Skip to content
OpenAdvisories

Archive

27 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /27 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-4991

    QDOCS Smart School Management System Admission Enquiry enquiry cross site scripting

    A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the component Admission Enquiry Module. Performing a manipulation of the argument Note results in cross s…

    QDOCS Smart School Management System
  • Low 3.7
    CVE-2026-4988

    Open5GS CCA Message smf_s6b denial of service

    A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler. The manipulation results in denial of service. The attack may be launched remotely. Attacks of this…

  • Low 2.7
    CVE-2026-33879

    FLIP doesn't have rate limiting or brute-force protection on login

    Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTC…

    londonaicentre FLIP
  • Low 3.5
    CVE-2026-4973

    SourceCodester Online Quiz System add-question.php cross site scripting

    A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-question.php. Performing a manipulation of the argument quiz_question results in cross site script…

    SourceCodester Online Quiz System
  • Low 2.4
    CVE-2026-4972

    code-projects Online Reviewer System btn_functions.php cross site scripting

    A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation of the argument Description leads to cr…

    code-projects Online Reviewer System
  • Low 3.5
    CVE-2026-4969

    code-projects Social Networking Site Alert home.php cross site scripting

    A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component Alert Handler. The manipulation of the argument content leads to cross site scripting. Remote exploi…

    code-projects Social Networking Site
  • Low 3.5
    CVE-2023-7340

    Wazuh authd service (os_auth) Heap-based Buffer Overflow

    Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting…

    wazuh wazuh
  • Low 3.1
    CVE-2026-4958

    OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization

    A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument…

    OpenBMB XAgent
  • Low 3.5
    CVE-2026-32984

    Heap buffer overflow in wazuh-authd

    Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting…

    wazuh wazuh
  • Low 2.7
    CVE-2026-4957

    OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file

    A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive informatio…

    OpenBMB XAgent
  • Low 1.2
    CVE-2026-33284

    GlobalLeaks has insufficient URL validation in user support API

    GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to …

    globaleaks globaleaks-whistleblowing-software
  • Low 3.7
    CVE-2026-27860

    If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This …

    Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  • Low 2.4
    CVE-2026-4909

    code-projects Exam Form Submission update_s7.php cross site scripting

    A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation of the argument sname causes cross site scripting. It is possible to initiate the attack remotely. T…

    code-projects Exam Form Submission