Skip to content
OpenAdvisories

Archive

16 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /16 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-23489 Public exploit

    Fields GLPI plugin vulnerable to RCE in dropdown generation

    Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

    pluginsGLPI fields
  • Medium 4.7
    CVE-2026-4253 Public exploit

    Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection

    A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injectio…

    Tenda AC8
  • Medium 4.3
    CVE-2026-2461 Public exploit

    Missing authorization check allows unauthorized modification of other users' comments on a board

    Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisor…

    Mattermost Mattermost github.com/mattermost/mattermost-plugin-boards Go
  • High 8.4
    CVE-2026-4255 Public exploit

    DLL Injection Privilege Escalation

    A DLL search order hijacking vulnerability in Thermalright TR-VISION HOME on Windows (64-bit) allows a local attacker to escalate privileges via DLL side-loading. The application loads certain dynamic-link library (DLL) dependencies using the default Windows …

    thermalright TR-VISION HOME
  • High 7.1
    CVE-2026-21005 Public exploit

    Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with S…

    Samsung Mobile Smart Switch
  • Medium 6.9
    CVE-2026-21004 Public exploit

    Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of ser…

    Samsung Mobile Smart Switch
  • Medium 5.9
    CVE-2026-21002 Public exploit

    Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to ins…

    Samsung Mobile Galaxy Store
  • Medium 5.9
    CVE-2026-21001 Public exploit

    Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privile…

    Samsung Mobile Galaxy Store
  • High 8.8
    CVE-2025-50881 Public exploit

    The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code E…

  • Medium 5.3
    CVE-2025-69727 Public exploit

    An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components …

  • Medium 6.5
    CVE-2025-68971 Public exploit

    In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attac…