Skip to content
OpenAdvisories

Archive

6 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /6 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-30225 Public exploit

    OliveTin: RestartAction always runs actions as guest

    OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run…

    OliveTin OliveTin github.com/OliveTin/OliveTin Go
  • High 8.3
    CVE-2026-29075 Public exploit

    Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

    Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner.…

    mesa mesa
  • High 8.8
    CVE-2025-15602 Public exploit

    Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation

    Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of …

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 6.9
    CVE-2026-29059 Public exploit Scanner template

    Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly

    Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log…

    windmill-labs windmill
  • Critical 9.8
    CVE-2026-29058 Public exploit Scanner template

    AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php

    AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, d…

    WWBN AVideo-Encoder wwbn/avideo Packagist
  • High 8.8
    CVE-2026-29041 Public exploit

    Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload

    Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when ha…

    chamilo chamilo-lms
  • Critical 9.8
    CVE-2026-28501 Public exploit

    WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

    WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName pa…

    WWBN AVideo wwbn/avideo Packagist