По дате публикации
Эксплуатируемые и новые серьёзные CVE: март 2026 г.
342 записей · 10 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 4
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
30Наблюдать | CVE-2026-26801Proof of concept | Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitivepdfmake · pdfmake · CWE-918 | Высокая7,5 | — | 0,6 % | 10 мар. 2026 г. |
31Наблюдать | CVE-2026-27280Proof of concept | DNG SDK | Out-of-bounds Write (CWE-787)adobe · dng software development kit · CWE-787 | Высокая7,8 | — | 0,2 % | 10 мар. 2026 г. |
32Наблюдать | CVE-2026-27826Proof of concept | MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headerssooperset · mcp atlassian · CWE-918 | Высокая8,2 | — | 1,0 % | 10 мар. 2026 г. |
32Наблюдать | CVE-2026-27825Proof of concept | MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentmcp-atlassian · mcp atlassian · CWE-22 | Высокая8,0 | — | 1,5 % | 10 мар. 2026 г. |
30Наблюдать | CVE-2026-30951Proof of concept | Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Typesequelizejs · sequelize · CWE-89 | Высокая7,5 | — | 0,4 % | 10 мар. 2026 г. |
34Наблюдать | CVE-2026-30952Proof of concept | liquidjs has a path traversal fallback vulnerabilityliquidjs · liquidjs · CWE-22 | Высокая8,7 | — | 0,5 % | 10 мар. 2026 г. |
39Наблюдать | CVE-2026-30965Proof of concept | Parse Server session token exfiltration via `redirectClassNameForKey` query parameterparseplatform · parse-server · CWE-863 | Критическая9,9 | — | 1,5 % | 10 мар. 2026 г. |
25Наблюдать | CVE-2026-31807Proof of concept | SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSSb3log · siyuan · CWE-79 | Средняя6,4 | — | 0,5 % | 10 мар. 2026 г. |
25Наблюдать | CVE-2026-31809Proof of concept | SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSSb3log · siyuan · CWE-79 | Средняя6,4 | — | 0,5 % | 10 мар. 2026 г. |
34Наблюдать | CVE-2026-30958Proof of concept | OneUptime: Path Traversal — Arbitrary File Read (No Auth)hackerbay · oneuptime · CWE-22 | Высокая8,6 | — | 1,1 % | 10 мар. 2026 г. |
39Наблюдать | CVE-2026-23813Proof of concept | Authentication Bypass in Web Interface allows Unauthenticated Admin Password Resethpe · arubaos-cx · CWE-287 | Критическая9,8 | — | 0,7 % | 11 мар. 2026 г. |
31Наблюдать | CVE-2026-2413Proof of concept | Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Pathelemntor · ally – web accessibility & usability · CWE-89 | Высокая7,5 | — | 2,3 % | 11 мар. 2026 г. |
39Наблюдать | CVE-2026-2631Proof of concept | Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalationunknown · datalogics ecommerce delivery · CWE-269 | Критическая9,8 | — | 0,8 % | 11 мар. 2026 г. |
34Наблюдать | CVE-2026-31844Proof of concept | Authenticated SQL Injection in Koha displayby parameter of suggestion.plkoha · koha · CWE-89 | Высокая8,7 | — | 0,5 % | 11 мар. 2026 г. |
30Наблюдать | CVE-2026-3805Proof of concept | use after free in SMB connection reusehaxx · curl · CWE-416 | Высокая7,5 | — | 0,9 % | 11 мар. 2026 г. |
13Наблюдать | CVE-2025-70330Proof of concept | Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files.CWE-125 | Низкая3,3 | — | 0,1 % | 11 мар. 2026 г. |
39Наблюдать | CVE-2026-30741Proof of concept | A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Siopenclaw · openclaw · CWE-94 | Критическая9,8 | — | 1,2 % | 11 мар. 2026 г. |
34Наблюдать | CVE-2025-67034Эксплойта нет | Lantronix EDS5000, G520, and X300 OS Command Injectionlantronix · eds5032 firmware · CWE-78 | Высокая8,6 | — | 0,5 % | 11 мар. 2026 г. |
73На этой неделе | CVE-2025-67038Готовый эксплойт | Lantronix EDS5000, G520, and X300 OS Command Injectionlantronix · eds5008 firmware · CWE-78 | Критическая9,3 | KEV | 19,9 % | 11 мар. 2026 г. |
39Наблюдать | CVE-2026-31852Proof of concept | Jellyfin Possible Organization/Secret Compromise from dangerous CI implementationjellyfin · jellyfin · CWE-269 | Критическая9,8 | — | 0,6 % | 11 мар. 2026 г. |
32Наблюдать | CVE-2026-31857Proof of concept | CraftCMS has an RCE vulnerability via relational conditionals in the control panelcraftcms · craft cms · CWE-94 | Высокая8,1 | — | 0,9 % | 11 мар. 2026 г. |
34Наблюдать | CVE-2026-31858Эксплойта нет | CraftCMS's `ElementSearchController` Affected by Blind SQL Injectioncraftcms · craft cms · CWE-89 | Высокая8,7 | — | 0,4 % | 11 мар. 2026 г. |
27Наблюдать | CVE-2019-25485Proof of concept | R 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR Bypassr-project · r · CWE-787 | Средняя6,9 | — | 0,1 % | 11 мар. 2026 г. |
34Наблюдать | CVE-2026-31900Proof of concept | Black's vulnerable version parsing leads to RCE in GitHub Actionpython · black · CWE-20 | Высокая8,7 | — | 0,6 % | 11 мар. 2026 г. |
34Наблюдать | CVE-2026-32096Proof of concept | Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/snsuseplunk · plunk · CWE-918 | Высокая8,6 | — | 0,4 % | 11 мар. 2026 г. |
39Наблюдать | CVE-2025-66956Proof of concept | Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and executeCWE-284 | Критическая9,9 | — | 0,4 % | 11 мар. 2026 г. |
35Наблюдать | CVE-2026-32127Proof of concept | SQL Injection Vulnerability in ajax graphs library (OpenEMR)open-emr · openemr · CWE-89 | Высокая8,8 | — | 0,5 % | 11 мар. 2026 г. |
25Наблюдать | CVE-2026-32128Proof of concept | FastGPT Python Sandbox Bypass of File-Write Restrictionfastgpt · fastgpt · CWE-184 | Средняя6,3 | — | 0,3 % | 11 мар. 2026 г. |
39Наблюдать | CVE-2026-32136Proof of concept | AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypassadguard · adguardhome · CWE-287 | Критическая9,8 | — | 0,8 % | 11 мар. 2026 г. |
19Наблюдать | CVE-2026-4040Proof of concept | OpenClaw File Existence tools.exec.safeBins information exposureopenclaw · openclaw · CWE-200 | Средняя4,8 | — | 0,2 % | 12 мар. 2026 г. |
31Наблюдать | CVE-2026-27940Proof of concept | llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fixggml · llama.cpp · CWE-122 | Высокая7,8 | — | 0,1 % | 12 мар. 2026 г. |
24Наблюдать | CVE-2026-29066Proof of concept | Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLIssw · tinacms\/cli · CWE-200 | Средняя6,2 | — | 0,5 % | 12 мар. 2026 г. |
26Наблюдать | CVE-2025-66955Proof of concept | Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access fileasseco · live · CWE-552 | Средняя6,5 | — | 0,2 % | 12 мар. 2026 г. |
21Наблюдать | CVE-2026-32230Proof of concept | Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pageuptime.kuma · uptime kuma · CWE-862 | Средняя5,3 | — | 0,8 % | 12 мар. 2026 г. |
32Наблюдать | CVE-2026-32247Proof of concept | Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filtersgetzep · graphiti · CWE-943 | Высокая8,1 | — | 0,5 % | 12 мар. 2026 г. |
40В плане | CVE-2026-3611Proof of concept | Honeywell IQ4x BMS Controller Missing authentication for critical functionhoneywell · iq4e firmware · CWE-306 | Критическая10,0 | — | 1,0 % | 12 мар. 2026 г. |
25Наблюдать | CVE-2025-60012Proof of concept | Apache Livy: Restrict file accessapache · livy · CWE-20 | Средняя6,3 | — | 0,4 % | 13 мар. 2026 г. |
25Наблюдать | CVE-2025-66249Proof of concept | Apache Livy: Unauthorized directory accessapache · livy · CWE-22 | Средняя6,3 | — | 0,6 % | 13 мар. 2026 г. |
30Наблюдать | CVE-2026-1668Proof of concept | Input Validation Vulnerability on Multiple Omada Switchestp-link · omada sg2005p-pd firmware · CWE-20 | Высокая7,7 | — | 1,0 % | 13 мар. 2026 г. |
30Наблюдать | CVE-2026-31899Proof of concept | CairoSVG vulnerable to Exponential DoS via recursive <use> element amplificationcourtbouillon · cairosvg · CWE-674 | Высокая7,5 | — | 0,5 % | 13 мар. 2026 г. |
10Наблюдать | CVE-2026-32445Эксплойта нет | WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerabilityelementor · elementor website builder · CWE-862 | Низкая2,7 | — | 0,3 % | 13 мар. 2026 г. |
40В плане | CVE-2026-32746Proof of concept | telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_gnu · inetutils · CWE-120 | Критическая9,8 | — | 2,5 % | 13 мар. 2026 г. |
60На этой неделе | CVE-2026-3891Готовый эксплойт | Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Uploadlinknacional · pix for woocommerce · CWE-434 | Критическая9,8 | — | 29,7 % | 13 мар. 2026 г. |
66На этой неделе | CVE-2026-3909Готовый эксплойт | Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a cgoogle · chrome · CWE-787 | Высокая8,8 | KEV | 2,3 % | 13 мар. 2026 г. |
