CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- nicolargo glancesGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers8.1 High
- nicolargo glancesGlances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`9.1 Critical
- nicolargo glancesGlances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding5.9 Medium
- nicolargo glancesGlances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements7.0 High
- nicolargo glancesGlances's Default CORS Configuration Allows Cross-Origin Credential Theft8.1 High
- tenda ac8, ac8 firmware +1 moreTenda AC8 IPv6 check_is_ipv6 ip address for authentication9.3 Critical
- nicolargo glancesGlances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials7.5 High
- nicolargo glancesGlances has a Command Injection via Process Names in Action Command Templates7.0 High
- lxc incus-osIncusOS has a LUKS encryption bypass due to insufficient TPM policy7.7 High
- nicolargo glancesGlances exposes the REST API without authentication8.7 High
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack8.6 High
- vapor leafkit, leaf-kit +1 moreLeafKit's HTML escaping may be skipped for Collection values, enabling XSS6.9 Medium
- pyca pyopenssl, red hat confidential compute attestation, exploit intelligence +37 more +39 morepyOpenSSL DTLS cookie callback buffer overflow7.2 High
- dicebear@dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions7.5 High
- authlib, red hat lightspeed core, ansible automation platform 2 +7 more +9 moreAuthlib: Fail-Open Cryptographic Verification in OIDC Hash Binding8.2 High
- amazon aws api mcp server, aws api mcp server +1 moreAWS API MCP File Access Restriction Bypass6.8 Medium
- citydata citychatCityData CityChat ai.citydata.citychat credentials.json credentials storage2.0 Low
- albert sağlık hizmetleri ve ticaret healthAlbert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage2.0 Low
- librechat, librechat rag api +1 moreLibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.7.5 High
- ancorathemes unica, hcltech unica audience central +1 moreBoolean-Based SQL Injection in Multiple Unica Components9.8 Critical
- saad iqbal wp easypayWordPress WP EasyPay plugin <= 4.2.11 - Broken Access Control vulnerability5.4 Medium
- authlibAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle8.3 High
- authlib, red hat lightspeed core, ansible automation platform 2 +7 more +9 moreAuthlib JWS JWK Header Injection: Signature Verification Bypass9.1 Critical
- pyca pyopensslpyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback1.7 Low
- io.spinnaker.clouddriver clouddriver-artifacts, io.spinnaker.orca orca-core +1 moreSpinnaker clouddriver and orca URL validation bypass via underscores in hostnames9.1 Critical
- jlowin fastmcp, red hat developer hub, openshift ai (rhoai) +1 more +3 moreFastMCP OAuth Proxy token reuse across MCP servers7.4 High
- webnus inc. modern events calendarWordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability5.3 Medium
- No product listedLa Nacion App app.lanacion.activity BuildConfig.java credentials storage2.0 Low
- mattermost, mattermost server +1 moreGuest users can bypass read permissions via search API4.3 Medium
- mattermost, mattermost server +1 morePassword Change Bypass via Auth Switch Endpoint3.1 Low
- mattermost, mattermost server +1 moreSSRF bypass via IPv4-mapped IPv6 literals4.3 Medium
- mattermost, mattermost server +1 morePrivate channel enumeration via /mute slash command4.3 Medium
- forcepoint web security (on-prem), web security +1 moreStored Cross Site Scripting in Forcepoint Web Security4.8 Medium
- hcl aionHCL AION is affected by an internal filesystem paths disloser vulnerability3.3 Low
- hcl aionHCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.2.2 Low
- hcl aionHCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.1.9 Low
- hcl aionHCL AION is affected by a vulnerability where certain identifiers may be predictable in nature1.8 Low
- babychakra pregnancy & parenting appBabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage2.0 Low
- hcl aionHCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged.5.8 Medium
- hcl aionHCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment4.7 Medium
- hcl aionHCL AION is affected by a improper handling of uploads files Size1.8 Low
- flexmls flexmls® idxWordPress Flexmls® IDX plugin <= 3.15.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- itsourcecode college management systemitsourcecode College Management System time-table.php sql injection5.3 Medium
- open5gsOpen5GS CCA smf_s6b_sta_cb denial of service6.9 Medium
- softing smartlink sw-ht, smartlink sw-pn +1 moreGlobal file reads caused by improper URL checks in webserver5.3 Medium
- softing smartlink sw-ht, smartlink sw-pn +1 moreHTTP POST with specific higher content length leads into heap corruption7.7 High
- lagom whmcs templateLagom WHMCS Template Datatables prototype pollution5.1 Medium
- mattermost, mattermost server +1 moreMemory Exhaustion via Malformed DOC File Upload4.3 Medium
- hcl aionHCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of...4.8 Medium
- hcl aionMultiple security vulnerabilities affect HCL AION5.6 Medium
- Show moreLoading…