Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2026

342 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 4

  • CVE-2026-3395
    23Monitor

    MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

    MediumCVSS 5.5Proof of conceptEPSS 2%

    max-3000 · maxsite cmsMar 1, 2026

  • CVE-2026-26720
    39Monitor

    An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    twenty · twentyMar 2, 2026

  • CVE-2026-21385
    61This week

    Integer Overflow or Wraparound in Graphics

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    qualcomm · sm7675p firmwareMar 2, 2026

  • CVE-2026-28286
    39Monitor

    ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    zimaspace · zimaosMar 2, 2026

  • CVE-2026-28358
    10Monitor

    NocoDB: User Enumeration via Password Reset Endpoint

    LowCVSS 2.7Proof of conceptEPSS 0%

    nocodb · nocodbMar 2, 2026

  • CVE-2026-3180
    30Monitor

    Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 0%

    contest-gallery · contest gallery – upload & vote photos, media, sell with paypal & stripeMar 2, 2026

  • CVE-2026-0006
    39Monitor

    In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    google · androidMar 2, 2026

  • CVE-2026-0010
    33Monitor

    In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check.

    HighCVSS 8.4Proof of conceptEPSS 0%

    google · androidMar 2, 2026

  • CVE-2026-0013
    33Monitor

    In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy.

    HighCVSS 8.4Proof of conceptEPSS 0%

    google · androidMar 2, 2026

  • CVE-2026-0014
    24Monitor

    In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation.

    MediumCVSS 6.2Proof of conceptEPSS 0%

    google · androidMar 2, 2026

  • CVE-2026-0023
    31Monitor

    In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permis

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidMar 2, 2026

  • CVE-2026-0047
    33Monitor

    In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permis

    HighCVSS 8.4Proof of conceptEPSS 0%

    google · androidMar 2, 2026

  • CVE-2026-2256
    26Monitor

    Command injection vulnerability in ModelScope's ms-agent

    MediumCVSS 6.5Proof of conceptEPSS 1%

    modelscope · ms-agentMar 2, 2026

  • CVE-2026-1492
    47Plan

    User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderMar 3, 2026

  • CVE-2025-59059
    39Monitor

    Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    apache · rangerMar 3, 2026

  • CVE-2025-66680
    28Monitor

    An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files v

    HighCVSS 7.1Proof of conceptEPSS 0%

    wisecleaner · wise force deleterMar 3, 2026

  • CVE-2026-3494
    21Monitor

    MariaDB Server Audit Plugin Comment Handling Bypass

    MediumCVSS 5.3Proof of conceptEPSS 0%

    mariadb · mariadbMar 3, 2026

  • CVE-2026-24415
    20Monitor

    OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter

    MediumCVSS 5.1Proof of conceptEPSS 0%

    devcode · openstamanagerMar 3, 2026

  • CVE-2026-27971
    37Monitor

    Qwik affected by unauthenticated RCE via server$ Deserialization

    CriticalCVSS 9.2Proof of conceptEPSS 2%

    qwik · qwikMar 3, 2026

  • CVE-2026-28289
    33Monitor

    FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

    HighCVSS 8.1WeaponizedEPSS 2%

    freescout · freescoutMar 3, 2026

  • CVE-2026-1980
    21Monitor

    WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    iqonicdesign · wpbookitMar 3, 2026

  • CVE-2026-2025
    30Monitor

    Mail Mint < 1.19.5 - Unauthenticated Emails Disclosure

    HighCVSS 7.5Proof of conceptEPSS 1%

    unknown · mail mintMar 4, 2026

  • CVE-2023-7337
    30Monitor

    JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie

    HighCVSS 7.5Proof of conceptEPSS 1%

    rabilal · js help desk – ai-powered support & ticketing systemMar 4, 2026

  • CVE-2025-70341
    31Monitor

    Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

    HighCVSS 7.8Proof of conceptEPSS 0%

    app-auto-patch · app-auto-patchMar 4, 2026

  • CVE-2025-70342
    26Monitor

    erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json.