65На этой неделе | CVE-2026-3910Готовый эксплойт | Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandgoogle · chrome · CWE-94 | Высокая8,8 | KEV | 1,0 % | 13 мар. 2026 г. |
30Наблюдать | CVE-2026-4111Эксплойта нет | Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchivered hat · red hat enterprise linux 10 · CWE-835 | Высокая7,5 | — | 0,7 % | 13 мар. 2026 г. |
23Наблюдать | CVE-2026-21001Proof of concept | Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.samsung · galaxy store · CWE-22 | Средняя5,9 | — | 0,1 % | 16 мар. 2026 г. |
23Наблюдать | CVE-2026-21002Proof of concept | Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary applicsamsung · galaxy store · CWE-347 | Средняя5,9 | — | 0,0 % | 16 мар. 2026 г. |
27Наблюдать | CVE-2026-21004Proof of concept | Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.samsung · smart switch · CWE-287 | Средняя6,9 | — | 0,1 % | 16 мар. 2026 г. |
28Наблюдать | CVE-2026-21005Proof of concept | Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilegesamsung · smart switch · CWE-22 | Высокая7,1 | — | 0,2 % | 16 мар. 2026 г. |
17Наблюдать | CVE-2026-2461Proof of concept | Missing authorization check allows unauthorized modification of other users' comments on a boardmattermost · mattermost server · CWE-639 | Средняя4,3 | — | 0,1 % | 16 мар. 2026 г. |
39Наблюдать | CVE-2026-32621Proof of concept | Apollo Federation has prototype pollution via incomplete key sanitization@apollo · federation-internals · CWE-1321 | Критическая9,9 | — | 0,6 % | 16 мар. 2026 г. |
34Наблюдать | CVE-2026-32635Proof of concept | Angular has XSS in i18n attribute bindingsangular · angular cli · CWE-79 | Высокая8,6 | — | 0,5 % | 16 мар. 2026 г. |
24Наблюдать | CVE-2026-32707Proof of concept | PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loopdronecode · px4 drone autopilot · CWE-121 | Средняя6,1 | — | 0,2 % | 16 мар. 2026 г. |
18Наблюдать | CVE-2026-32772Эксплойта нет | telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.gnu · inetutils · CWE-669 | Средняя4,7 | — | 0,2 % | 16 мар. 2026 г. |
35Наблюдать | CVE-2026-3227Proof of concept | Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840Ntp-link · tl-wr802n firmware · CWE-78 | Высокая8,5 | — | 1,8 % | 16 мар. 2026 г. |
15Наблюдать | CVE-2026-4197Эксплойта нет | D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injectiondlink · dnr-202l firmware · CWE-74 | Низкая2,1 | — | 24,4 % | 16 мар. 2026 г. |
33Наблюдать | CVE-2026-4255Proof of concept | DLL Injection Privilege Escalationthermalright · tr-vision home · CWE-829 | Высокая8,4 | — | 0,2 % | 16 мар. 2026 г. |
21Наблюдать | CVE-2026-32583Proof of concept | WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerabilitywebnus inc. · modern events calendar · CWE-862 | Средняя5,3 | — | 0,8 % | 16 мар. 2026 г. |
36Наблюдать | CVE-2026-23489Proof of concept | Fields GLPI plugin vulnerable to RCE in dropdown generationteclib-edition · fields · CWE-20 | Критическая9,1 | — | 0,3 % | 16 мар. 2026 г. |
11Наблюдать | CVE-2026-4253Proof of concept | Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injectiontenda · ac8 firmware · CWE-77 | Низкая2,0 | — | 8,5 % | 16 мар. 2026 г. |
21Наблюдать | CVE-2025-69727Proof of concept | An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8.CWE-284 | Средняя5,3 | — | 0,2 % | 16 мар. 2026 г. |
26Наблюдать | CVE-2025-68971Proof of concept | In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be asCWE-400 | Средняя6,5 | — | 0,4 % | 16 мар. 2026 г. |
34Наблюдать | CVE-2026-32263Эксплойта нет | Craft CMS vulnerable to behavior injection RCE via EntryTypesControllercraftcms · craft cms · CWE-470 | Высокая8,6 | — | 0,7 % | 16 мар. 2026 г. |
34Наблюдать | CVE-2026-32264Эксплойта нет | Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllercraftcms · craft cms · CWE-470 | Высокая8,6 | — | 0,7 % | 16 мар. 2026 г. |
35Наблюдать | CVE-2025-50881Proof of concept | The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.CWE-94 | Высокая8,8 | — | 0,6 % | 16 мар. 2026 г. |
40В плане | CVE-2026-3888Готовый эксплойт | Local Privilege Escalation in snapdcanonical · ubuntu linux · CWE-268 | Высокая7,8 | — | 0,4 % | 17 мар. 2026 г. |
