Week 12, 2026

16–22 March 2026

New CVEs: 1,312
Critical: 94
High: 476
Newly exploited: 9
Advisories: 387
Malicious pkgs: 645

Newly exploited 9

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2025-32432 KEV Mar 20, 2026 Craft CMS Allows Remote Code Execution
craftcms · cms

EPSS 100%
Critical 9.2
CVE-2025-54068 KEV Mar 20, 2026 Livewire vulnerable to remote command execution during property update hydration
livewire · livewire

EPSS 96%
High 8.8
CVE-2025-31277 KEV Mar 20, 2026 The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.…
Apple · macOS · iOS and iPadOS · watchOS

EPSS 1.7%
High 7.8
CVE-2025-43510 KEV Mar 20, 2026 A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS…
Apple · macOS · iOS and iPadOS · watchOS
Medium 5.5
CVE-2025-43520 KEV Mar 20, 2026 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Seq…
Apple · macOS · iOS and iPadOS · watchOS
Critical 10.0
CVE-2026-20131 KEV Mar 19, 2026 · ransomware Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)

EPSS 44%
Critical 9.8
CVE-2026-20963 KEV Mar 18, 2026 Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 29%
High 7.2
CVE-2025-66376 KEV Mar 18, 2026 Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM…
Zimbra · Collaboration

EPSS 20%
Medium 4.3
CVE-2025-47813 KEV Mar 16, 2026 loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
Wftpserver · Wing FTP Server

EPSS 63%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.3
CVE-2026-33017 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
langflow-ai · langflow

EPSS 96%
Critical 10.0
CVE-2026-22557 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underly…
Ubiquiti · UniFi Network Application

EPSS 29%
Critical 9.1
CVE-2026-25769 Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
wazuh · wazuh

EPSS 9.1%
Critical 9.8
CVE-2026-3584 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
wpchill · Kali Forms — Contact Form & Drag-and-Drop Builder

EPSS 7.4%
Critical 9.8
CVE-2026-33057 Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
mesop-dev · mesop

EPSS 6.6%
Critical 9.0
CVE-2026-27540 WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
Rymera Web Co Pty · Woocommerce Wholesale Lead Capture

EPSS 2.7%
Critical 9.5
CVE-2026-30872 OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup
openwrt · openwrt

EPSS 2.4%
Critical 9.8
CVE-2025-69902 A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting…
EPSS 2.2%
Critical 9.1
CVE-2026-32238 OpenEMR has Remote Code Execution in backup functionality
openemr · openemr

EPSS 2%
Critical 9.8
CVE-2026-27542 WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability
Rymera Web Co Pty · Woocommerce Wholesale Lead Capture

EPSS 1.8%
Critical 9.1
CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path
grpc · grpc-go

EPSS 1.6%
Critical 9.8
CVE-2026-32985 Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution
Xerte · Xerte Online Toolkits

EPSS 1.5%
Critical 9.8
CVE-2026-4252 Tenda AC8 IPv6 check_is_ipv6 ip address for authentication
Tenda · AC8

EPSS 1.3%
Critical 9.8
CVE-2025-67113 OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote …
EPSS 1.3%
Critical 9.5
CVE-2026-30871 OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query
openwrt · openwrt

EPSS 1.3%

All 94 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.3
CVE-2025-71257 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass
BMC Software · FootPrints

EPSS 45%
High 8.8
CVE-2025-71260 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE
BMC Software · FootPrints

EPSS 34%
High 8.6
CVE-2026-32255 Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
kanbn · kan

EPSS 27%
Medium 4.3
CVE-2025-71258 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb
BMC Software · FootPrints

EPSS 17%
Medium 6.3
CVE-2026-4228 LB-LINK BL-WR9000 set_wifi sub_458754 command injection
LB-LINK · BL-WR9000

EPSS 13%
Medium 4.3
CVE-2025-71259 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS
BMC Software · FootPrints

EPSS 13%
Medium 4.7
CVE-2026-4537 Cudy TR1200 ipsec.lua action_ipsec_conn command injection
Cudy · TR1200

EPSS 9.8%
High 7.7
CVE-2026-32267 Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
craftcms · cms

EPSS 9.6%

Advisories

USN-8100-1 linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities 425 CVEs
USN-8095-3 linux-realtime, linux-realtime-6.8 vulnerabilities 423 CVEs
USN-8095-2 linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities 423 CVEs
USN-8095-1 linux, linux-aws, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities 423 CVEs
USN-8096-4 linux-realtime vulnerabilities 217 CVEs
USN-8096-3 linux-aws-5.15, linux-gcp-5.15, linux-gke, linux-hwe-5.15, linux-intel-iotg-5.15, linux-lowlatency-hwe-5.15, linux-oracle-5.15 vulnerabilities 217 CVEs
USN-8096-2 linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities 217 CVEs
USN-8096-1 linux, linux-aws, linux-gcp, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-xilinx-zynqmp vulnerabilities 217 CVEs
USN-8094-2 linux-gcp-6.17, linux-realtime vulnerabilities 172 CVEs
USN-8094-1 linux, linux-aws, linux-aws-6.17, linux-gcp, linux-hwe-6.17, linux-oracle, linux-oracle-6.17 vulnerabilities 172 CVEs