CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- ahsanriaz26gmailcom sales and inventory systemA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory...6.1 Medium
- clineDSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability...9.8 Critical
- presidio hai buildIn its design for automatic terminal command execution, HAI Build Code Generator offers two...9.8 Critical
- roocode roo codeRoo Code's command auto-approval module contains a critical OS command injection vulnerability...9.8 Critical
- rahmanazhar sakadevIn its design for automatic terminal command execution, SakaDev offers two options: Execute safe...9.8 Critical
- orangecat syntxSyntx's command auto-approval module contains a critical OS command injection vulnerability that...9.8 Critical
- No product listedMultiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software...6.1 Medium
- openairinterfaceOpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures...7.5 High
- cloudark kubeplusIn KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF...7.6 High
- schemaheroSQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert...7.4 High
- invoiceninja invoice ninjaInvoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in...7.7 High
- getgrav gravGrav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload...7.6 High
- mrcmsMRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file...5.3 Medium
- theunwindai awesome llm appsA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in...8.2 High
- No product listedIncorrect access control in the file_details.asp endpoint of DDSN Interactive Acora CMS v10.7.1...6.5 Medium
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreImproper Handling of Parameters in GitLab8.1 High
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R Parameter cstecgi.cgi setLanCfg command injection5.3 Medium
- perlPerl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib9.8 Critical
- nsa ghidraNSA Ghidra Auto-Analysis Annotation Command Execution8.8 High
- lollms, parisneo parisneo/lollms +1 moreUnauthenticated File Upload in parisneo/lollms7.5 High
- lollms, parisneo parisneo/lollms +1 moreServer-Side Request Forgery (SSRF) in parisneo/lollms7.5 High
- lollms, parisneo parisneo/lollms +1 moreInsecure Direct Object Reference (IDOR) in parisneo/lollms8.3 High
- xiongmai dvr/nvr devicesIn Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command...8.8 High
- openclawOpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval Prompt5.3 Medium
- openclawOpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass6.9 Medium
- openclawOpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation6.3 Medium
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke6.9 Medium
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession6.1 Medium
- openclawOpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks6.9 Medium
- openclawOpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing6.9 Medium
- openclawOpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel Extensions5.3 Medium
- openclawOpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName2.3 Low
- openclawOpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution7.1 High
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route7.1 High
- mikro-orm mikroorm, mikro-orm +1 moreMikroORM has Prototype Pollution in Utils.merge8.3 High
- mikro-orm mikroorm, mikro-orm +1 moreMikroORM is vulnerable to SQL Injection via specially crafted object9.3 Critical
- avideoAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php8.7 High
- njzjz wenxianwenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`9.8 Critical
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 moreTraefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)7.8 HighopenccnpmOpenCC has an Out-of-bounds read when processing truncated UTF-8 input6.5 Mediumgithub.com/bishopfox/sliverGoSliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted7.1 High- parse-community parse-serverParse Server: MFA single-use token bypass via concurrent authData login requests2.1 Low
- basecamp trixTrix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)2.1 Low
mppcrates.iompp has multiple payment bypass and griefing vulnerabilities9.3 Criticalmppxnpmmppx has multiple payment bypass and griefing vulnerabilities9.3 Critical- parse-community parse-serverParse Server: Auth data exposed via verify password endpoint8.2 High
- trinoTrino: Iceberg REST catalog static and vended credentials are accessible via query JSON7.7 High
- wevm mppxmppx has Stripe charge credential replay via missing idempotency check6.0 Medium
- wevm mppxmppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality7.5 High
- tenda fh1201, fh1201 firmware +1 moreTenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow8.7 High
- Show moreLoading…