Skip to content
OpenAdvisories

Archive

2 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /2 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-2256 Public exploit

    Command injection vulnerability in ModelScope's ms-agent

    A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

    modelscope ms-agent ms-agent PyPI
  • High 8.4
    CVE-2026-0047 Public exploit

    In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information du…

    Google Android Android
  • High 7.8
    CVE-2026-0023 Public exploit

    In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership du…

    Google Android Android
  • Medium 6.2
    CVE-2026-0014 Public exploit

    In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input …

    Google Android Android
  • High 8.4
    CVE-2026-0013 Public exploit

    In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confus…

    Google Android Android
  • High 8.4
    CVE-2026-0010 Public exploit

    In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This co…

    Google Android Android
  • Critical 9.8
    CVE-2026-0006 Public exploit

    In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead …

    Google Android Android
  • High 7.5
    CVE-2026-3180 Public exploit

    Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection

    The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient …

    contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Web / CMS
  • High 7.8
    CVE-2026-21385 Exploited Public exploit

    Integer Overflow or Wraparound in Graphics

    Memory corruption while using alignments for memory allocation.

    Qualcomm Snapdragon
    KEV Mar 3, 2026
  • High 8.6
    CVE-2026-28286 Public exploit

    ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when…

    IceWhale Tech ZimaOS
  • Critical 9.8
    CVE-2026-26720 Public exploit

    An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts mo…