CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- b3log siyuanSiYuan has Arbitrary Document Reading within the Publishing Service9.8 Critical
- yansongda payWeChat Pay callback signature verification bypassed when Host header is localhost8.6 High
- n8nn8n Vulnerable to LDAP Filter Injection in LDAP Node6.3 Medium
- n8nn8n Vulnerable to XSS via Binary Data Inline HTML Rendering6.3 Medium
- n8nn8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no6.3 Medium
- domoticzDomoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint4.8 Medium
- n8nn8n Has External Secrets Authorization Bypass in Credential Saving7.3 High
- n8nn8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK6.3 Medium
- golang tiff, golang.org/x/image golang.org/x/image/tiff +1 moreOOM from malicious IFD offset in golang.org/x/image/tiff5.3 Medium
- n8nn8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expression8.7 High
- harttle liquidjsLiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern7.5 High
- harttle liquidjsLiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash7.5 High
- n8nn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE9.4 Critical
@grackle-ai/servernpm@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling2.1 Low@grackle-ai/servernpm@grackle-ai/server has a Missing Secure Flag on Session Cookie2.3 Low- n8nn8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover8.8 High
@grackle-ai/servernpm@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers5.3 Medium@grackle-ai/powerlinenpm@grackle-ai/powerline Runs Without Authentication by Default6.3 Medium@grackle-ai/servernpm@grackle-ai/server has Missing WebSocket Origin Header Validation7.1 High@grackle-ai/mcpnpm@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool8.6 High@grackle-ai/servernpm@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template2.3 Low- n8nn8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition8.5 High
- n8nn8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode9.4 Critical
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead7.5 High
- modoboaModoboa has an OS Command Injection7.2 High
- devolutions server, hypr +1 moreAuthorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege...5.6 Medium
- n8nn8n has In-Process Memory Disclosure in its Task Runner7.1 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway has an Insufficient Session Expiration4.9 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type5.5 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms has a potential Unprotected Transport of Credentials6.5 Medium
- psf requestsRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility function4.4 Medium
- devolutions serverIncorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This...5.8 Medium
- fontconfigfontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling,...5.9 Medium
- gitlabImproper Validation of Specified Quantity in Input in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authentication for Critical Function in GitLab6.8 Medium
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab6.8 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab5.4 Medium
- gitlabImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab7.7 High
- gitlabCross-Site Request Forgery (CSRF) in GitLab8.1 High
- gitlabInefficient Algorithmic Complexity in GitLab7.5 High
- mattermost, mattermost server +1 moreCSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint4.6 Medium
- mattermost, mattermost server +1 moreDoS via URL Previews Rendering Malicious SVGs4.3 Medium
- mattermost, mattermost server +1 moreAccount Takeover via Substring Matching in OpenID Connect Authentication5.7 Medium
- mattermost, mattermost server +1 moreDenial of Service via HTTP/2 single packet attack on login endpoint4.3 Medium
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability9.1 Critical
- icopydoc yml for yandex marketWordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerability6.8 Medium
- wp folio team ppwpWordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerability5.4 Medium
- Show moreLoading…