CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- wwbn avideoAVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)8.6 High
- wwbn avideoAVideo has an unauthenticated decrypt oracle leaking any ciphertext7.5 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration7.5 High
- parse-community parse-serverParse Server: LiveQuery subscription query depth bypass8.2 High
- wwbn avideoAVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload8.8 High
SHAdd0WTAka/Zen-Ai-PentestGitHub ActionsZen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow10.0 Critical- wpchill kali forms — contact form & drag-and-drop builderKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process9.8 Critical
- the browsercompany of new york arcsearch, thebrowser arc search +1 moreAddress bar spoofing risk in ArcSearch on Android7.4 High
- wwbn avideoAVideo has Unauthenticated SSRF via plugin/Live/test.php9.3 Critical
- wwbn avideoAVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin5.3 Medium
- wwbn avideoAVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization5.4 Medium
- wwbn avideoAVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php6.1 Medium
- parse-community parse-serverParse Server: Query condition depth bypass via pre-validation transform pipeline8.7 High
- langflowLangflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading8.7 High
- ory ketoOry Keto has a SQL injection via forged pagination tokens7.2 High
- ory hydraOry Hydra has a SQL injection via forged pagination tokens7.2 High
- go-kratos kratosOry Kratos has a SQL injection via forged pagination tokens7.2 High
- ory oathkeeperOry Oathkeeper has a path traversal authorization bypass10.0 Critical
- ory oathkeeperOry Oathkeeper has an authentication bypass by cache key confusion8.1 High
- ory oathkeeperOry Oathkeeper has an authentication bypass by usage of untrusted header6.5 Medium
- h3h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes3.7 Low
- h3js h3h3 before 1.15.9 Path Traversal via Double Decoding8.2 High
- wwbn avideoAVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter7.1 High
- wwbn avideoAVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration7.3 High
- wwbn avideoAVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin7.4 High
- kyselyKysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings8.1 High
- kyselyKysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.8.1 High
- etcdetcd: Authorization bypasses in multiple APIs8.8 High
- minioMinIO: LDAP login brute-force via user enumeration and missing rate limit9.1 Critical
- wwbn avideoAVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter7.5 High
- langflowLangflow has Unauthenticated IDOR on Image Downloads7.5 High
- wwbn avideoAVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php7.5 High
- wwbn avideoAVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()8.1 High
- anchore syftSyft improper temporary file cleanup5.3 Medium
- parse-community parse-serverParse Server: Protected field change detection oracle via LiveQuery watch parameter6.3 Medium
- nimble-platform common@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch8.9 High
- pdfme schemaspdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label2.1 Low
- pdfme pdf-libpdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb7.1 High
- parse-community parse-serverParse Server: LiveQuery bypasses CLP pointer permission enforcement7.1 High
- wwbn avideoAVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy8.6 High
- wwbn avideoAVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin8.8 High
- wwbn avideoAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection10.0 Critical
- b3log siyuanSiYuan has an Unauthenticated Arbitrary File Read via Path Traversal7.5 High
- go-vikunja vikunjaVikunja Affected by DoS via Image Preview Generation6.5 Medium
- go-vikunja vikunjaVikunja has TOTP Reuse During Validity Window5.7 Medium
- dicebear@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection7.5 High
- etcdetcd: Nested etcd transactions bypass RBAC authorization checks0.0 None
- effect-ts effectEffect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC7.4 High
- struktur libde265NULL Pointer Dereference in libde2658.7 High
- struktur libde265heap out-of-bounds write in libde265 1.0.165.5 Medium
- Show moreLoading…