CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- wazuhWazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow4.9 Medium
- wazuhWazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware5.3 Medium
- wazuhWazuh has Privilege Escalation to Root via Cluster Protocol File Write9.1 Critical
- atlassian bamboo, bamboo data center +1 moreThis High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0,...8.6 High
- parse-community parse-serverParse Server's Cloud function dispatch crashes server via prototype chain traversal8.2 High
- bishopfox sliverSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports5.7 Medium
- wazuhWazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization9.1 Critical
- parse-community parse-serverParse Server has a password reset token single-use bypass via concurrent requests2.3 Low
- parse-community parse-serverParse Server crash via deeply nested query condition operators8.7 High
container-suseconnectSUSESecurity update for container-suseconnectNo score- heartcombo deviseDevise has a confirmable "change email" race condition that permits user to confirm email they have no access to6.0 Medium
- angeet es3 kvm, es3 kvm firmware +1 moreAngeet ES3 KVM OS command injection8.5 High
- angeet es3 kvm, es3 kvm firmware +1 moreAngeet ES3 KVM unauthenticated arbitrary file write9.3 Critical
- sipeed nanokvmSipeed NanoKVM unauthenticated Wi-Fi configuration endpoint8.8 High
- jetkvm, jetkvm kvm +1 moreJetKVM insufficient login rate limiting9.3 Critical
- jetkvm, jetkvm kvm +1 moreJetKVM insufficient firmware verification7.0 High
- gl-inet comet kvm, comet gl-rm1 firmware +1 moreGL-iNet Comet (GL-RM1) KVM insufficient certificate validation6.3 Medium
- gl-inet comet kvm, comet gl-rm1 firmware +1 moreGL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting9.3 Critical
- gl-inet comet kvm, comet gl-rm1 firmware +1 moreGL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console7.0 High
- gl-inet comet kvm, comet gl-rm1 firmware +1 moreGL-iNet Comet (GL-RM1) KVM insufficient firmware verification7.0 High
- imagemagickImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash5.3 Medium
- cloudnativelabs kube-routerKube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS7.1 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has HTML Injection in New Window paths9.6 Critical
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has a PDF Object Injection via FreeText color8.1 High
- agentejo cockpitCockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()7.7 High
- carmelo simple food order systemcode-projects Simple Food Order System add-item.php sql injection6.9 Medium
- objectcomputing micronaut, micronaut-projects micronaut-core +1 moreMicronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices8.2 High
- xenXenstored DoS by unprivileged domain7.1 High
- xenUse after free of paging structures in EPT7.8 High
- elysiajs elysiaElysia Cookie Value Prototype Pollution6.5 Medium
- pyasn1, red hat migration toolkit for containers, migration toolkit for virtualization +40 more +42 morepyasn1 Vulnerable to Denial of Service via Unbounded Recursion7.5 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators8.7 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreStack memory disclosure in filemd5 command7.1 High
- getoutline outlineOutline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts4.3 Medium
- getoutline outlineOutline's IDOR allows unauthorized viewing and seizing of private deleted drafts8.1 High
- citeum openctiOpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities6.5 Medium
- perle systems iolan sts, iolan scs +1 morePerle IOLAN STS/SCS Authenticated Command Injection via 'shell ps'8.6 High
- utt hiper 810gUTT HiPER 810G formApLbConfig strcpy buffer overflow8.7 High
- connectwise screenconnectScreenConnect Instance Level Cryptographic Material Exposure9.0 Critical
- softing smartlink sw-htScanning for higher HART revision device leads into NULL pointer dereference in live list6.8 Medium
- b3log siyuanSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)9.3 Critical
- b3log siyuanSiYuan has an Arbitrary File Read in its Desktop Publish Service9.9 Critical
- emilstenstrom justhtmljusthtml before 1.10.0 Denial of Service via deeply nested HTML8.7 High
- canonical ubuntu 16.04 lts, ubuntu 18.04 lts, ubuntu 20.04 lts +3 more +5 moreLocal Privilege Escalation in snapd7.8 High
- red hat satellite 6, satellite 6.17 for rhel 9, satellite 6.18 for rhel 9 +1 more +3 moreRubygem-katello: katello: denial of service and potential information disclosure via sql injection5.4 Medium
- hcltech unica, hcl sametime, hcltech unica audience central +7 more +9 moreHTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform4.7 Medium
- astral astral-tokio-tar, astral-sh tokio-tar +1 moreastral-tokio-tar insufficiently validates PAX extensions during extraction1.7 Low
- hcl sametimeBoolean-Based SQL Injection in Multiple Unica Components2.7 Low
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreLibsoup: libsoup: denial of service via use-after-free in http/2 server5.3 Medium
- apache airflowApache Airflow: DAG authorization bypass4.3 Medium
- Show moreLoading…