По дате публикации
Эксплуатируемые и новые серьёзные CVE: март 2026 г.
342 записей · 10 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 4
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
23Наблюдать | CVE-2026-3395Proof of concept | MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injectionmax-3000 · maxsite cms · CWE-74 | Средняя5,5 | — | 2,5 % | 1 мар. 2026 г. |
39Наблюдать | CVE-2026-26720Proof of concept | An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.twenty · twenty · CWE-94 | Критическая9,8 | — | 1,2 % | 2 мар. 2026 г. |
61На этой неделе | CVE-2026-21385Готовый эксплойт | Integer Overflow or Wraparound in Graphicsqualcomm · sm7675p firmware · CWE-190 | Высокая7,8 | KEV | 1,2 % | 2 мар. 2026 г. |
39Наблюдать | CVE-2026-28286Proof of concept | ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via APIzimaspace · zimaos · CWE-73 | Критическая9,9 | — | 0,6 % | 2 мар. 2026 г. |
10Наблюдать | CVE-2026-28358Proof of concept | NocoDB: User Enumeration via Password Reset Endpointnocodb · nocodb · CWE-204 | Низкая2,7 | — | 0,7 % | 2 мар. 2026 г. |
30Наблюдать | CVE-2026-3180Proof of concept | Contest Gallery <= 28.1.4 - Unauthenticated SQL Injectioncontest-gallery · contest gallery – upload & vote photos, media, sell with paypal & stripe · CWE-89 | Высокая7,5 | — | 0,9 % | 2 мар. 2026 г. |
39Наблюдать | CVE-2026-0006Proof of concept | In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow.google · android · CWE-122 | Критическая9,8 | — | 0,6 % | 2 мар. 2026 г. |
33Наблюдать | CVE-2026-0010Proof of concept | In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check.google · android · CWE-787 | Высокая8,4 | — | 0,1 % | 2 мар. 2026 г. |
33Наблюдать | CVE-2026-0013Proof of concept | In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy.google · android · CWE-441 | Высокая8,4 | — | 0,1 % | 2 мар. 2026 г. |
24Наблюдать | CVE-2026-0014Proof of concept | In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation.google · android · CWE-20 | Средняя6,2 | — | 0,1 % | 2 мар. 2026 г. |
31Наблюдать | CVE-2026-0023Proof of concept | In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permisgoogle · android · CWE-269 | Высокая7,8 | — | 0,0 % | 2 мар. 2026 г. |
33Наблюдать | CVE-2026-0047Proof of concept | In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permisgoogle · android · CWE-280 | Высокая8,4 | — | 0,1 % | 2 мар. 2026 г. |
26Наблюдать | CVE-2026-2256Proof of concept | Command injection vulnerability in ModelScope's ms-agentmodelscope · ms-agent · CWE-77 | Средняя6,5 | — | 1,6 % | 2 мар. 2026 г. |
47В плане | CVE-2026-1492Proof of concept | User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registrationwpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder · CWE-269 | Критическая9,8 | — | 27,9 % | 3 мар. 2026 г. |
39Наблюдать | CVE-2025-59059Proof of concept | Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreatorapache · ranger · CWE-94 | Критическая9,8 | — | 1,2 % | 3 мар. 2026 г. |
28Наблюдать | CVE-2025-66680Proof of concept | An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files vwisecleaner · wise force deleter · CWE-59 | Высокая7,1 | — | 0,2 % | 3 мар. 2026 г. |
21Наблюдать | CVE-2026-3494Proof of concept | MariaDB Server Audit Plugin Comment Handling Bypassmariadb · mariadb · CWE-778 | Средняя5,3 | — | 0,3 % | 3 мар. 2026 г. |
20Наблюдать | CVE-2026-24415Proof of concept | OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameterdevcode · openstamanager · CWE-79 | Средняя5,1 | — | 0,2 % | 3 мар. 2026 г. |
37Наблюдать | CVE-2026-27971Proof of concept | Qwik affected by unauthenticated RCE via server$ Deserializationqwik · qwik · CWE-502 | Критическая9,2 | — | 2,8 % | 3 мар. 2026 г. |
60На этой неделе | CVE-2026-28289Готовый эксплойт | FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Executionfreescout · freescout · CWE-434 | Высокая8,1 | — | 2,6 % | 3 мар. 2026 г. |
21Наблюдать | CVE-2026-1980Proof of concept | WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposureiqonicdesign · wpbookit · CWE-200 | Средняя5,3 | — | 0,8 % | 3 мар. 2026 г. |
30Наблюдать | CVE-2026-2025Proof of concept | Mail Mint < 1.19.5 - Unauthenticated Emails Disclosureunknown · mail mint · CWE-200 | Высокая7,5 | — | 1,5 % | 4 мар. 2026 г. |
30Наблюдать | CVE-2023-7337Proof of concept | JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookierabilal · js help desk – ai-powered support & ticketing system · CWE-89 | Высокая7,5 | — | 1,3 % | 4 мар. 2026 г. |
31Наблюдать | CVE-2025-70341Proof of concept | Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.app-auto-patch · app-auto-patch · CWE-94 | Высокая7,8 | — | 0,2 % | 4 мар. 2026 г. |
26Наблюдать | CVE-2025-70342Proof of concept | erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json.grahampugh · erase-install · CWE-732 | Средняя6,6 | — | 0,2 % | 4 мар. 2026 г. |
31Наблюдать | CVE-2026-23231Proof of concept | netfilter: nf_tables: fix use-after-free in nf_tables_addchain()linux · linux kernel · CWE-416 | Высокая7,8 | — | 0,8 % | 4 мар. 2026 г. |
39Наблюдать | CVE-2025-66678Proof of concept | An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execufaintsnow · hardware read \& write utility · CWE-89 | Критическая9,8 | — | 0,6 % | 4 мар. 2026 г. |
30Наблюдать | CVE-2026-28695Proof of concept | Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetcraftcms · craft cms · CWE-1336 | Высокая7,5 | — | 0,6 % | 4 мар. 2026 г. |
34Наблюдать | CVE-2026-28696Эксплойта нет | Craft affected by IDOR via GraphQL @parseRefscraftcms · craft cms · CWE-639 | Высокая8,7 | — | 0,4 % | 4 мар. 2026 г. |
37Наблюдать | CVE-2026-28783Эксплойта нет | Craft has a Twig Function Blocklist Bypasscraftcms · craft cms · CWE-94 | Критическая9,4 | — | 0,5 % | 4 мар. 2026 г. |
34Наблюдать | CVE-2026-28784Эксплойта нет | Craft is affected by potential authenticated Remote Code Execution via Twig SSTIcraftcms · craft cms · CWE-1336 | Высокая8,6 | — | 0,6 % | 4 мар. 2026 г. |
96Срочно | CVE-2026-20079Готовый эксплойт | Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerabilitycisco · secure firewall management center · CWE-288 | Критическая10,0 | KEV | 88,1 % | 4 мар. 2026 г. |
83Срочно | CVE-2026-20131Готовый эксплойт | Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerabilitycisco · secure firewall management center · CWE-502 | Критическая10,0 | KEV | 43,1 % | 4 мар. 2026 г. |
30Наблюдать | CVE-2026-0847Proof of concept | Path Traversal in nltk/nltknltk · nltk · CWE-22 | Высокая7,5 | — | 0,9 % | 4 мар. 2026 г. |
34Наблюдать | CVE-2025-66024Proof of concept | XWiki Blog Application home page vulnerable to Stored XSS via Post Titlexwiki · blog application · CWE-79 | Высокая8,6 | — | 0,3 % | 4 мар. 2026 г. |
37Наблюдать | CVE-2026-29000Proof of concept | pac4j-jwt JwtAuthenticator Authentication Bypasspac4j · pac4j-jwt · CWE-347 | Критическая9,3 | — | 0,5 % | 4 мар. 2026 г. |
30Наблюдать | CVE-2025-69411Proof of concept | WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerabilityrobert seyfriedsberger · ioncube tester plus · CWE-22 | Высокая7,5 | — | 1,6 % | 5 мар. 2026 г. |
23Наблюдать | CVE-2026-27344Proof of concept | WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerabilityinseriswiss · inseri core · CWE-862 | Средняя5,9 | — | 0,3 % | 5 мар. 2026 г. |
36Наблюдать | CVE-2026-27384Proof of concept | WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityboldgrid · w3 total cache · CWE-1284 | Критическая9,0 | — | 0,4 % | 5 мар. 2026 г. |
28Наблюдать | CVE-2026-27541Proof of concept | WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerabilityjosh kohlbach · wholesale suite · CWE-266 | Высокая7,2 | — | 0,3 % | 5 мар. 2026 г. |
34Наблюдать | CVE-2026-28134Proof of concept | WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerabilitycrocoblock · jetengine · CWE-94 | Высокая8,5 | — | 0,4 % | 5 мар. 2026 г. |
60На этой неделе | CVE-2026-29053Готовый эксплойт | Ghost Vulnerable to Remote Code Execution via Malicious Themesghost · ghost · CWE-74 | Критическая9,8 | — | 4,9 % | 5 мар. 2026 г. |
40В плане | CVE-2026-21628Proof of concept | Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomlatemplaza · astroid framework · CWE-434 | Критическая10,0 | — | 0,4 % | 5 мар. 2026 г. |
34Наблюдать | CVE-2026-25048Эксплойта нет | xgrammar: Multi-layer nesting causes DoSmlc-ai · xgrammar · CWE-674 | Высокая8,7 | — | 1,1 % | 5 мар. 2026 г. |
35Наблюдать | CVE-2026-26416Proof of concept | An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privilegetcs · cognix platform · CWE-269 | Высокая8,8 | — | 0,5 % | 5 мар. 2026 г. |
32Наблюдать | CVE-2026-26417Proof of concept | A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authetcs · cognix platform · CWE-284 | Высокая8,1 | — | 0,3 % | 5 мар. 2026 г. |
30Наблюдать | CVE-2026-26418Proof of concept | Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to acctcs · cognix platform · CWE-284 | Высокая7,5 | — | 0,7 % | 5 мар. 2026 г. |
39Наблюдать | CVE-2026-27944Proof of concept | Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosurenginxui · nginx ui · CWE-306 | Критическая9,8 | — | 1,0 % | 5 мар. 2026 г. |
24Наблюдать | CVE-2024-43035Proof of concept | Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint.fonoster · fonoster · CWE-24 | Средняя5,8 | — | 2,4 % | 5 мар. 2026 г. |
36Наблюдать | CVE-2025-55208Эксплойта нет | Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Fileschamilo · chamilo lms · CWE-79 | Критическая9,0 | — | 0,3 % | 5 мар. 2026 г. |
35Наблюдать | CVE-2025-70995Proof of concept | An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper vCWE-94 | Высокая8,8 | — | 0,6 % | 5 мар. 2026 г. |
40В плане | CVE-2026-0848Proof of concept | Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loadingnltk · nltk · CWE-20 | Критическая10,0 | — | 0,7 % | 5 мар. 2026 г. |
37Наблюдать | CVE-2026-28466Proof of concept | OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypassopenclaw · openclaw · CWE-863 | Критическая9,4 | — | 0,6 % | 5 мар. 2026 г. |
34Наблюдать | CVE-2026-27778Proof of concept | ePower epower.ie Improper Restriction of Excessive Authentication Attemptsepower · epower.ie · CWE-307 | Высокая8,7 | — | 0,8 % | 5 мар. 2026 г. |
32Наблюдать | CVE-2026-3612Эксплойта нет | Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injectionwavlink · wl-nu516u1 firmware · CWE-74 | Высокая7,3 | — | 10,3 % | 5 мар. 2026 г. |
60На этой неделе | CVE-2026-28501Готовый эксплойт | WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.phpwwbn · avideo · CWE-89 | Критическая9,8 | — | 1,4 % | 6 мар. 2026 г. |
35Наблюдать | CVE-2026-29041Proof of concept | Chamilo: Authenticated Remote Code Execution via Unrestricted File Uploadchamilo · chamilo lms · CWE-434 | Высокая8,8 | — | 1,0 % | 6 мар. 2026 г. |
60На этой неделе | CVE-2026-29058Готовый эксплойт | AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.phpwwbn · avideo-encoder · CWE-78 | Критическая9,8 | — | 6,7 % | 6 мар. 2026 г. |
28Наблюдать | CVE-2026-29059Proof of concept | Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publiclywindmill · windmill · CWE-22 | Средняя6,9 | — | 2,1 % | 6 мар. 2026 г. |
24Наблюдать | CVE-2026-29183Proof of concept | SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript executionb3log · siyuan · CWE-79 | Средняя6,1 | — | 0,6 % | 6 мар. 2026 г. |
39Наблюдать | CVE-2026-29075Proof of concept | Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runnermesa project · mesa · CWE-94 | Критическая9,8 | — | 0,5 % | 6 мар. 2026 г. |
37Наблюдать | CVE-2026-30844Эксплойта нет | Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loadingwekan project · wekan · CWE-918 | Критическая9,3 | — | 0,4 % | 6 мар. 2026 г. |
17Наблюдать | CVE-2026-30225Proof of concept | OliveTin: RestartAction always runs actions as guestolivetin · olivetin · CWE-250 | Средняя4,3 | — | 0,6 % | 6 мар. 2026 г. |
34Наблюдать | CVE-2025-15602Proof of concept | Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalationsnipeitapp · snipe-it · CWE-915 | Высокая8,7 | — | 0,4 % | 6 мар. 2026 г. |
30Наблюдать | CVE-2026-2020Proof of concept | JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attributeskatox · js archive list · CWE-502 | Высокая7,5 | — | 0,4 % | 6 мар. 2026 г. |
30Наблюдать | CVE-2026-27796Proof of concept | Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)homarr · homarr · CWE-200 | Высокая7,5 | — | 1,1 % | 7 мар. 2026 г. |
31Наблюдать | CVE-2026-30824Proof of concept | Flowise: Missing Authentication on NVIDIA NIM Endpointsflowiseai · flowise · CWE-306 | Высокая7,7 | — | 2,6 % | 7 мар. 2026 г. |
29Наблюдать | CVE-2025-14675Proof of concept | Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletionmetabox · meta box · CWE-22 | Высокая7,2 | — | 2,3 % | 7 мар. 2026 г. |
11Наблюдать | CVE-2026-3661Эксплойта нет | Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injectionwavlink · wl-nu516u1 firmware · CWE-74 | Низкая2,0 | — | 11,3 % | 7 мар. 2026 г. |
11Наблюдать | CVE-2026-3662Эксплойта нет | Wavlink WL-NU516U1 adm.cgi usb_p910 command injectionwavlink · wl-nu516u1 firmware · CWE-74 | Низкая2,0 | — | 11,3 % | 7 мар. 2026 г. |
22Наблюдать | CVE-2026-29780Proof of concept | eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Writegovcert.lu · eml parser · CWE-22 | Средняя5,5 | — | 0,1 % | 7 мар. 2026 г. |
8Наблюдать | CVE-2026-29781Proof of concept | Sliver: Authenticated Nil-Pointer Dereference in Handlersbishopfox · sliver · CWE-476 | Низкая2,1 | — | 0,5 % | 7 мар. 2026 г. |
32Наблюдать | CVE-2026-29786Proof of concept | node-tar: Hardlink Path Traversal via Drive-Relative Linkpathisaacs · tar · CWE-22 | Высокая8,2 | — | 0,4 % | 7 мар. 2026 г. |
8Наблюдать | CVE-2026-3786Proof of concept | EasyCMS Request Parameter RbacuserAction.class.php sql injectioneasycms · easycms · CWE-74 | Низкая2,1 | — | 0,5 % | 8 мар. 2026 г. |
7Наблюдать | CVE-2026-3796Proof of concept | Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access controlqianxin · qax internet control gateway · CWE-266 | Низкая1,9 | — | 0,1 % | 9 мар. 2026 г. |
11Наблюдать | CVE-2026-3798Эксплойта нет | Comfast CF-AC100 Request Path mbox-config sub_44AC14 command injectioncomfast · cf-ac100 firmware · CWE-74 | Низкая2,0 | — | 11,3 % | 9 мар. 2026 г. |
35Наблюдать | CVE-2025-69219Proof of concept | Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorapache · airflow providers http · CWE-913 | Высокая8,8 | — | 0,7 % | 9 мар. 2026 г. |
21Наблюдать | CVE-2026-25604Proof of concept | Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypassapache · apache-airflow-providers-amazon · CWE-346 | Средняя5,4 | — | 0,5 % | 9 мар. 2026 г. |
40В плане | CVE-2025-14558Готовый эксплойт | Remote code execution via ND6 Router Advertisementsfreebsd · freebsd · CWE-20 | Высокая7,2 | — | 6,3 % | 9 мар. 2026 г. |
22Наблюдать | CVE-2024-14027Proof of concept | xattr: switch to CLASS(fd)linux · linux kernel · CWE-401 | Средняя5,5 | — | 0,2 % | 9 мар. 2026 г. |
37Наблюдать | CVE-2026-31816Proof of concept | Budibase Universal Auth Bypass via Webhook Query Param Injectionbudibase · budibase · CWE-74 | Критическая9,1 | — | 2,1 % | 9 мар. 2026 г. |
35Наблюдать | CVE-2026-3288Proof of concept | ingress-nginx rewrite-target nginx configuration injectionkubernetes · ingress-nginx · CWE-20 | Высокая8,8 | — | 0,7 % | 9 мар. 2026 г. |
32Наблюдать | CVE-2026-31802Proof of concept | node-tar Symlink Path Traversal via Drive-Relative Linkpathisaacs · tar · CWE-22 | Высокая8,2 | — | 0,1 % | 10 мар. 2026 г. |
36Наблюдать | CVE-2026-30862Proof of concept | Critical Stored XSS & Privilege Escalation in Appsmithappsmith · appsmith · CWE-79 | Критическая9,0 | — | 0,4 % | 10 мар. 2026 г. |
39Наблюдать | CVE-2025-56422Эксплойта нет | A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.limesurvey · limesurvey · CWE-502 | Критическая9,8 | — | 0,8 % | 10 мар. 2026 г. |
21Наблюдать | CVE-2026-23907Proof of concept | Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Codeapache · pdfbox-examples · CWE-22 | Средняя5,3 | — | 0,9 % | 10 мар. 2026 г. |
31Наблюдать | CVE-2026-24018Proof of concept | A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.fortinet · forticlient · CWE-61 | Высокая7,8 | — | 0,2 % | 10 мар. 2026 г. |
32Наблюдать | CVE-2026-24291Proof of concept | Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-732 | Высокая7,8 | — | 3,2 % | 10 мар. 2026 г. |
32Наблюдать | CVE-2026-24294Proof of concept | Windows SMB Server Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-287 | Высокая7,8 | — | 4,8 % | 10 мар. 2026 г. |
32Наблюдать | CVE-2026-25172Proof of concept | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerabilitymicrosoft · windows server 2012 · CWE-122 | Высокая8,0 | — | 0,9 % | 10 мар. 2026 г. |
35Наблюдать | CVE-2026-25177Proof of concept | Active Directory Domain Services Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-641 | Высокая8,8 | — | 1,3 % | 10 мар. 2026 г. |
36Наблюдать | CVE-2026-26114Proof of concept | Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 | Высокая8,8 | — | 2,5 % | 10 мар. 2026 г. |
35Наблюдать | CVE-2026-26118Proof of concept | Azure MCP Server Tools Elevation of Privilege Vulnerabilitymicrosoft · azure mcp server · CWE-918 | Высокая8,8 | — | 0,8 % | 10 мар. 2026 г. |
31Наблюдать | CVE-2026-26128Proof of concept | Windows SMB Server Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-287 | Высокая7,8 | — | 0,3 % | 10 мар. 2026 г. |
34Наблюдать | CVE-2026-30928Proof of concept | Glances Exposes Unauthenticated Configuration Secretsnicolargo · glances · CWE-200 | Высокая8,7 | — | 1,5 % | 10 мар. 2026 г. |
35Наблюдать | CVE-2026-30944Proof of concept | StudioCMS Affected by Privilege Escalation via Insecure API Token Generationstudiocms · studiocms · CWE-639 | Высокая8,8 | — | 0,5 % | 10 мар. 2026 г. |
28Наблюдать | CVE-2026-30945Proof of concept | StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Servicestudiocms · studiocms · CWE-639 | Высокая7,1 | — | 0,4 % | 10 мар. 2026 г. |
25Наблюдать | CVE-2026-3228Proof of concept | NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcodenextscripts · nextscripts: social networks auto-poster · CWE-79 | Средняя6,4 | — | 0,3 % | 10 мар. 2026 г. |
21Наблюдать | CVE-2026-3306Proof of concept | Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write accessgithub · enterprise server · CWE-639 | Средняя5,3 | — | 0,4 % | 10 мар. 2026 г. |
34Наблюдать | CVE-2026-3854Proof of concept | Remote code execution via git push option injection in GitHub Enterprise Servergithub · enterprise server · CWE-77 | Высокая8,7 | — | 1,5 % | 10 мар. 2026 г. |
- CVE-2026-339523Наблюдать
MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
СредняяCVSS 5,5Proof of conceptEPSS 2 %max-3000 · maxsite cms1 мар. 2026 г.
- CVE-2026-2672039Наблюдать
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %twenty · twenty2 мар. 2026 г.
- CVE-2026-2138561На этой неделе
Integer Overflow or Wraparound in Graphics
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 1 %qualcomm · sm7675p firmware2 мар. 2026 г.
- CVE-2026-2828639Наблюдать
ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
КритическаяCVSS 9,9Proof of conceptEPSS 0 %zimaspace · zimaos2 мар. 2026 г.
- CVE-2026-2835810Наблюдать
NocoDB: User Enumeration via Password Reset Endpoint
НизкаяCVSS 2,7Proof of conceptEPSS 0 %nocodb · nocodb2 мар. 2026 г.
- CVE-2026-318030Наблюдать
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %contest-gallery · contest gallery – upload & vote photos, media, sell with paypal & stripe2 мар. 2026 г.
- CVE-2026-000639Наблюдать
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow.
КритическаяCVSS 9,8Proof of conceptEPSS 0 %google · android2 мар. 2026 г.
- CVE-2026-001033Наблюдать
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check.
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %google · android2 мар. 2026 г.
- CVE-2026-001333Наблюдать
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy.
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %google · android2 мар. 2026 г.
- CVE-2026-001424Наблюдать
In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation.
СредняяCVSS 6,2Proof of conceptEPSS 0 %google · android2 мар. 2026 г.
- CVE-2026-002331Наблюдать
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permis
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android2 мар. 2026 г.
- CVE-2026-004733Наблюдать
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permis
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %google · android2 мар. 2026 г.
- CVE-2026-225626Наблюдать
Command injection vulnerability in ModelScope's ms-agent
СредняяCVSS 6,5Proof of conceptEPSS 1 %modelscope · ms-agent2 мар. 2026 г.
- CVE-2026-149247В плане
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
КритическаяCVSS 9,8Proof of conceptEPSS 27 %wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder3 мар. 2026 г.
