İçeriğe atla
Noroxi

Yayın tarihine göre

Mart 2026: sömürülen ve yeni ciddi CVE kayıtları

342 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 4

  • CVE-2026-26801
    30İzleyin

    Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    pdfmake · pdfmake10 Mar 2026

  • CVE-2026-27280
    31İzleyin

    DNG SDK | Out-of-bounds Write (CWE-787)

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    adobe · dng software development kit10 Mar 2026

  • CVE-2026-27826
    32İzleyin

    MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

    YüksekCVSS 8,2Kavram kanıtıEPSS %1

    sooperset · mcp atlassian10 Mar 2026

  • CVE-2026-27825
    32İzleyin

    MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

    YüksekCVSS 8,0Kavram kanıtıEPSS %1

    mcp-atlassian · mcp atlassian10 Mar 2026

  • CVE-2026-30951
    30İzleyin

    Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    sequelizejs · sequelize10 Mar 2026

  • CVE-2026-30952
    34İzleyin

    liquidjs has a path traversal fallback vulnerability

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    liquidjs · liquidjs10 Mar 2026

  • CVE-2026-30965
    39İzleyin

    Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

    KritikCVSS 9,9Kavram kanıtıEPSS %1

    parseplatform · parse-server10 Mar 2026

  • CVE-2026-31807
    25İzleyin

    SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    b3log · siyuan10 Mar 2026

  • CVE-2026-31809
    25İzleyin

    SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    b3log · siyuan10 Mar 2026

  • CVE-2026-30958
    34İzleyin

    OneUptime: Path Traversal — Arbitrary File Read (No Auth)

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    hackerbay · oneuptime10 Mar 2026

  • CVE-2026-23813
    39İzleyin

    Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    hpe · arubaos-cx11 Mar 2026

  • CVE-2026-2413
    31İzleyin

    Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    elemntor · ally – web accessibility & usability11 Mar 2026

  • CVE-2026-2631
    39İzleyin

    Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    unknown · datalogics ecommerce delivery11 Mar 2026

  • CVE-2026-31844
    34İzleyin

    Authenticated SQL Injection in Koha displayby parameter of suggestion.pl

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    koha · koha11 Mar 2026

  • CVE-2026-3805
    30İzleyin

    use after free in SMB connection reuse

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    haxx · curl11 Mar 2026

  • CVE-2025-70330
    13İzleyin

    Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files.

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    11 Mar 2026

  • CVE-2026-30741
    39İzleyin

    A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Si

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    openclaw · openclaw11 Mar 2026

  • CVE-2025-67034
    34İzleyin

    Lantronix EDS5000, G520, and X300 OS Command Injection

    YüksekCVSS 8,6İstismar yokEPSS %0

    lantronix · eds5032 firmware11 Mar 2026

  • CVE-2025-67038
    73Bu hafta

    Lantronix EDS5000, G520, and X300 OS Command Injection

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %19

    lantronix · eds5008 firmware11 Mar 2026

  • CVE-2026-31852
    39İzleyin

    Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    jellyfin · jellyfin11 Mar 2026

  • CVE-2026-31857
    32İzleyin

    CraftCMS has an RCE vulnerability via relational conditionals in the control panel

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    craftcms · craft cms11 Mar 2026

  • CVE-2026-31858
    34İzleyin

    CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

    YüksekCVSS 8,7İstismar yokEPSS %0

    craftcms · craft cms11 Mar 2026

  • CVE-2019-25485
    27İzleyin

    R 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR Bypass

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    r-project · r11 Mar 2026

  • CVE-2026-31900
    34İzleyin

    Black's vulnerable version parsing leads to RCE in GitHub Action

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    python · black11 Mar 2026

  • CVE-2026-32096
    34İzleyin

    Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    useplunk · plunk11 Mar 2026

  • CVE-2025-66956
    39İzleyin

    Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    11 Mar 2026

  • CVE-2026-32127
    35İzleyin

    SQL Injection Vulnerability in ajax graphs library (OpenEMR)

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    open-emr · openemr11 Mar 2026

  • CVE-2026-32128
    25İzleyin

    FastGPT Python Sandbox Bypass of File-Write Restriction

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    fastgpt · fastgpt11 Mar 2026

  • CVE-2026-32136
    39İzleyin

    AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    adguard · adguardhome11 Mar 2026

  • CVE-2026-4040
    19İzleyin

    OpenClaw File Existence tools.exec.safeBins information exposure

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    openclaw · openclaw12 Mar 2026

  • CVE-2026-27940
    31İzleyin

    llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    ggml · llama.cpp12 Mar 2026

  • CVE-2026-29066
    24İzleyin

    Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

    OrtaCVSS 6,2Kavram kanıtıEPSS %0

    ssw · tinacms\/cli12 Mar 2026

  • CVE-2025-66955
    26İzleyin

    Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access file

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    asseco · live12 Mar 2026

  • CVE-2026-32230
    21İzleyin

    Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    uptime.kuma · uptime kuma12 Mar 2026

  • CVE-2026-32247
    32İzleyin

    Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    getzep · graphiti12 Mar 2026

  • CVE-2026-3611
    40Planlayın

    Honeywell IQ4x BMS Controller Missing authentication for critical function

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    honeywell · iq4e firmware12 Mar 2026

  • CVE-2025-60012
    25İzleyin

    Apache Livy: Restrict file access

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    apache · livy13 Mar 2026

  • CVE-2025-66249
    25İzleyin

    Apache Livy: Unauthorized directory access

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    apache · livy13 Mar 2026

  • CVE-2026-1668
    30İzleyin

    Input Validation Vulnerability on Multiple Omada Switches

    YüksekCVSS 7,7Kavram kanıtıEPSS %1

    tp-link · omada sg2005p-pd firmware13 Mar 2026

  • CVE-2026-31899
    30İzleyin

    CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    courtbouillon · cairosvg13 Mar 2026

  • CVE-2026-32445
    10İzleyin

    WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability

    DüşükCVSS 2,7İstismar yokEPSS %0

    elementor · elementor website builder13 Mar 2026

  • CVE-2026-32746
    40Planlayın

    telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    gnu · inetutils13 Mar 2026

  • CVE-2026-3891
    60Bu hafta

    Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8SilahlaştırılmışEPSS %29

    linknacional · pix for woocommerce13 Mar 2026

  • CVE-2026-3909
    66Bu hafta

    Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a c

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %2

    google · chrome13 Mar 2026

  • CVE-2026-3910
    65Bu hafta

    Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sand

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %1

    google · chrome13 Mar 2026

  • CVE-2026-4111
    30İzleyin

    Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 1013 Mar 2026

  • CVE-2026-21001
    23İzleyin

    Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    samsung · galaxy store16 Mar 2026

  • CVE-2026-21002
    23İzleyin

    Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary applic

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    samsung · galaxy store16 Mar 2026

  • CVE-2026-21004
    27İzleyin

    Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    samsung · smart switch16 Mar 2026

  • CVE-2026-21005
    28İzleyin

    Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    samsung · smart switch16 Mar 2026

  • CVE-2026-2461
    17İzleyin

    Missing authorization check allows unauthorized modification of other users' comments on a board

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    mattermost · mattermost server16 Mar 2026

  • CVE-2026-32621
    39İzleyin

    Apollo Federation has prototype pollution via incomplete key sanitization

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    @apollo · federation-internals16 Mar 2026

  • CVE-2026-32635
    34İzleyin

    Angular has XSS in i18n attribute bindings

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    angular · angular cli16 Mar 2026

  • CVE-2026-32707
    24İzleyin

    PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    dronecode · px4 drone autopilot16 Mar 2026

  • CVE-2026-32772
    18İzleyin

    telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

    OrtaCVSS 4,7İstismar yokEPSS %0

    gnu · inetutils16 Mar 2026

  • CVE-2026-3227
    35İzleyin

    Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N

    YüksekCVSS 8,5Kavram kanıtıEPSS %1

    tp-link · tl-wr802n firmware16 Mar 2026

  • CVE-2026-4197
    15İzleyin

    D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection

    DüşükCVSS 2,1İstismar yokEPSS %24

    dlink · dnr-202l firmware16 Mar 2026

  • CVE-2026-4255
    33İzleyin

    DLL Injection Privilege Escalation

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    thermalright · tr-vision home16 Mar 2026

  • CVE-2026-32583
    21İzleyin

    WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    webnus inc. · modern events calendar16 Mar 2026

  • CVE-2026-23489
    36İzleyin

    Fields GLPI plugin vulnerable to RCE in dropdown generation

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    teclib-edition · fields16 Mar 2026

  • CVE-2026-4253
    11İzleyin

    Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection

    DüşükCVSS 2,0Kavram kanıtıEPSS %8

    tenda · ac8 firmware16 Mar 2026

  • CVE-2025-69727
    21İzleyin

    An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8.

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    16 Mar 2026

  • CVE-2025-68971
    26İzleyin

    In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be as

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    16 Mar 2026

  • CVE-2026-32263
    34İzleyin

    Craft CMS vulnerable to behavior injection RCE via EntryTypesController

    YüksekCVSS 8,6İstismar yokEPSS %0

    craftcms · craft cms16 Mar 2026

  • CVE-2026-32264
    34İzleyin

    Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

    YüksekCVSS 8,6İstismar yokEPSS %0

    craftcms · craft cms16 Mar 2026

  • CVE-2025-50881
    35İzleyin

    The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    16 Mar 2026

  • CVE-2026-3888
    40Planlayın

    Local Privilege Escalation in snapd

    YüksekCVSS 7,8SilahlaştırılmışEPSS %0

    canonical · ubuntu linux17 Mar 2026

  • CVE-2026-25769
    36İzleyin

    Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    wazuh · wazuh17 Mar 2026

  • CVE-2026-20643
    21İzleyin

    A cross-origin issue in the Navigation API was addressed with improved input validation.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    apple · ipados17 Mar 2026

  • CVE-2026-21994
    39İzleyin

    Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component:

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    oracle · okit17 Mar 2026

  • CVE-2026-27978
    21İzleyin

    Next.js: null origin can bypass Server Actions CSRF checks

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    vercel · next.js17 Mar 2026

  • CVE-2026-29057
    25İzleyin

    Next.js: HTTP request smuggling in rewrites

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    vercel · next.js17 Mar 2026

  • CVE-2026-31891
    26İzleyin

    Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    agentejo · cockpit18 Mar 2026

  • CVE-2026-32596
    35İzleyin

    Glances exposes the REST API without authentication

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    nicolargo · glances18 Mar 2026

  • CVE-2026-32606
    30İzleyin

    IncusOS has a LUKS encryption bypass due to insufficient TPM policy

    YüksekCVSS 7,6Kavram kanıtıEPSS %0

    lxc · incus-os18 Mar 2026

  • CVE-2026-22730
    35İzleyin

    CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    vmware · spring ai18 Mar 2026

  • CVE-2026-2991
    29İzleyin

    KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    iqonicdesign · kivicare – clinic & patient management system (ehr)18 Mar 2026

  • CVE-2026-30345
    30İzleyin

    A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    18 Mar 2026

  • CVE-2026-30695
    24İzleyin

    A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includ

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    18 Mar 2026

  • CVE-2026-30048
    21İzleyin

    A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    18 Mar 2026

  • CVE-2026-31962
    35İzleyin

    HTSlib CRAM reader has heap buffer overflow due to improper validation of input

    YüksekCVSS 8,8İstismar yokEPSS %0

    htslib · htslib18 Mar 2026

  • CVE-2026-31967
    27İzleyin

    HTSlib CRAM reader has out-of-bounds read due to improper validation of input

    OrtaCVSS 6,9İstismar yokEPSS %0

    htslib · htslib18 Mar 2026

  • CVE-2026-32321
    35İzleyin

    ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    oxygenz · clipbucket18 Mar 2026

  • CVE-2026-32722
    24İzleyin

    Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    bloomberg · memray18 Mar 2026

  • CVE-2026-32731
    39İzleyin

    ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    apostrophecms · import-export18 Mar 2026

  • CVE-2026-32255
    35İzleyin

    Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    kan · kan18 Mar 2026

  • CVE-2026-32743
    26İzleyin

    PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handling

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    dronecode · px4 drone autopilot18 Mar 2026

  • CVE-2026-29608
    21İzleyin

    OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting

    OrtaCVSS 5,4İstismar yokEPSS %0

    openclaw · openclaw18 Mar 2026

  • CVE-2026-27540
    36İzleyin

    WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability

    KritikCVSS 9,0Kavram kanıtıEPSS %1

    rymera web co pty ltd. · woocommerce wholesale lead capture19 Mar 2026

  • CVE-2026-27542
    40Planlayın

    WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    rymera web co pty ltd. · woocommerce wholesale lead capture19 Mar 2026

  • CVE-2025-71257
    40Planlayın

    BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass

    OrtaCVSS 6,9Kavram kanıtıEPSS %44

    bmc · footprints19 Mar 2026

  • CVE-2025-71258
    26İzleyin

    BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb

    OrtaCVSS 5,3Kavram kanıtıEPSS %17

    bmc · footprints19 Mar 2026

  • CVE-2025-71259
    25İzleyin

    BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

    OrtaCVSS 5,3Kavram kanıtıEPSS %12

    bmc · footprints19 Mar 2026

  • CVE-2025-71260
    44Planlayın

    BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE

    YüksekCVSS 8,7Kavram kanıtıEPSS %34

    bmc · footprints19 Mar 2026

  • CVE-2025-69720
    31İzleyin

    The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    invisible-island · ncurses19 Mar 2026

  • CVE-2026-22557
    48Planlayın

    A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access f

    KritikCVSS 10,0Kavram kanıtıEPSS %28

    ubiquiti inc · unifi network application19 Mar 2026

  • CVE-2026-32238
    37İzleyin

    OpenEMR has Remote Code Execution in backup functionality

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    open-emr · openemr19 Mar 2026

  • CVE-2026-27454
    21İzleyin

    Discourse has check revision visibility on posts endpoint

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    discourse · discourse19 Mar 2026

  • CVE-2026-27934
    34İzleyin

    Discourse leaks private topic title and post excerpt via user action API endpoint

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    discourse · discourse19 Mar 2026

  • CVE-2026-32013
    34İzleyin

    OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    openclaw · openclaw19 Mar 2026