Skip to content
OpenAdvisories

Archive

13 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /13 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-15060

    claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability

    claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of claude-hovercraft. Authentication is not required to exploit this vuln…

    claude-hovercraft claude-hovercraft
  • Critical 9.9
    CVE-2026-32621 Public exploit

    Apollo Federation has prototype pollution via incomplete key sanitization

    Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in c…

    @apollo federation-internals query-planner gateway npm
  • Critical 9.7
    CVE-2026-32626

    AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates t…

    Mintplex-Labs anything-llm
  • Critical 9.1
    CVE-2026-31886

    Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution

    Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation…

    dagu-org dagu github.com/dagu-org/dagu Go
  • Critical 9.3
    CVE-2026-31806

    FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values pr…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2026-32746 Public exploit EPSS 45%

    telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption…

    GNU Inetutils inetutils inetutils Debian Ubuntu Alpine
  • Critical 10.0
    CVE-2026-26954

    SandboxJS has a Sandbox Escape

    SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} wher…

    nyariv SandboxJS @nyariv/sandboxjs npm
  • Critical 9.1
    CVE-2026-32367

    WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.

    Yannick Lefebvre Modal Dialog
  • Critical 9.8
    CVE-2026-3891 Public exploit Scanner template EPSS 34%

    Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

    The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This …

    linknacional Pix for WooCommerce Web / CMS
  • Critical 9.9
    CVE-2026-22192

    Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage

    Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authenticati…

    Voltronic Power SNMP Web Pro