CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- next click ventures realtyscriptRealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation6.9 Medium
- next click ventures realtyscriptRealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename5.1 Medium
- next click ventures realtyscriptRealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload Parameter5.1 Medium
- next click ventuers realtyscriptRealtyScript 4.0.2 Cross-Site Scripting via Multiple Parameters5.1 Medium
- next click ventuers realtyscriptRealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities6.9 Medium
- qool cmsQool CMS Multiple Persistent Cross-Site Scripting Vulnerabilities8.7 High
- qool cmsQool CMS 2.0 RC2 Cross-Site Request Forgery via adduser6.9 Medium
gpacDebianGPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflow5.3 Medium- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 goahead form2Wl5BasicSetup.cgi stack-based overflow9.3 Critical
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 goahead form2WlanBasicSetup.cgi stack-based overflow9.3 Critical
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow9.3 Critical
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 goahead form2RepeaterStep2.cgi stack-based overflow9.3 Critical
- tuya arduino-tuyaopenarduino-TuyaOpen WiFiUDP Null Pointer Dereference Denial of Service7.1 High
- tuya arduino-tuyaopenarduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution8.7 High
- tuya arduino-tuyaopenarduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosure7.0 High
- tuya arduino-tuyaopenarduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Execution8.6 High
- zkteco inc. zkaccess security systemZKTeco ZKAccess Security System 5.3.1 Stored XSS5.1 Medium
- zkteco inc. zkbiosecurityZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp6.8 Medium
- zkteco inc. zkbiosecurityZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction9.3 Critical
- zkteco inc. zkbiosecurityZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability6.9 Medium
- zkteco inc. zkbiosecurityZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin5.3 Medium
- zkteco inc. zkbiosecurityZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities5.1 Medium
- zkteco inc. zkbiosecurityZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution9.3 Critical
- zkteco inc. zkaccess professionalZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions8.7 High
- zkteco inc. zktime.netZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation9.3 Critical
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 goahead redirect.asp access control6.9 Medium
- aureus erpAureus ERP Chatter Message content-text-entry.blade.php cross site scripting5.1 Medium
- radare2Radare2 Mach-O File mach0.c walk_exports_trie resource consumption4.8 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreCommand Injection in mlflow/mlflow7.5 High
- codephiliax chat2dbCodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection5.3 Medium
- trendnet tew-632brpTRENDnet TEW-632BRP HTTP POST Request ping_response.cgi stack-based overflow8.6 High
- codegenieapp serverless-expressCodeGenieApp serverless-express API Endpoint TodoList.ts authorization5.3 Medium
- topsec topacmTopsec TopACM HTTP Request nmc_sync.php os command injection9.3 Critical
- tecnick tcexamTecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting4.8 Medium
- tecnick tcexamTecnick TCExam Group tce_edit_group.php cross site scripting4.8 Medium
- belkin f9k1122Belkin F9K1122 formReboot stack-based overflow8.7 High
- wavlink wl-nu516u1Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting5.1 Medium
- worksuite hr, crm and project managementWorksuite HR, CRM and Project Management create cross site scripting4.8 Medium
- wavlink wl-wn578w2Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection9.3 Critical
- wedevs user frontend: ai powered frontend posting, user directory, profile, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parame…5.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id7.5 High
- wickedplugins wicked folders – folder organizer for pages, posts, and custom post typesWicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion4.3 Medium
- wavlink wl-wn579a3Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection9.3 Critical
- zephyrproject zephyrstm32: usb: Infinite while loop in Interrupt Handler6.1 Medium
- vulnogramVulnogram - Stored Cross-Site Scripting via Comment Hypertext5.3 Medium
- zephyrproject zephyrcrypto: ATAES132A response length allows stack buffer overflow3.8 Low
- thimpress thim kit for elementor – pre-built templates & widgets for elementorThim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure5.3 Medium
tracing-etherscrates.io`tracing-ethers` was removed from crates.io due to malicious codeNo score- apache sparkApache Spark: Spark History Server Code Execution Vulnerability8.8 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license4.3 Medium
- Show moreLoading…