CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- roxnor getgenie – ai content writer with keyword research & seo tracking toolsGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API6.4 Medium
- syslink software ag avantraLegacy built-in user account7.2 High
- strategy11team formidable forms – contact form plugin, survey, quiz, payment, calculator form & custom form builderFormidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse7.5 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint7.5 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure4.3 Medium
- linknacional pix for woocommercePix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- vivo easyshareThe authentication mechanism for a specific feature in the EasyShare module contains a...6.9 Medium
- libssh, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreLibssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows7.8 High
- redhat fuse, red hat fuse 7 +1 moreFuse: privilege escalation via excessive /etc/passwd permissions6.4 Medium
- red hat openshift data foundation 4.22, redhat openshift data foundation +1 moreNoobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container6.4 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass6.9 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage5.3 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs2.1 Low
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag5.1 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient6.3 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext6.9 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email6.1 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - IP Address Spoofing in getIP()6.9 Medium
- voltronic power snmp web pro, gvectors wpdiscuz +1 moreVoltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi8.7 High
- gvectors wpdiscuzwpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()9.2 Critical
- voltronic power snmp web pro, gvectors wpdiscuz +1 moreVoltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage8.8 High
- beghelli sicuroweb (sicuro24), gvectors wpdiscuz +1 moreBeghelli Sicuro24 SicuroWeb AngularJS Template Injection5.1 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview5.3 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType8.7 High
pcapplusplusOSS-FuzzUNKNOWN READ in pcpp::BgpLayer::getHeaderLenNo score- statamic cms, statamic +1 moreStatamic: privilege escalation via stored cross-site scripting5.4 Medium
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +27 more +29 morePyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 High
- stellar rs-soroban-sdksoroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction5.3 Medium
- hackerbay oneuptimeOneUptime: Password Reset Token Logged at INFO Level6.9 Medium
- google chrome, chromium v8 +1 moreInappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote...8.8 High
- google chrome, skia +1 moreOut of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to...8.8 High
- hackerbay oneuptimeOneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")7.6 High
- hackerbay oneuptimeOneUptime ClickHouse SQL Injection via Aggregate Query Parameters10.0 Critical
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus: RCE via unsanitized input in create_function()9.8 Critical
- centrifugal centrifugoCentrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL9.3 Critical
- anchore enterpriseAnchore Enterprise GraphQL Reports API SQL injection8.5 High
- ellanetworks core, ella core +1 moreElla Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings6.5 Medium
- ellanetworks core, ella core +1 moreElla Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload7.5 High
- openclawOpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode8.1 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +18 more +20 moreundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client7.5 High
- nodejs undiciundici is vulnerable to CRLF Injection via upgrade option4.6 Medium
- nodejs undiciundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS5.9 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression7.5 High
sudoUbuntusudo vulnerabilityNo score- honeywell iq3, iq412, iq412 firmware +9 more +11 moreHoneywell IQ4x BMS Controller Missing authentication for critical function10.0 Critical
util-linuxUbuntuutil-linux vulnerabilityNo score- nodejs undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')6.5 Medium
- parse-community parse-serverParse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint6.3 Medium
- denoCommand Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)8.1 High
- Show moreLoading…