CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the Layout: Text and Fonts component9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Web Codecs component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions, integer overflow in the Graphics component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Playback component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape in the Responsive Design Mode component10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the CSS Parsing and Computation component9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component8.6 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to use-after-free in the Disability Access APIs component10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Telemetry component8.6 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Graphics: Canvas2D component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Graphics: Canvas2D component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreRace condition, use-after-free in the Graphics: WebRender component7.5 High
- freeipmiipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The...7.5 High
- concretecms concrete cmsConcreteCMS is vulnerable to Denial of Service During Bulk Downloads6.5 Medium
- idreamsoft icmsiCMS v8.0.0 contains a Cross-Site Scripting (XSS) vulnerability in the User Management component,...6.1 Medium
- esiclivreSQL injection in Solicitante::resetaSenha() in esiclivre/esiclivre v0.2.2 and earlier allows...6.5 Medium
- free5gcAn issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via...7.5 High
- jizhicmsJiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the...5.4 Medium
- dedecmsDedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in ...8.8 High
- wp-graphqlWPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permission4.3 Medium
- sourcecodester online catering reservationSourceCodester Online Catering Reservation search.php sql injection6.9 Medium
- itsourcecode sanitize or validate this inputitsourcecode sanitize or validate this input Parameter subjects.php sql injection5.3 Medium
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion8.1 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation5.4 Medium
- artbees jupiter x coreJupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import8.8 High
- acowebs woocommerce custom product addons proWoocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula9.8 Critical
- sourcecodester e-commerce siteSourceCodester E-Commerce Site products.php sql injection6.9 Medium
- wpjobportal wp job portal – ai-powered recruitment system for company or job board websiteWP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter7.5 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion4.3 Medium
- inc2734 smart custom fieldsSmart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search4.3 Medium
- expresstech quiz and survey master (qsm) – easy quiz and survey makerQuiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter6.5 Medium
- itsourcecode free hotel reservation systemitsourcecode Free Hotel Reservation System Parameter index.php sql injection6.9 Medium
- h3js h3h3 before 2.0.1-rc.18 Open Redirect via redirectBack()5.3 Medium
- ptc flexplm, windchill pdmlink +1 moreCritical Remote Code Execution vulnerability reported in Windchill9.3 Critical
- aquasec setup-trivy, trivy, aquasecurity trivy-action +3 more +5 moreTrivy ecosystem supply chain briefly compromised9.4 Critical
- h3js h3h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie8.7 High
- roadiz core-bundle-dev-appRoadiz has Server-Side Request Forgery (SSRF) in roadiz/documents6.8 Medium
- beeware briefcaseBriefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions7.3 High
- gstreamer, debian linux, freedesktop gst-plugins-good +6 more +8 moreGstreamer: incomplete fix of cve-2026-19405.1 Medium
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has possible glob injection in its DiskService6.6 Medium
- rubyonrails rails, rails activestorage, red hat 3scale api management platform 2 +2 moreRails Active Storage has possible Path Traversal in DiskService8.0 High
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible DoS vulnerability in its number helpers6.6 Medium
- totolink x6000r, x6000r firmware +1 moreTOTOLINK X6000R shttpd setLanCfg privilege escalation8.6 High
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests6.6 Medium
- census cswebCensus CSWeb leaked configuration files9.3 Critical
- census cswebCensus CSWeb stored XSS5.1 Medium
- census cswebCensus CSWeb arbitrary file upload8.7 High
- census cswebCensus CSWeb path traversal8.7 High
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has possible content type bypass via metadata in direct uploads5.3 Medium
- Show moreLoading…