CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- wisdomlogix fonts manager | custom fontsFonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter7.5 High
- acumenconsulting smarter analyticsSmarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter5.3 Medium
- flightbycanto cantoCanto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload5.3 Medium
- thoefter cms commander – manage multiple sitesCMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter8.8 High
- silvercover mylinksdumpmyLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters7.2 High
- wpxpo wowoptin: next-gen popup maker – create stunning popups and optins for lead generationWowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API7.2 High
- longturn freeciv21Crash when receiving specially-crafted packets7.5 High
- roxnor emailkit – email customizer for woocommerce & wpEmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter4.9 Medium
- optimizingmatters autoptimizeAutoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes6.4 Medium
- sweetdaisy86 repairbuddy – repair shop crm & booking plugin for wordpressRepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action5.3 Medium
- wpsaad image alt text manager – bulk & dynamic alt tags for image seo optimization + aiImage Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title6.4 Medium
- itracker360iTracker360 <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field6.1 Medium
- anssilaitila contact list – online staff directory & address bookContact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter6.4 Medium
- optimizingmatters autoptimizeAutoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value6.4 Medium
- demonisblack scoreboard for html5 games liteScoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- fahadmahmood keep backup dailyKeep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title4.4 Medium
- fahadmahmood injection guardInjection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name7.2 High
- fahadmahmood keep backup dailyKeep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter2.7 Low
- discourseDiscourse Allows Unauthorized Access to Deleted Posts Index via Group Membership4.9 Medium
- discourseDiscourse Authorization Page Displays Unvalidated Redirect Domain2.7 Low
- automated logic webctrl premium serverAutomated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information9.1 Critical
- automated logic webctrl premium serverAutomated Logic WebCTRL Premium Server Authentication Bypass by Spoofing7.5 High
- discourseDiscourse users can edit or synonymize hidden tags they can't see3.5 Low
- automated logic webctrl premium serverAutomated Logic WebCTRL Premium Server Multiple Binds to the Same Port7.7 High
- discourseDiscourse has inferable private group membership or existence via exclude_groups parameter6.9 Medium
- discoursePM access granted through invites after access revocation5.9 Medium
- discourseDiscourse staff can modify any user's group notification level1.3 Low
- igl-technologies eparking.fiIGL-Technologies eParking.fi Insufficiently Protected Credentials6.9 Medium
- discourseDiscourse exposes ip_address of flagged user3.5 Low
- igl eparking.fiIGL-Technologies eParking.fi Insufficient Session Expiration6.9 Medium
- discourseDiscourse's solved topic stream has potential stored XSS in topic title5.4 Medium
- igl eparking.fiIGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts8.7 High
- discourseDiscourse user can create Zendesk tickets even when it does not have access to topic5.1 Medium
- igl eparking.fiIGL-Technologies eParking.fi Missing Authentication for Critical Function9.3 Critical
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU7.8 High
- discourseDiscourse has a Hidden Solved topics permission bypass5.4 Medium
- denx u-bootDas U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because...8.2 High
- bareboxbarebox: FIT Signature Verification Bypass Vulnerability8.3 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation9.6 Critical
- ctek chargeportalCTEK Chargeportal Insufficiently Protected Credentials6.9 Medium
- ctek chargeportal, charge portal +1 moreCTEK Chargeportal Insufficient Session Expiration6.9 Medium
- ctek chargeportal, charge portal +1 moreCTEK Chargeportal Improper Restriction of Excessive Authentication Attempts8.7 High
- ctek chargeportal, charge portal +1 moreCTEK Chargeportal Missing Authentication for Critical Function9.3 Critical
- halloyHalloy has insecure file permissions on credential files4.8 Medium
- halloyHalloy has a file transfer path traveral vulnerability8.7 High
- No product listedPbootCMS Member Login MemberController.php checkUsername sql injection6.9 Medium
- kubernetes csi driver for nfsCSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server6.5 Medium
- mindinventory mindsqlMindinventory MindSQL mindsql_core.py ask_db sql injection5.3 Medium
- mindinventory mindsqlMindinventory MindSQL mindsql_core.py ask_db code injection5.3 Medium
- red hat openshift ai (rhoai)Feast: unauthenticated arbitrary file read7.5 High
- Show moreLoading…