CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- linux, linux kernel +1 morebtrfs: do not free data reservation in fallback from inline due to -ENOSPC7.5 High
- linux, linux kernel +1 morebtrfs: fix reservation leak in some error paths when inserting inline extent7.5 High
- dell integrated dell remote access controllerDell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G...4.9 Medium
- dell integrated dell remote access controllerDell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G...5.3 Medium
- avo-hq avoAvo has a XSS vulnerability on `return_to` param5.3 Medium
loofahRubyGemsImproper detection of disallowed URIs by Loofah `allowed_uri?`2.7 Low- free5gc chf, free5gc +1 morefree5GC CHF has Out-of-Bounds Slice Access that Leads to DoS7.1 High
- socketio socket.io, socket socket.io-parser +1 moresocket.io allows an unbounded number of binary attachments8.7 High
- zitadelZITADEL is missing enforcement of organization scopes5.3 Medium
- hackerbay oneuptimeOneUptime: WhatsApp Webhook Missing Signature Verification8.7 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremedia: dvb-core: fix wrong reinitialization of ringbuffer on reopen7.8 High
- linux, linux kernel +1 morexfs: get rid of the xchk_xfile_*_descr calls5.5 Medium
- linux, linux kernel +1 morexfs: only call xf{array,blob}_destroy if we have a valid pointer5.5 Medium
- linux, linux kernel +1 morexfs: check return value of xchk_scrub_create_subord5.5 Medium
- linux, linux kernel +1 morexfs: check for deleted cursors when revalidating two btrees5.5 Medium
- hackerbay oneuptimeOneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters8.1 High
- pinchtabPinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation5.8 Medium
- parzivalhack pyspectorPySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution5.3 Medium
- parzivalhack pyspectorPySpector: Plugin Sandbox Bypass leads to Arbitrary Code Execution8.3 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion8.8 High
- h3js h3h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments8.2 High
- h3h3 has a middleware bypass with one gadget7.4 High
- h3h3 has an observable timing discrepancy in basic auth utils5.9 Medium
- h3h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields7.5 High
- py-pdf pypdfpypdf has inefficient decoding of array-based streams5.1 Medium
- pdfme schemas@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG5.3 Medium
- pdfme schemas@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select5.3 Medium
- ajk automated logoutAutomated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-0304.3 Medium
- capgo cliCapgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations6.8 Medium
- b3log siyuanSiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata5.3 Medium
- b3log siyuanSiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering5.3 Medium
- arturia software centerWorld-writable uninstall script executed as root in Arturia Software Center8.2 High
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard8.2 High
- saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile appPost SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'7.2 High
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token7.3 High
- saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile appPost SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite5.3 Medium
- dartiss code embedCode Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields6.4 Medium
- arturia software centerInsufficient XPC Client validation leading to local privilege escalation in Arturia Software Center7.8 High
- jenkins loadninja, jenkins project loadninja plugin +1 moreJenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form4.3 Medium
- jenkins loadninja, jenkins project loadninja plugin +1 moreJenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files4.3 Medium
- jenkinsJenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation7.5 High
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins has a link following vulnerability allows arbitrary file creation8.8 High
- blakeblackshear frigateFrigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts7.1 High
- opentext zenworks service deskXSS Vulnerability discovered in OpenText™ ZENworks Service Desk.7.4 High
- hclsoftware travelerWordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability9.8 Critical
- ultrajson, red hat openstack platform 16.2, openstack platform 17.1 +1 more +3 moreUltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop7.5 High
- ultrajson, red hat openstack platform 16.2, openstack platform 17.1 +1 more +3 moreUltraJSON has a Memory Leak parsing large integers allows DoS7.5 High
- dadrus heimdallHeimdall: Path received via Envoy gRPC corrupted when containing query string8.2 High
- ondata ckan mcp server, ckan-mcp-server +1 moreCKAN MCP Server: SSRF via base_url allows access to internal networks5.3 Medium
- kyselySQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.8.2 High
- Show moreLoading…