Skip to content
OpenAdvisories

Archive

5 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /5 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.5
    CVE-2026-27778 Public exploit

    ePower epower.ie Improper Restriction of Excessive Authentication Attempts

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, o…

    ePower epower.ie
  • Critical 9.9
    CVE-2026-28466 Public exploit

    OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass

    OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with…

    OpenClaw OpenClaw openclaw npm
  • Critical 10.0
    CVE-2026-0848 Public exploit

    Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading

    NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the …

    nltk nltk/nltk nltk nltk Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2026-27944 Public exploit Scanner template EPSS 23%

    Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This al…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 10.0
    CVE-2026-21628 Public exploit

    Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

    A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution.

    astroidframe.work Astroid Template Framework
  • High 8.5
    CVE-2026-28134 Public exploit

    WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

    Crocoblock JetEngine
  • High 7.2
    CVE-2026-27541 Public exploit

    WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation. This issue affects Wholesale Suite: through 2.2.6.

    Josh Kohlbach Wholesale Suite
  • Medium 5.9
    CVE-2026-27344 Public exploit

    WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5.

    inseriswiss inseri core
  • High 7.7
    CVE-2026-29053 Public exploit

    Ghost Vulnerable to Remote Code Execution via Malicious Themes

    Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

    TryGhost Ghost ghost npm
  • Medium 5.8
    CVE-2024-43035 Public exploit

    Fonoster is vulnerable to directory traversal

    Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.…

    fonoster fonoster @fonoster/voice npm
  • High 8.8
    CVE-2025-70995 Public exploit

    An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execut…

  • High 8.8
    CVE-2026-26416 Public exploit

    An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users …

  • High 8.1
    CVE-2026-26417 Public exploit

    A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Cli…

  • High 7.5
    CVE-2026-26418 Public exploit

    Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows re…