CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- apache airflowApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata6.5 Medium
- apache airflowApache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization8.1 High
- apache airflowApache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications7.5 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http header injection and response splitting via crlf injection in content-type header3.9 Low
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: header and http request injection via crlf injection3.9 Low
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames3.9 Low
- linux, linux kernel +1 moreaudit: add missing syscalls to read class5.5 Medium
- linux, linux kernel +1 moreaudit: add fchmodat2() to change attributes class5.5 Medium
- typo3 extension "e-mail mfa provider", mrsilaz mfa mail +1 moreAuthentication Bypass in extension "E-Mail MFA Provider" (mfa_email)7.7 High
- ayacoo redirect tab, typo3 extension "redirect tabs" +1 moreBroken Access Control in extension "Redirect Tab"2.3 Low
- cps-it mailqueue, typo3 extension "mailqueue" +1 moreInsecure Deserialization in extension "Mailqueue" (mailqueue)5.2 Medium
- pluggabl booster for woocommerceWordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability5.3 Medium
- drangsoft gcb/fcb audit software, dragonsoft gcb\/fcb government financial cybersecurity configuration audit software +1 moreDrangSoft｜GCB/FCB Audit Software - Missing Authentication9.3 Critical
- octopus serverIn affected versions of Octopus Server it was possible for a low privileged user to manipulate an...2.3 Low
- bitwiseshiftleft stanford javascript crypto librarysjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey8.7 High
- agent0ai agent-zerofrdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery5.3 Medium
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure5.3 Medium
- agent0ai agent-zerofrdel/agent0ai agent-zero files.py get_abs_path path traversal5.3 Medium
- libuclLibucl: libucl: denial of service via embedded null byte in ucl input8.3 High
- wpxpo wowstore – store builder & product blocks for woocommerceWowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter7.5 High
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform getRecByTemplateId sql injection6.9 Medium
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Endpoint getDevDetailedInfo sql injection6.9 Medium
- No product listedAn issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026. It allows...8.1 High
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Endpoint queryResources sql injection6.9 Medium
- taoofagi easegen-admintaoofagi easegen-admin Pdf2MdUtil.java recognizeMarkdown path traversal5.1 Medium
- taoofagi easegen-admintaoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery5.1 Medium
- toddr yaml::syck, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 more +4 moreYAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter9.1 Critical
- oracle linuxA DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.5.5 Medium
- admidioAdmidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)8.0 High
- admidioAdmidio is Missing Authorization on Forum Topic and Post Deletion6.5 Medium
- admidioAdmidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection5.4 Medium
- admidioAdmidio is Missing Authorization and CSRF Protection on Document and Folder Deletion9.1 Critical
- admidioAdmidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint6.8 Medium
- admidioAdmidio is Missing CSRF Protection on Role Membership Date Changes5.7 Medium
- admidioAdmidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions5.7 Medium
- admidioAdmidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module8.8 High
- vshakitskiy eweewe: Loop with Unreachable Exit Condition ('Infinite Loop')7.5 High
- vshakitskiy eweewe has an Overly Permissive List of Allowed Inputs5.3 Medium
- pseitz lz4 flex, red hat logging subsystem for red hat openshift 6.2, logging subsystem for red hat openshift 6.4 +7 more +9 morelz4_flex: Decompression can leak information from uninitialized memory or reused output buffer8.2 High
- akuity kargoKargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration5.1 Medium
- ctfer fullchainFullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.1 High
- ctfer-io romeoRomeo is vulnerable to Archive Slip due to missing checks in sanitization8.3 High
- zwickroell gmbh & co. kg test data managementZwickRoell Test Data Management < 3.0.8 Path Traversal LFI8.7 High
- ctfer monitoringMonitoring is vulnerable to Archive Slip due to missing checks in sanitization8.8 High
- ctfer-io romeoRomeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.9 High
- ctfer-io chall-managerChall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.9 High
- filebrowserFile Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter6.5 Medium
- b3log siyuanSiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API9.8 Critical
- filebrowserFile Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin10.0 Critical
- siyuanSiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README9.4 Critical
- Show moreLoading…