Skip to content
OpenAdvisories

Archive

13 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /13 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.5
    CVE-2026-3227 Public exploit

    Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N

    A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to…

    TP-Link Systems TL-WR841N v14 TL-WR840N v6 TL-WR802N v4 Network devices
  • Medium 5.2
    CVE-2026-32707 Public exploit

    PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop

    PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabl…

    PX4 PX4-Autopilot
  • High 8.6
    CVE-2026-32635 Public exploit

    Angular has XSS in i18n attribute bindings

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Ang…

    angular core compiler angular.js Debian Ubuntu npm
  • Critical 9.9
    CVE-2026-32621 Public exploit

    Apollo Federation has prototype pollution via incomplete key sanitization

    Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in c…

    @apollo query-planner gateway federation-internals npm
  • High 7.5
    CVE-2026-31899 Public exploit

    CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

    CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

    Kozea CairoSVG cairosvg cairosvg Debian Ubuntu Alpine PyPI
  • Medium 6.8
    CVE-2026-31864 Public exploit

    JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

    JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited…

    jumpserver jumpserver
  • Critical 9.8
    CVE-2026-32746 Public exploit EPSS 45%

    telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption…

    GNU Inetutils inetutils inetutils Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-1668 Public exploit

    Input Validation Vulnerability on Multiple Omada Switches

    The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<…

    TP-Link Systems SG3452XP 2.3x SG2218 1.2x SG3428XPP-M2 1.2x Network devices
  • Medium 6.3
    CVE-2025-60012 Public exploit

    Apache Livy: Restrict file access

    Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3…

    Apache Software Foundation Apache Livy org.apache.livy:livy-server Maven
  • Medium 6.3
    CVE-2025-66249 Public exploit

    Apache Livy: Unauthorized directory access

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the …

    Apache Software Foundation Apache Livy org.apache.livy:livy-server Maven
  • Critical 9.8
    CVE-2026-3891 Public exploit Scanner template EPSS 34%

    Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

    The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This …

    linknacional Pix for WooCommerce Web / CMS