36Наблюдать | CVE-2026-25769Proof of concept | Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserializationwazuh · wazuh · CWE-502 | Критическая9,1 | — | 0,9 % | 17 мар. 2026 г. |
21Наблюдать | CVE-2026-20643Proof of concept | A cross-origin issue in the Navigation API was addressed with improved input validation.apple · ipados · CWE-20 | Средняя5,4 | — | 0,3 % | 17 мар. 2026 г. |
39Наблюдать | CVE-2026-21994Proof of concept | Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: oracle · okit · CWE-284 | Критическая9,8 | — | 0,4 % | 17 мар. 2026 г. |
21Наблюдать | CVE-2026-27978Proof of concept | Next.js: null origin can bypass Server Actions CSRF checksvercel · next.js · CWE-352 | Средняя5,3 | — | 0,2 % | 17 мар. 2026 г. |
25Наблюдать | CVE-2026-29057Proof of concept | Next.js: HTTP request smuggling in rewritesvercel · next.js · CWE-444 | Средняя6,3 | — | 0,5 % | 17 мар. 2026 г. |
26Наблюдать | CVE-2026-31891Proof of concept | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()agentejo · cockpit · CWE-89 | Средняя6,5 | — | 0,4 % | 18 мар. 2026 г. |
35Наблюдать | CVE-2026-32596Proof of concept | Glances exposes the REST API without authenticationnicolargo · glances · CWE-200 | Высокая8,7 | — | 1,7 % | 18 мар. 2026 г. |
30Наблюдать | CVE-2026-32606Proof of concept | IncusOS has a LUKS encryption bypass due to insufficient TPM policylxc · incus-os · CWE-522 | Высокая7,6 | — | 0,1 % | 18 мар. 2026 г. |
35Наблюдать | CVE-2026-22730Proof of concept | CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConvertervmware · spring ai · CWE-89 | Высокая8,8 | — | 0,5 % | 18 мар. 2026 г. |
29Наблюдать | CVE-2026-2991Proof of concept | KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Tokeniqonicdesign · kivicare – clinic & patient management system (ehr) · CWE-287 | Высокая7,3 | — | 0,5 % | 18 мар. 2026 г. |
30Наблюдать | CVE-2026-30345Proof of concept | A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside theCWE-23 | Высокая7,5 | — | 0,5 % | 18 мар. 2026 г. |
24Наблюдать | CVE-2026-30695Proof of concept | A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includCWE-79 | Средняя6,1 | — | 0,2 % | 18 мар. 2026 г. |
21Наблюдать | CVE-2026-30048Proof of concept | A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4.CWE-79 | Средняя5,4 | — | 0,3 % | 18 мар. 2026 г. |
35Наблюдать | CVE-2026-31962Эксплойта нет | HTSlib CRAM reader has heap buffer overflow due to improper validation of inputhtslib · htslib · CWE-122 | Высокая8,8 | — | 0,6 % | 18 мар. 2026 г. |
27Наблюдать | CVE-2026-31967Эксплойта нет | HTSlib CRAM reader has out-of-bounds read due to improper validation of inputhtslib · htslib · CWE-125 | Средняя6,9 | — | 0,5 % | 18 мар. 2026 г. |
35Наблюдать | CVE-2026-32321Proof of concept | ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltrationoxygenz · clipbucket · CWE-89 | Высокая8,8 | — | 0,5 % | 18 мар. 2026 г. |
24Наблюдать | CVE-2026-32722Proof of concept | Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadatabloomberg · memray · CWE-79 | Средняя6,1 | — | 0,3 % | 18 мар. 2026 г. |
39Наблюдать | CVE-2026-32731Proof of concept | ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extractionapostrophecms · import-export · CWE-22 | Критическая9,9 | — | 0,6 % | 18 мар. 2026 г. |
35Наблюдать | CVE-2026-32255Proof of concept | Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpointkan · kan · CWE-918 | Высокая8,6 | — | 1,7 % | 18 мар. 2026 г. |
26Наблюдать | CVE-2026-32743Proof of concept | PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handlingdronecode · px4 drone autopilot · CWE-121 | Средняя6,5 | — | 0,3 % | 18 мар. 2026 г. |
21Наблюдать | CVE-2026-29608Эксплойта нет | OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewritingopenclaw · openclaw · CWE-88 | Средняя5,4 | — | 0,1 % | 18 мар. 2026 г. |
36Наблюдать | CVE-2026-27540Proof of concept | WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerabilityrymera web co pty ltd. · woocommerce wholesale lead capture · CWE-434 | Критическая9,0 | — | 1,5 % | 19 мар. 2026 г. |
40В плане | CVE-2026-27542Proof of concept | WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerabilityrymera web co pty ltd. · woocommerce wholesale lead capture · CWE-266 | Критическая9,8 | — | 1,7 % | 19 мар. 2026 г. |
