CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- wecodex sat cfdiSAT CFDI 3.3 SQL Injection via signIn endpoint8.8 High
- wecodex school management system cmsSchool Management System CMS 1.0 Admin Login SQL Injection7.1 High
- wecodex hotel cmsWecodex Hotel CMS 1.0 SQL Injection via Admin Login8.8 High
- wecodex restaurant cmsWecodex Restaurant CMS 1.0 SQL Injection via Login8.8 High
- wecodex shipping system cmsShipping System CMS 1.0 SQL Injection via admin login8.8 High
- smallsrv small http, small http server +1 moreMultiple vulnerabilities in Small HTTP server by Smallsrv8.7 High
- plank laravel-mediableUnsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable9.3 Critical
- vienna symphonic library gmbh assistantMissing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library8.8 High
- mattermost, mattermost server +1 moreInsufficient authorization in shared channel membership sync grants team-level access instead of channel-level access5.4 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreicmp: fix NULL pointer dereference in icmp_tag_validation()5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenfnetlink_osf: validate individual option lengths in fingerprints7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morewifi: mac80211: fix NULL deref in mesh_matches_local()5.5 Medium
- hijiffy chatbotIncorrect authorization in HiJiffy Chatbot6.9 Medium
- hijiffy chatbotIncorrect authorization in HiJiffy Chatbot6.9 Medium
- utt hiper 1250gwUTT HiPER 1250GW Parameter formConfigDnsFilterGlobal strcpy buffer overflow8.7 High
- wavlink wl-nu516u1, wl-nu516u1 firmware +1 moreWavlink WL-NU516U1 nas.cgi ftext stack-based overflow8.7 High
- 648540858 wvp-gb28181-pro648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization6.9 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System Parameter checkregisitem.php sql injection6.9 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System Parameter modify.php cross site scripting5.3 Medium
- bentomlBentoML has Dockerfile Command Injection via system_packages in bentofile.yaml7.8 High
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.13 +7 more +9 moreOrg.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation3.1 Low
- dameng100 muucmfdameng100 muucmf list.html cross site scripting5.3 Medium
- ratoc systems, inc. raid monitoring manager for windowsThe installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation...8.5 High
- ratoc systems, inc. raid monitoring manager for windowsThe installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load...8.4 High
- dameng100 muucmfdameng100 muucmf list.html cross site scripting5.3 Medium
- freebsdRemote code execution via RPCSEC_GSS packet validation8.8 High
- freebsdRemote denial of service via null pointer dereference7.5 High
- freebsdTCP: remotely exploitable DoS vector (mbuf leak)7.5 High
- unknown leadconnectorLeadConnector < 3.0.22 - Unauthenticated Rest Call5.3 Medium
- unknown wp lightbox 2WP Lightbox 2 < 3.0.7 - Admin+ Stored XSS4.8 Medium
- unknown responsive plusResponsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- unknown shared filesShared Files < 1.7.58 - Contributor+ Arbitrary File Download6.8 Medium
- dameng100 muucmfdameng100 muucmf autoReply.html cross site scripting5.3 Medium
- dameng100 muucmfdameng100 muucmf index.html cross site scripting5.3 Medium
- elemntor elementor website builder – more than just a page builderElementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template4.3 Medium
- code-projects online food ordering systemcode-projects Online Food Ordering System Admin Login admin.php sql injection6.9 Medium
- itsourcecode online enrollment systemitsourcecode Online Enrollment System Parameter index.php sql injection6.9 Medium
- hupe13 dsgvo snippet for leaflet map and its extensionsDSGVO snippet for Leaflet Map and its Extensions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute6.4 Medium
- green house co., ltd. digital photo frame gh-wdf10aDigital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an active debug code...7.0 High
- code-projects online food ordering systemcode-projects Online Food Ordering System Shopping Cart cart.php sql injection6.9 Medium
- netcore power 15axNetcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection8.7 High
- specialk simple download counterSimple Download Counter <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute6.4 Medium
- specialk blackhole for bad botsBlackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header7.2 High
- trainingbusinesspros formlift for infusionsoft web formsFormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow5.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaAmelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change8.8 High
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action4.3 Medium
- code-projects food ordering systemSourceCodester Food Ordering System Parameter purchase.php sql injection6.9 Medium
- sourcecodester malawi online marketSourceCodester Malawi Online Market display.php sql injection6.9 Medium
- shortpixel image optimizer – optimize images, convert webp & avifShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title5.4 Medium
- xenioushk bwl advanced faq manager liteBWL Advanced FAQ Manager Lite <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode Attribute6.4 Medium
- Show moreLoading…