Skip to content
OpenAdvisories

Archive

4 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /4 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-2835 Public exploit

    HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

    An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Tran…

    Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io
  • Critical 9.1
    CVE-2026-29000 Public exploit

    pac4j-jwt JwtAuthenticator Authentication Bypass

    pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public ke…

    pac4j pac4j-jwt org.pac4j:pac4j-jwt Maven
  • High 8.6
    CVE-2025-66024 Public exploit

    XWiki Blog Application home page vulnerable to Stored XSS via Post Title

    The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the po…

    xwiki-contrib application-blog-ui org.xwiki.contrib.blog:application-blog-ui Maven
  • High 8.6
    CVE-2026-0847 Public exploit

    Path Traversal in nltk/nltk

    A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitiz…

    nltk nltk/nltk nltk nltk Debian Ubuntu PyPI
  • Critical 10.0
    CVE-2026-20131 Exploited · Ransomware Public exploit EPSS 44%

    Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

    A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to ins…

    Cisco Cisco Secure Firewall Management Center (FMC) Network devices
    KEV Mar 19, 2026
  • Critical 10.0
    CVE-2026-20079 Exploited Public exploit Scanner template EPSS 89%

    Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

    A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying oper…

    Cisco Cisco Secure Firewall Management Center (FMC) Network devices
    KEV Sep 9, 2026
  • High 7.5
    CVE-2026-28695 Public exploit

    Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

    Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::cre…

    craftcms cms craftcms/cms Packagist
  • High 7.8
    CVE-2026-23231 Public exploit

    netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hook…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-66678 Public exploit

    An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allo…

  • Medium 6.6
    CVE-2025-70342 Public exploit

    erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.js…

  • High 7.8
    CVE-2025-70341 Public exploit

    Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.