CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +22 more +24 moreForge has signature forgery in RSA-PKCS due to ASN.1 extra field7.5 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +17 more +19 moreForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input7.5 High
- code-projects online food ordering systemcode-projects Online Food Ordering System localhost.sql privilege escalation6.9 Medium
- code-projects online food ordering systemcode-projects Online Food Ordering System food.php cross site scripting4.8 Medium
@apollo/servernpm,apollo-server-corenpm,@rootio/apollo__serverRoot +1 more +3 moreApollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention6.3 Medium- openclawOpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update6.9 Medium
- red hat openshift ai (rhoai), redhat openshift ai, red hat openshift ai 2.25 +2 moreLlama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy8.1 High
- openclawOpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool6.0 Medium
- openclawOpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution6.9 Medium
- openclawOpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat6.3 Medium
- openclawOpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Action5.3 Medium
- openclawOpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter6.3 Medium
- openclawOpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation8.7 High
- openclawOpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook6.0 Medium
- openclawOpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk2.3 Low
- openclawOpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist6.3 Medium
- openclawOpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM6.9 Medium
- openclawOpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands7.1 High
cosignopenSUSESecurity update for cosignNo score- openclawOpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch6.9 Medium
- internationalization project internationalization, drupal internationalization (i18n) - i18n node submodule +1 moreAccess bypass in Drupal 7 i18n_node translation UI5.3 Medium
- tp-link systems inc. tl-wr850n v3, tp-link tl-wr850n firmware +1 moreCleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850N5.1 Medium
- openclawOpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots7.1 High
- openclawOpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions2.3 Low
- drupal file (field) paths, deciphered filefield paths +1 moreInformation disclosure via file URI overwrite in File (Field) Paths6.9 Medium
- kestraKestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields7.3 High
- grassroots dicom (gdcm)Grassroots DICOM Missing release of memory after effective lifetime8.7 High
- code-projects online food ordering systemcode-projects Online Food Ordering System contact.php cross site scripting5.3 Medium
- farisc0de uploadyUploady Vulnerable to Stored Cross-Site Scripting (XSS)4.6 Medium
- shaneisrael fireshareFireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`7.1 High
- getoutline outlineOutline has a rate limit bypass that allows brute force of email login OTP9.1 Critical
- invoiceninja invoice ninja, invoiceninja +1 moreInvoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes5.4 Medium
- tp-link systems inc. tl-wr841n v14, tp-link tl-wr841n firmware +1 moreDenial-of-Service Vulnerability in UPnP Component of TP Link's TL-WR841N7.1 High
- miraheze tsportalTSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service6.5 Medium
- lycheeorg lycheeLychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)4.8 Medium
- grafana, grafana oss +1 moreMissing Protected-field Authorization in Provisioning Contact Points API5.4 Medium
- grafana, grafana oss +1 moreGrafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS6.5 Medium
- lycheeorg lycheeLychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs2.3 Low
- lycheeorg lycheeLychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked5.3 Medium
- openclawOpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization7.7 High
- openclawOpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI8.7 High
- openclawOpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook6.9 Medium
- openclawOpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery5.1 Medium
- openclawOpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses6.9 Medium
- edgelesssys contrastContrast before 1.18.0 AML Injection Remote Code Execution8.4 High
- inventreeInvenTree has Path Traversal In Report Templates4.9 Medium
- inventreeInvenTree Vulnerable to ORM Filter Injection7.7 High
- craigjbass clearancekitClearanceKit: opfilter policy bypass via exchangedata and clone operations8.4 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake6.5 Medium
- openclawOpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface8.6 High
- Show moreLoading…