CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- squareapps my locationAn arbitrary file overwrite vulnerability in Squareapps LLC My Location Travel Timeline v11.80...8.4 High
- funair fly is funAn arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows...9.8 Critical
- triumph-adler mobile printAn arbitrary file overwrite vulnerability in PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001...8.4 High
- deftpdf document translatorAn arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers...9.8 Critical
- No product listedA directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1...7.6 High
- code-projects online food ordering systemcode-projects Online Food Ordering System Order order.php cross site scripting5.3 Medium
- tenda ch22, ch22 firmware +1 moreTenda CH22 Parameter QuickIndex formQuickIndex stack-based overflow8.7 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow8.7 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 Parameter setcfm fromSetCfm stack-based overflow8.7 High
- jhimross debugger & troubleshooterDebugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation8.8 High
- freerdpFreeRDP: Possible double free in kerberos_AcceptSecurityContext5.3 Medium
- freerdpFreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write7.1 High
- apache software foundation airflow provider for databricks, apache airflow providers databricks +1 moreApache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange4.8 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write7.5 High
- freerdpFreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read5.9 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write7.5 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS6.5 Medium
- freerdpFreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read7.1 High
- freerdpFreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks6.0 Medium
- freerdpFreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)6.9 Medium
- tenda ch22, ch22 firmware +1 moreTenda CH22 WriteFacMac FormWriteFacMac command injection5.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality9.8 Critical
- kyvernoCVE-2026-47899.8 Critical
- botan project botanBotan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field8.2 High
- botan project botanBotan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass5.9 Medium
- botan project botanBotan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)5.9 Medium
- frentix openolatOpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution8.8 High
- frentix openolatOpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow9.8 Critical
- tenda ch22, ch22 firmware +1 moreTenda CH22 createFileName formCreateFileName stack-based overflow8.7 High
- ci4-cms-erp ci4msCI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Critical
- ci4-cms-erp ci4msCI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Critical
- emqx nanomqNanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerable3.1 Low
- emqx nanomqnanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocket6.5 Medium
- code-projects accounting systemcode-projects Accounting System Parameter viewin_costumer.php sql injection6.9 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud page sql injection5.1 Medium
- tautulliTautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft7.4 High
- tautulliTautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters4.9 Medium
- tautulliTautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint8.7 High
- tautulliTautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server4.0 Medium
- tautulliTautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check7.5 High
telnyxPyPITelnyx has malicious code in PyPI versions 4.87.1 and 4.87.2No score- zcashfoundation zebra, zebra-consensus +1 moreZebra has a Consensus Failure due to Improper Verification of V5 Transactions8.4 High
- openclawOpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands5.3 Medium
- openclawOpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request7.2 High
openclawnpmOpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement6.5 Medium- openclawOpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence7.1 High
- openclawOpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation8.4 High
- yunaiv yudao-cloudYunaiV yudao-cloud get-by-website sql injection6.9 Medium
- openclawOpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint5.3 Medium
- openclawOpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing6.9 Medium
- Show moreLoading…