CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- nvidia megatron-lm, megatron lm +1 moreNVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by...7.8 High
- nvidia megatron-lm, megatron lm +1 moreNVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an...7.8 High
- nvidia megatron-lm, megatron lm +1 moreNVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may...7.8 High
- nvidia megatron lm, megatron-lm +1 moreNVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could...7.8 High
- nvidia hgx and dgx b300NVIDIA B300 MCU contains a vulnerability in the CX8 MCU that could allow a malicious actor to...5.9 Medium
- nvidia snap-4 containerNVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker...6.8 Medium
- nvidia snap-4 containerNVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious...6.8 Medium
- hclsoftware travelerHCL Traveler is susceptible to a weak default HTTP header validation vulnerability6.3 Medium
- hclsoftware travelerHCL Traveler is affected by sensitive information disclosure4.3 Medium
- pinchtabPinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token4.8 Medium
- pinchtabPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution6.7 Medium
- pinchtabA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution6.1 Medium
- pinchtabPinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems4.3 Medium
- pinchtabPinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl4.1 Medium
- solidtimesolidtime vulnerable to IDOR in private projects6.5 Medium
- mobsf mobile-security-framework-mobsf, opensecurity mobile security framework +1 moreMobSF has SQL Injection in its SQLite Database Viewer Utils5.3 Medium
- emilstenstrom justhtmljusthtml before 1.13.0 XSS via code fence breakout5.1 Medium
- gtsteffaniak filebrowserFileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel5.3 Medium
- error311 fileriseFileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback7.1 High
- error311 fileriseFileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle8.1 High
- icalendariCalendar has ICS injection via unsanitized URI property values4.3 Medium
fido2-libnpmfido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing7.5 High- ubiquiti inc unifi network serverAn Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access...8.8 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad8.8 High
- astroAstro: Remote allowlist bypass via unanchored matchPathname wildcard2.9 Low
- withastro astro, astro \@astrojs\/vercel +1 moreAstro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`6.5 Medium
- withastro astro, astro \@astrojs\/node +1 moreAstro: Memory exhaustion DoS due to missing request body size limit in Server Islands5.9 Medium
- parse-community parse-serverParse Server: Auth data exposed via /users/me endpoint7.1 High
- zabbixAgent 2 Docker plugin arbitrary file read via Docker API injection6.1 Medium
- zabbixUnauthenticated arbitrary PHP class instantiation6.9 Medium
- parse-community parse-serverParse Server: MFA recovery code single-use bypass via concurrent requests2.1 Low
- zabbixBlind, read-only SQL injection in Zabbix API via sortfield parameter8.7 High
- zabbixHost and event action script regex validation can be bypassed in certain situations, leading to potential command injection7.7 High
- parse-community parse-serverParse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter8.6 High
- zabbixInsufficient isolation of JavaScript (Duktape) execution context on Zabbix Server7.1 High
- parse-community parse-serverParse Server: Denial of service via unindexed database query for unconfigured auth providers8.7 High
linux-aws-fipsUbuntulinux-aws-fips vulnerabilityNo score- pharos controls mosaic show controllerMissing Authentication for Critical Function in Pharos Controls Mosaic Show Controller9.3 Critical
amd64-microcodeTuxCareUpdate of amd64-microcodeNo score- ellite wallosWallos: Password Reset Tokens Never Expire6.5 Medium
- idrive cloud backup client for windowsIDrive Cloud Backup Client for Windows contains a privilege escalation vulnerability7.8 High
- ellite wallosWallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php7.1 High
- ellite wallosWallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint5.4 Medium
- ellite wallosWallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/308407.7 High
- ellite wallosWallos: SSRF via HTTP Proxy Environment Variable8.3 High
lkrgTuxCare,lkrg-loggerTuxCare,lkrg-systemdTuxCare +2 moreUpdate of lkrgNo scorelkrg-kmodTuxCareUpdate of lkrg-kmodNo score- libvnc libvncserverLibVNCServer httpd proxy NULL Pointer Dereference6.3 Medium
- libvnc libvncserverLibVNCServer UltraZip Encoding Heap Out-of-bounds Read6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions4.9 Medium
- Show moreLoading…