Skip to content
OpenAdvisories

Archive

9 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /9 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-30862 Public exploit

    Critical Stored XSS & Privilege Escalation in Appsmith

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipelin…

    appsmithorg appsmith
  • High 8.2
    CVE-2026-31802 Public exploit

    node-tar Symlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file over…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.8
    CVE-2026-3288 Public exploit

    ingress-nginx rewrite-target nginx configuration injection

    A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller…

    Kubernetes ingress-nginx
  • Critical 9.1
    CVE-2026-31816 Public exploit Scanner template EPSS 17%

    Budibase Universal Auth Bypass via Webhook Query Param Injection

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path …

    Budibase budibase
  • Unscored —
    CVE-2024-14027 Public exploit

    xattr: switch to CLASS(fd)

    In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.2
    CVE-2025-14558 Public exploit

    Remote code execution via ND6 Router Advertisements

    The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of q…

    FreeBSD FreeBSD
  • Medium 5.4
    CVE-2026-25604 Public exploit

    Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

    In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.  This allowed to gain access to different instances with potentially different access controls by reusing SAML…

    Apache Software Foundation Apache Airflow Providers Amazon airflow-3 apache-airflow-providers-amazon Wolfi PyPI
  • High 8.8
    CVE-2025-69219 Public exploit

    Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator

    A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the like…

    Apache Software Foundation Apache Airflow Providers Http airflow-3 apache-airflow-providers-http Wolfi PyPI
  • Medium 5.3
    CVE-2026-3796 Public exploit

    Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control

    A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIO_Imp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access …

    Qi-ANXIN QAX Virus Removal