Skip to content
OpenAdvisories

Archive

25 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /25 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 8.8
    CVE-2026-33917 Public exploit

    OpenEMR has SQL Injection in CAMOS Form

    OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. The vulnerab…

    Open-Emr openemr
  • High 7.2
    CVE-2026-33910 Public exploit

    OpenEMR has a SQL Injection Vulnerability in patient selection

    OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attacke…

    Open-Emr openemr
  • High 8.1
    CVE-2026-29187 Public exploit

    OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php

    OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulner…

    Open-Emr openemr
  • Medium 4.4
    CVE-2026-25645 Public exploit

    Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is…

    psf requests open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 8.1
    CVE-2026-32488 Public exploit

    WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration: from n/a through <= 4.4.9.

    WPEverest User Registration
  • High 7.1
    CVE-2026-20687 Public exploit

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Critical 9.8
    CVE-2026-28858 Public exploit

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remot…

    Apple iOS and iPadOS iOS
  • Medium 6.2
    CVE-2026-20637 Public exploit

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Medium 5.5
    CVE-2026-20698 Public exploit

    The issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Medium 6.2
    CVE-2026-28867 Public exploit

    This issue was addressed with improved authentication. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 an…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Critical 9.8
    CVE-2026-26831 Public exploit

    textract is vulnerable to OS Command Injection

    textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, …

    textract npm
  • Critical 9.8
    CVE-2026-26830 Public exploit

    pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

    pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command st…

    pdf-image npm
  • Critical 9.8
    CVE-2026-26833 Public exploit

    thumbler allows OS Command Injection

    thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.

    thumbler npm
  • Critical 9.8
    CVE-2026-26832 Public exploit

    node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter

    node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command…

    node-tesseract-ocr npm