March 2026
6,821 CVEs published, +38% on February 2026 and +60% on March 2025. CISA added 26 to KEV.
2026 month by month
- Critical
- 68511% of the 6,046 with a CVSS score
- Added to CISA KEV
- 268 of this month's CVEs are in KEV, listed a median 3 days after publication
- Vendors
- 2,2815,659 products
- Top weakness
- XSSCWE-79 · 765 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1npmOpenclaw, Parse-server, Nocodb56229nonenew
- 2OpenclawOpenclaw, Voice-call, Nextcloud-talk19917nonenew
- 3GoogleAndroid, Chrome, Google Chrome178122new
- 4LinuxLinux, Linux Kernel1781nonenew
- 5Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Openclaw, Linux145102new
- 6MicrosoftMicrosoft Edge, Windows 10 Version 21h2, Windows 10 Version 22h214472new
- 7GoGithub.com/siyuan-note/siyuan/kernel, Github.com/olivetin/olivetin, Github.com/forceu/gokapi13919nonenew
- 8ThemerexAldo, Alliance, Aqualots10513nonenew
- 9PyPIGlances, Openssl-encrypt, Justhtml946nonenew
- 10ApplemacOS, iOS and iPadOS, iPadOS893nonenew
- 11Red HatRed Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux891nonenew
- 12PackagistCraftcms/cms, Wwbn/avideo, Admidio/admidio888nonenew
- 13TendaF453, F453 Firmware, W20E Firmware8814nonenew
- 14WwbnAvideo, Avideo-encoder8411nonenew
- 15AdobeAdobe Experience Manager, Experience Manager, Magento Open Source820nonenew
- 16IBMInfosphere Information Server, Sterling File Gateway, Sterling B2B Integrator720nonenew
- 17CiscoCisco Secure Firewall Threat Defense (FTD) Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Adaptive Security Appliance Software7021new
- 18DlinkDir-513 Firmware, Dns-726-4 Firmware, Dns-320l Firmware6626nonenew
- 19Parse-communityParse-server6510nonenew
- 20SourcecodesterSales and Inventory System, Client Database Management System, Resort Reservation System600nonenew
- 21code-projectsSimple Flight Ticket Booking System, Exam Form Submission, Simple Laundry System550nonenew
- 22MozillaFirefox, Thunderbird, Firefox Esr5121nonenew
- 23Crates.ioZeptoclaw, Aws-lc-sys, Vaultwarden501nonenew
- 24DiscourseDiscourse480nonenew
- 25LinuxfoundationEverest, Nats-server, Backstage453nonenew
Severity
How this month's CVEs score on CVSS; 775 have no score yet. Severity is not exploitation.
- Critical685
- High2,518
- Medium2,578
- Low265
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS765
- CWE-89SQL Injection478
- CWE-862Missing Authorization353
- CWE-787Out-of-bounds Write292
- CWE-22Path Traversal271
- CWE-863Incorrect Authorization265
- CWE-74Injection229
- CWE-98223
- CWE-94Code Injection201
- CWE-78OS Command Injection187
- CWE-918SSRF185
- CWE-121178
- CWE-284Improper Access Control163
- CWE-119Memory Buffer Bounds159
- CWE-125Out-of-bounds Read152
- CWE-639Auth Bypass via User Key136
- CWE-200Information Exposure129
- CWE-502Deserialization119
- CWE-20Improper Input Validation118
- CWE-306Missing Auth for Critical Function117
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries1,60020% of sector-tagged CVEs
- Web & CMS Plugins1,58120% of sector-tagged CVEs
- Enterprise Software86311% of sector-tagged CVEs
- Operating Systems5988% of sector-tagged CVEs
- Networking Infrastructure5217% of sector-tagged CVEs
- Security Products4496% of sector-tagged CVEs
- Mobile Apps3194% of sector-tagged CVEs
- Consumer Software3054% of sector-tagged CVEs
- 7 smaller sectors1,120
- Not yet classified508
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 862Missing Authorization | 787Out-of-bounds Write | 22Path Traversal | 863Incorrect Authorization | 74Injection | 98 | 94Code Injection | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| npm | 32 | 6 | 18 | 41 | 104 | 6 | 6 | 35 | ||
| Сообщество Свободного Программного Обеспечения | 9 | 2 | 3 | 12 | 12 | 8 | 3 | 17 | ||
| Ооо «ред Софт» | 4 | 5 | 17 | 10 | 2 | 1 | 2 | 3 | ||
| Openclaw | 1 | 1 | 20 | 37 | 1 | 2 | 17 | |||
| Linux | 1 | 8 | ||||||||
| 1 | 5 | 37 | 3 | 1 | 1 | |||||
| Go | 14 | 3 | 6 | 13 | 13 | 2 | 1 | 1 | ||
| Microsoft Corp | 2 | 1 | 8 | 1 | 1 | 1 | ||||
| Red Hat Inc. | 2 | 8 | 6 | |||||||
| Themerex | 93 | |||||||||
| Microsoft | 2 | 1 | 2 | 1 | 1 | |||||
| PyPI | 10 | 3 | 3 | 8 | 3 | 1 | 2 | 1 |
In the news
The CVEs security news mentioned most in March 2026.
- CVE-2025-14174Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security sev...28.8
- CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread27.5
- CVE-2025-61882Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploita...29.8
- CVE-2025-8088Path traversal vulnerability in WinRAR28.8
- CVE-2026-3055Insufficient input validation leading to memory overread29.8
- CVE-2005-0469Buffer overflow in the slc_add_reply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large numb...17.5
- CVE-2019-6693Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledg...16.5
- CVE-2020-27932A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Securit...17.8
- CVE-2020-27950A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Moja...15.5
- CVE-2021-27877An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current ...18.2
- CVE-2021-27878An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS commun...18.8
- CVE-2021-30952An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously c...17.8
CVEs published in March 2026
45 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityKEV10.0
- CVE-2026-20131Cisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityKEV10.0
- CVE-2025-67038Lantronix EDS5000, G520, and X300 OS Command InjectionKEV9.8
- CVE-2026-3055Insufficient input validation leading to memory overreadKEV9.8
- CVE-2026-33017Langflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointKEV9.8
- CVE-2026-33634Trivy ecosystem supply chain briefly compromisedKEV8.8
- CVE-2026-3909Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)KEV8.8
- CVE-2026-3910Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity:...KEV8.8
- CVE-2026-21385Integer Overflow or Wraparound in GraphicsKEV7.8
- CVE-2026-3502TrueConf Client Update Integrity Verification BypassKEV7.8
- CVE-2026-28289FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution10.0
- CVE-2026-4681Critical Remote Code Execution vulnerability reported in Windchill10.0
- CVE-2026-31851Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks9.8
- CVE-2026-4257Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality9.8
- CVE-2026-27540WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability9.0
- CVE-2026-3564ScreenConnect Instance Level Cryptographic Material Exposure9.0
- CVE-2026-23920Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection8.8
- CVE-2026-3083GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability8.8
- CVE-2026-4747Remote code execution via RPCSEC_GSS packet validation8.8
- CVE-2026-4815SQL Injection vulnerability in Support Board8.8
- CVE-2026-5027Langflow - Path Traversal Arbitrary File Write via upload_user_file8.8
- CVE-2026-32255Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint8.6
- CVE-2026-33216NATS has MQTT plaintext password disclosure8.6
- CVE-2026-32422WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability8.5
- CVE-2026-22733Authentication Bypass under Actuator CloudFoundry endpoints8.2
- CVE-2026-27654NGINX ngx_http_dav_module vulnerability8.2
- CVE-2026-23971WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability8.1
- CVE-2026-27940llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix7.8
- CVE-2026-29925Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.7.7
- CVE-2026-28431Misskey lacks proper authorization checks and input validation7.5
- CVE-2026-29074SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)7.5
- CVE-2026-29097SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet7.5
- CVE-2026-4020Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API7.5
- CVE-2026-3395MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection7.3
- CVE-2026-4201glowxq glowxq-oj SysFileController.java upload unrestricted upload7.3
- CVE-2026-26133M365 Copilot Information Disclosure Vulnerability7.1
- CVE-2026-30886New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check6.5
- CVE-2026-2358WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute6.4
- CVE-2025-64166Mercurius: Incorrect Content-Type parsing can lead to CSRF attack5.4
- CVE-2026-1276IBM QRadar SIEM Cross-Site Scripting5.4
- CVE-2026-27266Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4
- CVE-2026-1969ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload5.3
- CVE-2026-1001Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint4.8
- CVE-2026-3494MariaDB Server Audit Plugin Comment Handling Bypass4.3
- CVE-2026-4833Orc discount Markdown markdown.c compile recursion3.3