    MediumCVSS 6.6Proof of conceptEPSS 0%

    grahampugh · erase-installMar 4, 2026

  • CVE-2026-23231
    31Monitor

    netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelMar 4, 2026

  • CVE-2025-66678
    39Monitor

    An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    faintsnow · hardware read \& write utilityMar 4, 2026

  • CVE-2026-28695
    30Monitor

    Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

    HighCVSS 7.5Proof of conceptEPSS 0%

    craftcms · craft cmsMar 4, 2026

  • CVE-2026-28696
    34Monitor

    Craft affected by IDOR via GraphQL @parseRefs

    HighCVSS 8.7No exploitEPSS 0%

    craftcms · craft cmsMar 4, 2026

  • CVE-2026-28783
    37Monitor

    Craft has a Twig Function Blocklist Bypass

    CriticalCVSS 9.4No exploitEPSS 0%

    craftcms · craft cmsMar 4, 2026

  • CVE-2026-28784
    34Monitor

    Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

    HighCVSS 8.6No exploitEPSS 0%

    craftcms · craft cmsMar 4, 2026

  • CVE-2026-20079
    96Now

    Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 88%

    cisco · secure firewall management centerMar 4, 2026

  • CVE-2026-20131
    83Now

    Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 43%

    cisco · secure firewall management centerMar 4, 2026

  • CVE-2026-0847
    30Monitor

    Path Traversal in nltk/nltk

    HighCVSS 7.5Proof of conceptEPSS 0%

    nltk · nltkMar 4, 2026

  • CVE-2025-66024
    34Monitor

    XWiki Blog Application home page vulnerable to Stored XSS via Post Title

    HighCVSS 8.6Proof of conceptEPSS 0%

    xwiki · blog applicationMar 4, 2026

  • CVE-2026-29000
    37Monitor

    pac4j-jwt JwtAuthenticator Authentication Bypass

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    pac4j · pac4j-jwtMar 4, 2026

  • CVE-2025-69411
    30Monitor

    WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    robert seyfriedsberger · ioncube tester plusMar 5, 2026

  • CVE-2026-27344
    23Monitor

    WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability

    MediumCVSS 5.9Proof of conceptEPSS 0%

    inseriswiss · inseri coreMar 5, 2026

  • CVE-2026-27384
    36Monitor

    WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    boldgrid · w3 total cacheMar 5, 2026

  • CVE-2026-27541
    28Monitor

    WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability

    HighCVSS 7.2Proof of conceptEPSS 0%

    josh kohlbach · wholesale suiteMar 5, 2026

  • CVE-2026-28134
    34Monitor

    WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability

    HighCVSS 8.5Proof of conceptEPSS 0%

    crocoblock · jetengineMar 5, 2026

  • CVE-2026-29053
    40Plan

    Ghost Vulnerable to Remote Code Execution via Malicious Themes

    CriticalCVSS 9.8WeaponizedEPSS 4%

    ghost · ghostMar 5, 2026

  • CVE-2026-21628
    40Plan

    Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    templaza · astroid frameworkMar 5, 2026

  • CVE-2026-25048
    34Monitor

    xgrammar: Multi-layer nesting causes DoS

    HighCVSS 8.7No exploitEPSS 1%

    mlc-ai · xgrammarMar 5, 2026

  • CVE-2026-26416
    35Monitor

    An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privilege

    HighCVSS 8.8Proof of conceptEPSS 0%

    tcs · cognix platformMar 5, 2026

  • CVE-2026-26417
    32Monitor

    A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authe

    HighCVSS 8.1Proof of conceptEPSS 0%

    tcs · cognix platformMar 5, 2026

  • CVE-2026-26418
    30Monitor

    Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to acc

    HighCVSS 7.5Proof of conceptEPSS 0%

    tcs · cognix platformMar 5, 2026

  • CVE-2026-27944
    39Monitor

    Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    nginxui · nginx uiMar 5, 2026

  • CVE-2024-43035
    24Monitor

    Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint.

