Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2026

349 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 4 of 4

  • CVE-2026-5027
    47Plan

    Langflow - Path Traversal Arbitrary File Write via upload_user_file

    HighCVSS 8.8Proof of conceptEPSS 39%

    langflow · langflowMar 27, 2026

  • CVE-2026-27876
    37Monitor

    RCE on Grafana via sqlExpressions

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    grafana · grafanaMar 27, 2026

  • CVE-2026-33868
    24Monitor

    Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

    MediumCVSS 6.1Proof of conceptEPSS 0%

    joinmastodon · mastodonMar 27, 2026

  • CVE-2026-33873
    37Monitor

    Langflow has Authenticated Code Execution in Agentic Assistant Validation

    CriticalCVSS 9.3No exploitEPSS 1%

    langflow · langflowMar 27, 2026

  • CVE-2025-15617
    33Monitor

    Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

    HighCVSS 8.3Proof of conceptEPSS 0%

    wazuh · wazuhMar 27, 2026

  • CVE-2026-33894
    30Monitor

    Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

    HighCVSS 7.5No exploitEPSS 0%

    digitalbazaar · forgeMar 27, 2026

  • CVE-2026-33937
    40Plan

    Handlebars.js has JavaScript Injection via AST Type Confusion

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    handlebarsjs · handlebarsMar 27, 2026

  • CVE-2026-4987
    30Monitor

    SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'

    HighCVSS 7.5Proof of conceptEPSS 0%

    brainstormforce · sureforms – contact form, payment form & other custom form builderMar 27, 2026

  • CVE-2026-33980
    32Monitor

    Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

    HighCVSS 8.1Proof of conceptEPSS 0%

    pab1it0 · azure data explorer mcp serverMar 27, 2026

  • CVE-2026-33936
    21Monitor

    python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

    MediumCVSS 5.3Proof of conceptEPSS 0%

    tlsfuzzer · ecdsaMar 27, 2026

  • CVE-2026-5000
    27Monitor

    PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication

    MediumCVSS 6.9Proof of conceptEPSS 0%

    promtengineer · localgptMar 28, 2026

  • CVE-2026-34005
    35Monitor

    In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters

    HighCVSS 8.8Proof of conceptEPSS 1%

    xiongmai · dvr/nvr devicesMar 29, 2026

  • CVE-2026-0558
    40Plan

    Unauthenticated File Upload in parisneo/lollms

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    lollms · lollmsMar 29, 2026

  • CVE-2026-0560
    31Monitor

    Server-Side Request Forgery (SSRF) in parisneo/lollms

    HighCVSS 7.5Proof of conceptEPSS 1%

    lollms · lollmsMar 29, 2026

  • CVE-2025-15379
    41Plan

    Command Injection in mlflow/mlflow

    CriticalCVSS 10.0No exploitEPSS 2%

    lfprojects · mlflowMar 30, 2026

  • CVE-2026-30082
    24Monitor

    Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Mar 30, 2026

  • CVE-2026-29597
    26Monitor

    DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Mar 30, 2026

  • CVE-2026-34472
    31Monitor

    Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attac

    HighCVSS 7.1Proof of conceptEPSS 8%

    zte · zxhn h188a firmwareMar 30, 2026

  • CVE-2026-29909
    21Monitor

    MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module.

    MediumCVSS 5.3Proof of conceptEPSS 0%

    mrcms · mrcmsMar 30, 2026

  • CVE-2026-29954
    30Monitor

    In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of

    HighCVSS 7.6Proof of conceptEPSS 0%

    cloudark · kubeplusMar 30, 2026

  • CVE-2026-33032
    50Plan

    Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    nginxui · nginx uiMar 30, 2026

