CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- rymera web co pty ltd. woocommerce wholesale lead captureWordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability9.8 Critical
- wp media rocketWordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- tips and tricks hq wp ememberWordPress WP eMember plugin <= v10.2.2 - Broken Access Control vulnerability5.3 Medium
- tips and tricks hq wp ememberWordPress WP eMember theme <= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- veronalabs slimstat analyticsSlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'7.2 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM Information Disclosure6.2 Medium
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar SIEM Information Disclosure5.0 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM Cross-Site Scripting5.4 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM Cross-Site Scripting5.4 Medium
- No product listedDevome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities...8.8 High
- dedecmsAn issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via...9.8 Critical
- wgstart wgcloudThe backend database management connection test feature in wgcloud v3.6.3 has a server-side...7.5 High
- wgstart wgcloudThere is an arbitrary file read vulnerability in the test connection function of backend database...7.5 High
- wgstart wgcloudAn issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the...9.8 Critical
- microsoft .netASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a...7.5 High
- gnu ncurses, siemens ruggedcom rst2428p +1 morencurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function...7.3 High
- No product listedA path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi...6.5 Medium
- No product listedUse of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm...9.8 Critical
- No product listedOS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi...9.8 Critical
- No product listedUse of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small...9.8 Critical
- px4 px4-autopilot, dronecode px4 drone autopilot +1 morePX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handling6.5 Medium
- kanbn kanKan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment9.2 Critical
- kanKan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint8.6 High
- chrimle io.github.chrimle:openapi-to-java-records-mustache-templates-parentUnpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`2.3 Low
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 morePath Traversal Vulnerability in mlflow/mlflow8.1 High
- hytalemodding wikiHytale Modding Wiki has Insecure Direct Object Reference / GDPR PII Exposure4.3 Medium
- xpdfOut-of-bounds array write in Xpdf 4.06 due to missing validation2.1 Low
- openprojectOpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy9.1 Critical
- openprojectOpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution9.1 Critical
- beijing academy of artificial intelligence (baai) omnigen2-rlOmniGen2-RL Reward Server Unsafe Deserialization RCE9.3 Critical
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration8.8 High
- samtoolsNULL pointer dereference in samtools cram-size6.9 Medium
- samtoolssamtools mpileup has use-after-free leading to an invalid read6.9 Medium
- open-emr openemrOpenEMR's Message Update Ignores Patient id6.5 Medium
- nltknltk Vulnerable to Cross-site Scripting6.1 Medium
- budibaseBudibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview8.7 High
- nhost, nhost storage +1 moreNhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload2.1 Low
- linuxfoundation tekton pipelines, tektoncd pipeline, red hat builds for red hat openshift +9 more +11 moreTekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod9.6 Critical
- emilstenstrom justhtmljusthtml before 1.12.0 Sanitizer Bypass via Markdown9.3 Critical
- emilstenstrom justhtmljusthtml before 1.12.0 Mutation XSS via Raw Text Elements5.1 Medium
github.com/russellhaering/gosaml2GoUnsigned SAML LogoutRequest Acceptance in gosaml27.5 Highgithub.com/russellhaering/gosaml2Gogosaml2 CBC Padding Panic — Unauthenticated Process Crash8.7 High- goxmldsig project goxmldsig, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +10 more +12 moregoxmldsig has validateSignature Loop Variable Capture Signature Bypass7.5 High
- nltkNLTK before 3.9.4 Denial of Service via JSONTaggedDecoder8.7 High
github.com/k1LoW/moGomo has a XSS via inline SVG script tags in Markdown rendering2.3 Low- kelvinmo simplejwtSimpleJWT has an Unauthenticated Denial of Service via JWE header tampering7.5 High
roundcubeUbunturoundcube regressionNo score- free5gc, free5gc udm +1 morefree5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques8.7 High
- free5gc, free5gc udm +1 morefree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error8.7 High
- b3log siyuanSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass7.5 High
- Show moreLoading…