# march 2026

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for march 2026, painted from 6,236 published cves](https://media.cvegen.art/posters/2026-03/1280.jpg?v=f3970f8290)

what the poster shows: 31 days as bands of dry brush, the first day at the top. 24 ran above the 2025 average for their weekday and sweep fast and wide; the other 7 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-03.mp4?v=b681495ed5)

| fact | value |
| --- | --- |
| cves | 6,236 |
| against an average 2025 month | 1.6× |
| busiest day | mar 25, 619 |
| rated critical, cvss 9 or higher | 634 |
| critical with no login and no click | 480 |
| used in real attacks | 10 |

## march 2026 in numbers

march 2026 brought 6,236 cves, 1.6 times an average 2025 month. 24 of its 31 days ran above the 2025 average for that weekday.

- 619 on mar 25, the busiest day. patchstack published 248 of them at once.
- 634 rated critical, cvss 9 or higher. 480 of them can be hit over the network with no login and nothing for a user to click.
- 2,311 in open-source packages, 5.1 times their 2025 monthly average. no other kind of software grew as fast.
- 674 came in three single drops: patchstack 268 on mar 5, patchstack 248 on mar 25, github 158 on mar 20.

## 10 already used in real attacks

cisa kev, as of oct 24.

### by product

- 1 qualcomm multiple chipsets, mar 2
- 1 cisco secure firewall management center, mar 4
- 1 cisco secure firewall management center and security cloud control firewall management, mar 4
- 1 lantronix eds5000, mar 11
- 1 google chromium v8, mar 12
- 1 google skia, mar 12
- 1 langflow, mar 20
- 1 aquasecurity trivy, mar 23
- 1 citrix netscaler, mar 23
- 1 trueconf client, mar 30

### every cve

- mar 2, qualcomm multiple chipsets, [cve-2026-21385](https://www.cve.org/CVERecord?id=CVE-2026-21385)
- mar 4, cisco secure firewall management center (fmc) and security cloud control (scc) firewall management, [cve-2026-20079](https://www.cve.org/CVERecord?id=CVE-2026-20079)
- mar 4, cisco secure firewall management center (fmc), [cve-2026-20131](https://www.cve.org/CVERecord?id=CVE-2026-20131)
- mar 11, lantronix eds5000, [cve-2025-67038](https://www.cve.org/CVERecord?id=CVE-2025-67038)
- mar 12, google skia, [cve-2026-3909](https://www.cve.org/CVERecord?id=CVE-2026-3909)
- mar 12, google chromium v8, [cve-2026-3910](https://www.cve.org/CVERecord?id=CVE-2026-3910)
- mar 20, langflow langflow, [cve-2026-33017](https://www.cve.org/CVERecord?id=CVE-2026-33017)
- mar 23, citrix netscaler, [cve-2026-3055](https://www.cve.org/CVERecord?id=CVE-2026-3055)
- mar 23, aquasecurity trivy, [cve-2026-33634](https://www.cve.org/CVERecord?id=CVE-2026-33634)
- mar 30, trueconf client, [cve-2026-3502](https://www.cve.org/CVERecord?id=CVE-2026-3502)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | march 1 to 31, 2026 |
| cves | 6,236 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-03/2000.jpg?v=f3970f8290)

## other months

- before: [february 2026](https://cvegen.art/2026/02.md), 4,616 cves
- after: [april 2026](https://cvegen.art/2026/04.md), 5,813 cves
- [all months](https://cvegen.art/index.md)