Skip to content
OpenAdvisories

Archive

24 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /24 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.2
    CVE-2026-33331 Public exploit

    oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

    oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control …

    middleapi orpc @orpc/openapi npm
  • High 8.7
    CVE-2026-23921 Public exploit

    Blind, read-only SQL injection in Zabbix API via sortfield parameter

    A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can …

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 8.6
    CVE-2026-33157 Public exploit

    Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

    Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previo…

    craftcms cms craftcms/cms Packagist
  • High 8.2
    CVE-2026-27654 Public exploit EPSS 26%

    NGINX ngx_http_dav_module vulnerability

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modifica…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-33310 Public exploit

    Intake has a Command Injection via shell() Expansion in Parameter Defaults

    Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a paramet…

    intake intake intake PyPI