    MediumCVSS 5.8Proof of conceptEPSS 2%

    fonoster · fonosterMar 5, 2026

  • CVE-2025-55208
    36Monitor

    Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files

    CriticalCVSS 9.0No exploitEPSS 0%

    chamilo · chamilo lmsMar 5, 2026

  • CVE-2025-70995
    35Monitor

    An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper v

    HighCVSS 8.8Proof of conceptEPSS 0%

    Mar 5, 2026

  • CVE-2026-0848
    40Plan

    Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    nltk · nltkMar 5, 2026

  • CVE-2026-28466
    37Monitor

    OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    openclaw · openclawMar 5, 2026

  • CVE-2026-27778
    34Monitor

    ePower epower.ie Improper Restriction of Excessive Authentication Attempts

    HighCVSS 8.7Proof of conceptEPSS 0%

    epower · epower.ieMar 5, 2026

  • CVE-2026-3612
    32Monitor

    Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection

    HighCVSS 7.3No exploitEPSS 10%

    wavlink · wl-nu516u1 firmwareMar 5, 2026

  • CVE-2026-28501
    39Monitor

    WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

    CriticalCVSS 9.8WeaponizedEPSS 1%

    wwbn · avideoMar 6, 2026

  • CVE-2026-29041
    35Monitor

    Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload

    HighCVSS 8.8Proof of conceptEPSS 1%

    chamilo · chamilo lmsMar 6, 2026

  • CVE-2026-29058
    41Plan

    AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php

    CriticalCVSS 9.8WeaponizedEPSS 6%

    wwbn · avideo-encoderMar 6, 2026

  • CVE-2026-29059
    28Monitor

    Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly

    MediumCVSS 6.9Proof of conceptEPSS 2%

    windmill · windmillMar 6, 2026

  • CVE-2026-29183
    24Monitor

    SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution

    MediumCVSS 6.1Proof of conceptEPSS 0%

    b3log · siyuanMar 6, 2026

  • CVE-2026-29075
    39Monitor

    Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mesa project · mesaMar 6, 2026

  • CVE-2026-30844
    37Monitor

    Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

    CriticalCVSS 9.3No exploitEPSS 0%

    wekan project · wekanMar 6, 2026

  • CVE-2026-30225
    17Monitor

    OliveTin: RestartAction always runs actions as guest

    MediumCVSS 4.3Proof of conceptEPSS 0%

    olivetin · olivetinMar 6, 2026

  • CVE-2025-15602
    34Monitor

    Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation

    HighCVSS 8.7Proof of conceptEPSS 0%

    snipeitapp · snipe-itMar 6, 2026

  • CVE-2026-2020
    30Monitor

    JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute

    HighCVSS 7.5Proof of conceptEPSS 0%

    skatox · js archive listMar 6, 2026

  • CVE-2026-27796
    30Monitor

    Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)

