CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- qnap qunetswitchQuNetSwitch5.7 Medium
- tenda a18 proTenda A18 Pro fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow8.7 High
- graphitiGraphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names9.1 Critical
- precurio intranet portalPrecurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload8.6 High
- textpattern, textpattern cms +1 moreTextpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection5.1 Medium
- utt hiper 1250gwUTT HiPER 1250GW setSysAdm strcpy buffer overflow8.7 High
- python, python software foundation cpython, red hat ai inference server 3.2 +24 more +26 morewebbrowser.open() allows leading dashes in URLs7.0 High
- go-vikunja vikunjaRead-only Vikunja users can delete project background images via broken object-level authorization5.3 Medium
- go-vikunja vikunjaVikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers5.3 Medium
- utt hiper 1200gwUTT HiPER 1200GW websHostFilter strcpy buffer overflow8.7 High
- d-link dir-513, dlink dir-513 firmware +1 moreD-Link DIR-513 Web Service formEasySetPassword stack-based overflow8.7 High
- itsourcecode college management systemitsourcecode College Management System search_student.php sql injection5.3 Medium
- gainsight assistGainsight Assist reflected XSS/HTML injection6.1 Medium
- gainsight assistGainsight Assist plugin information disclosure5.3 Medium
- devolutions serverImproper certificate validation in the PAM propagation WinRM connections allows a network...8.1 High
tokio-signalcrates.io`tokio-signal` is unmaintainedNo scoretokio-udpcrates.io`tokio-udp` is unmaintainedNo scoretokio-executorcrates.io`tokio-executor` is unmaintainedNo scoretokio-compatcrates.io`tokio-compat` is unmaintainedNo scoretokio-fscrates.io`tokio-fs` is unmaintainedNo scoretokio-timercrates.io`tokio-timer` is unmaintainedNo scoretokio-tcpcrates.io`tokio-tcp` is unmaintainedNo scoretokio-iocrates.io`tokio-io` is unmaintainedNo scoretokio-reactorcrates.io`tokio-reactor` is unmaintainedNo scoretokio-codeccrates.io`tokio-codec` is unmaintainedNo scoretokio-processcrates.io`tokio-process` is unmaintainedNo scoretokio-current-threadcrates.io`tokio-current-thread` is unmaintainedNo scoretokio-tlscrates.io`tokio-tls` is unmaintainedNo scoretokio-synccrates.io`tokio-sync` is unmaintainedNo scoretokio-threadpoolcrates.io`tokio-threadpool` is unmaintainedNo scoretokio-udscrates.io`tokio-uds` is unmaintainedNo score- rustls webpkirustls-webpki before 0.103.10 CRL Revocation Check Bypass5.9 Medium
- labredescefetrj wegiaWeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameter9.3 Critical
- labredescefetrj wegiaWeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter9.3 Critical
- labredescefetrj wegiaWeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter9.3 Critical
- labredescefetrj wegiaWeGIA has an arbitrary SQL execution vulnerability via crafted backup archive8.6 High
- traefikTraefik: BasicAuth Middleware Timing Attack Allows Username Enumeration6.3 Medium
- getgreenshot greenshotGreenshot Vulnerable to OS Command Injection via ExternalCommand Plugin6.5 Medium
- traefik, red hat openshift dev spaces 3.27, openshift dev spaces 3.28 +1 more +3 moreTraefik mTLS bypass via fragmented ClientHello SNI extraction failure7.8 High
- uptime.kuma uptime kuma, louislam uptime-kuma +1 moreUptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)6.5 Medium
- themerex melaniaWordPress Melania theme <= 2.5.0 - Local File Inclusion vulnerability8.1 High
- totalsuite totalcontest liteWordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability6.3 Medium
- blakeblackshear frigateFrigate has insecure password change functionality8.6 High
- joshuae1974 flash video playerWordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability7.1 High
- vasilis triantafyllou special box for contentWordPress Download Special Box for Content plugin <= 1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- qwikQwik has array method pollution in FormData processing, allowing type confusion and DoS7.5 High
- stirling pdf, stirling-tools stirling-pdf +1 moreStirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction8.1 High
- fastgptFastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml9.4 Critical
- error311 fileriseFileRise: Default Encryption Key Enables Token Forgery and Config Decryption8.2 High
- error311 fileriseFileRise: WebDAV upload path bypasses filename validation enforced by regular uploads4.3 Medium
- Show moreLoading…