CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible XSS vulnerability in SafeBuffer#%5.3 Medium
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible ReDoS vulnerability in number_to_delimited6.9 Medium
- blinkoBlinko: Admin RCE - MCP Server Command Injection8.6 High
- rails actionviewRails has a possible XSS vulnerability in its Action View tag helpers2.3 Low
- blinkoBlinko: Unauthorized Path Traversal File Enumeration - music-metadata6.9 Medium
- blinkoBlinko: multiple interfaces in the comment feature allow unauthorized access6.9 Medium
- blinkoBlinko: IDOR - user.detail Endpoint Leaks Superadmin Token6.0 Medium
- rubyonrails rails, rails actionpack +1 moreRails has a possible XSS vulnerability in its Action Pack debug exceptions1.3 Low
- cern indicoIndico discloses local files resulting in Remote Code Execution through LaTeX injection7.7 High
- blinkoBlinko: Unauthorized User Information Leak6.9 Medium
- blinkoBlinko: Low Privilege User Privilege Escalation - upsertUser Endpoint5.3 Medium
- opensource-workshop connect-cmsConnect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information8.1 High
- opensource-workshop connect-cmsConnect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature7.5 High
- opensource-workshop connect-cmsConnect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin6.8 Medium
- opensource-workshop connect-cmsConnect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin8.2 High
- opensource-workshop connect-cmsConnect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View8.7 High
- opensource-workshop connect-cmsConnect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin8.8 High
- blinkoBlinko: Authenticated Arbitrary File Write - saveAdditionalDevFile5.3 Medium
- blinkoBlinko: Authenticated Arbitrary File Write - saveDevPlugin5.3 Medium
- blinkoBlinko: Unauthorized Arbitrary File Read - /plugins6.9 Medium
- blinkoBlinko: Unauthorized Arbitrary File Read - /api/file/temp8.2 High
- citrix netscaler, netscaler gateway, netscaler adc +2 more +4 moreInsufficient input validation leading to memory overread9.3 Critical
- 648540858 wvp-gb28181-pro648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection5.3 Medium
- netscaler adc, gateway +1 moreRace Condition leading to User Session Mixup7.7 High
- systemdsystemd: Local unprivileged user can trigger an assert5.5 Medium
- salesforce marketing cloud engagementImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability...9.4 Critical
- newapi new api, quantumnous new-api +1 moreNew API has passkey-based secure step-up verification bypass for root-only channel secret disclosure4.9 Medium
- projectworlds lawyer management system, online lawyer management system +1 moreprojectworlds Lawyer Management System lawyers.php cross site scripting5.1 Medium
- newapi new api, quantumnous new-api +1 moreNew API: IDOR in VideoProxy allows cross-user video content access via missing ownership check6.5 Medium
- mantisbtMantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline8.6 High
- mantisbtMantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation8.6 High
- mantisbtMantisBT SOAP API has an authentication bypass vulnerability on MySQL9.3 Critical
- mailenableMailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter5.1 Medium
- mailenableMailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter5.1 Medium
- mailenableMailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex Parameter5.1 Medium
- putyourlightson craft-sprigSprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground5.5 Medium
- agronholm cbor2cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads7.5 High
- wwbn avideoAVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php7.1 High
- wwbn avideoAVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php8.6 High
- wwbn avideoAVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort8.8 High
- wwbn avideoAVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php9.4 Critical
- wwbn avideoAVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()5.3 Medium
- wwbn avideoAVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint5.3 Medium
- wwbn avideoAVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data5.3 Medium
- pegasystems pega robot studioAn arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.9.0 Critical
- wwbn avideoAVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field5.4 Medium
- wwbn avideoAVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name7.2 High
- wwbn avideoAVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()8.1 High
- code-projects exam form submissioncode-projects Exam Form Submission update_s6.php cross site scripting4.8 Medium
- tp-link systems inc. td-w8961n v4.0, tp-link td-w8961nd firmware +1 moreDenial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N7.1 High
- Show moreLoading…