Management System Parameter view_employee.php sql injection 6.9 Medium
- filebrowser File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution 8.1 High
- filebrowser File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file 7.6 High
- jahlives openssl encrypt openssl_encrypt before 1.4.0 Schema Validation Bypass 9.3 Critical
- jahlives openssl encrypt openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection 8.7 High
- jahlives openssl encrypt openssl_encrypt before 1.4.0 Password Exposure via CLI Argument 8.7 High
- jahlives openssl encrypt openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass 9.3 Critical
- jahlives openssl encrypt openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool 9.3 Critical
-
nuxt-og-imagenpm Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters 5.3 Medium - ameliabooking booking for appointments and events calendar – amelia Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter 6.5 Medium
-
j0k3r/grabyPackagist Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config 2.1 Low - itsourcecode payroll management system itsourcecode Payroll Management System Parameter manage_user.php sql injection 6.9 Medium
- axiomatic bento4 Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow 4.8 Medium
- jlowin fastmcp, red hat openshift ai (rhoai), satellite 6.18 +2 more FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability 10.0 Critical
- phpmyfaq phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor 5.4 Medium
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 more ONNX: Path Traversal via Symlink 8.7 High
- jlowin fastmcp FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities 8.2 High
- cloudreve Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) 8.1 High
- gn themes wp shortcodes plugin — shortcodes ultimate WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute 6.4 Medium
- jlowin fastmcp FastMCP has a Command Injection vulnerability - Gemini CLI 6.7 Medium
- color iccdev iccDEV: HBO in icAnsiToUtf8() 6.2 Medium
- color iccdev iccDEV: SBO in CIccTagFixedNum::GetValues() 6.2 Medium
- color iccdev iccDEV: HBO in CIccApplyCmmSearch::costFunc() 6.2 Medium
- color iccdev iccDEV: DoS in CIccCLUT::Iterate() & CIccMBB::Describe() 4.0 Medium
- color iccdev iccDEV: UB at IccTagLut.cpp 6.2 Medium
- axiomatic bento4 Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow 4.8 Medium
- color iccdev iccDEV: NPD in CIccTagLut16::Write() 6.2 Medium
- color iccdev iccDEV: UB at IccIO.cpp 6.2 Medium
- color iccdev iccDEV: UB at IccUtil.cpp 6.2 Medium
- color iccdev iccDEV: UB at IccUtilXml.cpp 6.2 Medium
- color iccdev iccDEV: UB at IccUtil.cpp 6.2 Medium
- color iccdev iccDEV: UB at TiffImg.h 6.2 Medium
- color iccdev iccDEV: SBO in CIccCalculatorFunc::Apply() 6.2 Medium
- color iccdev iccDEV: UB in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions() 6.2 Medium
- Show olderLoading…