40В плане | CVE-2025-71257Proof of concept | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypassbmc · footprints · CWE-306 | Средняя6,9 | — | 44,5 % | 19 мар. 2026 г. |
26Наблюдать | CVE-2025-71258Proof of concept | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWebbmc · footprints · CWE-918 | Средняя5,3 | — | 17,4 % | 19 мар. 2026 г. |
25Наблюдать | CVE-2025-71259Proof of concept | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSSbmc · footprints · CWE-918 | Средняя5,3 | — | 12,9 % | 19 мар. 2026 г. |
44В плане | CVE-2025-71260Proof of concept | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCEbmc · footprints · CWE-502 | Высокая8,7 | — | 34,3 % | 19 мар. 2026 г. |
31Наблюдать | CVE-2025-69720Proof of concept | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.invisible-island · ncurses · CWE-121 | Высокая7,8 | — | 0,4 % | 19 мар. 2026 г. |
48В плане | CVE-2026-22557Proof of concept | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access fubiquiti inc · unifi network application · CWE-22 | Критическая10,0 | — | 28,1 % | 19 мар. 2026 г. |
37Наблюдать | CVE-2026-32238Proof of concept | OpenEMR has Remote Code Execution in backup functionalityopen-emr · openemr · CWE-78 | Критическая9,1 | — | 2,6 % | 19 мар. 2026 г. |
21Наблюдать | CVE-2026-27454Proof of concept | Discourse has check revision visibility on posts endpointdiscourse · discourse · CWE-862 | Средняя5,3 | — | 0,9 % | 19 мар. 2026 г. |
34Наблюдать | CVE-2026-27934Proof of concept | Discourse leaks private topic title and post excerpt via user action API endpointdiscourse · discourse · CWE-201 | Высокая8,7 | — | 1,4 % | 19 мар. 2026 г. |
34Наблюдать | CVE-2026-32013Proof of concept | OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methodsopenclaw · openclaw · CWE-59 | Высокая8,7 | — | 0,7 % | 19 мар. 2026 г. |
- CVE-2026-2680130Наблюдать
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %pdfmake · pdfmake10 мар. 2026 г.
- CVE-2026-2728031Наблюдать
DNG SDK | Out-of-bounds Write (CWE-787)
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %adobe · dng software development kit10 мар. 2026 г.
- CVE-2026-2782632Наблюдать
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
ВысокаяCVSS 8,2Proof of conceptEPSS 1 %sooperset · mcp atlassian10 мар. 2026 г.
- CVE-2026-2782532Наблюдать
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
ВысокаяCVSS 8,0Proof of conceptEPSS 1 %mcp-atlassian · mcp atlassian10 мар. 2026 г.
- CVE-2026-3095130Наблюдать
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %sequelizejs · sequelize10 мар. 2026 г.
- CVE-2026-3095234Наблюдать
liquidjs has a path traversal fallback vulnerability
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %liquidjs · liquidjs10 мар. 2026 г.
- CVE-2026-3096539Наблюдать
Parse Server session token exfiltration via `redirectClassNameForKey` query parameter
КритическаяCVSS 9,9Proof of conceptEPSS 1 %parseplatform · parse-server10 мар. 2026 г.
- CVE-2026-3180725Наблюдать
SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS
СредняяCVSS 6,4Proof of conceptEPSS 0 %b3log · siyuan10 мар. 2026 г.
- CVE-2026-3180925Наблюдать
SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS
СредняяCVSS 6,4Proof of conceptEPSS 0 %b3log · siyuan10 мар. 2026 г.
- CVE-2026-3095834Наблюдать
OneUptime: Path Traversal — Arbitrary File Read (No Auth)
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %hackerbay · oneuptime10 мар. 2026 г.
- CVE-2026-2381339Наблюдать
Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset
КритическаяCVSS 9,8Proof of conceptEPSS 0 %hpe · arubaos-cx11 мар. 2026 г.
- CVE-2026-241331Наблюдать
Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %elemntor · ally – web accessibility & usability11 мар. 2026 г.
- CVE-2026-263139Наблюдать
Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation
КритическаяCVSS 9,8Proof of conceptEPSS 0 %unknown · datalogics ecommerce delivery11 мар. 2026 г.
- CVE-2026-3184434Наблюдать
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %koha · koha11 мар. 2026 г.
- CVE-2026-380530Наблюдать
use after free in SMB connection reuse
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %haxx · curl11 мар. 2026 г.
