CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- spring security, vmware spring boot +1 moreAuthentication Bypass under Actuator CloudFoundry endpoints8.2 High
- suitecrm, suitecrm suitecrm-core +1 moreSuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)6.5 Medium
- suitecrm, suitecrm suitecrm-core +1 moreSuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing8.6 High
- suitecrm, suitecrm suitecrm-core +1 moreAuthenticated SuiteCRM Users Can Retrieve The Password Hash of Any User6.5 Medium
- suitecrmSuiterCRM has LDAP Filter Injection in Authentication Module8.8 High
- suitecrmSuiteCRM has Authenticated SQL Injection in Authentication Module8.8 High
- suitecrmSuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints8.1 High
- suitecrmSuiteCRM vulnerable to authenticated SSRF via PDF export5.0 Medium
- suitecrmSuiteCRM has blind XSS in return_id parameter5.9 Medium
- suitecrmSuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture5.4 Medium
- suitecrmSuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM2.7 Low
- suitecrmSuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass9.1 Critical
- suitecrmSuiteCRM has Authenticated RCE in Modules7.2 High
- suitecrmSuiteCRM Vulnerable to Directory Traversal to DoS in Modules4.9 Medium
- suitecrmSuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter7.1 High
- spring security, vmware spring security +1 moreUnder Some Conditions Spring Security HTTP Headers Are not Written9.1 Critical
- suitecrmSuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.8.8 High
- openwrt luci, openwrt +1 moreLuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal8.6 High
- suitecrmSuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action4.9 Medium
- suitecrmSuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet7.1 High
- suitecrmSuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields8.1 High
- spring boot, vmware spring boot +1 moreAuthentication Bypass under Actuator Health groups paths8.2 High
- openwrtOpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation1.8 Low
- discourseDiscourse has Improper Authorization in "Post Edits" Report For Moderators2.2 Low
- discourseDiscourse has stored click‑based XSS via Graphviz SVG javascript: links4.4 Medium
- discourseDiscourse leaks PM post edits to moderators2.7 Low
- discourseDiscourse fixes loose hostname matching in spam host allowlist4.3 Medium
- discourseDiscourse filters whisper posts from private-posts feed6.5 Medium
- openwrtOpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens2.4 Low
- discourseDiscourse hardens chat DM channel creation and expansion5.4 Medium
- openwrtOpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup9.5 Critical
- discourseDiscourse prevents hidden profile data leak via user onebox4.3 Medium
- kubernetes ingress-nginx, nginx ingress controller +1 moreingress-nginx comment-based nginx configuration injection8.8 High
- openwrtOpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query9.5 Critical
- discourseDiscourse missing permission check for policy creation in discourse-policy8.2 High
- discourseDiscourse vulnerable to group membership addition permission bypass via discourse-policy plugin2.3 Low
- discourseDiscourse discloses restricted post-action counts to non-privileged users6.9 Medium
- freescoutFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})9.3 Critical
- discourseDiscourse leaks private topic metadata to non-authorized users6.9 Medium
- parse-community parse-serverParse Server: Auth provider validation bypass on login via partial authData7.0 High
scribanNuGet,Scriban.SignedNuGet +1 moreScriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)5.3 Medium- scribanScriban before 6.6.0 Denial of Service via Infinite Recursion8.7 High
- scribanScriban before 6.6.0 Denial of Service via Uncontrolled Recursion8.7 High
- freescoutFreeScout: Stored XSS through SVG file upload with filter bypass8.5 High
- angular angular-cli, cli +1 moreAngular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass6.9 Medium
- freescoutFreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages0.0 None
- microsoft bing imagesMicrosoft Bing Images Remote Code Execution Vulnerability9.8 Critical
- wolfsslwc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read1.2 Low
- discourseDiscourse leaks private topic title and post excerpt via user action API endpoint8.7 High
- wofssl wolfsslInteger Overflow in Certificate Chain Allocation1.2 Low
- Show moreLoading…