Skip to content
OpenAdvisories

Archive

20 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /20 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go
  • Critical 9.8
    CVE-2026-3584 Public exploit Scanner template

    Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process

    The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placehold…

    WP Chill Kali Forms — Contact Form & Drag-and-Drop Builder Web / CMS
  • Critical 9.4
    CVE-2026-33075 Public exploit

    FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml

    FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration by any external contributor. It uses pull_request_target (which runs with access…

    labring FastGPT
  • Critical 9.8
    CVE-2026-33057 Public exploit Scanner template

    Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

    Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authent…

    mesop-dev mesop mesop PyPI
  • Critical 9.3
    CVE-2026-33017 Exploited Public exploit Scanner template EPSS 96%

    Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

    Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data paramete…

    langflow-ai langflow langflow PyPI
    KEV Mar 25, 2026
  • Critical 9.8
    CVE-2026-32985 Public exploit

    Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution

    Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious …

    Xerte Xerte Online Toolkits