Most Exploited Open-Source Vulnerabilities: March 2026

This March 2026 report is a historical, illustrative snapshot of how to read a month of CISA KEV additions, EPSS scores and advisory trends across npm, PyPI, Maven and Go. Its figures are not audited statistics. For real KEV and EPSS lead-time data, see GeekWala Research's KEV Exploitation 2026 report.

Update: this was our inaugural report, and we billed it as the first in a monthly series. We didn't keep that cadence — the next edition is the Q2 2026 roundup, covering April through June and explaining the move to a quarterly schedule. The data below reflects March 2026 only and is not current; read it as a historical snapshot, and use the Q2 edition (or scan your own dependencies) for what matters today.

This is the inaugural edition of GeekWala's vulnerability exploitation report. Each edition, we analyze EPSS score movements, CISA KEV additions, and ecosystem advisory trends to help developers prioritize what matters. Our goal is simple: cut through the noise of hundreds of advisories and surface the vulnerabilities that attackers are actually exploiting in the wild.

Note: CVE identifiers used in this report are illustrative examples based on real vulnerability patterns. They do not correspond to actual CVE records. The aggregate figures (KEV-addition counts, advisory volumes, patch times, incident counts and the GeekWala-scanned-project percentages) are illustrative too; they show the shape of a monthly analysis in this format and are not audited statistics. For actual CVE data, check your dependencies with GeekWala's scanner.

For the real, non-illustrative version of this analysis, see GeekWala Research's KEV Exploitation 2026 report: a 12-month audit of actual CISA KEV additions and real EPSS lead-time data across these same ecosystems, with the full dataset published for reproduction.

Executive Summary: March 2026

Every figure in this summary is illustrative; see the note above.

• 7 new CVEs added to the CISA Known Exploited Vulnerabilities catalog this month, up from 5 in February.
• 34% of GeekWala-scanned projects contained at least one dependency listed in the KEV catalog, a slight increase from 31% last month.
• npm had the highest advisory volume with 47 new advisories; Go had the fastest average patch response time at 2 days.
• Supply chain attacks targeting build tools continued their upward trend, with 3 confirmed incidents involving compromised post-install scripts in npm packages.

Top 5 Most Dangerous Vulnerabilities This Month

1. Prototype Pollution in Popular Utility Library (npm)

• CVE: CVE-2026-90001 (illustrative)
• Ecosystem: npm
• EPSS Score: 0.67 (67% exploitation probability)
• CVSS: 8.1 (High)
• KEV Status: Added March 8, 2026
• Affected pattern: A widely-used object merging utility library with over 40 million weekly downloads contained a prototype pollution vulnerability in its deep merge function. Attackers could inject properties into Object.prototype through crafted payloads, leading to denial of service or remote code execution in downstream applications that relied on the merged output for security decisions.
• Why it matters: The library sits in the dependency tree of multiple major frameworks. Transitive exposure was estimated at 12% of all npm packages.
• Remediation: Update to the latest patched version. If unable to update immediately, validate all input objects before passing them to deep merge operations and freeze prototypes where possible.

2. Arbitrary Code Execution via Deserialization in Data Processing Library (PyPI)

• CVE: CVE-2026-90002 (illustrative)
• Ecosystem: PyPI
• EPSS Score: 0.54 (54% exploitation probability)
• CVSS: 9.8 (Critical)
• KEV Status: Added March 12, 2026
• Affected pattern: A data serialization library commonly used in machine learning pipelines accepted untrusted pickle-format input without restriction. Attackers exploited this in exposed ML inference endpoints to achieve remote code execution on servers processing model artifacts.
• Why it matters: The vulnerability was actively exploited in attacks targeting publicly accessible Jupyter notebook servers and ML model-serving APIs. CISA flagged confirmed exploitation in government-adjacent research infrastructure.
• Remediation: Update to the patched version that restricts deserialization to a safe subset of types. Audit any endpoint that accepts serialized data from untrusted sources. Consider switching to safer serialization formats such as JSON or MessagePack for external inputs.

3. SQL Injection via ORM Query Builder in Database Abstraction Layer (Maven)

• CVE: CVE-2026-90003 (illustrative)
• Ecosystem: Maven (Java)
• EPSS Score: 0.43 (43% exploitation probability)
• CVSS: 8.6 (High)
• KEV Status: Added March 15, 2026
• Affected pattern: A popular Java ORM framework contained a SQL injection vulnerability in its dynamic query builder when using raw column name interpolation. Applications that allowed user-controlled input to influence sort column names or filter field names were vulnerable to full database extraction.
• Why it matters: The ORM is embedded in thousands of enterprise Java applications. The vulnerability bypassed parameterized query protections because column names, unlike values, are not parameterized in most SQL dialects. EPSS scores on this CVE have been climbing steadily since its disclosure in late February, indicating growing attacker tooling.
• Remediation: Update to the patched version. In the interim, implement an allowlist of permitted column names and reject any input not on the list. Never pass user input directly to column name or table name positions in queries.

4. Path Traversal in Static File Server Middleware (Go)

• CVE: CVE-2026-90004 (illustrative)
• Ecosystem: Go
• EPSS Score: 0.38 (38% exploitation probability)
• CVSS: 7.5 (High)
• KEV Status: Not yet listed
• Affected pattern: A widely-used Go HTTP middleware for serving static files failed to properly sanitize URL-encoded path separators on Windows. Attackers could read arbitrary files from the server filesystem, including environment files and private keys, by sending requests with double-encoded path traversal sequences.
• Why it matters: While Go's standard library http.FileServer is not affected, this third-party middleware is used by several popular Go web frameworks as their default static file handler. The vulnerability only manifests on Windows deployments, but those represent a significant share of Go services running in enterprise environments.
• Remediation: Update to the patched version. Ensure static file serving roots are restricted to dedicated directories with minimal permissions. On Windows deployments, audit access logs for path traversal patterns (%2e%2e%2f and variants).

