CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- filebrowserFile Browser has an Authorization Policy Bypass in its Public Share Download Flow6.5 Medium
github.com/argoproj-labs/terraform-provider-argocdGoTerraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-681214.8 Medium- langflowLangflow has Missing Ownership Verification in API Key Deletion (IDOR)6.1 Medium
- craftcms cms, craft cms +1 moreCraft CMS Vulnerable to Stored XSS in Revision Context Menu5.3 Medium
- canonical jujuInsecure Direct Object Reference attack via predictable secret ID in Juju6.6 Medium
- canonical jujuUnauthorized access to Kubernetes secrets in Juju8.8 High
- canonical jujuUnauthorized update of out-of-scope Vault secrets7.6 High
- canonical jujuTiming ownership claim attack on new external back-end secrets5.3 Medium
- libp2p rust-libp2p, protocol libp2p-gossipsub +1 morelibp2p-rust: Gossipsub PRUNE.backoff Duration Overflow8.7 High
- danny-avila librechatIn LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.6.3 Medium
- danny-avila librechatLibreChat RAG API Authentication Bypass8.0 High
- bee content design befree sdkStored XSS in beefree.io5.3 Medium
- linux, linux kernel +1 moreperf/core: Fix refcount bug and potential UAF in perf_mmap7.8 High
- linux, linux kernel +1 moretcp: secure_seq: add back ports to TS offset5.5 Medium
- linux, linux kernel +1 morewifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration8.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/sched: act_gate: snapshot parameters with RCU on replace7.8 High
- linux, linux kernel +1 morenvme: fix memory allocation in nvme_pr_read_keys()7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreRDMA/umad: Reject negative data_len in ib_umad_write7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreRDMA/siw: Fix potential NULL pointer dereference in header processing7.5 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morefs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morefs: ntfs3: check return value of indx_find to avoid infinite loop5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morefs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata5.5 Medium
- ajay contextual related postsWordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability5.3 Medium
- yoast duplicate postYoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite5.4 Medium
kubernetesopenSUSESecurity update for kubernetesNo score- vmware spring aiCVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter8.6 High
- vmware spring aiCVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter8.8 High
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreCross‑Site Request Forgery in Link Aggregation Configuration7.1 High
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreStored Cross‑Site Scripting in Link Aggregation Name Handling7.1 High
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreStack-Based Buffer Overflow in CLI Login Username Handling over CLI5.3 Medium
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreStack-Based Buffer Overflow in TFTP File-Transfer Command Handling over CLI6.5 Medium
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreStack-Based Buffer Overflow in File Install Parameter Handling4.9 Medium
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreStack-Based Buffer Overflow in File Transfer Parameter Handling4.9 Medium
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreCommand Injection Vulnerability in Root CA Certificate Transfer Workflow7.2 High
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreBuffer Overflow using TFTP Filename6.5 Medium
- dahua nvr2-4ks3, xvr1b16h-i/t, xvr4232an-i/t +2 moreA vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical...2.4 Low
- alhadeff writeprint stylometryWriteprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter6.1 Medium
- unknown get use apisGet Use APIs < 2.0.10 - Contributor+ Stored XSS5.9 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.12 +5 more +7 moreKeycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak5.8 Medium
- wp swings subscriptions for woocommerceSubscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation5.3 Medium
- silentwind [cr]paid link manager[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting6.1 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.10, single sign-on 7.6 for rhel 7 +5 more +7 moreKeycloak: keycloak: denial of service due to excessive samlrequest decompression5.3 Medium
- mdjnelson moodle-mod customcertmdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key9.6 Critical
- kanboardKanboard has Authenticated SQL Injection in Project Permissions Handler8.4 High
- kanboardKanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin7.0 High
- wpgmaps wp go maps (formerly wp google maps)WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings6.4 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.14, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: unauthorized authentication via disabled saml identity provider8.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.14, build of keycloak 26.4 +7 more +9 moreKeycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions7.7 High
- itsourcecode university management systemitsourcecode University Management System add_result.php cross site scripting4.8 Medium
- danvei233 xiaoheifsxiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)7.2 High
- Show moreLoading…