Skip to content
OpenAdvisories

Archive

31 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /31 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-34243 Public exploit

    wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`

    wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potenti…

    njzjz wenxian njzjz/wenxian GitHub Actions
  • Critical 9.3
    CVE-2026-34220 Public exploit

    MikroORM is vulnerable to SQL Injection via specially crafted object

    MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This i…

    mikro-orm mikro-orm @mikro-orm/core npm
  • Critical 9.6
    CVE-2026-0596 Public exploit

    Command Injection in mlflow/mlflow

    A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacha…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.9
    CVE-2026-33579 Public exploit

    OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval

    OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending devic…

    OpenClaw OpenClaw openclaw npm
  • Critical 10.0
    CVE-2026-34156 Public exploit Scanner template EPSS 35%

    NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

    NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allow…

    nocobase nocobase @nocobase/plugin-workflow-javascript npm
  • Critical 9.8
    CVE-2026-3300 Public exploit Scanner template EPSS 39%

    Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

    The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field val…

    WPEverest Everest Forms Pro Web / CMS