- CVE-2025-7033013Наблюдать
Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files.
НизкаяCVSS 3,3Proof of conceptEPSS 0 %11 мар. 2026 г.
- CVE-2026-3074139Наблюдать
A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Si
КритическаяCVSS 9,8Proof of conceptEPSS 1 %openclaw · openclaw11 мар. 2026 г.
- CVE-2025-6703434Наблюдать
Lantronix EDS5000, G520, and X300 OS Command Injection
ВысокаяCVSS 8,6Эксплойта нетEPSS 0 %lantronix · eds5032 firmware11 мар. 2026 г.
- CVE-2025-6703873На этой неделе
Lantronix EDS5000, G520, and X300 OS Command Injection
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 19 %lantronix · eds5008 firmware11 мар. 2026 г.
- CVE-2026-3185239Наблюдать
Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
КритическаяCVSS 9,8Proof of conceptEPSS 0 %jellyfin · jellyfin11 мар. 2026 г.
- CVE-2026-3185732Наблюдать
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %craftcms · craft cms11 мар. 2026 г.
- CVE-2026-3185834Наблюдать
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
ВысокаяCVSS 8,7Эксплойта нетEPSS 0 %craftcms · craft cms11 мар. 2026 г.
- CVE-2019-2548527Наблюдать
R 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR Bypass
СредняяCVSS 6,9Proof of conceptEPSS 0 %r-project · r11 мар. 2026 г.
- CVE-2026-3190034Наблюдать
Black's vulnerable version parsing leads to RCE in GitHub Action
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %python · black11 мар. 2026 г.
- CVE-2026-3209634Наблюдать
Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %useplunk · plunk11 мар. 2026 г.
- CVE-2025-6695639Наблюдать
Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute
КритическаяCVSS 9,9Proof of conceptEPSS 0 %11 мар. 2026 г.
- CVE-2026-3212735Наблюдать
SQL Injection Vulnerability in ajax graphs library (OpenEMR)
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %open-emr · openemr11 мар. 2026 г.
- CVE-2026-3212825Наблюдать
FastGPT Python Sandbox Bypass of File-Write Restriction
СредняяCVSS 6,3Proof of conceptEPSS 0 %fastgpt · fastgpt11 мар. 2026 г.
- CVE-2026-3213639Наблюдать
AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 0 %adguard · adguardhome11 мар. 2026 г.
- CVE-2026-404019Наблюдать
OpenClaw File Existence tools.exec.safeBins information exposure
СредняяCVSS 4,8Proof of conceptEPSS 0 %openclaw · openclaw12 мар. 2026 г.
- CVE-2026-2794031Наблюдать
llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %ggml · llama.cpp12 мар. 2026 г.
- CVE-2026-2906624Наблюдать
Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
СредняяCVSS 6,2Proof of conceptEPSS 0 %ssw · tinacms\/cli12 мар. 2026 г.
- CVE-2025-6695526Наблюдать
Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access file
СредняяCVSS 6,5Proof of conceptEPSS 0 %asseco · live12 мар. 2026 г.
- CVE-2026-3223021Наблюдать
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
СредняяCVSS 5,3Proof of conceptEPSS 0 %uptime.kuma · uptime kuma12 мар. 2026 г.
- CVE-2026-3224732Наблюдать
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %getzep · graphiti12 мар. 2026 г.
- CVE-2026-361140В плане
Honeywell IQ4x BMS Controller Missing authentication for critical function
КритическаяCVSS 10,0Proof of conceptEPSS 1 %honeywell · iq4e firmware12 мар. 2026 г.
- CVE-2025-6001225Наблюдать
Apache Livy: Restrict file access
СредняяCVSS 6,3Proof of conceptEPSS 0 %apache · livy13 мар. 2026 г.
- CVE-2025-6624925Наблюдать
Apache Livy: Unauthorized directory access
СредняяCVSS 6,3Proof of conceptEPSS 0 %apache · livy13 мар. 2026 г.
- CVE-2026-166830Наблюдать
Input Validation Vulnerability on Multiple Omada Switches
ВысокаяCVSS 7,7Proof of conceptEPSS 1 %tp-link · omada sg2005p-pd firmware13 мар. 2026 г.
- CVE-2026-3189930Наблюдать
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %courtbouillon · cairosvg13 мар. 2026 г.
- CVE-2026-3244510Наблюдать
WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability
НизкаяCVSS 2,7Эксплойта нетEPSS 0 %elementor · elementor website builder13 мар. 2026 г.
- CVE-2026-3274640В плане
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_
КритическаяCVSS 9,8Proof of conceptEPSS 2 %gnu · inetutils13 мар. 2026 г.
- CVE-2026-389160На этой неделе
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Готовый эксплойтEPSS 29 %linknacional · pix for woocommerce13 мар. 2026 г.
- CVE-2026-390966На этой неделе
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a c
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 2 %google · chrome13 мар. 2026 г.
- CVE-2026-391065На этой неделе
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sand
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 1 %google · chrome13 мар. 2026 г.
- CVE-2026-411130Наблюдать
Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive
ВысокаяCVSS 7,5Эксплойта нетEPSS 0 %red hat · red hat enterprise linux 1013 мар. 2026 г.
- CVE-2026-2100123Наблюдать
Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.
СредняяCVSS 5,9Proof of conceptEPSS 0 %samsung · galaxy store16 мар. 2026 г.
- CVE-2026-2100223Наблюдать
Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary applic
СредняяCVSS 5,9Proof of conceptEPSS 0 %samsung · galaxy store16 мар. 2026 г.
- CVE-2026-2100427Наблюдать
Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.
СредняяCVSS 6,9Proof of conceptEPSS 0 %samsung · smart switch16 мар. 2026 г.
- CVE-2026-2100528Наблюдать
Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %samsung · smart switch16 мар. 2026 г.
- CVE-2026-246117Наблюдать
Missing authorization check allows unauthorized modification of other users' comments on a board
СредняяCVSS 4,3Proof of conceptEPSS 0 %mattermost · mattermost server16 мар. 2026 г.
- CVE-2026-3262139Наблюдать
Apollo Federation has prototype pollution via incomplete key sanitization
КритическаяCVSS 9,9Proof of conceptEPSS 0 %@apollo · federation-internals16 мар. 2026 г.
- CVE-2026-3263534Наблюдать
Angular has XSS in i18n attribute bindings
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %angular · angular cli16 мар. 2026 г.
- CVE-2026-3270724Наблюдать
PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop
СредняяCVSS 6,1Proof of conceptEPSS 0 %dronecode · px4 drone autopilot16 мар. 2026 г.
- CVE-2026-3277218Наблюдать
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
СредняяCVSS 4,7Эксплойта нетEPSS 0 %gnu · inetutils16 мар. 2026 г.
- CVE-2026-322735Наблюдать
Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N
ВысокаяCVSS 8,5Proof of conceptEPSS 1 %tp-link · tl-wr802n firmware16 мар. 2026 г.
- CVE-2026-419715Наблюдать
D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection
НизкаяCVSS 2,1Эксплойта нетEPSS 24 %dlink · dnr-202l firmware16 мар. 2026 г.
- CVE-2026-425533Наблюдать
DLL Injection Privilege Escalation
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %thermalright · tr-vision home16 мар. 2026 г.
- CVE-2026-3258321Наблюдать
WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability
СредняяCVSS 5,3Proof of conceptEPSS 0 %webnus inc. · modern events calendar16 мар. 2026 г.
- CVE-2026-2348936Наблюдать
Fields GLPI plugin vulnerable to RCE in dropdown generation
КритическаяCVSS 9,1Proof of conceptEPSS 0 %teclib-edition · fields16 мар. 2026 г.
- CVE-2026-425311Наблюдать
Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection
НизкаяCVSS 2,0Proof of conceptEPSS 8 %tenda · ac8 firmware16 мар. 2026 г.
- CVE-2025-6972721Наблюдать
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8.
СредняяCVSS 5,3Proof of conceptEPSS 0 %16 мар. 2026 г.
- CVE-2025-6897126Наблюдать
In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be as
СредняяCVSS 6,5Proof of conceptEPSS 0 %16 мар. 2026 г.
- CVE-2026-3226334Наблюдать
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
ВысокаяCVSS 8,6Эксплойта нетEPSS 0 %craftcms · craft cms16 мар. 2026 г.
- CVE-2026-3226434Наблюдать
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
ВысокаяCVSS 8,6Эксплойта нетEPSS 0 %craftcms · craft cms16 мар. 2026 г.
- CVE-2025-5088135Наблюдать
The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %16 мар. 2026 г.
- CVE-2026-388840В плане
Local Privilege Escalation in snapd
ВысокаяCVSS 7,8Готовый эксплойтEPSS 0 %canonical · ubuntu linux17 мар. 2026 г.
- CVE-2026-2576936Наблюдать
Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
КритическаяCVSS 9,1Proof of conceptEPSS 0 %wazuh · wazuh17 мар. 2026 г.
- CVE-2026-2064321Наблюдать
A cross-origin issue in the Navigation API was addressed with improved input validation.
СредняяCVSS 5,4Proof of conceptEPSS 0 %apple · ipados17 мар. 2026 г.
- CVE-2026-2199439Наблюдать
Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component:
КритическаяCVSS 9,8Proof of conceptEPSS 0 %oracle · okit17 мар. 2026 г.
- CVE-2026-2797821Наблюдать
Next.js: null origin can bypass Server Actions CSRF checks
СредняяCVSS 5,3Proof of conceptEPSS 0 %vercel · next.js17 мар. 2026 г.
- CVE-2026-2905725Наблюдать
Next.js: HTTP request smuggling in rewrites
СредняяCVSS 6,3Proof of conceptEPSS 0 %vercel · next.js17 мар. 2026 г.
- CVE-2026-3189126Наблюдать
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
СредняяCVSS 6,5Proof of conceptEPSS 0 %agentejo · cockpit18 мар. 2026 г.
- CVE-2026-3259635Наблюдать
Glances exposes the REST API without authentication
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %nicolargo · glances18 мар. 2026 г.
- CVE-2026-3260630Наблюдать
IncusOS has a LUKS encryption bypass due to insufficient TPM policy
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %lxc · incus-os18 мар. 2026 г.
- CVE-2026-2273035Наблюдать
CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %vmware · spring ai18 мар. 2026 г.
- CVE-2026-299129Наблюдать
KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %iqonicdesign · kivicare – clinic & patient management system (ehr)18 мар. 2026 г.
- CVE-2026-3034530Наблюдать
A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %18 мар. 2026 г.
- CVE-2026-3069524Наблюдать
A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includ
СредняяCVSS 6,1Proof of conceptEPSS 0 %18 мар. 2026 г.
- CVE-2026-3004821Наблюдать
A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4.
СредняяCVSS 5,4Proof of conceptEPSS 0 %18 мар. 2026 г.
- CVE-2026-3196235Наблюдать
HTSlib CRAM reader has heap buffer overflow due to improper validation of input
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %htslib · htslib18 мар. 2026 г.
- CVE-2026-3196727Наблюдать
HTSlib CRAM reader has out-of-bounds read due to improper validation of input
СредняяCVSS 6,9Эксплойта нетEPSS 0 %htslib · htslib18 мар. 2026 г.
- CVE-2026-3232135Наблюдать
ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %oxygenz · clipbucket18 мар. 2026 г.
- CVE-2026-3272224Наблюдать
Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata
СредняяCVSS 6,1Proof of conceptEPSS 0 %bloomberg · memray18 мар. 2026 г.
- CVE-2026-3273139Наблюдать
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
КритическаяCVSS 9,9Proof of conceptEPSS 0 %apostrophecms · import-export18 мар. 2026 г.
- CVE-2026-3225535Наблюдать
Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %kan · kan18 мар. 2026 г.
- CVE-2026-3274326Наблюдать
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handling
СредняяCVSS 6,5Proof of conceptEPSS 0 %dronecode · px4 drone autopilot18 мар. 2026 г.
- CVE-2026-2960821Наблюдать
OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting
СредняяCVSS 5,4Эксплойта нетEPSS 0 %openclaw · openclaw18 мар. 2026 г.
- CVE-2026-2754036Наблюдать
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,0Proof of conceptEPSS 1 %rymera web co pty ltd. · woocommerce wholesale lead capture19 мар. 2026 г.
- CVE-2026-2754240В плане
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %rymera web co pty ltd. · woocommerce wholesale lead capture19 мар. 2026 г.
- CVE-2025-7125740В плане
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass
СредняяCVSS 6,9Proof of conceptEPSS 44 %bmc · footprints19 мар. 2026 г.
- CVE-2025-7125826Наблюдать
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb
СредняяCVSS 5,3Proof of conceptEPSS 17 %bmc · footprints19 мар. 2026 г.
- CVE-2025-7125925Наблюдать
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS
СредняяCVSS 5,3Proof of conceptEPSS 12 %bmc · footprints19 мар. 2026 г.
- CVE-2025-7126044В плане
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE
ВысокаяCVSS 8,7Proof of conceptEPSS 34 %bmc · footprints19 мар. 2026 г.
- CVE-2025-6972031Наблюдать
The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %invisible-island · ncurses19 мар. 2026 г.
- CVE-2026-2255748В плане
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access f
КритическаяCVSS 10,0Proof of conceptEPSS 28 %ubiquiti inc · unifi network application19 мар. 2026 г.
- CVE-2026-3223837Наблюдать
OpenEMR has Remote Code Execution in backup functionality
КритическаяCVSS 9,1Proof of conceptEPSS 2 %open-emr · openemr19 мар. 2026 г.
- CVE-2026-2745421Наблюдать
Discourse has check revision visibility on posts endpoint
СредняяCVSS 5,3Proof of conceptEPSS 0 %discourse · discourse19 мар. 2026 г.
- CVE-2026-2793434Наблюдать
Discourse leaks private topic title and post excerpt via user action API endpoint
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %discourse · discourse19 мар. 2026 г.
- CVE-2026-3201334Наблюдать
OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %openclaw · openclaw19 мар. 2026 г.