Skip to content
OpenAdvisories

Archive

13 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /13 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

186 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-31883

    FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-29775

    FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CAC…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-29774

    FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionR…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.3
    CVE-2026-32745

    In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings

    JetBrains Datalore
  • Medium 6.3
    CVE-2025-60012 Public exploit

    Apache Livy: Restrict file access

    Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3…

    Apache Software Foundation Apache Livy org.apache.livy:livy-server Maven
  • Medium 6.3
    CVE-2025-66249 Public exploit

    Apache Livy: Unauthorized directory access

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the …

    Apache Software Foundation Apache Livy org.apache.livy:livy-server Maven
  • Medium 6.5
    CVE-2026-2673

    OpenSSL TLS 1.3 server may choose unexpected key agreement group

    Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used e…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • Medium 6.5
    CVE-2025-13778

    Device Reboot Control

    Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.

    ABB AWIN GW120 AWIN GW100 rev.2 ICS / OT
  • Medium 5.3
    CVE-2026-32543

    WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Blocks: from n/a through <= 2.2.0.

    cyberchimps Responsive Blocks
  • Medium 5.3
    CVE-2026-32486

    WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.

    WP Travel Engine Travel Booking
  • Medium 5.3
    CVE-2026-32487

    WordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Landing Page: from n/a through <= 1.2.7.

    Rara Theme Lawyer Landing Page
  • Medium 4.3
    CVE-2026-32461

    WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.

    Really Simple Plugins Really Simple SSL
  • Medium 6.5
    CVE-2026-32460

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This i…

    themefic Ultimate Addons for Contact Form 7
  • Medium 5.9
    CVE-2026-32462

    WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows DOM-Based XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.1.3.

    Liton Arefin Master Addons for Elementor
  • Medium 4.3
    CVE-2026-32456

    WordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin Menu Editor: from n/a through <= 1.14.1.

    Janis Elsts Admin Menu Editor
  • Medium 5.3
    CVE-2026-32457

    WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product …

    Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-32455

    WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DOM-Based XSS.This issue affects MDTF: from n/a through <= 1.3.5.

    RealMag777 MDTF
  • Medium 6.5
    CVE-2026-32454

    WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.

    ThemeFusion Avada Core
  • Medium 6.5
    CVE-2026-32450

    WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for W…

    RealMag777 Active Products Tables for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-32451

    WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

    ThemeFusion Fusion Builder
  • Medium 5.3
    CVE-2026-32452

    WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

    ThemeFusion Fusion Builder
  • Medium 5.3
    CVE-2026-32453

    WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.

    ThemeFusion Avada Core
  • Medium 6.5
    CVE-2026-32449

    WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through <= 1.3.4.

    themifyme Themify Event Post
  • Medium 4.3
    CVE-2026-32446

    WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.

    Syed Balkhi Contact Form by WPForms
  • Medium 6.5
    CVE-2026-32443

    WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.

    Josh Kohlbach Product Feed PRO for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2026-32447

    WordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.2.

    Vito Peleg Atarim
  • Medium 6.5
    CVE-2026-32448

    WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a throu…

    Eric Teubert Podlove Podcast Publisher
  • Medium 5.3
    CVE-2026-32436

    WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.

    vowelweb VW Photography
  • Medium 5.3
    CVE-2026-32440

    WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.

    Ex-Themes WP Food
  • Medium 5.3
    CVE-2026-32437

    WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.

    vowelweb VW Portfolio
  • Medium 5.0
    CVE-2026-32442

    WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.

    E2Pdf e2pdf
  • Medium 5.3
    CVE-2026-32438

    WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.

    vowelweb VW School Education
  • Medium 5.3
    CVE-2026-32439

    WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.

    WebGeniusLab BigHearts
  • Medium 5.3
    CVE-2026-32435

    WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.

    vowelweb VW Pet Shop
  • Medium 5.3
    CVE-2026-32434

    WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.

    vowelweb VW Fitness
  • Medium 6.5
    CVE-2026-32431

    WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.

    Brainstorm Force Astra Bulk Edit
  • Medium 5.3
    CVE-2026-32432

    WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.42.

    codepeople WP Time Slots Booking Form
  • Medium 6.5
    CVE-2026-32429

    WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.…

    Noor Alam Magical Addons For Elementor
  • Medium 5.3
    CVE-2026-32428

    WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.

    Ays Pro Popup Like box
  • Medium 6.5
    CVE-2026-32430

    WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a t…

    IdeaBox Creations PowerPack Addons for Elementor