CVEs published in March 2026

CVE-2026-22898Critical

QVR Pro: missing authentication for critical function vulnerability has been reported to affect QVR Pro.

CVE-2026-22902High

CVE-2026-22901High

CVE-2026-22900High

CVE-2026-22897High

CVE-2026-22895Medium

cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service.

CVE-2025-62846High

CVE-2025-62845High

CVE-2025-62844High

CVE-2025-62843High

CVE-2025-59383Low

buffer overflow vulnerability has been reported to affect Media Streaming Add-On.

CVE-2026-4519High

Command-line option injection in webbrowser.open via crafted URLs

CVE-2026-22737Medium

Spring Framework: Use of Java scripting engine enabled (e.g.

CVE-2026-22735Low

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE).

CVE-2025-9714Medium

Libxml2 Vulnerability in NetApp Products

CVE-2022-41409High

PCRE2 Vulnerability in NetApp Products

CVE-2026-22732Critical

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that…

CVE-2026-22733High

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability

CVE-2026-22731High

Authentication bypass via misconfigured Health Group additional path

CVE-2026-27135High

Denial of Service via malformed HTTP/2 frames after session termination

CVE-2026-22730High

critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter

CVE-2026-22729High

JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter

CVE-2026-31938Critical

Cross site scripting via unsanitized output options

CVE-2026-31898Critical

Arbitrary code execution via unsanitized input in createAnnotation method

CVE-2026-30922Critical

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

CVE-2026-4463Critical

Heap buffer overflow in WebRTC

CVE-2026-4462Medium

Out of bounds read in Blink

CVE-2026-4461High

Inappropriate implementation in V8

CVE-2026-4460Medium

Out of bounds read in Skia

CVE-2026-4459Critical

Out of bounds read and write in WebAudio

CVE-2026-4458Critical

Use after free in Extensions

CVE-2026-4457Critical

Type Confusion in V8

CVE-2026-4456Critical

Use after free in Digital Credentials API

CVE-2026-4455High

Heap buffer overflow in PDFium

CVE-2026-4454Critical

Use after free in Network

CVE-2026-4453High

Integer overflow in Dawn

CVE-2026-4452Critical

Integer overflow in ANGLE

CVE-2026-4451High

Insufficient validation of untrusted input in Navigation

CVE-2026-4450Critical

Out of bounds write in V8

CVE-2026-4449Critical

Use after free in Blink

CVE-2026-4448Critical

Heap buffer overflow in ANGLE

CVE-2026-4447Critical

Inappropriate implementation in V8

CVE-2026-4446High

Use after free in WebRTC

CVE-2026-4444Critical

Stack buffer overflow in WebRTC

CVE-2026-4443Critical

Heap buffer overflow in WebAudio

CVE-2026-4442Critical

Heap buffer overflow in CSS

CVE-2026-4441Critical

Use after free in Base

CVE-2026-4440Critical

Out of bounds read and write in WebGL

CVE-2026-4439Critical

Out of bounds memory access in WebGL

CVE-2026-20652High

Java Platform Standard Edition Vulnerability in NetApp Products

CVE-2026-27448Medium

TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

CVE-2026-22727High

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all…

CVE-2026-21570High

Confluence: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0…

CVE-2026-30911High

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

CVE-2026-28779High

Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

CVE-2026-28563Medium

Apache Airflow: DAG authorization bypass

CVE-2026-26929Medium

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

CVE-2026-3644Medium

Incomplete control character validation in http.cookies

CVE-2025-54920High

Apache Spark: This issue affects Apache Spark: before 3.5.7 and 4.0.1.

CVE-2025-66249Medium

Apache Livy: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy.

CVE-2025-60012Medium

Apache Livy: Malicious configuration can lead to unauthorized file access in Apache Livy.

CVE-2026-2673Medium

OpenSSL TLS 1.3 server may choose unexpected key agreement group

CVE-2025-68372High

Linux Kernel Vulnerability in NetApp Products

CVE-2025-5702Medium

Glibc Vulnerability in NetApp Products

CVE-2025-32003Medium

CVE-2025-27535Medium

CVE-2025-27243Medium

CVE-2025-24851Medium

CVE-2025-11413Medium

GNU Binutils Vulnerability in NetApp Products

CVE-2026-32597Critical

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

CVE-2026-32141Critical

Unbounded recursion DoS in parse revive phase

CVE-2026-21668Critical

CVE-2026-21667Critical

CVE-2026-21666Critical

CVE-2026-21709Critical

CVE-2026-21708Critical

CVE-2026-21672Critical

CVE-2026-21671Critical

CVE-2026-21670Critical

CVE-2026-21669Critical

CVE-2026-31958Critical

Denial of Service via large multipart bodies

CVE-2026-0231High

information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM

CVE-2026-0230Medium

problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS

CVE-2026-20118Medium

Cisco IOS XR Egress Packet Network Interface Aligner Interrupt Denial of Service Vulnerability

CVE-2026-20117Medium

CVE-2026-20116Medium

CVE-2026-20074High

Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability

CVE-2026-20046High

CVE-2026-20040High

CVE-2026-3904Medium

nscd client crash on x86_64 under high nscd load

CVE-2026-3805High

Libcurl Vulnerability in NetApp Products

CVE-2026-3784Medium

Unauthorized access due to improper HTTP proxy connection reuse

CVE-2026-3783Medium

Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect

CVE-2026-1965Medium

Libcurl Vulnerability in NetApp Products

CVE-2026-23817Medium

vulnerability in the web-based management interface of AOS-CX Switches could

CVE-2026-23816High

vulnerability in the command line interface of AOS-CX Switches could

CVE-2026-23815High

vulnerability in a custom binary used in AOS-CX Switches' CLI could

CVE-2026-23814High

vulnerability in the command parameters of a certain AOS-CX CLI command could

CVE-2026-23813Critical

vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially

CVE-2026-4111Critical

Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data in libarchive