CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- bakkbone floristpress for woo – customize your ecommerce store for your floristFloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameter6.1 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts7.2 High
- miyagawa plack::middleware::session::cookie, plack\ +1 morePlack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution9.8 Critical
- asus firmware, router +1 moreA Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Web management...8.6 High
- code-projects accounting systemcode-projects Accounting System delete.php sql injection5.3 Medium
- code-projects accounting systemcode-projects Accounting System Web Application add_costumer.php cross site scripting5.1 Medium
- masteriyo lms – online course builder for elearning, lms & educationMasteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator8.8 High
- orc discountOrc discount Markdown markdown.c compile recursion4.8 Medium
- kalcaddle kodboxkalcaddle kodbox Password-protected Share auth.class.php can improper authentication6.3 Medium
- saloonSaloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)8.1 High
- kalcaddle kodboxkalcaddle kodbox Public Share userShare.class.php add privilege escalation6.3 Medium
popplerOSS-FuzzUNKNOWN READ in XRef::constructObjectEntryNo score- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid vulnerable to Denial of Service in ICP Request handling9.2 Critical
- squid-cache squidSquid has issues in ICP message handling6.9 Medium
- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid has Denial of Service in ICP Response handling8.7 High
- openbao, red hat cryostat 4 +1 moreOpenBao has Reflected XSS in its OIDC authentication error message9.4 Critical
- openbao, red hat cryostat 4 +1 moreOpenBao lacks user confirmation for OIDC direct callback mode9.6 Critical
- thedaylightstudio fuel cmsDaylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the ...7.7 High
- thedaylightstudio fuel cmsAn issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset...9.1 Critical
- thedaylightstudio dwoo, fuel cms +1 moreAn issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to...9.8 Critical
- auntvt timoCross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.6.1 Medium
- zerbea hcxtoolsBuffer Overflow vulnerability in ZerBea hcxpcapngtool v. 7.0.1-43-g2ee308e allows a local...6.2 Medium
- workflowfirst staffwikiA cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7...6.1 Medium
- lightcms project lightcmsA reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2...6.1 Medium
- yzmcmsA reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS...6.1 Medium
- getkirby kirbyWithdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload6.5 Medium
- containers crunCrun incorrectly parses `crun exec` option `-u`, leading to privilege escalation0.0 None
- open-emr openemrOpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data7.7 High
- open-emr openemrOpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification8.1 High
- open-emr openemrOpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler7.1 High
- open-emr openemrOpenEMR has Improper ACL On Import/Export Popup5.4 Medium
- open-emr openemrOpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures4.3 Medium
- open-emr openemrReflected XSS via Unescaped contextName Parameter in Custom Template Editor6.1 Medium
- open-emr openemrOpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes7.6 High
- open-emr openemrOpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access6.5 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injection5.3 Medium
- open-emr openemrOpenEMR Missing Authorization on Claim File Download Endpoint7.6 High
- open-emr openemrOpenEMR has SQL Injection in CAMOS Form8.8 High
- wpjobportal wp job portal – ai-powered recruitment system for company or job board websiteWP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field8.8 High
- open-emr openemrOpenEMR Missing ACL Checks on Insurance Company API Routes5.4 Medium
- open-emr openemrOpenEMR has SQL Injection in PostCalendar Category Delete7.2 High
- open-emr openemrOpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files7.7 High
- open-emr openemrOpenEMR has reflected XSS in ajax_download.php via reportID parameter5.4 Medium
- open-emr openemrOpenEMR vulnerable to reflected XSS in graphs.php via title parameter5.4 Medium
- open-emr openemrOpenEMR has a SQL Injection Vulnerability in patient selection7.2 High
- open-emr openemrOpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing5.9 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injection5.3 Medium
- open-emr openemrOpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC38.7 High
- open-emr openemrOpenEMR has IDOR in Fee Sheet Product Save6.5 Medium
- open-emr openemrOpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php8.1 High
- Show moreLoading…