CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- pixarra twistedbrush pro studioTwistedBrush Pro Studio 24.06 Resize Image Denial of Service6.9 Medium
- pixarra twistedbrush pro studioTwistedBrush Pro Studio 24.06 Script Recorder Denial of Service6.9 Medium
- tomabo mp4 converterTomabo MP4 Converter 3.25.22 Denial of Service via Name Field6.8 Medium
- cewe photo importer, cewe-photoworld cewe photo importer +1 moreCEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed Image6.9 Medium
- cewe photo show, cewe-photoworld cewe photo show +1 moreCEWE PHOTO SHOW 6.4.3 Denial of Service via Password Field8.7 High
- sandboxieSandboxie 5.30 Denial of Service via Program Alerts Buffer Overflow6.9 Medium
- verypdf encrypt pdfEncrypt PDF 2.3 Denial of Service via Buffer Overflow6.9 Medium
- verypdf, verypdf pcl converter +1 moreVeryPDF PCL Converter 2.7 Denial of Service via PDF Security6.9 Medium
- bluestacksBlueStacks 4.80.0.1060 Denial of Service via Search Field6.9 Medium
- infiltration-systems netawareNetAware 1.20 Denial of Service via Add Block Buffer Overflow6.9 Medium
- infiltration-systems netawareNetAware 1.20 Share Name Denial of Service6.9 Medium
- lizardsystems terminal services managerTerminal Services Manager 3.2.1 Local Buffer Overflow Denial of Service6.9 Medium
- pidginPidgin 2.13.0 Denial of Service via Malformed Username6.9 Medium
- deepwisdom metagptFoundation Agents MetaGPT operator.py code_generate code injection5.3 Medium
- No product listedPbootCMS Backend UserController.php access control5.3 Medium
- vanna-ai vannavanna-ai vanna base.py ask sql injection5.3 Medium
- vanna-ai vannavanna-ai vanna legacy exec injection5.3 Medium
- No product listedPbootCMS Parameter MemberController.php alert_location cross site scripting5.3 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field7.5 High
- No product listedPbootCMS File Upload file.php incomplete blacklist5.3 Medium
- creativedev4 show posts list – easy designs, filters and moreShow Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- benmoody content syndication toolkitContent Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- waianaeboy702 ed's social shareEd's Social Share <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- jeremyshapiro fusedeskFuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute6.4 Medium
- agence web eoxia - montpellier task managerTask Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter6.5 Medium
- ketanmujumdar mandatory fieldMandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields4.4 Medium
- systemsrtk ricerca – advanced searchRicerca – advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings4.4 Medium
- wpweaver weaver show postsWeaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting4.4 Medium
- peacefulqode pq addons – creative elementor widgetsPQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes6.4 Medium
- hoosierdragon text toggleText Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- phy9pas post snippitsPost Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update6.1 Medium
- neo2oo5 neos connector for fakturamaNeos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Update4.3 Medium
- mooeypoo wikilookupWikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting4.4 Medium
- husobj expire usersExpire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields8.8 High
- revukangaroo review map by revukangarooReview Map by RevuKangaroo <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- codeclove hr press liteHr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure6.5 Medium
- sherkspear sherk custom post type displaysSherk Custom Post Type Displays <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- wpdive elementcampElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter6.5 Medium
- intermod comment spam wiperComment SPAM Wiper <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting4.4 Medium
- agence web eoxia - montpellier task managerTask Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- viaviwebtech twitter feedsTwitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute6.4 Medium
- qrolic performance monitorPerformance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- logichunt logo slider wp – responsive logo carousel, logo gallery & logo showcaseLogo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode6.4 Medium
- punnel – landing page builderPunnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action5.3 Medium
- jeric izon schema shortcodeSchema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- minnur integration with hubspot formsIntegration with Hubspot Forms <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- gbsdeveloper multi post carousel by categoryMulti Post Carousel by Category <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute6.4 Medium
- swergroup paypal shortcodesPaypal Shortcodes <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes6.4 Medium
- basiliskan comment geniusComment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- arevico multi functional flexi lightboxMulti Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter5.5 Medium
- Show moreLoading…