CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- invoiceshelfInvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field7.6 High
- invoiceshelfInvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field7.6 High
- parse-community parse-serverParse Server: Streaming file download bypasses afterFind file trigger authorization8.2 High
- libops captcha-protect, captcha protect +1 moreCaptcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template6.1 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow8.7 High
- nautobotNautobot: Management of users via REST API does not apply configured password validators2.7 Low
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key names8.1 High
- lodash, lodash lodash-amd, lodash-es +2 more +4 morelodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`6.5 Medium
- anritsu remote spectrum monitor ms27100a, remote spectrum monitor ms27101a, remote spectrum monitor ms27102a +1 more +3 moreMissing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor9.3 Critical
- sourcecodester leave application systemSourceCodester Leave Application System file inclusion6.9 Medium
- sourcecodester leave application systemSourceCodester Leave Application System User Management cross site scripting4.8 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.4.8 Medium
- discourseDiscourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure5.1 Medium
- discourseDiscourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint5.3 Medium
- discourseDiscourse: Group SMTP test endpoint susceptible to SSRF5.3 Medium
- discourseDiscourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions6.3 Medium
- discourseDiscourse: Authorization bypass in oneboxer via user-controlled category id4.3 Medium
- discourseDiscourse: Missing post-level authorization allows whisper metadata disclosure5.3 Medium
- discourseDiscourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories6.3 Medium
- discourseDiscourse: Unauthorized channel membership inference via excluded_memberships_channel_id4.3 Medium
- discourseDiscourse: Category group moderators can perform actions on topics in restricted categories without read access5.3 Medium
- discourseDiscourse: Stored XSS via unescaped assignee name2.1 Low
- discourseDiscourse: XSS on category description update via API5.4 Medium
- discourseDiscourse: Stored XSS in discourse-ai shared conversations onebox5.3 Medium
- discourseDiscourse: Admin-only report can be exported by moderators5.3 Medium
- discourseDiscourse: Open redirect via `sso_destination_url` cookie in `enter`5.1 Medium
- discoursediscourse-subscriptions plugin leaking stripe API key in multisite environment2.0 Low
- code-projects simple gym management systemcode-projects Simple Gym Management System Payment sql injection5.3 Medium
- microfocus operations agentPrivilege escalation vulnerability in Operations Agent8.6 High
- aws aws-c-event-streamAWS C Event Stream Streaming Decoder Stack Buffer Overflow7.7 High
- scitokens scitokens-cpp, cpp library +1 moreSciTokens C++: Relative Path Traversal Vulnerability8.3 High
- scitokens scitokens-cpp, cpp library +1 moreSciTokens C++: Sibling-Path Authorization Bypass8.1 High
- No product listedchatwoot Webhook API trigger.rb Trigger server-side request forgery5.3 Medium
- nvidia bionemo frameworkNVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted...7.8 High
- nvidia bionemo frameworkNVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted...8.8 High
- nvidia jetson linux, jetson xavier series, jetson orin series and jetson thor +1 moreNVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical...7.6 High
- nvidia jetson linux, jetson xavier series, jetson orin series and jetson thor +1 moreNVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not...5.2 Medium
- nvidia jetson xavier series and jetson orin series, jetson linux +1 moreNVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an...8.3 High
- jjnapiork pagi::middleware::session::store::cookie, pagi\ +1 morePAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely7.5 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflow8.7 High
- cmsmadesimple cms made simpleCMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal5.1 Medium
- appsup-dart josejose vulnerable to untrusted JWK header key acceptance during signature verification7.5 High
- teluu pjsip, pjsip pjproject +1 morePJSIP: Heap OOB read in VPX unpacketizer6.9 Medium
- anthropic claude, claude desktop - windows +1 moreUncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe)...4.7 Medium
- bishopfox sliverSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface5.9 Medium
- craigjbass clearancekitClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modification6.3 Medium
- parse-community parse-serverParse Server: LiveQuery protected-field guard bypass via array-like logical operator value5.3 Medium
- parse-community parse-serverParse Server: Session field immutability bypass via falsy-value guard5.3 Medium
- parse-community parse-serverParse Server: GraphQL complexity validator exponential fragment traversal DoS8.2 High
- floragunn search guard flx, search-guard flx +1 moreSearch Guard audit logs can contain under certain conditions user credentials4.9 Medium
- Show moreLoading…