- CVE-2025-5905939Наблюдать
Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator
КритическаяCVSS 9,8Proof of conceptEPSS 1 %apache · ranger3 мар. 2026 г.
- CVE-2025-6668028Наблюдать
An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files v
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %wisecleaner · wise force deleter3 мар. 2026 г.
- CVE-2026-349421Наблюдать
MariaDB Server Audit Plugin Comment Handling Bypass
СредняяCVSS 5,3Proof of conceptEPSS 0 %mariadb · mariadb3 мар. 2026 г.
- CVE-2026-2441520Наблюдать
OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
СредняяCVSS 5,1Proof of conceptEPSS 0 %devcode · openstamanager3 мар. 2026 г.
- CVE-2026-2797137Наблюдать
Qwik affected by unauthenticated RCE via server$ Deserialization
КритическаяCVSS 9,2Proof of conceptEPSS 2 %qwik · qwik3 мар. 2026 г.
- CVE-2026-2828960На этой неделе
FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
ВысокаяCVSS 8,1Готовый эксплойтEPSS 2 %freescout · freescout3 мар. 2026 г.
- CVE-2026-198021Наблюдать
WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
СредняяCVSS 5,3Proof of conceptEPSS 0 %iqonicdesign · wpbookit3 мар. 2026 г.
- CVE-2026-202530Наблюдать
Mail Mint < 1.19.5 - Unauthenticated Emails Disclosure
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %unknown · mail mint4 мар. 2026 г.
- CVE-2023-733730Наблюдать
JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %rabilal · js help desk – ai-powered support & ticketing system4 мар. 2026 г.
- CVE-2025-7034131Наблюдать
Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %app-auto-patch · app-auto-patch4 мар. 2026 г.
- CVE-2025-7034226Наблюдать
erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json.
СредняяCVSS 6,6Proof of conceptEPSS 0 %grahampugh · erase-install4 мар. 2026 г.
- CVE-2026-2323131Наблюдать
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel4 мар. 2026 г.
- CVE-2025-6667839Наблюдать
An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu
КритическаяCVSS 9,8Proof of conceptEPSS 0 %faintsnow · hardware read \& write utility4 мар. 2026 г.
- CVE-2026-2869530Наблюдать
Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %craftcms · craft cms4 мар. 2026 г.
- CVE-2026-2869634Наблюдать
Craft affected by IDOR via GraphQL @parseRefs
ВысокаяCVSS 8,7Эксплойта нетEPSS 0 %craftcms · craft cms4 мар. 2026 г.
- CVE-2026-2878337Наблюдать
Craft has a Twig Function Blocklist Bypass
КритическаяCVSS 9,4Эксплойта нетEPSS 0 %craftcms · craft cms4 мар. 2026 г.
- CVE-2026-2878434Наблюдать
Craft is affected by potential authenticated Remote Code Execution via Twig SSTI
ВысокаяCVSS 8,6Эксплойта нетEPSS 0 %craftcms · craft cms4 мар. 2026 г.
- CVE-2026-2007996Срочно
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 88 %cisco · secure firewall management center4 мар. 2026 г.
- CVE-2026-2013183Срочно
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 43 %cisco · secure firewall management center4 мар. 2026 г.
- CVE-2026-084730Наблюдать
Path Traversal in nltk/nltk
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %nltk · nltk4 мар. 2026 г.
- CVE-2025-6602434Наблюдать
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %xwiki · blog application4 мар. 2026 г.
- CVE-2026-2900037Наблюдать
pac4j-jwt JwtAuthenticator Authentication Bypass
КритическаяCVSS 9,3Proof of conceptEPSS 0 %pac4j · pac4j-jwt4 мар. 2026 г.
- CVE-2025-6941130Наблюдать
WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %robert seyfriedsberger · ioncube tester plus5 мар. 2026 г.
- CVE-2026-2734423Наблюдать
WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability
СредняяCVSS 5,9Proof of conceptEPSS 0 %inseriswiss · inseri core5 мар. 2026 г.
- CVE-2026-2738436Наблюдать
WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability
КритическаяCVSS 9,0Proof of conceptEPSS 0 %boldgrid · w3 total cache5 мар. 2026 г.
- CVE-2026-2754128Наблюдать
WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %josh kohlbach · wholesale suite5 мар. 2026 г.
- CVE-2026-2813434Наблюдать
WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability
ВысокаяCVSS 8,5Proof of conceptEPSS 0 %crocoblock · jetengine5 мар. 2026 г.
- CVE-2026-2905360На этой неделе
Ghost Vulnerable to Remote Code Execution via Malicious Themes
КритическаяCVSS 9,8Готовый эксплойтEPSS 4 %ghost · ghost5 мар. 2026 г.
