CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- filebrowserFile Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely5.3 Medium
- openclawOpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files6.8 Medium
- openclawOpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP9.2 Critical
- openclawOpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request8.7 High
- openclawOpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing9.3 Critical
- openclawOpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error Logs8.7 High
- github.com/shamaton/msgpack, shamaton msgpack, github.com/shamaton/msgpack/v2 +1 more +3 moreDenial of service in github.com/shamaton/msgpack7.5 High
- github.com/buger/jsonparser, jsonparser project jsonparser, red hat cluster observability operator 1.5.0 +17 more +19 moreDenial of service in github.com/buger/jsonparser7.5 High
- github.com/jackc/pgproto3/v2, jackc pgproto3, red hat assisted installer for red hat openshift container platform 2 +26 more +28 moreDenial of service in github.com/jackc/pgproto3/v27.5 High
- mattermost, mattermost server +1 morePermalink Preview Information Disclosure After Permission Revocation4.3 Medium
- mattermost, mattermost server +1 moreTeam Admin Privilege Escalation to Demote Members to Guest3.8 Low
- mattermost, mattermost server +1 moreDoS in Calls plugin via malformed msgpack in websocket request.5.8 Medium
- mattermost, mattermost server +1 morePermission Bypass in Playbook Run Creation4.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Reflected XSS in the session category listing page6.1 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: SQL Injection in the statistics AJAX endpoint8.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS: User enumeration vulnerability via response6.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Authenticated RCE via H5P Import8.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php9.3 Critical
- buffalo terastation nas ts5400r, buffaloamericas terastation nas ts5400r firmware +1 moreBuffalo TeraStation TS5400R Excessive File Permissions Information Disclosure6.9 Medium
- b3log siyuanSiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface5.1 Medium
- b3log siyuanSiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes6.8 Medium
- b3log siyuanSiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write7.6 High
- b3log siyuanSiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure5.3 Medium
- b3log siyuanSiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets6.8 Medium
- parse-community parse-serverParse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries8.3 High
- craftcms azure-blobAzure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability8.7 High
- craftcms cms, craft cms +1 moreCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()7.7 High
- craftcms google-cloudGoogle Cloud Storage for Craft CMS has an Information Disclosure Vulnerability2.4 Low
- craftcms aws-s3Amazon S3 for Craft CMS has an Information Disclosure vulnerability6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController8.6 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE via EntryTypesController8.6 High
- craftcms cms, craft cms +1 moreCraft CMS has a Path Traversal Vulnerability in AssetsController5.3 Medium
- craftcms webhooksRCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin8.5 High
ca-certificatesTuxCareUpdate of ca-certificatesNo score- amazon bedrock agentcore starter toolkitImproper S3 ownership verification in Bedrock AgentCore Starter Toolkit5.8 Medium
ca-certificatesTuxCareUpdate of ca-certificatesNo score- python, python software foundation cpython +1 moreStack overflow parsing XML with deeply nested DTD content models6.0 Medium
amd64-microcodeTuxCareUpdate of amd64-microcodeNo score- python, python software foundation cpython +1 moreIncomplete control character validation in http.cookies6.0 Medium
- tenda ac8, ac8 firmware +1 moreTenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow9.3 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10 versions prior to ThinOS 2602_10.0573, contain an Improper Neutralization of...7.8 High
- pluginsglpi fieldsFields GLPI plugin vulnerable to RCE in dropdown generation9.1 Critical
- tenda ac8, ac8 firmware +1 moreTenda AC8 Web UploadCfg route_set_user_policy_rule os command injection5.1 Medium
- hereta eth-imc408m firmware, shenzhen hereta technology co., ltd. hereta eth-imc408m +1 moreHereta ETH-IMC408M Stored XSS via Device Name5.1 Medium
- hereta eth-imc408m firmware, shenzhen hereta technology co., ltd. hereta eth-imc408m +1 moreHereta ETH-IMC408M Stored XSS via Device Location5.1 Medium
- hereta eth-imc408m firmware, shenzhen hereta technology co., ltd. hereta eth-imc408m +1 moreHereta ETH-IMC408M Reflected XSS via ping_ipaddr Parameter5.1 Medium
- hereta eth-imc408m firmware, shenzhen hereta technology co., ltd. hereta eth-imc408m +1 moreHereta ETH-IMC408M CSRF via Configuration Setup5.1 Medium
- nyariv sandboxjsSandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)4.8 Medium
- bloomberg memrayMemray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata3.6 Low
- studiocmsStudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens2.7 Low
- Show moreLoading…