CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users1.3 Low
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL2.7 Low
- craftcms cms, craft cms +1 moreCraft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)4.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior8.6 High
- froxlorFroxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API8.6 High
- godoxyGoDoxy has a Path Traversal Vulnerability in its File API6.5 Medium
- parse-community parse-serverParse Server: Session update endpoint allows overwriting server-generated session fields5.3 Medium
- autheliaAuthelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting0.5 Low
- silabs.com simplicity installer tool (silicon labs tool - slt) for simplicity studio v6, simplicity studio v5 +1 moreCommand Execution vulnerability in Simplicity Installer2.1 Low
- sbtsbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows6.7 Medium
- parisneo lollms-webui, lollms web ui +1 moreLoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint9.1 Critical
- go-vikunja vikunjaVikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion6.9 Medium
- go-vikunja vikunjaVikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation7.5 High
- go-vikunja vikunjaVikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections6.4 Medium
- go-vikunja vikunjaVikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion8.1 High
- go-vikunja vikunjaWebhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API6.5 Medium
- go-vikunja vikunjaVikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read6.5 Medium
- go-vikunja vikunjaVikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources6.4 Medium
- go-vikunja vikunjaVikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect7.1 High
- go-vikunja vikunjaVikunja Desktop vulnerable to Remote Code Execution via same-window navigation6.5 Medium
- go-vikunja vikunjaVikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal6.4 Medium
- go-vikunja vikunjaVikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration6.5 Medium
- libtiff, debian linux, red hat ai inference server 3.2 +30 more +32 moreLibtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing7.8 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +9 more +11 moreNGINX ngx_mail_auth_http_module vulnerability8.7 High
- f5 nginx open source, nginx plus +1 moreNGINX ngx_stream_ssl_module vulnerability5.3 Medium
- f5 nginx open source, nginx plus +1 moreNGINX ngx_mail_proxy_module vulnerability6.3 Medium
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +9 more +11 moreNGINX ngx_http_dav_module vulnerability8.8 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +10 more +12 moreNGINX ngx_http_mp4_module vulnerability8.5 High
- f5 nginx open source, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreNGINX ngx_http_mp4_module vulnerability8.5 High
- langflowLangflow GitHub Actions Shell Injection9.1 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Firefox 149 and Thunderbird 1499.8 Critical
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Privacy: Anti-Tracking component6.5 Medium
- mozilla firefox, thunderbird +1 moreDenial-of-service in the Libraries component in NSS7.5 High
- mozilla firefox, thunderbird +1 moreDenial-of-service in the XML component7.5 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Graphics: Canvas2D component10.0 Critical
- mozilla firefox, thunderbird +1 moreUndefined behavior in the Audio/Video component9.1 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript Engine component9.8 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the IPC component8.8 High
- phreesoft phreebooks erp, phreebookserp +1 morePhreeBooks ERP 5.2.3 Remote Code Execution via Image Manager8.7 High
- tabs mail carrier, tabslab mailcarrier +1 moreTabs Mail Carrier 2.5.1 Buffer Overflow via MAIL FROM9.3 Critical
- winavi ipod/3gp/mp4/psp converterWinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of Service6.9 Medium
- direct-soft winmpg video convert, winmpg video convert local dos exploit +1 moreWinMPG Video Convert 9.3.5 Buffer Overflow Local Denial of Service6.9 Medium
- endonesia portaleNdonesia Portal v8.7 SQL Injection via banners.php8.8 High
- bootstrapy cmsBootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact Modules8.8 High
- netartmedia vlog systemNetartmedia Vlog System Lastest SQL Injection via email Parameter8.8 High
- inoutscripts inout article base cmsInout Article Base CMS Lastest SQL Injection via portalLogin.php8.8 High
- matri4web matrimony website scriptMatrimony Website Script M-Plus Multiple SQL Injection8.8 High
- meeplace business review scriptMeeplace Business Review Script Lastest SQL Injection via addclick.php7.1 High
- freshsoftware netstat proX-NetStat Pro 5.63 Local Buffer Overflow via EggHunter8.6 High
- Show moreLoading…