CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- itsourcecode college management systemitsourcecode College Management System courses.php sql injection5.1 Medium
- hcl aionMultiple security vulnerabilities affect HCL AION4.5 Medium
- mattermost, mattermost server +1 moreGuest user can upload files without permission across teams4.3 Medium
- mattermost, mattermost server +1 moreDenial of service via malformed User-Agent header in getBrowserVersion4.3 Medium
- mattermost, mattermost server +1 moreDoS attack via login attempts with multi-megabyte passwords7.5 High
- itsourcecode free hotel reservation systemitsourcecode Free Hotel Reservation System index.php sql injection6.9 Medium
- mattermost, mattermost server +1 moreAdmin RCE via Malicious Plugin Upload on CI Test Instances6.6 Medium
- mattermost, mattermost server +1 moreInformation Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts4.3 Medium
- raythaLack of bruteforce protection in Raytha CMS6.9 Medium
- raythaReflected XSS in Raytha CMS5.1 Medium
- raythaUser enumeration in Raytha CMS6.9 Medium
- raythaReflected XSS in Raytha CMS5.1 Medium
- raythaStored XSS in Raytha CMS5.3 Medium
- raythaHeader Poisoning in Raytha CMS7.5 High
- raythaServer-Site Request Forgery in Raytha CMS5.1 Medium
- raythaCross-Site Request Forgery in Raytha CMS6.9 Medium
- raythaStored XSS in Raytha CMS5.1 Medium
- raythaStored XSS in Raytha CMS5.1 Medium
- raythaAuthenticated RCE in Raytha CMS8.6 High
- 3ds solidworks, dassault systèmes solidworks desktop +1 moreCode Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 20267.8 High
python-cryptographyUbuntupython-cryptography regressionNo score- mattermost, mattermost server +1 moreMemory Exhaustion via Malformed PSD File Upload4.3 Medium
- itsourcecode online enrollment systemitsourcecode Online Enrollment System index.php sql injection6.9 Medium
- mattermost, mattermost server +1 moreUnauthorized channel enumeration in private teams after member removal4.3 Medium
- mattermost, mattermost server +1 moreWebSocket Message Spoofing via Permalink Embed Manipulation4.3 Medium
- mattermost, mattermost server +1 moreMissing authorization check allows unauthorized modification of other users' comments on a board4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized access to invite ID during team creation4.3 Medium
- mattermost, mattermost ms teams +1 moreMS Teams plugin sensitive config values not properly masked in support packets7.6 High
- mattermost, mattermost server +1 moreDenial of Service via Unbounded Memory Allocation in Integration Actions5.3 Medium
- itsourcecode online enrollment systemitsourcecode Online Enrollment System login.php sql injection6.9 Medium
- truesec lapswebuiAdmin Passwords Cached by Browsers in Truesec LAPSWebUI6.0 Medium
- truesec lapswebuiInsecure Logout Functionality in Truesec LAPSWebUI6.0 Medium
- truesec lapswebuiLong Session Lifetime in Truesec LAPSWebUI6.0 Medium
- siteserver sscmsSSCMS DDL SitesAddController.Submit.cs sql injection5.3 Medium
- wakyma, wakyma application web +1 moreStored Cross-Site Scripting (XSS) vulnerability in the Wakyma application web4.8 Medium
- wakyma, wakyma application web +1 moreNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web5.3 Medium
- wakyma, wakyma application web +1 moreNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web7.1 High
- wakyma, wakyma application web +1 moreNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web7.1 High
- wakyma application webIdentity based authorization bypass vulnerability (IDOR) in the Wakyma application web8.6 High
- No product listedThingsGateway download path traversal5.3 Medium
- educativa campusMultiple vulnerabilities on the Educativa Campus6.9 Medium
- educativa campusMultiple vulnerabilities on the Educativa Campus8.7 High
- tiandy integrated management platformTiandy Integrated Management Platform getAuthorityByUserId sql injection6.9 Medium
- tinycontrol lk3.9, lk4, tcpdu +1 more +3 moreCredentials exposure in tinycontrol devices8.7 High
- tinycontrol lk3.9, lk4, tcpdu +1 more +3 moreCredentials exposure in tinycontrol devices8.6 High
- vanna-ai vannavanna-ai vanna Endpoint __init__.py run_sql server-side request forgery6.9 Medium
- vanna-ai vannavanna-ai vanna Endpoint __init__.py update_sql sql injection5.3 Medium
- vanna-ai vannavanna-ai vanna bigquery_vector.py remove_training_data sql injection6.9 Medium
- lb-link bl-wr9000, bl-wr9000 firmware +1 moreLB-LINK BL-WR9000 set_wifi sub_458754 command injection5.3 Medium
- lb-link bl-wr9000, bl-wr9000 firmware +1 moreLB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflow8.7 High
- Show moreLoading…