Skip to content
OpenAdvisories

Archive

14 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /14 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Critical 9.8
    CVE-2026-4163

    Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection

    A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to ini…

    WAVLINK WL-WN579A3
  • Medium 6.1
    CVE-2026-4179

    stm32: usb: Infinite while loop in Interrupt Handler

    Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop.

    zephyrproject-rtos Zephyr
  • Medium 6.4
    CVE-2026-32774

    Vulnogram - Stored Cross-Site Scripting via Comment Hypertext

    Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browser…

    Vulnogram Vulnogram vulnogram npm
  • Low 3.8
    CVE-2026-0849

    crypto: ATAES132A response length allows stack buffer overflow

    Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

    zephyrproject-rtos Zephyr
  • Medium 5.3
    CVE-2026-1870

    Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure

    The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all …

    ThimPress Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor Web / CMS
  • Unscored —
    RUSTSEC-2026-0040

    `tracing-ethers` was removed from crates.io due to malicious code

    The `tracing-ethers` crate attempted to exfiltrate ssh keys to an app hosted on `vercel.app` The malicious crate had 9 version published on 2026-03-09 approximately 5 days before removal and had no evidence of actual downloads. There were no crates depending …

    tracing-ethers crates.io
  • High 8.8
    CVE-2025-54920

    Apache Spark: Spark History Server Code Execution Vulnerability

    This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History W…

    Apache Software Foundation Apache Spark org.apache.spark:spark-core_2.11 org.apache.spark:spark-core_2.10 Maven
  • Medium 4.3
    CVE-2026-1948

    NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license

    The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_license() function in all versions up to, and including, 9.1.9. This makes it possi…

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS