По дате публикации
Эксплуатируемые и новые серьёзные CVE: март 2026 г.
349 записей · 10 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 4 из 4
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
37Наблюдать | CVE-2026-27876Proof of concept | RCE on Grafana via sqlExpressionsgrafana · grafana · CWE-94 | Критическая9,1 | — | 1,9 % | 27 мар. 2026 г. |
47В плане | CVE-2026-5027Proof of concept | Langflow - Path Traversal Arbitrary File Write via upload_user_filelangflow · langflow · CWE-22 | Высокая8,8 | — | 39,9 % | 27 мар. 2026 г. |
24Наблюдать | CVE-2026-33868Proof of concept | Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'joinmastodon · mastodon · CWE-601 | Средняя6,1 | — | 0,4 % | 27 мар. 2026 г. |
37Наблюдать | CVE-2026-33873Эксплойта нет | Langflow has Authenticated Code Execution in Agentic Assistant Validationlangflow · langflow · CWE-94 | Критическая9,3 | — | 1,4 % | 27 мар. 2026 г. |
30Наблюдать | CVE-2026-33894Эксплойта нет | Forge has signature forgery in RSA-PKCS due to ASN.1 extra fielddigitalbazaar · forge · CWE-20 | Высокая7,5 | — | 0,4 % | 27 мар. 2026 г. |
40В плане | CVE-2026-33937Proof of concept | Handlebars.js has JavaScript Injection via AST Type Confusionhandlebarsjs · handlebars · CWE-94 | Критическая9,8 | — | 1,9 % | 27 мар. 2026 г. |
33Наблюдать | CVE-2025-15617Proof of concept | Wazuh GitHub Actions Workflow Exposure of Sensitive Credentialswazuh · wazuh · CWE-522 | Высокая8,3 | — | 0,3 % | 27 мар. 2026 г. |
32Наблюдать | CVE-2026-33980Proof of concept | Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queriespab1it0 · azure data explorer mcp server · CWE-943 | Высокая8,1 | — | 0,4 % | 27 мар. 2026 г. |
21Наблюдать | CVE-2026-33936Proof of concept | python-ecdsa: Denial of Service via improper DER length validation in crafted private keystlsfuzzer · ecdsa · CWE-20 | Средняя5,3 | — | 0,4 % | 27 мар. 2026 г. |
30Наблюдать | CVE-2026-4987Proof of concept | SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'brainstormforce · sureforms – contact form, payment form & other custom form builder · CWE-20 | Высокая7,5 | — | 0,9 % | 27 мар. 2026 г. |
27Наблюдать | CVE-2026-5000Proof of concept | PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authenticationpromtengineer · localgpt · CWE-287 | Средняя6,9 | — | 0,3 % | 28 мар. 2026 г. |
35Наблюдать | CVE-2026-34005Proof of concept | In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters xiongmai · dvr/nvr devices · CWE-78 | Высокая8,8 | — | 1,5 % | 29 мар. 2026 г. |
40В плане | CVE-2026-0558Proof of concept | Unauthenticated File Upload in parisneo/lollmslollms · lollms · CWE-287 | Критическая9,8 | — | 2,0 % | 29 мар. 2026 г. |
31Наблюдать | CVE-2026-0560Proof of concept | Server-Side Request Forgery (SSRF) in parisneo/lollmslollms · lollms · CWE-918 | Высокая7,5 | — | 1,7 % | 29 мар. 2026 г. |
41В плане | CVE-2025-15379Эксплойта нет | Command Injection in mlflow/mlflowlfprojects · mlflow · CWE-77 | Критическая10,0 | — | 2,3 % | 30 мар. 2026 г. |
24Наблюдать | CVE-2026-30082Proof of concept | Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.CWE-79 | Средняя6,1 | — | 0,1 % | 30 мар. 2026 г. |
26Наблюдать | CVE-2026-29597Proof of concept | DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability.CWE-284 | Средняя6,5 | — | 0,2 % | 30 мар. 2026 г. |
31Наблюдать | CVE-2026-34472Proof of concept | Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attaczte · zxhn h188a firmware · CWE-200 | Высокая7,1 | — | 8,5 % | 30 мар. 2026 г. |
21Наблюдать | CVE-2026-29909Proof of concept | MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module.mrcms · mrcms · CWE-20 | Средняя5,3 | — | 0,4 % | 30 мар. 2026 г. |
30Наблюдать | CVE-2026-29954Proof of concept | In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of cloudark · kubeplus · CWE-88 | Высокая7,6 | — | 0,2 % | 30 мар. 2026 г. |
50В плане | CVE-2026-33032Proof of concept | Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeovernginxui · nginx ui · CWE-306 | Критическая9,8 | — | 35,2 % | 30 мар. 2026 г. |
63На этой неделе | CVE-2026-3502Готовый эксплойт | TrueConf Client Update Integrity Verification Bypasstrueconf · trueconf · CWE-494 | Высокая7,8 | KEV | 5,5 % | 30 мар. 2026 г. |
22Наблюдать | CVE-2026-5147Proof of concept | YunaiV yudao-cloud get-by-website sql injectionyunaiv · yudao-cloud · CWE-74 | Средняя5,5 | — | 0,3 % | 30 мар. 2026 г. |
38Наблюдать | CVE-2026-21710Proof of concept | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the apnodejs · node.js · CWE-770 | Высокая7,5 | — | 25,0 % | 30 мар. 2026 г. |
23Наблюдать | CVE-2026-21717Proof of concept | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially prnodejs · node.js · CWE-328 | Средняя5,9 | — | 0,2 % | 30 мар. 2026 г. |
35Наблюдать | CVE-2026-31831Proof of concept | Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpointtautulli · tautulli · CWE-23 | Высокая8,7 | — | 1,9 % | 30 мар. 2026 г. |
32Наблюдать | CVE-2026-27018Proof of concept | Gotenberg: Chromium deny-list bypass via case-insensitive URL schemethecodingmachine · gotenberg · CWE-22 | Высокая7,8 | — | 1,7 % | 30 мар. 2026 г. |
19Наблюдать | CVE-2026-32794Proof of concept | Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchangeapache · airflow providers databricks · CWE-295 | Средняя4,8 | — | 0,3 % | 30 мар. 2026 г. |
60На этой неделе | CVE-2026-4257Готовый эксплойт | Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionalitysupsysticcom · contact form by supsystic · CWE-94 | Критическая9,8 | — | 41,4 % | 30 мар. 2026 г. |
51В плане | CVE-2026-3300Proof of concept | Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Fieldwpeverest · everest forms pro · CWE-94 | Критическая9,8 | — | 39,1 % | 30 мар. 2026 г. |
52В плане | CVE-2026-4020Proof of concept | Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST APIrocketgenius · gravity smtp · CWE-200 | Высокая7,5 | — | 73,7 % | 30 мар. 2026 г. |
34Наблюдать | CVE-2026-34040Proof of concept | Moby: AuthZ plugin bypass with oversized request bodydocker · engine · CWE-288 | Высокая7,8 | — | 9,1 % | 30 мар. 2026 г. |
30Наблюдать | CVE-2026-34070Proof of concept | LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functionslangchain · langchain core · CWE-22 | Высокая7,5 | — | 1,3 % | 30 мар. 2026 г. |
26Наблюдать | CVE-2026-34036Proof of concept | Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.phpdolibarr · dolibarr erp/crm · CWE-98 | Средняя6,5 | — | 1,4 % | 31 мар. 2026 г. |
30Наблюдать | CVE-2026-5201Proof of concept | Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg imagegnome · gdk-pixbuf · CWE-122 | Высокая7,5 | — | 1,0 % | 31 мар. 2026 г. |
49В плане | CVE-2026-34156Proof of concept | NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Nodenocobase · nocobase · CWE-913 | Критическая9,9 | — | 34,9 % | 31 мар. 2026 г. |
31Наблюдать | CVE-2026-0596Proof of concept | Command Injection in mlflow/mlflowlfprojects · mlflow · CWE-78 | Высокая7,8 | — | 1,3 % | 31 мар. 2026 г. |
37Наблюдать | CVE-2026-33579Proof of concept | OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approvalopenclaw · openclaw · CWE-863 | Критическая9,4 | — | 0,8 % | 31 мар. 2026 г. |
40В плане | CVE-2026-34162Эксплойта нет | FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theftfastgpt · fastgpt · CWE-306 | Критическая10,0 | — | 0,4 % | 31 мар. 2026 г. |
30Наблюдать | CVE-2026-34200Proof of concept | Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Portnhost · cli · CWE-306 | Высокая7,7 | — | 0,3 % | 31 мар. 2026 г. |
37Наблюдать | CVE-2026-34220Proof of concept | MikroORM is vulnerable to SQL Injection via specially crafted objectmikro-orm · mikroorm · CWE-89 | Критическая9,3 | — | 0,4 % | 31 мар. 2026 г. |
23Наблюдать | CVE-2026-34227Proof of concept | Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interfacebishopfox · sliver · CWE-306 | Средняя5,9 | — | 0,3 % | 31 мар. 2026 г. |
40В плане | CVE-2026-34243Proof of concept | wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`njzjz · wenxian · CWE-77 | Критическая9,8 | — | 2,1 % | 31 мар. 2026 г. |
8Наблюдать | CVE-2026-5203Proof of concept | CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversalCWE-22 | Низкая2,0 | — | 0,3 % | 31 мар. 2026 г. |
29Наблюдать | CVE-2026-34733Эксплойта нет | AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guardwwbn · avideo · CWE-284 | Высокая7,3 | — | 0,3 % | 31 мар. 2026 г. |
30Наблюдать | CVE-2026-34453Proof of concept | SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked contentb3log · siyuan · CWE-863 | Высокая7,5 | — | 1,2 % | 31 мар. 2026 г. |
34Наблюдать | CVE-2026-34605Proof of concept | SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )b3log · siyuan · CWE-79 | Высокая8,6 | — | 0,4 % | 31 мар. 2026 г. |
21Наблюдать | CVE-2026-2950Эксплойта нет | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`lodash · lodash · CWE-1321 | Средняя5,3 | — | 0,3 % | 31 мар. 2026 г. |
40В плане | CVE-2026-4800Proof of concept | lodash vulnerable to Code Injection via `_.template` imports key nameslodash · lodash · CWE-94 | Критическая9,8 | — | 2,7 % | 31 мар. 2026 г. |
- CVE-2026-2787637Наблюдать
RCE on Grafana via sqlExpressions
КритическаяCVSS 9,1Proof of conceptEPSS 1 %grafana · grafana27 мар. 2026 г.
- CVE-2026-502747В плане
Langflow - Path Traversal Arbitrary File Write via upload_user_file
ВысокаяCVSS 8,8Proof of conceptEPSS 39 %langflow · langflow27 мар. 2026 г.
- CVE-2026-3386824Наблюдать
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
СредняяCVSS 6,1Proof of conceptEPSS 0 %joinmastodon · mastodon27 мар. 2026 г.
- CVE-2026-3387337Наблюдать
Langflow has Authenticated Code Execution in Agentic Assistant Validation
КритическаяCVSS 9,3Эксплойта нетEPSS 1 %langflow · langflow27 мар. 2026 г.
- CVE-2026-3389430Наблюдать
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
ВысокаяCVSS 7,5Эксплойта нетEPSS 0 %digitalbazaar · forge27 мар. 2026 г.
- CVE-2026-3393740В плане
Handlebars.js has JavaScript Injection via AST Type Confusion
КритическаяCVSS 9,8Proof of conceptEPSS 1 %handlebarsjs · handlebars27 мар. 2026 г.
- CVE-2025-1561733Наблюдать
Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials
ВысокаяCVSS 8,3Proof of conceptEPSS 0 %wazuh · wazuh27 мар. 2026 г.
- CVE-2026-3398032Наблюдать
Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %pab1it0 · azure data explorer mcp server27 мар. 2026 г.
- CVE-2026-3393621Наблюдать
python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
СредняяCVSS 5,3Proof of conceptEPSS 0 %tlsfuzzer · ecdsa27 мар. 2026 г.
- CVE-2026-498730Наблюдать
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %brainstormforce · sureforms – contact form, payment form & other custom form builder27 мар. 2026 г.
- CVE-2026-500027Наблюдать
PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication
СредняяCVSS 6,9Proof of conceptEPSS 0 %promtengineer · localgpt28 мар. 2026 г.
- CVE-2026-3400535Наблюдать
In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %xiongmai · dvr/nvr devices29 мар. 2026 г.
- CVE-2026-055840В плане
Unauthenticated File Upload in parisneo/lollms
КритическаяCVSS 9,8Proof of conceptEPSS 2 %lollms · lollms29 мар. 2026 г.
- CVE-2026-056031Наблюдать
Server-Side Request Forgery (SSRF) in parisneo/lollms
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %lollms · lollms29 мар. 2026 г.
- CVE-2025-1537941В плане
Command Injection in mlflow/mlflow
КритическаяCVSS 10,0Эксплойта нетEPSS 2 %lfprojects · mlflow30 мар. 2026 г.
- CVE-2026-3008224Наблюдать
Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.
СредняяCVSS 6,1Proof of conceptEPSS 0 %30 мар. 2026 г.
- CVE-2026-2959726Наблюдать
DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability.
СредняяCVSS 6,5Proof of conceptEPSS 0 %30 мар. 2026 г.
- CVE-2026-3447231Наблюдать
Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attac
ВысокаяCVSS 7,1Proof of conceptEPSS 8 %zte · zxhn h188a firmware30 мар. 2026 г.
- CVE-2026-2990921Наблюдать
MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module.
СредняяCVSS 5,3Proof of conceptEPSS 0 %mrcms · mrcms30 мар. 2026 г.
- CVE-2026-2995430Наблюдать
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %cloudark · kubeplus30 мар. 2026 г.
- CVE-2026-3303250В плане
Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
КритическаяCVSS 9,8Proof of conceptEPSS 35 %nginxui · nginx ui30 мар. 2026 г.
- CVE-2026-350263На этой неделе
TrueConf Client Update Integrity Verification Bypass
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 5 %trueconf · trueconf30 мар. 2026 г.
- CVE-2026-514722Наблюдать
YunaiV yudao-cloud get-by-website sql injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %yunaiv · yudao-cloud30 мар. 2026 г.
- CVE-2026-2171038Наблюдать
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the ap
ВысокаяCVSS 7,5Proof of conceptEPSS 25 %nodejs · node.js30 мар. 2026 г.
- CVE-2026-2171723Наблюдать
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially pr
СредняяCVSS 5,9Proof of conceptEPSS 0 %nodejs · node.js30 мар. 2026 г.
- CVE-2026-3183135Наблюдать
Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %tautulli · tautulli30 мар. 2026 г.
- CVE-2026-2701832Наблюдать
Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %thecodingmachine · gotenberg30 мар. 2026 г.
- CVE-2026-3279419Наблюдать
Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange
СредняяCVSS 4,8Proof of conceptEPSS 0 %apache · airflow providers databricks30 мар. 2026 г.
- CVE-2026-425760На этой неделе
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
КритическаяCVSS 9,8Готовый эксплойтEPSS 41 %supsysticcom · contact form by supsystic30 мар. 2026 г.
- CVE-2026-330051В плане
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
КритическаяCVSS 9,8Proof of conceptEPSS 39 %wpeverest · everest forms pro30 мар. 2026 г.
- CVE-2026-402052В плане
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
ВысокаяCVSS 7,5Proof of conceptEPSS 73 %rocketgenius · gravity smtp30 мар. 2026 г.
- CVE-2026-3404034Наблюдать
Moby: AuthZ plugin bypass with oversized request body
ВысокаяCVSS 7,8Proof of conceptEPSS 9 %docker · engine30 мар. 2026 г.
- CVE-2026-3407030Наблюдать
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %langchain · langchain core30 мар. 2026 г.
- CVE-2026-3403626Наблюдать
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
СредняяCVSS 6,5Proof of conceptEPSS 1 %dolibarr · dolibarr erp/crm31 мар. 2026 г.
- CVE-2026-520130Наблюдать
Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %gnome · gdk-pixbuf31 мар. 2026 г.
- CVE-2026-3415649В плане
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
КритическаяCVSS 9,9Proof of conceptEPSS 34 %nocobase · nocobase31 мар. 2026 г.
- CVE-2026-059631Наблюдать
Command Injection in mlflow/mlflow
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %lfprojects · mlflow31 мар. 2026 г.
- CVE-2026-3357937Наблюдать
OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
КритическаяCVSS 9,4Proof of conceptEPSS 0 %openclaw · openclaw31 мар. 2026 г.
- CVE-2026-3416240В плане
FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft
КритическаяCVSS 10,0Эксплойта нетEPSS 0 %fastgpt · fastgpt31 мар. 2026 г.
- CVE-2026-3420030Наблюдать
Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port
ВысокаяCVSS 7,7Proof of conceptEPSS 0 %nhost · cli31 мар. 2026 г.
- CVE-2026-3422037Наблюдать
MikroORM is vulnerable to SQL Injection via specially crafted object
КритическаяCVSS 9,3Proof of conceptEPSS 0 %mikro-orm · mikroorm31 мар. 2026 г.
- CVE-2026-3422723Наблюдать
Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
СредняяCVSS 5,9Proof of conceptEPSS 0 %bishopfox · sliver31 мар. 2026 г.
- CVE-2026-3424340В плане
wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`
КритическаяCVSS 9,8Proof of conceptEPSS 2 %njzjz · wenxian31 мар. 2026 г.
- CVE-2026-52038Наблюдать
CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
НизкаяCVSS 2,0Proof of conceptEPSS 0 %31 мар. 2026 г.
- CVE-2026-3473329Наблюдать
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
ВысокаяCVSS 7,3Эксплойта нетEPSS 0 %wwbn · avideo31 мар. 2026 г.
- CVE-2026-3445330Наблюдать
SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %b3log · siyuan31 мар. 2026 г.
- CVE-2026-3460534Наблюдать
SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %b3log · siyuan31 мар. 2026 г.
- CVE-2026-295021Наблюдать
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
СредняяCVSS 5,3Эксплойта нетEPSS 0 %lodash · lodash31 мар. 2026 г.
- CVE-2026-480040В плане
lodash vulnerable to Code Injection via `_.template` imports key names
КритическаяCVSS 9,8Proof of conceptEPSS 2 %lodash · lodash31 мар. 2026 г.