CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- code-projects simple laundry systemcode-projects Simple Laundry System Parameters viewdetail.php sql injection6.9 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s3.php cross site scripting4.8 Medium
- kingaddons king addons for elementor – 80+ elementor widgets, 4 000+ elementor templates, woocommerce, mega menu, popup builderKing Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure5.3 Medium
- shaonsina sina extension for elementorSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting…6.4 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s4.php cross site scripting4.8 Medium
- unknown trx addonsThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload5.3 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s5.php cross site scripting4.8 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s2.php cross site scripting4.8 Medium
- reviewx – multi-criteria reviews for woocommerce with google reviews & schemaReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure5.3 Medium
- reviewx – multi-criteria reviews for woocommerce with google reviews & schemaReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export5.3 Medium
- reviewx – multi-criteria reviews for woocommerce with google reviews & schemaReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution7.3 High
- sourcecodester simple e-learning systemSourceCodester Simple E-learning System User Profile Update sql injection5.3 Medium
- sourcecodester simple e-learning systemSourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection5.3 Medium
- kjur jsrsasignjsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations5.1 Medium
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Missing cryptographic validation during DSA signing enables private key extraction9.4 Critical
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation9.3 Critical
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs8.7 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass8.7 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic9.1 Critical
- reviewx – multi-criteria reviews for woocommerce with google reviews & schemaReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulat…6.5 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection5.3 Medium
- tenda a15, a15 firmware +1 moreTenda A15 UploadCfg stack-based overflow9.3 Critical
- belkin f9k1122, f9k1122 firmware +1 moreBelkin F9K1122 formWISP5G stack-based overflow8.7 High
- geovision gv-edge recording managerGeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege10.0 Critical
- tenda ac21, ac21 firmware +1 moreTenda AC21 SetNetControlList formSetQosBand buffer overflow8.7 High
grokOSS-FuzzHeap-use-after-free in tf::Executor::_invokeNo score- xnview nconvertXnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file6.2 Medium
- xnview nconvertXnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file.6.2 Medium
- No product listedA NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through...7.5 High
owntoneopenSUSEA NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone...7.5 High- strongswanstrongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow8.7 High
github.com/digitalocean/droplet-agentGo,govulncheck-vulndbopenSUSE +1 moreDigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint8.8 HighznunyDebian,otrs2Ubuntu +1 moreA Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl...6.1 Medium- phpgurukul vehicle record management systemA stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of...6.1 Medium
- phpgurukul vehicle record management systemA stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of...4.8 Medium
- phpgurukul vehicle record management systemMultiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of...4.8 Medium
- phpgurukul vehicle record management systemA stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of...4.8 Medium
- phpgurukul vehicle record management systemA stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of...4.8 Medium
- tikiA Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of...5.4 Medium
- tikiA Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in...5.4 Medium
- yangzongzhuan ruoyiyangzongzhuan RuoYi Quartz Job job code injection5.1 Medium
- No product listedMacCMS Member Order Detail User.php order_info authorization5.3 Medium
- flippercode wp maps – store locator,google maps,openstreetmap,mapbox,listing,directory & filtersWP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter7.5 High
- No product listedMacCMS Timming API Endpoint Timming.php weak authentication6.9 Medium
- linksys mr9600, mr9600 firmware +1 moreLinksys MR9600 SmartConnect.lua smartConnectConfigure os command injection8.7 High
- code-projects exam form submissioncode-projects Exam Form Submission update_s1.php cross site scripting5.3 Medium
- Show moreLoading…