CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- firetree rockpressRockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions5.3 Medium
- creativemindssolutions cm custom reports – flexible reporting to track what matters mostCM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels4.4 Medium
- ghera74 ilghera carta docente for woocommerceilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter6.5 Medium
- error311 fileriseFileRise has Unauthenticated Share Link Deletion3.7 Low
- pjsip, pjsip pjproject +1 morePJSIP has an Out-of-bounds Read in SIP multipart parsing6.9 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: nf_tables: always walk all pending catchall elements7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit5.5 Medium
- linux, linux kernel +1 morenet: add xmit recursion limit to tunnel xmit functions5.5 Medium
- linux, linux kernel +1 moreio_uring: ensure ctx->rings is stable for task work flags manipulation7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenetfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moremacvlan: observe an RCU grace period in macvlan_common_newlink() error path7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: nf_tables: unconditionally bump set->nelems before insertion7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreperf: Fix __perf_event_overflow() vs perf_remove_from_context() race7.8 High
- jexactylJexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template5.8 Medium
- yi technology home cameraYi Technology YI Home Camera HTTP Firmware Update ipc signature verification9.2 Critical
- yi technology home cameraYi Technology YI Home Camera WPA/WPS hard-coded key2.3 Low
- yi technology home cameraYi Technology YI Home Camera CGI Endpoint ipc missing authentication5.3 Medium
- yi technology home cameraYi Technology YI Home Camera ipc hard-coded credentials8.7 High
- angeljudesuarez university management systemitsourcecode University Management System admin_single_student_update.php cross site scripting4.8 Medium
- itsourcecode online doctor appointment systemitsourcecode Online Doctor Appointment System appointment_action.php sql injection5.1 Medium
- wwbn avideoWWBN AVideo has predictable default admin credentials in official Docker deployment path8.1 High
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_supplier.php sql injection5.3 Medium
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_employee.php sql injection5.1 Medium
- wwbn avideo-encoderAVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause8.6 High
- wwbn avideo-encoderAVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator9.3 Critical
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injection5.1 Medium
- frappe erpnextERP has a possibility SQL Injection vulnerability due to missing validation7.1 High
- dataease sqlbotSQLBot: RCE via SQL Injection in Excel Upload Endpoint8.6 High
- dataease sqlbotSQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL8.7 High
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injection5.1 Medium
- pjsip, pjsip pjproject +1 morePJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser8.4 High
- pjsip, pjsip pjproject +1 morePJSIP has ICE session use-after-free race conditions8.0 High
- stellarwp membership plugin – restrict contentMembership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect4.3 Medium
- coderevolution aimogen pro - all-in-one ai content writer, editor, chatbot & automation toolkitAimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call9.8 Critical
- comfast cf-ac100Comfast CF-AC100 mbox-config command injection5.1 Medium
- dataeaseDataEase is Vulnerable to H2 JDBC RCE Bypass7.7 High
- discourseDiscourse's unscoped status lookups leak restricted metadata5.3 Medium
- discourseDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check5.3 Medium
- discourseDiscourse has a poll authorization bypass via post_id array parameter5.3 Medium
- discourseDiscourse hasUnauthorized Exposure of Private User Action Types5.3 Medium
- discourseDiscourse has Unauthorized Post Data Exposure in discourse-user-notes5.3 Medium
- discourseDiscourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint2.2 Low
- openvessl anchorrAnchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS9.1 Critical
- openvessl anchorrAnchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config9.7 Critical
- comfast cf-ac100Comfast CF-AC100 mbox-config command injection5.1 Medium
- oracle identity manager, web services manager +1 moreVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST...9.8 Critical
- opensourcepos open source point of sale, opensourcepos +1 moreOpen Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality8.8 High
- comfast cf-ac100Comfast CF-AC100 mbox-config command injection5.1 Medium
- d-link dir-513, dlink dir-513 firmware +1 moreD-Link DIR-513 formSysCmd os command injection5.3 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification8.1 High
- Show moreLoading…