Skip to content
OpenAdvisories

Archive

11 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /11 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-32136 Public exploit

    AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

    AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once t…

    AdguardTeam AdGuardHome github.com/AdguardTeam/AdGuardHome Go
  • Critical 9.3
    CVE-2026-32096 Public exploit

    Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

    Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an a…

    useplunk plunk
  • Critical 10.0
    CVE-2026-31852 Public exploit

    Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

    Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write p…

    jellyfin code-quality.yml
  • Critical 9.8
    CVE-2026-2631 Public exploit

    Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation

    The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protect…

    Web / CMS
  • Critical 9.8
    CVE-2026-23813 Public exploit

    Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset

    A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin passw…

    Hewlett Packard Enterprise (HPE) AOS-CX
  • Critical 9.9
    CVE-2025-66956 Public exploit

    Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers …

  • Critical 9.8
    CVE-2025-67038 Exploited Public exploit EPSS 21%

    Lantronix EDS5000, G520, and X300 OS Command Injection

    An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to injec…

    LANTRONIX G520 Series EDS5000 series X300 series
    KEV Jun 23, 2026
  • Critical 9.8
    CVE-2026-30741 Public exploit

    A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary …