CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
wireless-regdbDebianwireless-regdb - security updateNo score- microsoft edge chromium, edge for android +1 moreMicrosoft Edge (Chromium-based) for Android Spoofing Vulnerability5.0 Medium
- leanprover vscode-lean4XSS in @leanprover/unicode-input-component0.0 None
- runtipiRuntipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`8.1 High
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 autopilot has a heap Use-After-Free in MavlinkShell::available() via SERIAL_CONTROL Race Condition5.3 Medium
- tp link systems inc. tl-wr840n v6, tp-link systems inc. tl-wr802n v4, tl-wr841n v14 +3 more +5 moreAuthenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N8.5 High
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import4.2 Medium
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM access control bypass: suspended users can continue using Browser Extension API keys2.7 Low
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences3.8 Low
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors4.3 Medium
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)5.4 Medium
- px4 px4-autopilot, dronecode px4 drone autopilot +1 moreZenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)7.8 High
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop5.2 Medium
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet7.1 High
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 autopilot BST Device Name Length Can Overflow Driver Buffer6.8 Medium
- kasuganosoras pigeonPigeon has a Host Header Injection in email verification flow8.2 High
- microsoft 365 copilot, edge, excel +26 more +28 moreM365 Copilot Information Disclosure Vulnerability7.1 High
- cleanuparrCleanuparr has Username Enumeration via Timing Attack6.9 Medium
- gnu inetutilstelnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from...3.4 Low
- ctfer-io monitoringImproper Access Control in github.com/ctfer-io/monitoring7.1 High
ficklingPyPIfickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`6.9 MediumficklingPyPIfickling modules linecache, difflib and gc are missing from the unsafe modules blocklist6.9 Medium- luckypennysoftware automapperAutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion7.5 High
- b3log siyuanSiYuan renderSprig: missing admin check allows any user to read full workspace DB6.5 Medium
- danthedeckie simpleeval, red hat openshift ai (rhoai), openshift ai 2.25 +1 more +3 more(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.8.7 High
- @angular compiler, core, angular cli +2 moreAngular has XSS in i18n attribute bindings8.6 High
- openclawOpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation6.9 Medium
- openclawOpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token8.8 High
- openclawOpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC Parameters8.7 High
- openclawOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections9.4 Critical
- openclawOpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool9.2 Critical
- openclawOpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins8.6 High
- openclawOpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints8.7 High
- openclawOpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization8.8 High
- openclawOpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu6.9 Medium
- openclawOpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.request7.1 High
- openclawOpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes8.6 High
- sindresorhus file-typefile-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry5.3 Medium
- openclawOpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist6.9 Medium
idunno.AtProtoNuGet,idunno.AtProto.OAuthCallbackNuGet,idunno.BlueskyNuGet +2 moreidunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability7.5 High- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter7.7 High
- yhirose cpp-httplibcpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy8.7 High
github.com/centrifugal/centrifugoGo,github.com/centrifugal/centrifugo/v3Go,github.com/centrifugal/centrifugo/v4Go +2 more +4 moreCentrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning0.0 None- claude-hovercraftclaude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability9.8 Critical
- socomec diris a-40Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability6.3 Medium
- icewarpIceWarp collaboration Directory Traversal Information Disclosure Vulnerability7.5 High
- gstreamer, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability7.8 High
- gstreamer, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreGStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability7.8 High
- gstreamer, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreGStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability8.8 High
- gstreamer, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability7.8 High
- Show moreLoading…