CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- color iccdeviccDEV: HBO in icMemDump()6.2 Medium
- color iccdeviccDEV: HBO in CTiffImg::WriteLine()6.2 Medium
- color iccdeviccDEV: UB in CIccOpDefEnvVar::Exec()6.2 Medium
- color iccdeviccDEV: SO in SIccCalcOp::ArgsUsed()6.2 Medium
- color iccdeviccDEV: SEGV in CIccTagArray::Cleanup()6.2 Medium
- color iccdeviccDEV: HBO in CIccMpeSpectralMatrix::Describe()6.2 Medium
- color iccdeviccDEV: UB in CIccCalculatorFunc::ApplySequence()6.2 Medium
- b3log siyuanSiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )8.6 High
- b3log siyuanSiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution8.6 High
- b3log siyuanSiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection9.7 Critical
- b3log siyuanSiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client9.1 Critical
- b3log siyuanSiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content7.5 High
- anthropic claude sdk for typescript, anthropics anthropic-sdk-typescript +1 moreClaude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories6.3 Medium
- anthropic claude sdk for python, anthropics anthropic-sdk-python +1 moreClaude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory Tool4.8 Medium
- anthropic claude sdk for python, anthropics anthropic-sdk-python +1 moreClaude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape5.8 Medium
- freescoutFreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout5.4 Medium
- freescoutFreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()6.9 Medium
- yhirose cpp-httplibcpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body4.8 Medium
- aptrsAPTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint9.4 Critical
- nuxt og image, nuxt-modules og-image +1 moreNuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes6.1 Medium
- nuxt og image, nuxt-modules og-image +1 moreNuxt OG Image vulnerable to DoS via image generation6.9 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow8.7 High
- microsoft xml notepad, xmlnotepad +1 moreXML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading6.5 Medium
- alertaalerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API6.9 Medium
- wwbn avideoAVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation6.5 Medium
- wwbn avideoAVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php6.1 Medium
- wwbn avideoAVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter4.3 Medium
- wwbn avideoAVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug6.5 Medium
- wwbn avideoAVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard6.5 Medium
- wwbn avideoAVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints5.3 Medium
- wwbn avideoAVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php7.5 High
- wwbn avideoAVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification6.4 Medium
- wwbn avideoAVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins6.5 Medium
- wwbn avideoAVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users6.5 Medium
- wwbn avideoAVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel6.1 Medium
- wwbn avideoAVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking8.1 High
- wwbn avideoAVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php6.5 Medium
- admidioAdmidio: Missing CSRF Protection on Registration Approval Actions4.5 Medium
- admidioAdmidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter4.3 Medium
- admidioAdmidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php4.6 Medium
- admidioAdmidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess7.5 High
- mrmn2 pdfdingPdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download Endpoints6.5 Medium
- px4 autopilotPX4 Autopilot Missing authentication for critical function9.3 Critical
- sonicwall email securityA vulnerability exists in the SonicWall Email Security appliance due to improper input...3.8 Low
- sonicwall email securityA denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall...2.7 Low
- sonicwall email securityA stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email...4.8 Medium
- invoiceshelfInvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field7.6 High
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow8.7 High
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow8.7 High
- Show moreLoading…