CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- ruby json, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +6 more +8 moreRuby JSON has a format string injection vulnerability8.3 High
- wwbn avideoAVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command5.9 Medium
- salvoSalvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing8.7 High
- salvoSalvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass7.5 High
github.com/modelcontextprotocol/go-sdkGoImproper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk8.2 High- wwbn avideoAVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration4.3 Medium
- wwbn avideoAVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation5.5 Medium
- nltk, red hat lightspeed core, openshift lightspeed +4 more +6 moreNLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite8.1 High
- nltk, red hat lightspeed core, openshift lightspeed +4 more +6 moreNLTK has unauthenticated remote shutdown in nltk.app.wordnet_app7.5 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File7.7 High
aws-lc-syscrates.ioAWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN8.2 High- aws aws-lc, aws-lc-fips +1 moreCRL Distribution Point Scope Check Logic Error in AWS-LC9.1 Critical
- alexcrichton tar-rs, tar project tar +1 moretar-rs: unpack_in can chmod arbitrary directories by following symlinks5.1 Medium
- alexcrichton tar-rstar-rs incorrectly ignores PAX size headers if header size is nonzero5.1 Medium
- slovensko.digital autogramImproper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko...8.6 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter7.5 High
- toddr xml::parser, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreXML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack9.8 Critical
- toddr xml::parser, xml\ +1 moreXML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes7.5 High
- secomea gatemanagerUnauthorized access to information6.5 Medium
- hclsoftware connectionsHCL Connections is vulnerable to cross-site scripting (XSS)5.4 Medium
- wpeverest everest forms proWordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- ryan howard website llms.txtWordPress Website LLMs.txt plugin <= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- syarif mobile app editorWordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability9.1 Critical
- thimpress builderpressWordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability9.8 Critical
- membership software wishlist member xWordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability8.8 High
- dotstore fraud prevention for woocommerceWordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability7.5 High
- qantumthemes kenthaWordPress Kentha theme <= 4.7.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themehunk gutenberg blocksWordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- markbeljaars table of contents creatorWordPress Table of Contents Creator plugin <= 1.6.4.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- artstudioworks brooksideWordPress Brookside theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpsight wpcasaWordPress WPCasa plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeton finagWordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability9.8 Critical
- themeton zuutWordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability9.8 Critical
- tagdiv opt-in builderWordPress tagDiv Opt-In Builder plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- tagdiv composerWordPress tagDiv Composer plugin <= 5.4.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- instantpopupbuilder instant popup builder – powerful popup maker for opt-ins, email newsletters & lead generationInstant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter5.3 Medium
- hcltech unica, hclsoftware unica marketing operations (plan) +1 moreHCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability7.6 High
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability7.5 High
- themepaste admin safety guardWordPress Admin Safety Guard plugin <= 1.2.6 - Broken Authentication vulnerability8.1 High
- uipress liteWordPress UiPress lite plugin <= 3.5.09 - Broken Access Control vulnerability6.3 Medium
- codename065 download managerDownload Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter4.3 Medium
- bplugins info cards – add text and media in card layoutsInfo Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes6.4 Medium
- dartiss draft listDraft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter6.4 Medium
- pattihis add custom fields to mediaAdd Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter4.3 Medium
- ovatheme tripgoWordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability8.1 High
- buddhathemes colorfolio - freelance designer wordpress themeWordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability8.1 High
- really simple plugins b.v. simple security proWordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- cozmoslabs profile builder proWordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability9.3 Critical
- rymera web co pty ltd. woocommerce wholesale lead captureWordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability9.0 Critical
- Show moreLoading…