Browse CVE records published in March 2026, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 5236 matching CVEs · Page 32 of 105.
Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoofing over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to disclose information locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
Published Mar 10, 2026 · Updated Apr 14, 2026
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
Published Mar 10, 2026 · Updated Apr 14, 2026
The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' functions in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options, including critical settings such as API keys, authentication keys, and layout configurations.
Published Mar 21, 2026 · Updated Apr 14, 2026
WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/Scheduler/Scheduler.php` calls `url_get_contents()` with an admin-configurable `callbackURL` that is validated only by `isValidURL()` (URL format check). Unlike other AVideo endpoints that were recently patched for SSRF (GHSA-9x67-f2v7-63rw, GHSA-h39h-7cvg-q7j6), the Scheduler's callback URL is never passed through `isSSRFSafeURL()`, which blocks requests to RFC-1918 private addresses, loopback, and cloud metadata endpoints. An admin can configure a scheduled task with an internal network `callbackURL` to perform SSRF against cloud infrastructure metadata services or internal APIs not otherwise reachable from the internet. Version 26.0 contains a patch for the issue.
Published Mar 20, 2026 · Updated Apr 13, 2026
Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148.0.2.
Published Mar 10, 2026 · Updated Apr 13, 2026
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2.
Published Mar 10, 2026 · Updated Apr 13, 2026
Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2.
Published Mar 10, 2026 · Updated Apr 13, 2026
Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2.
Published Mar 9, 2026 · Updated Apr 13, 2026
Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Published Mar 24, 2026 · Updated Apr 13, 2026
Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Published Mar 24, 2026 · Updated Apr 13, 2026
Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Published Mar 24, 2026 · Updated Apr 13, 2026
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Published Mar 24, 2026 · Updated Apr 13, 2026
Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Published Mar 24, 2026 · Updated Apr 13, 2026
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Published Mar 24, 2026 · Updated Apr 13, 2026
JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Published Mar 24, 2026 · Updated Apr 13, 2026
Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Published Mar 24, 2026 · Updated Apr 13, 2026
