Skip to content
OpenAdvisories

Archive

6 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /6 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Low 2.5
    CVE-2026-27139

    FileInfo can escape from a Root in os

    On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by …

    Go standard library os langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Low 2.7
    CVE-2026-30241

    Mercurius: queryDepth limit bypassed for WebSocket subscriptions

    Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutat…

    mercurius-js mercurius mercurius npm
  • Low 2.1
    CVE-2026-30237

    Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

    Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is re…

    Intermesh groupoffice
  • Low 2.0
    CVE-2026-29790

    dbt-common: commonprefix() doesn't protect against path traversal

    dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses…

    dbt-labs dbt-common dbt-common PyPI
  • Low 2.2
    CVE-2026-29110

    Cryptomator: Leaking of cleartext paths into log file in non-debug mode

    Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at a time, where the ac…

    cryptomator cryptomator