5. SSRF via Redirect Following in HTTP Client Library (Cross-Ecosystem)

• CVE: CVE-2026-90005 (illustrative)
• Ecosystem: npm, PyPI, RubyGems (independent implementations, same vulnerability pattern)
• EPSS Score: 0.51 (51% exploitation probability)
• CVSS: 8.3 (High)
• KEV Status: Added March 18, 2026
• Affected pattern: HTTP client libraries in three ecosystems followed redirects to internal network addresses without validation. Attackers exploited this in webhook processing endpoints: by configuring a webhook URL that issued a 302 redirect to an internal metadata service (e.g., cloud provider instance metadata at 169.254.169.254), they could exfiltrate cloud credentials and pivot into internal infrastructure.
• Why it matters: This pattern affected independent libraries in npm, PyPI, and RubyGems simultaneously. The underlying issue, following redirects without validating the target address against internal IP ranges, is a systemic blind spot in HTTP client design. All three libraries have been patched, but the pattern likely exists in additional libraries not yet audited.
• Remediation: Update affected HTTP client libraries. Implement SSRF protections at the application level: validate redirect targets against an internal IP denylist before following them. For webhook features, see our guide on safe webhook URL validation.

Ecosystem Breakdown

Illustrative figures; see the note at the top of this report.

npm continues to dominate in raw advisory volume — consistent with OSV's per-ecosystem advisory counts — which is expected given the ecosystem's size. The more revealing metric is patch time: in this illustrative data, Go and crates.io fixes land within 2-3 days of disclosure, while Maven and RubyGems average 7-8 days. Maven's longer patch times are partly explained by the slower release cadence of enterprise Java libraries and more complex CI/CD pipelines.

EPSS Score Movements: Rising Threats

Illustrative figures; see the note at the top of this report.

Three vulnerabilities showed significant EPSS score increases this month, signaling growing attacker interest even before KEV listing:

CVE-2026-90003 (Java ORM SQL Injection) jumped from 0.18 to 0.43 over the past 30 days. The sharp rise correlates with the publication of a proof-of-concept exploit on a security research blog and the subsequent inclusion of the exploit in at least two open-source penetration testing frameworks. History shows that once an exploit lands in automated tooling, exploitation at scale follows within weeks.

CVE-2026-90004 (Go Path Traversal) rose from 0.12 to 0.38. Despite not yet being added to the KEV catalog, active scanning for this vulnerability has been detected by multiple honeypot networks. The Windows-specific nature of the bug initially kept EPSS scores low, but exploitation attempts have increased as attackers realized many Go microservices in enterprise environments run on Windows containers.

A February-era PyPI advisory (not detailed in this report) saw its EPSS score climb from 0.29 to 0.61 in this illustrative data, the kind of jump that warrants patching before any KEV listing. For measured EPSS lead times before KEV listing, see GeekWala Research's KEV Exploitation 2026 report.

Rising EPSS scores matter because they indicate that attackers are actively developing and deploying exploits, often weeks before a vulnerability appears on the CISA KEV list. By the time a CVE is KEV-listed, the exploitation window has already been open. Prioritizing by EPSS rather than waiting for KEV listing closes that gap. Learn more about how EPSS works and why it outperforms CVSS for prioritization in our EPSS explainer.

Trends: What's Changing

Illustrative figures; see the note at the top of this report.

Build tool supply chain attacks are accelerating. March saw 3 confirmed incidents of compromised npm packages that injected malicious code via post-install scripts. Two targeted CI/CD environments specifically, exfiltrating environment variables during build time rather than at runtime. This is a shift in attacker tactics: build-time attacks are harder to detect because the malicious code never appears in the deployed application.

The EPSS-to-KEV lag (illustrative). In this report's illustrative data, the time between a CVE reaching an EPSS score above 0.40 and its addition to the KEV catalog is 18 days. That figure models the kind of trend worth tracking; it is not a measured CISA statistic. For measured EPSS lead times before KEV listing, see GeekWala Research's KEV Exploitation 2026 report. Either way, a rising EPSS score is a useful leading indicator.

Transitive dependencies remain the primary attack surface. Most vulnerable dependency findings sit in transitive (indirect) dependencies, not direct ones. Developers typically have visibility into the packages they explicitly install but limited awareness of what those packages pull in. This is why automated scanning matters: you cannot manually audit a dependency tree that is hundreds of packages deep.

What to Do

Staying ahead of actively exploited vulnerabilities does not require reading every advisory. It requires systematic scanning and smart prioritization:

1. Scan your dependencies regularly. Automated scanning catches transitive vulnerabilities that manual review misses. Even a weekly cadence dramatically reduces your exposure window.
2. Prioritize by EPSS, not CVSS alone. A CVSS 9.8 with an EPSS of 0.02 is far less urgent than a CVSS 7.5 with an EPSS of 0.60. EPSS tells you what attackers are actually exploiting. Read our vulnerability prioritization guide for a detailed framework.
3. Watch KEV additions. If a dependency in your project appears on the CISA KEV list, treat it as a production incident. These are confirmed exploited-in-the-wild vulnerabilities, not theoretical risks.
4. Audit your build pipeline. With supply chain attacks increasingly targeting build tools rather than runtime dependencies, ensure your CI/CD environment has restricted network access and that post-install scripts are reviewed or disabled.

We've since moved this series to a quarterly cadence — see the Q2 2026 edition for the April-June follow-up. If you want to be notified when new reports drop, follow us on the blog, or set up scheduled scans on your Pro projects to get an email after every re-scan.

Check if your project is affected. Scan your dependencies now