    HighCVSS 7.5Proof of conceptEPSS 1%

    homarr · homarrMar 7, 2026

  • CVE-2026-30824
    31Monitor

    Flowise: Missing Authentication on NVIDIA NIM Endpoints

    HighCVSS 7.7Proof of conceptEPSS 2%

    flowiseai · flowiseMar 7, 2026

  • CVE-2025-14675
    29Monitor

    Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion

    HighCVSS 7.2Proof of conceptEPSS 2%

    metabox · meta boxMar 7, 2026

  • CVE-2026-3661
    11Monitor

    Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

    LowCVSS 2.0No exploitEPSS 11%

    wavlink · wl-nu516u1 firmwareMar 7, 2026

  • CVE-2026-3662
    11Monitor

    Wavlink WL-NU516U1 adm.cgi usb_p910 command injection

    LowCVSS 2.0No exploitEPSS 11%

    wavlink · wl-nu516u1 firmwareMar 7, 2026

  • CVE-2026-29780
    22Monitor

    eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write

    MediumCVSS 5.5Proof of conceptEPSS 0%

    govcert.lu · eml parserMar 7, 2026

  • CVE-2026-29781
    8Monitor

    Sliver: Authenticated Nil-Pointer Dereference in Handlers

    LowCVSS 2.1Proof of conceptEPSS 0%

    bishopfox · sliverMar 7, 2026

  • CVE-2026-29786
    32Monitor

    node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

    HighCVSS 8.2Proof of conceptEPSS 0%

    isaacs · tarMar 7, 2026

  • CVE-2026-3786
    8Monitor

    EasyCMS Request Parameter RbacuserAction.class.php sql injection

    LowCVSS 2.1Proof of conceptEPSS 0%

    easycms · easycmsMar 8, 2026

  • CVE-2026-3796
    7Monitor

    Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control

    LowCVSS 1.9Proof of conceptEPSS 0%

    qianxin · qax internet control gatewayMar 9, 2026

  • CVE-2026-3798
    11Monitor

    Comfast CF-AC100 Request Path mbox-config sub_44AC14 command injection

    LowCVSS 2.0No exploitEPSS 11%

    comfast · cf-ac100 firmwareMar 9, 2026

  • CVE-2025-69219
    35Monitor

    Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator

    HighCVSS 8.8Proof of conceptEPSS 0%

    apache · airflow providers httpMar 9, 2026

  • CVE-2026-25604
    21Monitor

    Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

    MediumCVSS 5.4Proof of conceptEPSS 0%

    apache · apache-airflow-providers-amazonMar 9, 2026

  • CVE-2025-14558
    30Monitor

    Remote code execution via ND6 Router Advertisements

    HighCVSS 7.2WeaponizedEPSS 6%

    freebsd · freebsdMar 9, 2026

  • CVE-2024-14027
    22Monitor

    xattr: switch to CLASS(fd)

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelMar 9, 2026

  • CVE-2026-31816
    37Monitor

    Budibase Universal Auth Bypass via Webhook Query Param Injection

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    budibase · budibaseMar 9, 2026

  • CVE-2026-3288
    35Monitor

    ingress-nginx rewrite-target nginx configuration injection

    HighCVSS 8.8Proof of conceptEPSS 0%

    kubernetes · ingress-nginxMar 9, 2026

  • CVE-2026-31802
    32Monitor

    node-tar Symlink Path Traversal via Drive-Relative Linkpath

    HighCVSS 8.2Proof of conceptEPSS 0%

    isaacs · tarMar 10, 2026

  • CVE-2026-30862
    36Monitor

    Critical Stored XSS & Privilege Escalation in Appsmith

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    appsmith · appsmithMar 10, 2026

  • CVE-2025-56422
    39Monitor

    A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

    CriticalCVSS 9.8No exploitEPSS 0%

    limesurvey · limesurveyMar 10, 2026

  • CVE-2026-23907
    21Monitor

    Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

    MediumCVSS 5.3Proof of conceptEPSS 0%

    apache · pdfbox-examplesMar 10, 2026

  • CVE-2026-24018
    31Monitor

    A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.

    HighCVSS 7.8Proof of conceptEPSS 0%

    fortinet · forticlientMar 10, 2026

  • CVE-2026-24291
    32Monitor

    Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 3%

    microsoft · windows 10 1607Mar 10, 2026

  • CVE-2026-24294
    32Monitor

    Windows SMB Server Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 4%

    microsoft · windows 10 1607Mar 10, 2026

  • CVE-2026-25172
    32Monitor

    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

    HighCVSS 8.0Proof of conceptEPSS 0%

    microsoft · windows server 2012Mar 10, 2026

  • CVE-2026-25177
    35Monitor

    Active Directory Domain Services Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    microsoft · windows 10 1607Mar 10, 2026

  • CVE-2026-26114
    36Monitor

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 2%

    microsoft · sharepoint serverMar 10, 2026

  • CVE-2026-26118
    35Monitor

    Azure MCP Server Tools Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    microsoft · azure mcp serverMar 10, 2026

  • CVE-2026-26128
    31Monitor

    Windows SMB Server Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    microsoft · windows 10 1607Mar 10, 2026

  • CVE-2026-30928
    34Monitor

    Glances Exposes Unauthenticated Configuration Secrets

    HighCVSS 8.7Proof of conceptEPSS 1%

    nicolargo · glancesMar 10, 2026

  • CVE-2026-30944
    35Monitor

    StudioCMS Affected by Privilege Escalation via Insecure API Token Generation

    HighCVSS 8.8Proof of conceptEPSS 0%

    studiocms · studiocmsMar 10, 2026

  • CVE-2026-30945
    28Monitor

    StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

    HighCVSS 7.1Proof of conceptEPSS 0%

    studiocms · studiocmsMar 10, 2026

  • CVE-2026-3228
    25Monitor

    NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode

    MediumCVSS 6.4Proof of conceptEPSS 0%

    nextscripts · nextscripts: social networks auto-posterMar 10, 2026

  • CVE-2026-3306
    21Monitor

    Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access

    MediumCVSS 5.3Proof of conceptEPSS 0%

    github · enterprise serverMar 10, 2026

  • CVE-2026-3854
    34Monitor

    Remote code execution via git push option injection in GitHub Enterprise Server

    HighCVSS 8.7Proof of conceptEPSS 1%

    github · enterprise serverMar 10, 2026