CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- zscaler client connectorIncorrect startup configuration in ZCC5.4 Medium
- floragunn search guard flx, search-guard flx +1 moreSome management operations on data streams are not properly restricted when user does not have the necessary privileges6.8 Medium
- parse-community parse-serverParse Server: Cloud function validator bypass via prototype chain traversal9.1 Critical
- floragunn search guard flx, search-guard flx +1 moreOpen redirect vulnerability in Search Guard Kibana Plugin via manipulated requests4.3 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreCommand Injection in mlflow/mlflow9.6 Critical
- openclawOpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider6.9 Medium
- openclawOpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation8.6 High
- openclawOpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters7.1 High
- openclawOpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication6.3 Medium
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval9.4 Critical
- openclawOpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions5.3 Medium
- openclawOpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve8.6 High
- openclawOpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel6.9 Medium
- nhost cli, nhost +1 moreNhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port7.7 High
- checkmkStored cross-site scripting in Pending Changes sidebar8.5 High
- checkmkXSS in Unified Search via Unescaped Host/Service Names8.6 High
- fastgptFastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft10.0 Critical
- fastgptServer-Side Request Forgery via MCP Tools Endpoint in FastGPT7.7 High
- pengutronix raucRAUC: Improper Signing of Plain Bundles Exceeding 2 GiB7.2 High
- artifex mupdfCVE-2026-33087.8 High
- powerdns dnsdistUse after free when parsing EDNS options in Lua4.8 Medium
- powerdns dnsdistOut-of-bounds write when rewriting large DNS packets5.9 Medium
- powerdns dnsdistUnbounded memory allocation for DoQ and DoH35.3 Medium
- powerdns dnsdistDNS over HTTPS ACL bypass6.5 Medium
- powerdns dnsdistOut-of-bounds read when parsing DNS packets via Lua5.3 Medium
- powerdns dnsdistInformation disclosure via CORS misconfiguration3.1 Low
- powerdns dnsdistHTML injection in the web dashboard3.1 Low
- cato networks socketCato's Socket WebUI is vulnerable to OS Command Injection8.3 High
- yves sereal::encoder, sereal\ +1 moreSereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library8.1 High
- yves sereal::decoder, sereal\ +1 moreSereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library8.1 High
- teckel minify htmlMinify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update5.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignmen…4.3 Medium
- code-projects student membership systemcode-projects Student Membership System Admin Login index.php sql injection6.9 Medium
- extend themes kubio ai page builderWordPress Kubio AI Page Builder plugin <= 2.7.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- 1millionbot millie chat, millie chatbot +1 moreMultiple vulnerabilities in 1millionbot Millie chatbot7.0 High
- 1millionbot millie chat, millie chatbot +1 moreMultiple vulnerabilities in 1millionbot Millie chatbot8.7 High
- mock business::onlinepayment::storedtransaction, business\ +1 moreBusiness::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key9.1 Critical
- code-projects student membership systemcode-projects Student Membership System delete_user.php sql injection5.3 Medium
- umami software application softwareSQL inyection in Umami Software application9.3 Critical
- code-projects student membership systemcode-projects Student Membership System delete_member.php sql injection5.3 Medium
- teampassMultiple vulnerabilities in Teampass9.3 Critical
- anon proxy server proxy server, anonproxyserver anon proxy server +1 moreReflected Cross-Site Scripting on Anon Proxy Server5.1 Medium
- anon proxy server proxy server, anonproxyserver anon proxy server +1 moreReflected Cross-Site Scripting in Anon Proxy Server5.1 Medium
- teampassMultiple vulnerabilities in Teampass9.3 Critical
- anon proxy server proxy server, anonproxyserver anon proxy server +1 moreReflected Cross-Site Scripting on Anon Proxy Server5.1 Medium
- 3ds 3dexperience, dassault systèmes delmia factory resource manager +1 morePath Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x7.1 High
- 3ds 3dexperience, dassault systèmes delmia factory resource manager +1 moreStored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x8.7 High
- 3ds 3dexperience, dassault systèmes enovia collaborative industry innovator +1 moreStored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x8.7 High
- gnome gdk-pixbuf, red hat ai inference server 3.2, ai inference server 3.3 +35 more +37 moreGdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image7.5 High
- code-projects student membership systemcode-projects Student Membership System User Registration sql injection6.9 Medium
- Show moreLoading…