CVE Statistics: March 2026

🌐 Discover the key figures for vulnerabilities published in March 2026 on CVE Find.

🔎 Overview

• Total number of CVEs published : 6,306 (+31.2% vs the previous month)
• Vulnerabilities added to the CISA KEV catalog : 26

📂 Breakdown by main categories

• Authorization problems : 835
• Cross-site Scripting : 738
• Overflow : 589
• SQL Injection : 478
• Directory Traversal : 250
• Code Injection : 198

📈 Breakdown by CVSS score

• Low : 138
• Medium : 2486
• High : 2635
• Critical : 873

🏢 Most affected vendors

1. linux : 307
2. microsoft : 247
3. openclaw : 198
4. apple : 194
5. google : 184

📦 Most affected products

1. linux linux_kernel : 307
2. openclaw openclaw : 198
3. apple macos : 183
4. microsoft windows : 151
5. google android : 110

⚠️ Notable CVEs of the month

• CVE-2026-34162 (10 CRITICAL) : FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authenticat...
• CVE-2026-28505 (10 CRITICAL) : Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed...
• CVE-2025-15379 (10 CRITICAL) : A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deplo...
• CVE-2025-15036 (10 CRITICAL) : A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This ...
• CVE-2026-4963 (10 CRITICAL) : A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_p...

Explore all the data in detail on CVE Find.