CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- bcrypt-rubybcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby4.5 Medium
- dicebear@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options4.7 Medium
- ellanetworks core, ella core +1 moreElla Core panics on malformed ULNASTransport Message without a Request Type6.5 Medium
- ellanetworks core, ella core +1 moreElla Core panics on malformed NGAP Location Report7.5 High
- ellanetworks core, ella core +1 moreElla Core panics on invalid PDU Session IDs in NGAP messages6.5 Medium
- intakeIntake has a Command Injection via shell() Expansion in Parameter Defaults8.8 High
- langflowLangflow has an Arbitrary File Write (RCE) via v2 API10.0 Critical
- wolfsslBuffer overflow in CRL number parsing in wolfSSL7.2 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Prototype Pollution via parse()8.9 High
freerdp3Ubuntufreerdp3 regressionNo score- tinytagtinytag: Denial of Service via non-terminating SYLT frame parsing loop6.5 Medium
- wolfsslHeap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function5.0 Medium
- wwbn avideoAVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php5.1 Medium
- wwbn avideoAVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php2.1 Low
- elastic kibanaImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service6.5 Medium
- wwbn avideoAVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php8.2 High
- wwbn avideoAVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources5.0 Medium
- wwbn avideoAVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter8.1 High
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration6.5 Medium
- wolfsslAcceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.25.5 Medium
- elastic packetbeatImproper Validation of Array Index in Packetbeat Leading to Denial of Service5.7 Medium
- elastic metricbeatMemory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service5.7 Medium
- wolfsslInteger underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path2.1 Low
- wolfsslStack buffer overflow in PKCS7 SignedData encoding with custom signed attributes2.2 Low
- wwbn avideoAVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos7.5 High
- lfprojects mcp go sdk, modelcontextprotocol go-sdk +1 moreMCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion7.1 High
- phpseclibphpseclib's AES-CBC unpadding susceptible to padding oracle timing attack8.2 High
- autobrr quiqui CORS Misconfiguration: Arbitrary Origins Trusted9.0 Critical
- smallstep certificates, step-ca +1 moreStep CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)10.0 Critical
- collerek ormarormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor7.1 High
- artifex software inc. *pymupdf* pymupdf, red hat enterprise linux ai (rhel ai) 3 +1 moreCVE-2026-30297.5 High
- opexus ecase, ecomplaint, opexustech ecase ecomplaint +2 moreOPEXUS eComplaint and eCASE XSS via Name of Organization field5.1 Medium
- opexus ecase, ecomplaint, opexustech ecase ecomplaint +2 moreOPEXUS eComplaint and eCASE XSS via my information5.1 Medium
- opexus ecomplaint, opexustech ecase ecomplaint +1 moreOPEXUS eComplaint unauthenticated file upload5.3 Medium
- opexus ecase, opexustech ecase ecomplaint +1 moreOPEXUS eComplaint and eCase stored XSS via profile first and last name5.1 Medium
- opexus ecase, ecomplaint, opexustech ecase ecomplaint +2 moreOPEXUS eComplaint and eCase insecure password reset9.2 Critical
glanceUbuntuglance vulnerabilityNo score- themegoods photographyWordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability7.2 High
- linkitonedevgroup location aware sensor system (lass)Linkit ONE Location Aware Sensor System (LASS) Reflected XSS via PM25.php5.1 Medium
- ubiquiti inc unifi network applicationAn Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a...7.7 High
- ubiquiti inc unifi network applicationA malicious actor with access to the network could exploit a Path Traversal vulnerability found...10.0 Critical
- libarchive, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreLibarchive: libarchive: denial of service via malformed iso file processing6.5 Medium
- libarchive, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +39 more +41 moreLibarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing7.5 High
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE8.7 High
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS5.3 Medium
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb5.3 Medium
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass6.9 Medium
mcp-bridgenpmMCP Connect has unauthenticated remote OS command execution via /bridge endpoint9.8 Critical- tomwright daselDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service6.2 Medium
- avideoAVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint6.9 Medium
- Show moreLoading…