CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- canonical lxdAuthenticated RCE via unsanitized compression_algorithm9.4 Critical
- @backstage plugin-scaffolder-backend, linuxfoundation backstage\/plugin-scaffolder-backend +1 more@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint4.4 Medium
- @backstage plugin-auth-backend, linuxfoundation backstage +1 more@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch1.7 Low
- @backstage plugin-auth-backend, linuxfoundation backstage +1 more@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass5.9 Medium
kora-libcrates.iokora-lib: Token-2022 Transfer Fee Not Deducted During Payment VerificationNo scorekora-libcrates.iokora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy6.9 Mediumgithub.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 moreTraefik: HTTP/2 frames can cause a running server to panic7.7 High- uptime.kuma uptime kuma, louislam uptime-kuma +1 moreUptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page5.3 Medium
- openclawOpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway6.3 Medium
- openclawOpenClaw < 2026.2.26 - Sender Authorization Bypass in Slack System Event Handlers5.3 Medium
openclawnpmOpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary7.0 High- openclawOpenClaw < 2026.2.26 - Workspace Path Boundary Bypass via Non-existent Symlink7.2 High
openclawnpmOpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries7.1 High- openclawOpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration2.3 Low
- openclawOpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download5.8 Medium
- openclawOpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run5.3 Medium
github.com/OliveTin/OliveTinGoOliveTin's email argument makes compliance harder, enables log injection6.9 Medium- unjs unheadUnhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity0.0 None
- unjs unheadUnhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check5.3 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: authentication bypass via digest authentication replay attack5.8 Medium
- streamsoft prestiżWeak KSeF token encoding in Streamsoft Prestiż6.3 Medium
- progress software flowmon ads, progress flowmon anomaly detection system +1 morePossibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application8.6 High
- progress software flowmon ads, progress flowmon anomaly detection system +1 morePossibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web application8.6 High
- specialk simple ajax chat – add a fast, secure chat boxSimple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'6.1 Medium
- lmsys sglangCVE-2026-39897.8 High
- lmsys sglangCVE-2026-30609.8 Critical
- lmsys sglangCVE-2026-30599.8 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via authorization bypass in admin api3.1 Low
- red hat enterprise linux 10, enterprise linux 9, jboss core services +2 moreMod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection4.3 Medium
gpacDebianGPAC SVG Parser load_svg.c svgin_process out-of-bounds write4.8 MediumgpacDebianGPAC TeXML File load_text.c txtin_process_texml stack-based overflow4.8 Medium- itsourcecode cafe reservation systemitsourcecode Cafe Reservation System Registration signup.php sql injection6.9 Medium
- sourcecodester web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add_admin.php improper authorization5.3 Medium
- rxi ferxi fe fe.c read_ out-of-bounds4.8 Medium
- thakeenathees pocketlangThakeeNathees pocketlang pkByteBufferAddString memory corruption4.8 Medium
- jarikomppa soloudjarikomppa soloud WAV File dr_wav.h drwav_read_pcm_frames_s16__msadpcm out-of-bounds4.8 Medium
- tenda w3, w3 firmware +1 moreTenda W3 POST Parameter wifiSSIDset stack-based overflow8.7 High
- tenda w3, w3 firmware +1 moreTenda W3 POST Parameter wifiSSIDget stack-based overflow8.7 High
- rui314 moldrui314 mold Object File input-files.cc initialize_sections heap-based overflow4.8 Medium
- itsourcecode payroll management systemitsourcecode Payroll Management System manage_employee_deductions.php cross site scripting5.3 Medium
- unknown reading progressbarReading progressbar < 1.3.1 - Admin+ Stored XSS4.3 Medium
- arraytics timeticsTimetics < 1.0.52 - Unauthenticated Payment/Booking Status Update4.3 Medium
- codegenieapp serverless-expressCodeGenieApp serverless-express Users Endpoint dynamodb.ts injection5.3 Medium
- cesiumgs cesiumjsCesiumGS CesiumJS standalone.html cross site scripting5.3 Medium
- campcodes division regional athletic meet game result matrix systemCampcodes Division Regional Athletic Meet Game Result Matrix System save_up_athlete.php cross site scripting5.1 Medium
- campcodes division regional athletic meet game result matrix systemCampcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scripting5.1 Medium
- itsourcecode university management systemitsourcecode University Management System view_result.php cross site scripting5.3 Medium
- itsourcecode online doctor appointment systemitsourcecode Online Doctor Appointment System doctor_action.php sql injection6.9 Medium
- itsourcecode online doctor appointment systemitsourcecode Online Doctor Appointment System patient_action.php sql injection6.9 Medium
- quickjs-ng quickjsquickjs-ng quickjs quickjs.c js_iterator_concat_return use after free4.8 Medium
- Show moreLoading…