Skip to content
OpenAdvisories

Archive

25 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /25 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

214 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-20112

    A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Softwar…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 5.3
    CVE-2026-20113

    A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Softwar…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 5.4
    CVE-2026-20114

    A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated,…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.1
    CVE-2026-20115

    A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confid…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.5
    CVE-2026-20083

    A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated,…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.5
    CVE-2026-20110

    A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of s…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.1
    CVE-2026-20104

    A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 4.8
    CVE-2026-3218

    Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.

    Drupal Responsive Favicons drupal/responsive_favicons Packagist
  • Medium 6.1
    CVE-2026-3217

    SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.0
    CVE-2026-3216

    Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 5.4
    CVE-2026-3215

    Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.

    Drupal Islandora drupal/islandora Packagist
  • Medium 6.5
    CVE-2026-3214

    CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

    Drupal CAPTCHA drupal/captcha Packagist
  • Medium 4.7
    CVE-2026-3213

    Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 5.4
    CVE-2026-3212

    Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.

    Drupal Tagify drupal/tagify Packagist
  • Medium 4.3
    CVE-2026-3211

    Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

    Drupal Theme Negotiation by Rules drupal/theme_rule Packagist
  • Medium 5.3
    CVE-2026-3210

    Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011

    Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.

    Drupal Material Icons drupal/material_icons Packagist
  • Medium 6.1
    CVE-2026-2349

    UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.

    Drupal UI Icons drupal/ui_icons Packagist
  • Medium 5.4
    CVE-2026-2348

    Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.

    Drupal Quick Edit drupal/quickedit Packagist
  • Medium 4.3
    CVE-2026-1917

    Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 6.5
    CVE-2026-33268

    Nanoleaf Lines unauthenticated firmware file store

    Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. Fixed in 12.3.6.

    Nanoleaf Lines
  • Medium 5.4
    CVE-2026-3591

    A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

    A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-3119

    Authenticated query containing a TKEY record may cause named to terminate unexpectedly

    Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configurati…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • Medium 4.8
    CVE-2026-4816

    Reflected Cross Site Scripting (XSS) vulnerability in Support Board

    A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the 'search' parameter in '/suppo…

    Schiocco Support Board
  • Medium 5.1
    CVE-2025-40841

    Ericsson Indoor Connect 8855 - Cross-Site Request Forgery Vulnerability

    Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lead to unauthorized modification of certain information.

    Ericsson Indoor Connect 8855
  • Medium 5.7
    CVE-2026-32326

    SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authenti…

    Sharp home 5G HR02 Wi-Fi STATION SH-54C Wi-Fi STATION SH-52B
  • Medium 5.3
    CVE-2026-2343

    PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive Download

    The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.

    Web / CMS
  • Medium 6.7
    CVE-2026-33253

    SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the …

    SANYO DENKI SANUPS SOFTWARE SANUPS SOFTWARE STANDALONE
  • Medium 4.3
    CVE-2026-1166

    Open Redirect Vulnerability in Hitachi Ops Center Administrator

    Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.

    Hitachi Hitachi Ops Center Administrator
  • Medium 6.4
    CVE-2026-4766

    Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta

    The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied…

    devrix Easy Image Gallery Web / CMS
  • Medium 4.3
    CVE-2026-20691

    An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and i…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  • Medium 6.2
    CVE-2026-28833

    A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS …

    Apple macOS iOS and iPadOS visionOS macOS iOS
  • Medium 5.5
    CVE-2026-20668

    A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26…

    Apple macOS iOS and iPadOS visionOS macOS iOS
  • Medium 6.8
    CVE-2025-43534

    A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS …

    Apple iOS and iPadOS iOS
  • Medium 5.5
    CVE-2026-28868

    A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Medium 5.5
    CVE-2026-20633

    This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma …

    Apple macOS macOS
  • Medium 5.5
    CVE-2026-28829

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sono…

    Apple macOS macOS
  • Medium 4.3
    CVE-2026-20664

    The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, ma…

    Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu
  • Medium 5.5
    CVE-2026-28852

    A stack overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Medium 6.5
    CVE-2026-28844

    A file access issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.4. An attacker …

    Apple macOS macOS
  • Medium 5.5
    CVE-2026-28845

    An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app ma…

    Apple macOS macOS