Weekly digest
Week 14, 2026 (30 Mar – 5 Apr)
A heavy week: 474 new CVEs, well above the recent average of about 138. Severity skewed high: 63 critical and 185 high, 52% of the total. 45 arrived with exploitation evidence or public exploit code already attached. CISA added one CVE to the Known Exploited Vulnerabilities catalog. linux was the most-affected vendor with 59.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
New this week, ranked by depth score
The 12 that matter most of the 474 published.
CVE-2026-5281High· 8.8CISA KEV0dayPoCUse after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-34156Critical· 9.9PoCNocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with …
CVE-2026-0545Critical· 9.8PoCIn mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job e…
CVE-2026-34976Critical· 10.0PoCDgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
CVE-2026-33579Critical· 9.9PoCOpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can…
CVE-2018-25254Critical· 9.8PoCNICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands
NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized d…
CVE-2026-31402Critical· 9.8PoCIn the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operat…
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operat…
CVE-2026-34243Critical· 9.8PoCwenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title)
wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell com…
CVE-2026-34220Critical· 9.8PoCMikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL q…
CVE-2026-28766Critical· 9.3PoCA specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
CVE-2026-25197Critical· 9.1PoCA specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
CVE-2026-35029HighPoCLiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
Most-affected vendors
By CVEs published in the period.