Skip to content
OpenAdvisories

Archive

17 March 2026

Vulnerabilities first published on this day (UTC), newest first.

4 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-27978 Public exploit

    Next.js: null origin can bypass Server Actions CSRF checks

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (s…

  • Medium 5.4
    CVE-2026-20643 Public exploit

    A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Backgro…

  • Critical 9.1
    CVE-2026-25769 Public exploit

    Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (m…

  • High 7.8
    CVE-2026-3888 Public exploit

    Local Privilege Escalation in snapd

    Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS…