Skip to content
OpenAdvisories

Archive

3 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /3 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

60 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-0540

    DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

    DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, …

    cure53 DOMPurify langfuse-3-worker opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2025-15599

    DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML

    DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can includ…

    cure53 DOMPurify langfuse-3-worker opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2025-64736

    An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and M…

    The Biosig Project libbiosig biosig biosig Debian Ubuntu
  • Medium 6.9
    CVE-2026-3344

    WatchGuard Firebox System Integrity Check Bypass

    A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.

    WatchGuard Fireware OS
  • Medium 5.1
    CVE-2026-3343

    WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI

    A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.

    WatchGuard Fireware OS
  • Medium 5.3
    CVE-2025-59060

    Apache Ranger: Hostname verification bypass in NiFiRegistryClient

    Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger-nifi-registry-plugin Maven
  • Medium 5.7
    CVE-2025-15595

    Privilege escalation via dll hijacking in Inno Setup

    Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.

    mlsoft Inno Setup
  • Medium 6.1
    CVE-2026-3455

    mailparser vulnerable to Cross-site Scripting

    Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding ex…

    mailparser npm
  • Medium 5.6
    CVE-2026-20801

    Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher…

    Gallagher NxWitness VMS and Hanwha VMS Integrations
  • Medium 5.7
    CVE-2025-47147

    Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow…

    Gallagher Command Centre Mobile Client
  • Medium 6.5
    CVE-2026-1487

    LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import

    The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes i…

    latepoint LatePoint – Calendar Booking Plugin for Appointments and Events Web / CMS
  • Medium —
    GHSA-5847-rm3g-23mw

    OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

    ## Vulnerability The hook authentication throttle keyed failed attempts by raw socket `remoteAddress` text. IPv4 and IPv4-mapped IPv6 forms of the same client (for example `1.2.3.4` and `::ffff:1.2.3.4`) were treated as different clients, allowing separate ra…

    openclaw npm
  • Medium 6.5
    CVE-2024-55025

    Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized …

  • Medium 6.5
    CVE-2024-55019

    Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231…

  • Medium 5.3
    CVE-2024-55023

    Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allo…

  • Medium 4.1
    CVE-2021-35483

    The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to…

  • Medium 5.5
    CVE-2025-62816

    An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. Unvalidated VS…

  • Medium 5.5
    CVE-2025-62815

    An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference…

  • Medium 5.5
    CVE-2025-63912

    Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for d…

  • Medium 5.3
    CVE-2025-70236

    Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter.