Skip to content
OpenAdvisories

Archive

30 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /30 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-32794 Public exploit

    Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange

    Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipula…

    Apache Software Foundation Apache Airflow Provider for Databricks apache-airflow PyPI
  • Critical 9.8
    CVE-2026-4257 Public exploit Scanner template EPSS 41%

    Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

    The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` templa…

    supsysticcom Contact Form by Supsystic Web / CMS
  • Medium 5.9
    CVE-2026-21717 Public exploit

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-21710 Public exploit EPSS 25%

    A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.3
    CVE-2026-5147 Public exploit

    YunaiV yudao-cloud get-by-website sql injection

    A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack r…

    YunaiV yudao-cloud
  • High 7.8
    CVE-2026-3502 Exploited Public exploit

    TrueConf Client Update Integrity Verification Bypass

    TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, t…

    TrueConf TrueConf Client
    KEV Apr 2, 2026
  • Critical 9.8
    CVE-2026-33032 Public exploit Scanner template EPSS 35%

    Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

    Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthR…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 7.1
    CVE-2026-34472 Public exploit

    Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows …

  • Medium 5.3
    CVE-2026-29909 Public exploit

    MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/…

  • High 7.6
    CVE-2026-29954 Public exploit

    In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing t…

  • Medium 6.5
    CVE-2026-29597 Public exploit

    DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged u…

  • Medium 6.1
    CVE-2026-30082 Public exploit

    Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of Ing…