CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- bochsBochs 2.6-5 Buffer Overflow Remote Code Execution9.3 Critical
- invisible-island mawkMAWK 1.3.3-17 Stack-Based Buffer Overflow9.3 Critical
- varaneckas jad java decompilerJAD 1.5.8e-1kali1 Stack-Based Buffer Overflow9.3 Critical
- msk mapscrnMapscrn 2.0.3 Stack-Based Buffer Overflow8.6 High
- ticalc tiemuTiEmu 2.08 Stack-Based Buffer Overflow Vulnerability9.3 Critical
- varaneckas jad java decompilerJAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Execution9.3 Critical
- iselectiSelect 1.4.0-2+b1 Local Buffer Overflow via key parameter8.6 High
- ekg gaduEKG Gadu 1.9 Local Buffer Overflow via Username Parameter8.6 High
- zftp clientzFTP Client 20061220+dfsg3-4.1 Local Buffer Overflow8.6 High
- hnb, hnb project hierarchical notebook +1 moreHNB Organizer 1.9.18-10 Local Buffer Overflow via -rc Parameter8.6 High
- pinfoPInfo 0.6.9-5.1 Local Buffer Overflow via -m Parameter8.6 High
- nrss, nrss reader +1 moreNRSS RSS Reader 0.3.9-1 Stack Buffer Overflow8.6 High
- trn threaded usenet news readerTRN 3.6-23 Stack Buffer Overflow Local Code Execution8.6 High
- yasr screen readerYasr 0.6.9-5 Buffer Overflow via Command-line Parameter8.6 High
- ticalc texas instrument emulatorTiEmu 3.03-nogdb+dfsg-3 Buffer Overflow via ROM Parameter8.6 High
- mamedev mess emulatorMulti Emulator Super System 0.154-3.1 Buffer Overflow8.6 High
- werner ytreeyTree 1.94-1.1 Stack-Based Buffer Overflow8.6 High
- identicalsoftware xwpexwpe 1.5.30a-2.1 Stack-based Buffer Overflow8.6 High
- sinaptik ai pandasaiSinaptik AI PandasAI pandasai-lancedb Extension lancedb.py get_relevant_docs_by_id sql injection6.9 Medium
- wpquads quads ads manager for google adsenseQuads Ads Manager for Google AdSense <= 2.0.98.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters5.4 Medium
- microchip time provider 4100, timeprovider 4100 firmware +1 moreHardcoded Upgrade Decryption Passwords5.5 Medium
- wandb openuiwandb OpenUI Window Message Event index.html cross site scripting5.1 Medium
- softaculous page builder: pagelayer – drag and drop website builderPagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'5.3 Medium
- wandb openuiwandb OpenUI APIStatusError server.py generic_exception_handler information exposure5.1 Medium
- wandb openuiwandb OpenUI config.py hard-coded credentials4.8 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenf_tables: nft_dynset: fix possible stateful expression memleak in error path5.5 Medium
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token6.5 Medium
- unknown restaurant cafeteriaRestaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation5.4 Medium
- laborator oxygen - woocommerce wordpress themeOxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path7.2 High
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'7.5 High
luceneOSS-FuzzSecurity exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCIINo score- zephyrproject zephyrnet: eswifi socket send payload length not bounded7.3 High
- openclawOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting6.3 Medium
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass5.3 Medium
- openclawOpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices6.9 Medium
- openclawOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting6.3 Medium
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope8.7 High
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect8.5 High
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim8.7 High
- openclawOpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint7.2 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag8.0 High
- minioMinIO is Vulnerable to SSE Metadata Injection via Replication Headers7.1 High
AWSSDK.CloudFrontNuGet,AWSSDK.Extensions.CloudFront.SignersNuGet +1 moreAWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction7.7 High- benmcollins libjwtLibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing5.8 Medium
- zcashfoundation zebra, zebra-chain +1 moreZebra node crash — V5 transaction hash panic (P2P reachable)9.2 Critical
- giskard giskard-agent, giskard-agents, giskard-ai giskard-oss +2 moreGiskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment7.7 High
- labredescefetrj wegiaWeGIA has SQL Injection in deletar_tag.php8.8 High
- wandb openuiwandb OpenUI HTMLAnnotator server.py get_share HTML injection5.3 Medium
- qdocs smart school management systemQDOCS Smart School Management System Admission Enquiry enquiry cross site scripting5.1 Medium
- streetwriters notesnook web/desktop, notesnook desktop +1 moreNotesnook vulnerable to RCE via stored XSS in Note History diff viewer8.6 High
- Show moreLoading…