CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- openclawOpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl Parameters7.1 High
- openclawOpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts6.9 Medium
- vim, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreVim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in...9.2 Critical
- broadcom data loss preventionElevation of Privileges in Symantec Data Loss Prevention Windows Endpoint7.8 High
- parse-community parse-serverParse Server: GraphQL API endpoint ignores CORS origin restriction5.3 Medium
- trueconf client, trueconf +1 moreTrueConf Client Update Integrity Verification Bypass7.8 High
- suluSulu checks fix permissions for subentities endpoints5.3 Medium
- sourcecodester rss feed parserSourceCodester RSS Feed Parser file_get_contents server-side request forgery5.3 Medium
- parse-community parse-serverParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers8.2 High
- lfprojects mcp java sdk, modelcontextprotocol java-sdk +1 moreMCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)6.1 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft9.3 Critical
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing5.8 Medium
- django slippersSlippers: Cross-Site Scripting (XSS) in `attrs` Template Tag6.1 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core7.4 High
- go-gitgo-git: Maliciously crafted idx file can cause asymmetric memory consumption5.0 Medium
- nocobaseNocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node10.0 Critical
- gnu glibc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreiconv crash due to assertion failure with untrusted input7.5 High
- docker model runner, model-runner +1 moreDocker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)6.8 Medium
- tinacms, ssw tinacms\/graphql +1 more@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files8.1 High
- openscOpenSC: Stack-buffer-overflow WRITE in card-oberthur3.8 Low
- go-gitgo-git: Missing validation decoding Index v4 files leads to panic2.8 Low
- openscOpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers3.9 Low
- nicolargo glancesGlances Vulnerable to Command Injection via Dynamic Configuration Values7.8 High
- openscOpenSC: Out of Bounds vulnerability3.9 Low
- nicolargo glancesGlances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard7.1 High
- raine consult-llm-mcpraine consult-llm-mcp server.ts child_process.execSync os command injection4.8 Medium
- openscOpenSC: Stack-buffer-overflow WRITE in GET RESPONSE3.8 Low
- @clerk expressSmoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url Parameter5.1 Medium
- @clerk expressSmoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP Parameter5.1 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover9.8 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys8.8 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: DoS via Negative Integer Input in Logrotate Interval6.9 Medium
- 0xjacky nginx-ui, nginxui nginx ui, uozi cosy +2 moreNginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse7.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory6.9 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui Backup Restore Allows Tampering with Encrypted Backups9.4 Critical
- ci4-cms-erp ci4msCI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS4.7 Medium
- gotenbergGotenberg: Chromium deny-list bypass via case-insensitive URL scheme7.8 High
- osrg gobgposrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control6.3 Medium
- crewaiCVE-2026-22857.5 High
- crewaiCVE-2026-22869.8 Critical
- crewaiCVE-2026-22879.8 Critical
- crewaiCVE-2026-22759.6 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUsers could trigger a crash of mongod primaries during promotion to sharded6.0 Medium
- osrg gobgposrg GoBGP bgp.go DecodeFromBytes off-by-one6.3 Medium
- redhat virtio-win, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreVirtio-win: virtio-win: memory corruption via use-after-free in virtio blk device reset6.7 Medium
- redhat virtio-win, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreVirtio-win: virtio-win: denial of service via unvalidated descriptor count in unmap request6.7 Medium
- osrg gobgposrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control6.3 Medium
- bluekitchen gmbh btstackBlueKitchen BTstack < 1.8.1 AVRCP Browsing Target GET_FOLDER_ITEMS Handler OOB Read / Undefined Behavior2.1 Low
- bluekitchen gmbh btstackBlueKitchen BTstack < 1.8.1 AVRCP Controller GET_PLAYER_APPLICATION_SETTING_*_TEXT Handlers OOB Read2.1 Low
- bluekitchen gmbh btstackBlueKitchen BTstack < 1.8.1 AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_* Handlers OOB Read2.1 Low
- Show moreLoading…