CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- craftcms cmsCraft CMS - Authorization Bypass in assets/preview-file Endpoint5.3 Medium
- error311 fileriseFileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content4.3 Medium
- blakeblackshear frigateFrigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp6.5 Medium
- blakeblackshear frigateAuthenticated Frigate users can read the full unredacted configuration via `/api/config/raw6.5 Medium
- stirling pdf, stirling-tools stirling-pdf +1 moreStirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export5.4 Medium
- stirling pdf, stirling-tools stirling-pdf +1 moreStirling-PDF vulnerable to DoS via add-watermark6.5 Medium
- go-vikunja vikunjaVikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR9.3 Critical
- h3 srvxsrvx is vulnerable to middleware bypass via absolute URI in request line4.8 Medium
- libpngLIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch647.6 High
- libpngLIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`7.5 High
- ciliumCilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic5.4 Medium
- sakailms sakaiSAK-52311: Sakai site-manage group titles can contain XSS content1.3 Low
- datadog dd-trace-javadd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution9.3 Critical
- linuxfoundation everest, everest everest-core +1 moreEVerest has RemoteStop Bypass via BCB Toggle Session Restart5.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has Delayed Authorization Response Bypasses Termination After RemoteStop5.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio8.2 High
- linuxfoundation everest, everest everest-core +1 moreEVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted5.0 Medium
- openclawOpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read8.7 High
- linuxfoundation everest, everest everest-core +1 moreEVerest: ISO15118 session_setup use-after-free can crash EVSE process5.5 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state5.5 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state5.5 Medium
- mattermost, mattermost server +1 moreArbitrary File Read via Advanced Logging Support Packet6.8 Medium
- mattermost, mattermost server +1 moreMissing timestamp validation in Zoom webhook handler2.2 Low
- linuxfoundation everest, everest everest-core +1 moreEVerest EvseManager phase-switch path has unsynchronized shared-state access race condition4.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has use-after-free in auth timeout timer via race condition5.3 Medium
- mattermost, mattermost server +1 moreGuest users can view group member IDs without respecting view restrictions4.3 Medium
- mattermost, mattermost server +1 moreZip Bomb Denial of Service via Unrestricted Archive Decompression6.5 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race7.0 High
- mattermost, mattermost server +1 moreImproper Input Validation in Zoom Plugin Webhook Handler4.9 Medium
- mattermost, mattermost server +1 moremmctl export download command doesn’t restrict permissions to created file to file owner5.0 Medium
- mattermost, mattermost server +1 moreTerminal Escape Injection in mmctl Report Posts Command8.0 High
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue5.9 Medium
- nodejs node, node.js, red hat enterprise linux 10 +7 more +9 moreA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received...7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user...5.9 Medium
- nodejs node, node.js +1 moreA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream...5.3 Medium
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()`...3.3 Low
- nodejs node, node.js +1 moreAn incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the...3.3 Low
- nodejs node, node.js +1 moreA flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric...5.9 Medium
- freedesktop polkit, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePolkit: polkit: denial of service via unbounded input processing through standard input5.5 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map4.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free4.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash4.6 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes7.5 High
- linuxfoundation everest, everest everest-core +1 moreEVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ8.4 High
- linuxfoundation everest, everest everest-core +1 moreEVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload8.8 High
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability5.9 Medium
- siemens cpci85 central processing/communication, sicore base system +1 moreA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions <...8.7 High
- siemens cpci85 central processing/communication, rtum85 rtu base +1 moreA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions <...7.1 High
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability6.1 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing8.4 High
- Show moreLoading…