Skip to content
OpenAdvisories

Archive

7 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /7 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-30861

    WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. Th…

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Critical 10.0
    CVE-2026-30860

    WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vulnerability exists in the application's database query functionality. The validation system fails to …

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Critical 9.3
    CVE-2026-30863

    Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When…

    parse-community parse-server parse-server npm
  • Critical 9.1
    CVE-2026-30832

    Soft Serve: SSRF via unvalidated LFS endpoint in repo import

    Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpo…

    charmbracelet soft-serve github.com/charmbracelet/soft-serve Go
  • Critical 9.3
    CVE-2026-29191

    ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint

    ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in versio…

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go
  • Critical 9.3
    CVE-2026-25070

    XikeStor SKS8310-8X PingTestSet Command Injection

    XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote attackers to execute arbitrary operating system commands. Attackers ca…

    Anhui Seeker Electronic Technology XikeStor SKS8310-8X