- CVE-2026-2162840В плане
Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla
КритическаяCVSS 10,0Proof of conceptEPSS 0 %templaza · astroid framework5 мар. 2026 г.
- CVE-2026-2504834Наблюдать
xgrammar: Multi-layer nesting causes DoS
ВысокаяCVSS 8,7Эксплойта нетEPSS 1 %mlc-ai · xgrammar5 мар. 2026 г.
- CVE-2026-2641635Наблюдать
An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privilege
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %tcs · cognix platform5 мар. 2026 г.
- CVE-2026-2641732Наблюдать
A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authe
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %tcs · cognix platform5 мар. 2026 г.
- CVE-2026-2641830Наблюдать
Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to acc
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %tcs · cognix platform5 мар. 2026 г.
- CVE-2026-2794439Наблюдать
Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
КритическаяCVSS 9,8Proof of conceptEPSS 1 %nginxui · nginx ui5 мар. 2026 г.
- CVE-2024-4303524Наблюдать
Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint.
СредняяCVSS 5,8Proof of conceptEPSS 2 %fonoster · fonoster5 мар. 2026 г.
- CVE-2025-5520836Наблюдать
Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files
КритическаяCVSS 9,0Эксплойта нетEPSS 0 %chamilo · chamilo lms5 мар. 2026 г.
- CVE-2025-7099535Наблюдать
An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper v
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %5 мар. 2026 г.
- CVE-2026-084840В плане
Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading
КритическаяCVSS 10,0Proof of conceptEPSS 0 %nltk · nltk5 мар. 2026 г.
- CVE-2026-2846637Наблюдать
OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass
КритическаяCVSS 9,4Proof of conceptEPSS 0 %openclaw · openclaw5 мар. 2026 г.
- CVE-2026-2777834Наблюдать
ePower epower.ie Improper Restriction of Excessive Authentication Attempts
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %epower · epower.ie5 мар. 2026 г.
- CVE-2026-361232Наблюдать
Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection
ВысокаяCVSS 7,3Эксплойта нетEPSS 10 %wavlink · wl-nu516u1 firmware5 мар. 2026 г.
- CVE-2026-2850160На этой неделе
WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
КритическаяCVSS 9,8Готовый эксплойтEPSS 1 %wwbn · avideo6 мар. 2026 г.
- CVE-2026-2904135Наблюдать
Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %chamilo · chamilo lms6 мар. 2026 г.
- CVE-2026-2905860На этой неделе
AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php
КритическаяCVSS 9,8Готовый эксплойтEPSS 6 %wwbn · avideo-encoder6 мар. 2026 г.
- CVE-2026-2905928Наблюдать
Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
СредняяCVSS 6,9Proof of conceptEPSS 2 %windmill · windmill6 мар. 2026 г.
- CVE-2026-2918324Наблюдать
SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution
СредняяCVSS 6,1Proof of conceptEPSS 0 %b3log · siyuan6 мар. 2026 г.
- CVE-2026-2907539Наблюдать
Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner
КритическаяCVSS 9,8Proof of conceptEPSS 0 %mesa project · mesa6 мар. 2026 г.
- CVE-2026-3084437Наблюдать
Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading
КритическаяCVSS 9,3Эксплойта нетEPSS 0 %wekan project · wekan6 мар. 2026 г.
- CVE-2026-3022517Наблюдать
OliveTin: RestartAction always runs actions as guest
СредняяCVSS 4,3Proof of conceptEPSS 0 %olivetin · olivetin6 мар. 2026 г.
- CVE-2025-1560234Наблюдать
Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %snipeitapp · snipe-it6 мар. 2026 г.
- CVE-2026-202030Наблюдать
JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %skatox · js archive list6 мар. 2026 г.
- CVE-2026-2779630Наблюдать
Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %homarr · homarr7 мар. 2026 г.
- CVE-2026-3082431Наблюдать
Flowise: Missing Authentication on NVIDIA NIM Endpoints
ВысокаяCVSS 7,7Proof of conceptEPSS 2 %flowiseai · flowise7 мар. 2026 г.
- CVE-2025-1467529Наблюдать
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
ВысокаяCVSS 7,2Proof of conceptEPSS 2 %metabox · meta box7 мар. 2026 г.
- CVE-2026-366111Наблюдать
Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 11 %wavlink · wl-nu516u1 firmware7 мар. 2026 г.
- CVE-2026-366211Наблюдать
Wavlink WL-NU516U1 adm.cgi usb_p910 command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 11 %wavlink · wl-nu516u1 firmware7 мар. 2026 г.
- CVE-2026-2978022Наблюдать
eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write
СредняяCVSS 5,5Proof of conceptEPSS 0 %govcert.lu · eml parser7 мар. 2026 г.
