CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injection5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injection5.3 Medium
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 WebDAV Arbitrary File Upload9.3 Critical
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference9.3 Critical
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 Unauthenticated Remote Reboot8.7 High
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 gui_mgr.cgi cgi_mycloud_auto_downlaod command injection5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 network_mgr.cgi cgi_dhcpd command injection5.3 Medium
- glowxq glowxq-ojglowxq glowxq-oj SysFileController.java upload unrestricted upload6.9 Medium
- glowxq glowxq-ojglowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery6.9 Medium
- bazinga012 mcp code executorbazinga012 mcp_code_executor index.ts installDependencies command injection4.8 Medium
- osrg gobgpGoBGP vulnerable to a denial of service via the NEXT_HOP path attribute7.5 High
- No product listedA command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2...9.8 Critical
- p2r3 bareironA write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to...9.8 Critical
- p2r3 bareironAn out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated...9.1 Critical
- xcitium openedrA local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2...8.8 High
- xcitium openedrA local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious...7.8 High
- chyrpSQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain...7.5 High
- No product listedAn Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8....5.3 Medium
- ffmpegOut-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The...5.4 Medium
- No product listedIn Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a...6.5 Medium
- No product listedDoom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation...7.5 High
- openeclassAn authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of...5.4 Medium
- netboxCross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An...6.1 Medium
- No product listedThe `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is...8.8 High
- hypermodel-labs mcp-server-auto-commithypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection4.8 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injection5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 wizard_mgr.cgi command injection5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control6.9 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G goahead UpdateClientInfo access control6.9 Medium
- avinashbole quip-mcp-serverAvinashBole quip-mcp-server index.ts setupToolHandlers command injection5.3 Medium
- jawherkl node-api-postgresJawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload6.9 Medium
- jawherkl node-api-postgresJawherKl node-api-postgres user.js User.getAll sql injection6.9 Medium
- No product listedphpipam Section edit-result.php sql injection5.1 Medium
- d-link dir-619lD-Link DIR-619L boa formSchedule stack-based overflow8.7 High
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authentication6.9 Medium
- No product listedUEditor JSONP Callback controller.php cross site scripting5.1 Medium
- next click ventures realtyscriptRealtyScript 4.0.2 Multiple Time-based Blind SQL Injection8.8 High
- serviio proServiio PRO 1.8 Unauthenticated Password Change via REST API8.7 High
- serviio proServiio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowser5.1 Medium
- serviio proServiio PRO 1.8 Local Privilege Escalation via Unquoted Path8.5 High
- serviio proServiio PRO 1.8 REST API Information Disclosure8.7 High
- wowza streaming engineWowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities5.1 Medium
- wowza streaming engineWowza Streaming Engine 4.5.0 CSRF via user edit endpoint6.9 Medium
- wowza streaming engineWowza Streaming Engine 4.5.0 Privilege Escalation via user edit8.7 High
- wowza streaming engineWowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe8.5 High
- nextclickventures realtyscript, next click ventures realtyscripts +1 moreRealtyScript 4.0.2 SQL Injection via u_id and agent Parameters8.8 High
- next click ventures realtyscriptRealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php5.1 Medium
- next click ventures realtyscriptRealtyScript 4.0.2 Stored Cross-Site Scripting via location_name Parameter5.1 Medium
- Show moreLoading…