CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- microsoft exchange online, microsoft 365 copilot chat, exchange online +2 moreMicrosoft Exchange Elevation of Privilege Vulnerability9.9 Critical
- microsoft copilotMicrosoft Copilot Information Disclosure Vulnerability6.5 Medium
- microsoft 365 copilotM365 Copilot Information Disclosure Vulnerability5.3 Medium
- microsoft azure data factoryAzure Data Factory Information Disclosure Vulnerability8.6 High
- microsoft bingMicrosoft Bing Tampering Vulnerability6.5 Medium
- microsoft azure devops: msazure, azure devops +1 moreAzure DevOps: msazure Elevation of Privilege Vulnerability8.6 High
- microsoft bing imagesMicrosoft Bing Images Remote Code Execution Vulnerability9.8 Critical
- microsoft purviewMicrosoft Purview Elevation of Privilege Vulnerability8.6 High
- microsoft purviewMicrosoft Purview Elevation of Privilege Vulnerability8.6 High
- microsoft azure cloud shellAzure Cloud Shell Elevation of Privilege Vulnerability10.0 Critical
- wolfsslImproper key_share validation in TLS 1.3 HelloRetryRequest1.2 Low
- discourseDiscourse has Stored XSS in AI Triage Automation5.1 Medium
- dataease sqlbotSQLBot: Remote Code Execution via Terminology Poisoning8.6 High
- discourseDiscourse Vulnerable to Stored XSS via Shared AI Conversation Onebox5.1 Medium
- discourseDiscourse has a bypass of official warnings messages by non-staff users6.9 Medium
- wolfsslHeap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path1.3 Low
- discourseDiscourse has check revision visibility on posts endpoint5.3 Medium
- open-emr openemrOpenEMR has stored XSS in portal_payment.php via Unescaped table_args8.7 High
- open-emr openemrOpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor5.4 Medium
- wolfsslBuffer Overflow in HPKE via Oversized ECH Config6.9 Medium
- discourseDiscourse vulnerable to HTML injection via prohibited iframe URLs4.1 Medium
- open-emr openemrOpenEMR has Authorization Bypass in Dated Reminders Log6.5 Medium
- open-emr openemrOpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View5.4 Medium
- open-emr openemrOpenEMR: zhAclCheck Ignores Explicit ACL Denies7.3 High
- wolfsslwolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation7.5 High
- open-emr openemrOpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)7.2 High
- open-emr openemrOpenEMR has arbitrary image file read via PDF generator7.1 High
- wofssl wolfsslECH parsing heap buffer overflow8.3 High
- open-emr openemrOpenEMR has Stored XSS in patient encounter Eye Exam form answers8.5 High
- wolfsslCompiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V2.1 Low
- open-emr openemrOpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page4.4 Medium
- wolfsslNon-constant time multiplication subroutine __muldi3 on RISC-V RV32I2.1 Low
- johnbillion query monitorQuery Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI7.2 High
- wwbn avideoAVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`7.6 High
- open-emr openemrOpenEMR has Remote Code Execution in backup functionality9.1 Critical
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve: Authenticated repo import can clone server-local private repositories7.1 High
- open-emr openemrOpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders6.5 Medium
- open-emr openemrOpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals6.5 Medium
- wwbn avideoAVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)9.8 Critical
- daguDagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG8.1 High
- wwbn avideoAVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass9.1 Critical
- naturalintelligence fast-xml-parserfast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation5.9 Medium
- thephpleague commonmarkleague/commonmark has an embed extension allowed_domains bypass6.3 Medium
- zauberzeug niceguiNiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion6.9 Medium
- keystonejs keystone@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany4.3 Medium
- parse-community parse-serverParse Server: Email verification resend page leaks user existence6.3 Medium
- wolfssl, wolfssl inc. (wolfcrypt) +1 moreFault injection attack with ML-DSA and ML-KEM on ARM4.3 Medium
skia-pythonPyPIskia-python vendors vulnerable libfreetype because of pinned cibuildwheel version8.1 High- minioMinIO: JWT Algorithm Confusion in OIDC Authentication9.2 Critical
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: Improper Authentication and Origin Validation Error6.5 Medium
- Show moreLoading…