Skip to content
OpenAdvisories

Archive

27 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /27 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-33937 Public exploit

    Handlebars.js has JavaScript Injection via AST Type Confusion

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Critical 9.1
    CVE-2026-27876 Public exploit

    RCE on Grafana via sqlExpressions

    A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going …

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  • Critical 9.8
    CVE-2026-22738 Public exploit

    SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

    In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-…

    Spring Spring AI org.springframework.ai:spring-ai-vector-store Maven
  • Critical 9.3
    CVE-2026-33701 Public exploit

    OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

    OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serializa…

    open-telemetry opentelemetry-java-instrumentation io.opentelemetry.javaagent:opentelemetry-javaagent Maven