Skip to content
OpenAdvisories

Archive

23 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /23 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-4001 Public exploit

    Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula

    The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php.…

    acowebs Woocommerce Custom Product Addons Pro Web / CMS
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI Aqua Security team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • Critical 9.3
    CVE-2026-32913 Public exploit

    OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

    OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers l…

    OpenClaw OpenClaw openclaw npm
  • Critical 9.3
    CVE-2026-3055 Exploited Public exploit Scanner template EPSS 91%

    Insufficient input validation leading to memory overread

    Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

    NetScaler ADC Gateway
    KEV Mar 30, 2026
  • Critical 9.3
    CVE-2026-30849 Public exploit Scanner template

    MantisBT SOAP API has an authentication bypass vulnerability on MySQL

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password paramete…

    mantisbt mantisbt mantisbt/mantisbt Packagist
  • High 7.5
    CVE-2026-25075 Public exploit

    strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow

    strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authen…

    strongSwan strongSwan strongswan strongswan Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-4567 Public exploit

    Tenda A15 UploadCfg stack-based overflow

    A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the argument File leads to stack-based buffer overflow. The attack may be initiated remotely. The explo…

    Tenda A15
  • Medium 5.4
    CVE-2024-46878 Public exploit

    A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and e…

  • Medium 5.4
    CVE-2024-46879 Public exploit

    A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php i…

  • Medium 6.1
    CVE-2025-52204 Public exploit

    A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomer…

    otrs2 znuny znuny Debian Ubuntu
  • High 8.8
    CVE-2026-24516 Public exploit

    DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint

    A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner component (internal/troubleshooting/actioner/actioner.go) processes metadata from the metadata service endpoint and executes commands specified …

    github.com/digitalocean/droplet-agent Go