Skip to content
OpenAdvisories

Archive

18 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /18 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.6
    CVE-2026-32255 Public exploit Scanner template EPSS 27%

    Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint

    Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly…

    kanbn kan
  • High 8.8
    CVE-2026-32321 Public exploit

    ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration

    ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` parame…

    MacWarrior clipbucket-v5
  • High 7.3
    CVE-2026-2991 Public exploit

    KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token

    The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token …

    Iqonic Design KiviCare – Clinic & Patient Management System (EHR) Web / CMS
  • High 8.8
    CVE-2026-22730 Public exploit

    CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter

    A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.

    VMware Spring AI org.springframework.ai:spring-ai-mariadb-store Maven
  • High 7.7
    CVE-2026-32606 Public exploit

    IncusOS has a LUKS encryption bypass due to insufficient TPM policy

    IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physical access to the machine to access the encrypted data witho…

    lxc incus-os github.com/lxc/incus-os/incus-osd Go
  • High 7.7
    CVE-2026-31891 Public exploit

    Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

    Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/a…

    cockpit-hq cockpit cockpit-hq/cockpit cockpit Ubuntu Packagist
  • High 7.5
    CVE-2026-30345 Public exploit

    A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitr…