CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- fleetdm fleetFleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts5.7 Medium
- fleetdm fleetFleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin6.3 Medium
- fleetdm fleetFleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database6.2 Medium
- fleetdm fleetFleet's team maintainer can transfer hosts from any team via missing source team authorization4.9 Medium
- code-projects social networking sitecode-projects Social Networking Site Endpoint delete_photos.php sql injection5.3 Medium
- code-projects social networking sitecode-projects Social Networking Site Alert home.php cross site scripting5.1 Medium
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 moreHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options8.3 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation7.5 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion9.8 Critical
- yahoo serialize, serialize-javascript +1 moreSerialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects5.9 Medium
- fleetdm fleetFleet's unbounded request body read allows remote Denial of Service8.7 High
- wwbn avideoAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page8.2 High
- fleetdm fleetFleet: Password reset tokens remain valid after password change for 24 hours6.0 Medium
- wwbn avideoAVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key9.1 Critical
- wazuh, wazuh provisioning scripts (agent build environment) +1 moreWazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE6.3 Medium
- wwbn avideoAVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification5.3 Medium
- wwbn avideoAVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance5.3 Medium
- wwbn avideoAVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php5.3 Medium
- n8nn8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL4.8 Medium
- n8nn8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field5.1 Medium
- n8nn8n - Cross-Site Scripting and Open Redirect in Form Node5.1 Medium
- n8nn8n - Stored Cross-Site Scripting in Form Trigger Node5.1 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php6.5 Medium
- wazuh, wazuh (github actions) +1 moreWazuh GitHub Actions Workflow Exposure of Sensitive Credentials8.3 High
- pyloadpyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration9.3 Critical
- locutusLocutus Prototype Pollution due to incomplete fix for CVE-2026-255216.3 Medium
- locutusLocutus has Prototype Pollution via __proto__ Key Injection in unserialize()6.9 Medium
- express xss sanitizer project xss sanitizer, ahmedadelfahim express-xss-sanitizer +1 moreExpress XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)8.2 High
- moby, docker engine +1 moreMoby: AuthZ plugin bypass with oversized request body8.8 High
- sourcecodester diary appSourceCodester Diary App diary.php cross-site request forgery5.3 Medium
- itsourcecode free hotel reservation systemitsourcecode Free Hotel Reservation System index.php sql injection5.3 Medium
- lettaletta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection6.9 Medium
- moby, docker engine, red hat multicluster engine for kubernetes +7 more +9 moreMoby: Off-by-one error in plugin privilege validation6.8 Medium
- lettaletta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgery5.3 Medium
- huggingface smolagentshuggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection5.3 Medium
- uvnc ultravncUltraVNC Service version.dll uncontrolled search path7.3 High
- wwbn avideoAVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()5.4 Medium
- wwbn avideoAVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications5.4 Medium
- wazuh, wazuh wazuh-agent, wazuh-manager +2 moreWazuh Agent and Manager OS Command Injection and Untrusted Search Path7.1 High
- wwbn avideoAVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking6.3 Medium
- appsmithAppsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs6.9 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreUnauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow8.1 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via malformed http request headers8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 moreUndertow: undertow: request smuggling via `\r\r\r` as a header block terminator8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via inconsistent header parsing8.7 High
- tenda ac6, ac6 firmware +1 moreTenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow8.7 High
- tenda ac6, ac6 firmware +1 moreTenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow8.7 High
- tlsfuzzer ecdsa, python-ecdsa +1 morepython-ecdsa: Denial of Service via improper DER length validation in crafted private keys5.3 Medium
- Show moreLoading…