CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- imagemagickImageMagick has a possible stack buffer overflow in sixel encoder6.7 Medium
- capnprotoCap'n Proto: Integer overflow in KJ-HTTP chunk size6.3 Medium
- capnprotoCap'n Proto has an integer overflow in KJ-HTTP6.3 Medium
- tolgee, tolgee tolgee-platform +1 moreTolgee has an XXE Injection in Translation Import9.3 Critical
- vimNFA regex engine NULL pointer dereference affects Vim < 9.2.01375.3 Medium
- redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2 +2 more +4 moreMirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface4.9 Medium
ca-certificatesTuxCareUpdate of ca-certificatesNo scoreels-os-releaseTuxCareUpdate of els-os-releaseNo score- psf black, red hat openshift lightspeed, ansible automation platform 2 +6 more +8 moreBlack: Arbitrary file writes from unsanitized user input in cache file name8.7 High
- stalin-143 websiteNEXULEAN API Key Leak8.2 High
- shopware commercialshopware/commercial: `/api/_info/config` route exposes information about licenses5.3 Medium
- inductive automation ignition software, inductiveautomation ignition +1 moreInductive Automation Ignition Software Deserialization of Untrusted Data5.4 Medium
- swag platform-securityswag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes5.3 Medium
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Unbounded recursion DoS in parse() revive phase7.5 High
- dataeaseDataease: Redshift JDBC RCE Bypass9.3 Critical
- debian linux, openbsd openssh, canonical ubuntu linux +39 more +41 moreVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This...2.7 Low
- python, python software foundation cpython +1 moretarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling2.0 Low
- dataeaseDataease: Unfiltered active SVG content leads to Stored XSS5.3 Medium
- dataeaseDataEase SQL Injection Vulnerability9.3 Critical
- stellar rs-soroban-poseidonPoseidon V1 variable-length input collision via implicit zero-padding8.7 High
- magic-wormhole project magic wormhole, magic-wormhole +1 moreMagic Wormhole: "wormhole receive" allows arbitrary local file overwrite8.2 High
- linuxfoundation inspektor gadget, inspektor-gadget +1 moreInspektor Gadget: Tracing Denial of Service via Event Flooding4.8 Medium
- trane tracer concierge, tracer sc, tracer sc+ +2 more +4 moreUse of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge6.9 Medium
- trane tracer concierge, tracer sc, tracer sc+ +2 more +4 moreUse of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge8.2 High
- trane tracer concierge, tracer sc, tracer sc+ +2 more +4 moreMissing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge6.9 Medium
- parse-community parse-serverParse Server: Account takeover via operator injection in authentication data identifier9.3 Critical
- parse-community parse-serverParse Server OAuth2 adapter shares mutable state across providers via singleton instance9.1 Critical
- basecamp trixTrix: Stored XSS vulnerability through serialized attributes4.6 Medium
- trane tracer concierge, tracer sc, tracer sc+ +2 more +4 moreMemory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge8.7 High
- getzep graphitiGraphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters8.1 High
- tp-link systems inc. tl-mr6400 v5.3, tp-link tl-mr6400 firmware +1 moreCommand Injection Vulnerability in Telnet CLI on TP-Link TL-MR64008.5 High
- trane tracer concierge, tracer sc, tracer sc+ +2 more +4 moreUse of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge9.2 Critical
- hyperterseRaw exposure of database statements in Hyperterse MCP search tool6.5 Medium
- citeum openctiOpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature7.7 High
- @tinacms cli, ssw tinacms\/cli +1 moreArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI6.2 Medium
- tinacms, ssw tinacms\/cli +1 morePath Traversal in Media Upload Handle in Tina7.4 High
- @tinacms cli, ssw tinacms\/cli +1 morePath Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS8.4 High
- @tinacms cli, ssw tinacms\/cli +1 moreCross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS9.7 Critical
- ggml llama.cppllama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix7.8 High
- steveiliop56 tinyauthTinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint8.5 High
- steveiliop56 tinyauthTinyauth's OIDC authorization codes are not bound to client on token exchange6.5 Medium
zeptoclawcrates.ioZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation6.5 Medium- aisarlabs zeptoclawZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink8.8 High
- qhkm zeptoclawZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data8.2 High
- postalserver postalPostal has HTML injection / XSS in message view8.1 High
- @tinacms graphql, ssw tinacms\/graphql +1 morePath Traversal in @tinacms/graphql6.3 Medium
- veeam backup and replication, backup \& replication +1 moreA vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres...9.9 Critical
- veeam backup and replicationA vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication...8.8 High
- projectsendprojectsend Auth.php response discrepancy6.3 Medium
- netartmedia real estate portalNetartmedia Real Estate Portal 5.0 SQL Injection via index.php8.8 High
- Show moreLoading…