CVEs published in March 2026
299 tracked CVEs from 19 vendors had their first vendor advisory published in March 2026: 85 critical, 93 high, 4 in CISA KEV. Newest first.
342 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2026-3470Medium
SonicWall · 1 advisory - Added
CVE-2026-3469Medium
SonicWall · 1 advisory - Added
CVE-2026-3468Medium
SonicWall · 1 advisory - Added
CVE-2026-4800Critical
RCE (Remote Code Execution) lodash Dependency in Bitbucket Data Center
Atlassian, NetApp, Red Hat, Splunk · 5 advisories - Added
CVE-2026-2950Critical
Prototype pollution allows deletion of built-in prototype properties via array path bypass
NetApp, Red Hat, Splunk · 3 advisories - Added
CVE-2026-34073Critical
Security bypass due to improper DNS name constraint validation
NetApp, Red Hat, Splunk · 4 advisories - Added
CVE-2026-33997High
Privilege validation bypass during plugin installation
Docker, Red Hat · 2 advisories - Added
CVE-2026-5287Critical
Use after free in PDF
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5286Critical
Use after free in Dawn
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5285Critical
Use after free in WebGL
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5284Critical
Use after free in Dawn
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5283High
Inappropriate implementation in ANGLE
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5282Medium
Out of bounds read in WebCodecs
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5281CriticalCISA KEV
Google Dawn Use-After-Free Vulnerability
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5280Critical
Use after free in WebCodecs
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5279Critical
Object corruption in V8
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5278Critical
Use after free in Web MIDI
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5277Critical
Integer overflow in ANGLE
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5276Medium
Insufficient policy enforcement in WebUSB
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5275Critical
Heap buffer overflow in ANGLE
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5274Critical
Integer overflow in Codecs
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5273Critical
Use after free in CSS
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-5272Critical
Heap buffer overflow in GPU
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-32794Medium
Apache Airflow: Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks.
Apache · 1 advisory - Added
CVE-2026-21714Medium
Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames
NetApp, Red Hat · 2 advisories - Added
CVE-2026-21713Medium
Information disclosure via timing oracle in HMAC verification
NetApp, Red Hat · 2 advisories - Added
CVE-2026-21711Medium
Unauthorized inter-process communication due to missing Unix Domain Socket permission checks
NetApp, Red Hat · 2 advisories - Added
CVE-2026-21710High
Denial of Service due to crafted HTTP `__proto__` header
NetApp, Red Hat · 2 advisories - Added
CVE-2026-4046High
Denial of Service via iconv function with specific character sets
NetApp, Red Hat · 2 advisories - Added
CVE-2026-21712High
Denial of Service via malformed Internationalized Domain Name processing
NetApp, Red Hat · 2 advisories - Added
CVE-2026-4315High
WatchGuard Firebox Cross-Site Request Forgery (CSRF) in Fireware Web UI
WatchGuard · 1 advisory - Added
CVE-2026-4266High
WatchGuard Firebox Insecure Deserialization in Fireware Access Portal
WatchGuard · 1 advisory - Added
CVE-2026-2370High
Improper authorization allows credential disclosure and GitLab app impersonation
GitLab, Red Hat · 2 advisories - Added
CVE-2019-25651Critical
Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC…
Ubiquiti · 1 advisory - Added
CVE-2019-25652High
UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM
Ubiquiti · 1 advisory - Added
CVE-2026-33941High
Handlebars.js Vulnerability in NetApp Products
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33940High
Handlebars.js Vulnerability in NetApp Products
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33939High
Denial of Service via malformed decorator syntax in template compilation
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33938High
Handlebars.js Vulnerability in NetApp Products
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33937Critical
Remote Code Execution via crafted Abstract Syntax Tree object in compile
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33871High
Denial of Service via HTTP/2 CONTINUATION frame flood
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33870High
Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values
NetApp, Red Hat · 2 advisories - Added
CVE-2026-3055HighCISA KEV
Citrix NetScaler Out-of-Bounds Read Vulnerability
NetScaler · 1 advisory - Added
CVE-2026-33748High
Unauthorized file access via Git URL fragment subdir components
Docker, Red Hat · 2 advisories - Added
CVE-2026-22744High
In RedisFilterExpressionConverter of spring-ai-redis-store
VMware · 1 advisory - Added
CVE-2026-22743High
Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter.
VMware · 1 advisory - Added
CVE-2026-22742High
Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel
VMware · 1 advisory - Added
CVE-2026-22738Critical
In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore
VMware · 1 advisory - Added
CVE-2025-48795Medium
Apache CXF Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-33671Critical
Regular Expression Denial of Service via crafted extglob patterns
Red Hat, Splunk · 2 advisories - Added
CVE-2026-33416Critical
Arbitrary code execution due to use-after-free vulnerability
NetApp, Red Hat · 2 advisories - Added
CVE-2026-4867Critical
Denial of Service via catastrophic backtracking from malformed URL parameters
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33413High
Etcd Vulnerability in NetApp Products
NetApp, Red Hat · 2 advisories - Added
CVE-2026-3988High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10…
GitLab · 1 advisory - Added
CVE-2026-3857High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10…
GitLab · 1 advisory - Added
CVE-2026-2995High
GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before…
GitLab · 1 advisory - Added
CVE-2026-2973Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10…
GitLab · 1 advisory - Added
CVE-2026-2745Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10…
GitLab · 1 advisory - Added
CVE-2026-2726Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10…
GitLab · 1 advisory - Added
CVE-2026-1724Medium
GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before…
GitLab · 1 advisory - Added
CVE-2025-14595Medium
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before…
GitLab · 1 advisory - Added
CVE-2025-13436Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10…
GitLab · 1 advisory - Added
CVE-2025-13078Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10…
GitLab · 1 advisory - Added
CVE-2026-20125High
Cisco IOS Software and IOS XE Software Release 3E HTTP Server Denial of Service Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20115Medium
Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20114Medium
Cisco IOS XE Software Lobby Ambassador Privilege Escalation Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20113Medium
Cisco IOx Application Hosting Environment Carriage Return Line Feed Injection Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20112Medium
Cisco IOx Application Hosting Environment Stored Cross-Site Scripting Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20108Medium
Cisco Catalyst SD-WAN Manager Cross-Site Scripting Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20104Medium
Cisco IOS XE Software for Cisco Catalyst and Rugged Series Switches Secure Boot Bypass Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20086High
Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family CAPWAP Denial of Service Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20084High
Cisco IOS XE Software for Catalyst 9000 Series Switches DHCP Snooping Denial of Service Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20083Medium
Cisco IOS XE Software Secure Copy Protocol Server Denial of Service Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20012High
Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20004High
Cisco IOS XE Software TLS Memory Exhaustion Denial of Service Vulnerability
Cisco · 1 advisory - Added
GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before…
GitLab · 1 advisory - Added
CVE-2026-1519High
Denial of Service via maliciously crafted DNSSEC-validated zone
NetApp, Red Hat · 2 advisories - Added
CVE-2026-32647Critical
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might
F5, Red Hat, Splunk, Veeam · 4 advisories - Added
CVE-2026-27651Critical
NGINX ngx_mail_auth_http_module vulnerability
F5, Red Hat, Splunk, Veeam · 4 advisories - Added
CVE-2026-28755Critical
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module
F5, Red Hat, Splunk · 3 advisories - Added
CVE-2026-28753Critical
NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
F5, Red Hat, Splunk · 3 advisories - Added
CVE-2026-27654Critical
NGINX ngx_http_dav_module vulnerability
F5, Red Hat, Splunk, Veeam · 4 advisories - Added
CVE-2026-27784Critical
NGINX ngx_http_mp4_module vulnerability
F5, Red Hat, Splunk, Veeam · 4 advisories - Added
CVE-2026-32642Medium
Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists
Apache, Red Hat · 2 advisories - Added
CVE-2026-22739High
Vulnerability in Spring Cloud
VMware · 1 advisory - Added
CVE-2026-29111High
Systemd Vulnerability in NetApp Products
NetApp, Red Hat · 2 advisories - Added
CVE-2026-4680High
Use after free in FedCM
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-4679Critical
Integer overflow in Fonts
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-4678Critical
Use after free in WebGPU
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-4677Medium
Out of bounds read in WebAudio
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-4676Critical
Use after free in Dawn
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-4675Medium
Heap buffer overflow in WebGL
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-4674Medium
Out of bounds read in CSS
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-4673Critical
Heap buffer overflow in WebAudio
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-33228Critical
Prototype pollution vulnerability allows arbitrary code execution via crafted JSON.
NetApp, Red Hat, Splunk · 3 advisories - Added
CVE-2026-33236Critical
Arbitrary file overwrite and creation via path traversal in XML index files
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33231Critical
Denial of Service via unauthenticated remote shutdown
NetApp, Red Hat · 2 advisories - Added
CVE-2026-33186Critical
gRPC-Go Vulnerability in NetApp Products
NetApp, Red Hat, Splunk · 5 advisories - Added
CVE-2026-4438Medium
Invalid DNS hostname returned via gethostbyaddr functions
NetApp, Red Hat · 2 advisories - Added
CVE-2026-4437Medium
Incorrect DNS response parsing via crafted DNS server response
NetApp, Red Hat · 2 advisories