  • CVE-2026-3502
    63This week

    TrueConf Client Update Integrity Verification Bypass

    HighCVSS 7.8KEVWeaponizedEPSS 5%

    trueconf · trueconfMar 30, 2026

  • CVE-2026-21710
    38Monitor

    A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the ap

    HighCVSS 7.5Proof of conceptEPSS 25%

    nodejs · node.jsMar 30, 2026

  • CVE-2026-21717
    23Monitor

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially pr

    MediumCVSS 5.9Proof of conceptEPSS 0%

    nodejs · node.jsMar 30, 2026

  • CVE-2026-31831
    35Monitor

    Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

    HighCVSS 8.7Proof of conceptEPSS 1%

    tautulli · tautulliMar 30, 2026

  • CVE-2026-27018
    32Monitor

    Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme

    HighCVSS 7.8Proof of conceptEPSS 1%

    thecodingmachine · gotenbergMar 30, 2026

  • CVE-2026-32794
    19Monitor

    Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange

    MediumCVSS 4.8Proof of conceptEPSS 0%

    apache · airflow providers databricksMar 30, 2026

  • CVE-2026-4257
    60This week

    Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

    CriticalCVSS 9.8WeaponizedEPSS 41%

    supsysticcom · contact form by supsysticMar 30, 2026

  • CVE-2026-5147
    22Monitor

    YunaiV yudao-cloud get-by-website sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    yunaiv · yudao-cloudMar 30, 2026

  • CVE-2026-3300
    51Plan

    Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    wpeverest · everest forms proMar 30, 2026

  • CVE-2026-4020
    52Plan

    Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API

    HighCVSS 7.5Proof of conceptEPSS 73%

    rocketgenius · gravity smtpMar 30, 2026

  • CVE-2026-34040
    34Monitor

    Moby: AuthZ plugin bypass with oversized request body

    HighCVSS 7.8Proof of conceptEPSS 9%

    docker · engineMar 30, 2026

  • CVE-2026-34070
    30Monitor

    LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

    HighCVSS 7.5Proof of conceptEPSS 1%

    langchain · langchain coreMar 30, 2026

  • CVE-2026-34036
    26Monitor

    Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php

    MediumCVSS 6.5Proof of conceptEPSS 1%

    dolibarr · dolibarr erp/crmMar 31, 2026

  • CVE-2026-5201
    30Monitor

    Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

    HighCVSS 7.5Proof of conceptEPSS 1%

    gnome · gdk-pixbufMar 31, 2026

  • CVE-2026-34156
    49Plan

    NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

    CriticalCVSS 9.9Proof of conceptEPSS 34%

    nocobase · nocobaseMar 31, 2026

  • CVE-2026-0596
    31Monitor

    Command Injection in mlflow/mlflow

    HighCVSS 7.8Proof of conceptEPSS 1%

    lfprojects · mlflowMar 31, 2026

  • CVE-2026-33579
    37Monitor

    OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    openclaw · openclawMar 31, 2026

  • CVE-2026-34162
    40Plan

    FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft

    CriticalCVSS 10.0No exploitEPSS 0%

    fastgpt · fastgptMar 31, 2026

  • CVE-2026-34200
    30Monitor

    Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

    HighCVSS 7.7Proof of conceptEPSS 0%

    nhost · cliMar 31, 2026

  • CVE-2026-34220
    37Monitor

    MikroORM is vulnerable to SQL Injection via specially crafted object

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    mikro-orm · mikroormMar 31, 2026

  • CVE-2026-34227
    23Monitor

    Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

    MediumCVSS 5.9Proof of conceptEPSS 0%

    bishopfox · sliverMar 31, 2026

  • CVE-2026-34243
    40Plan

    wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    njzjz · wenxianMar 31, 2026

  • CVE-2026-5203
    8Monitor

    CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal

    LowCVSS 2.0Proof of conceptEPSS 0%

    Mar 31, 2026

  • CVE-2026-34733
    29Monitor

    AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

    HighCVSS 7.3No exploitEPSS 0%

    wwbn · avideoMar 31, 2026

  • CVE-2026-34453
    30Monitor

    SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content

    HighCVSS 7.5Proof of conceptEPSS 1%

    b3log · siyuanMar 31, 2026

  • CVE-2026-34605
    34Monitor

    SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

    HighCVSS 8.6Proof of conceptEPSS 0%

    b3log · siyuanMar 31, 2026

  • CVE-2026-2950
    21Monitor

    lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

    MediumCVSS 5.3No exploitEPSS 0%

    lodash · lodashMar 31, 2026

  • CVE-2026-4800
    40Plan

    lodash vulnerable to Code Injection via `_.template` imports key names

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    lodash · lodashMar 31, 2026