- CVE-2026-297818Наблюдать
Sliver: Authenticated Nil-Pointer Dereference in Handlers
НизкаяCVSS 2,1Proof of conceptEPSS 0 %bishopfox · sliver7 мар. 2026 г.
- CVE-2026-2978632Наблюдать
node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %isaacs · tar7 мар. 2026 г.
- CVE-2026-37868Наблюдать
EasyCMS Request Parameter RbacuserAction.class.php sql injection
НизкаяCVSS 2,1Proof of conceptEPSS 0 %easycms · easycms8 мар. 2026 г.
- CVE-2026-37967Наблюдать
Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control
НизкаяCVSS 1,9Proof of conceptEPSS 0 %qianxin · qax internet control gateway9 мар. 2026 г.
- CVE-2026-379811Наблюдать
Comfast CF-AC100 Request Path mbox-config sub_44AC14 command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 11 %comfast · cf-ac100 firmware9 мар. 2026 г.
- CVE-2025-6921935Наблюдать
Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %apache · airflow providers http9 мар. 2026 г.
- CVE-2026-2560421Наблюдать
Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass
СредняяCVSS 5,4Proof of conceptEPSS 0 %apache · apache-airflow-providers-amazon9 мар. 2026 г.
- CVE-2025-1455840В плане
Remote code execution via ND6 Router Advertisements
ВысокаяCVSS 7,2Готовый эксплойтEPSS 6 %freebsd · freebsd9 мар. 2026 г.
- CVE-2024-1402722Наблюдать
xattr: switch to CLASS(fd)
СредняяCVSS 5,5Proof of conceptEPSS 0 %linux · linux kernel9 мар. 2026 г.
- CVE-2026-3181637Наблюдать
Budibase Universal Auth Bypass via Webhook Query Param Injection
КритическаяCVSS 9,1Proof of conceptEPSS 2 %budibase · budibase9 мар. 2026 г.
- CVE-2026-328835Наблюдать
ingress-nginx rewrite-target nginx configuration injection
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %kubernetes · ingress-nginx9 мар. 2026 г.
- CVE-2026-3180232Наблюдать
node-tar Symlink Path Traversal via Drive-Relative Linkpath
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %isaacs · tar10 мар. 2026 г.
- CVE-2026-3086236Наблюдать
Critical Stored XSS & Privilege Escalation in Appsmith
КритическаяCVSS 9,0Proof of conceptEPSS 0 %appsmith · appsmith10 мар. 2026 г.
- CVE-2025-5642239Наблюдать
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %limesurvey · limesurvey10 мар. 2026 г.
- CVE-2026-2390721Наблюдать
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
СредняяCVSS 5,3Proof of conceptEPSS 0 %apache · pdfbox-examples10 мар. 2026 г.
- CVE-2026-2401831Наблюдать
A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %fortinet · forticlient10 мар. 2026 г.
- CVE-2026-2429132Наблюдать
Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 3 %microsoft · windows 10 160710 мар. 2026 г.
- CVE-2026-2429432Наблюдать
Windows SMB Server Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 4 %microsoft · windows 10 160710 мар. 2026 г.
- CVE-2026-2517232Наблюдать
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
ВысокаяCVSS 8,0Proof of conceptEPSS 0 %microsoft · windows server 201210 мар. 2026 г.
- CVE-2026-2517735Наблюдать
Active Directory Domain Services Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %microsoft · windows 10 160710 мар. 2026 г.
- CVE-2026-2611436Наблюдать
Microsoft SharePoint Server Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %microsoft · sharepoint server10 мар. 2026 г.
- CVE-2026-2611835Наблюдать
Azure MCP Server Tools Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %microsoft · azure mcp server10 мар. 2026 г.
- CVE-2026-2612831Наблюдать
Windows SMB Server Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %microsoft · windows 10 160710 мар. 2026 г.
- CVE-2026-3092834Наблюдать
Glances Exposes Unauthenticated Configuration Secrets
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %nicolargo · glances10 мар. 2026 г.
- CVE-2026-3094435Наблюдать
StudioCMS Affected by Privilege Escalation via Insecure API Token Generation
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %studiocms · studiocms10 мар. 2026 г.
- CVE-2026-3094528Наблюдать
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %studiocms · studiocms10 мар. 2026 г.
- CVE-2026-322825Наблюдать
NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode
СредняяCVSS 6,4Proof of conceptEPSS 0 %nextscripts · nextscripts: social networks auto-poster10 мар. 2026 г.
- CVE-2026-330621Наблюдать
Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access
СредняяCVSS 5,3Proof of conceptEPSS 0 %github · enterprise server10 мар. 2026 г.
- CVE-2026-385434Наблюдать
Remote code execution via git push option injection in GitHub Enterprise Server
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %github · enterprise server10 мар. 2026 г.