CVE-2026 records published in March 2026

This page lists the 5,228 CVE-2026 records published in March 2026, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists nine of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2026 list filters these records by severity or signal.

Critical
63612.2% of these records
Listed in CISA KEV
90.2% of these records
Reported exploited
160.3% of these records
Detection signal
811.5% of these records
Exploit code
1663.2% of these records
Actionable vendor fix
3,80772.8% of these records

Figures as of 2026-10-24 13:48 UTC. Records published in March 2026 have had from about seven months to about eight months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.

CVE-2026 records published in March 2026, newest first: records 1 to 1,000 of 5,228
CVE Summary CVSS EPSS Published Signals
CVE-2026-34887Kubio AI Page Builder WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-03-31Fix
CVE-2026-34881OpenStack Glance is affected by server-side request forgery (SSRF)5.0CNA v3.10.4%2026-03-31Fix
CVE-2026-34784Parse Platform Parse Server streaming file download trigger improper authorization8.2CNA v4.00.5%2026-03-31Fix
CVE-2026-34740AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL Validation6.5CNA v3.10.4%2026-03-31
CVE-2026-34739AVideo: Reflected XSS via Unescaped ip parameter in User_Location testIP.php6.1CNA v3.10.3%2026-03-31
CVE-2026-34738AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus request parameter4.3CNA v3.10.3%2026-03-31
CVE-2026-34737AVideo: Arbitrary Stripe Subscription Cancellation via Debug endpoint and retrieveSubscriptions Bug6.5CNA v3.10.3%2026-03-31
CVE-2026-34733AVideo: Unauthenticated file deletion via PHP Operator Precedence Bug in CLI Guard6.5CNA v3.10.4%2026-03-31
CVE-2026-34732AVideo: Missing authentication in CreatePlugin list.json.php template affects 21 endpoints5.3CNA v3.10.4%2026-03-31
CVE-2026-34731AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php7.5CNA v3.10.6%2026-03-31
CVE-2026-34716AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification6.4CNA v3.10.3%2026-03-31
CVE-2026-34613AVideo: CSRF on Plugin Enable/Disable endpoint allows Disabling Security plugins6.5CNA v3.10.3%2026-03-31
CVE-2026-34611AVideo: CSRF on emailAllUsers.json.php enables Mass Phishing Email to All Users6.5CNA v3.10.2%2026-03-31
CVE-2026-34605SiYuan: Reflected XSS8.6CNA v4.00.6%2026-03-31NucleiFix
CVE-2026-34595Parse Platform Parse Server LiveQuery subscriptions type confusion5.3CNA v4.00.4%2026-03-31Fix
CVE-2026-34586PdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download endpoints6.5CNA v3.10.4%2026-03-31Fix
CVE-2026-34585SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution8.6CNA v3.10.4%2026-03-31Fix
CVE-2026-34574parse-community parse-server parse Server: Session field immutability bypass via falsy-value guard5.3CNA v4.00.3%2026-03-31Fix
CVE-2026-34573parse-server has GraphQL complexity validator exponential fragment traversal DoS8.2CNA v4.00.9%2026-03-31Fix
CVE-2026-34556InternationalColorConsortium iccDEV out-of-bounds read6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34555iccDEV: SBO in CIccTagFixedNum::GetValues6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34554iccDEV: HBO in CIccApplyCmmSearch::costFunc6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34553International Color Consortium iccDEV CLUT dumping denial of service4.0CNA v3.10.2%2026-03-31Fix
CVE-2026-34552InternationalColorConsortium iccDEV null pointer dereference6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34551iccDEV: NPD in CIccTagLut16::Write6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34550InternationalColorConsortium iccDEV incorrect numeric conversion6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34549International Color Consortium iccDEV profile parsing undefined behavior6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34548International Color Consortium iccDEV XML conversion utility incorrect numeric conversion6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34547International Color Consortium iccDEV profile dump utility undefined behavior6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34546International Color Consortium iccDEV TIFF image handling divide by zero6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34542iccDEV: SBO in CIccCalculatorFunc::Apply6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34541International Color Consortium iccDEV profile connection conditions null pointer dereference6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34540International Color Consortium iccDEV profile dump utility vulnerability6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34539iccDEV: HBO in CTiffImg::WriteLine6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34537InternationalColorConsortium iccDEV undefined behavior6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34536International Color Consortium iccDEV profile calculator stack overflow6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34535iccDEV: SEGV in CIccTagArray::Cleanup6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34534iccDEV: HBO in CIccMpeSpectralMatrix::Describe6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34533International Color Consortium iccDEV profile calculator vulnerability6.2CNA v3.10.2%2026-03-31Fix
CVE-2026-34532parse-server has cloud function validator bypass via prototype chain traversal9.1CNA v4.00.5%2026-03-31Fix
CVE-2026-34506OpenClaw Sender Allowlist Bypass in Microsoft Teams plugin via Route Allowlist Configuration2.3CNA v4.00.3%2026-03-31Fix
CVE-2026-34505OpenClaw Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation6.9CNA v4.00.4%2026-03-31Fix
CVE-2026-34504OpenClaw server-side request forgery via Unguarded Image Download in fal Provider6.9CNA v4.00.4%2026-03-31Fix
CVE-2026-34503OpenClaw Incomplete WebSocket Session Termination on Device Removal and Token Revocation8.6CNA v4.00.5%2026-03-31Fix
CVE-2026-34453SiYuan: Unauthenticated access to Password-Protected Bookmarks via /API/bookmark/getBookmark7.5CNA v3.11.5%2026-03-31NucleiFix
CVE-2026-34452Claude SDK for Python: Memory Tool Path Validation race condition allows sandbox escape5.8CNA v4.00.1%2026-03-31Fix
CVE-2026-34451Claude SDK for TypeScript: Memory Tool Path Validation allows sandbox escape to Sibling Directories6.3CNA v4.00.4%2026-03-31Fix
CVE-2026-34450Claude SDK for Python: Insecure default File Permissions in Local Filesystem Memory tool4.8CNA v4.00.2%2026-03-31Fix
CVE-2026-34449SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet injection9.7CNA v3.10.8%2026-03-31Fix
CVE-2026-34448B3LOG SiYuan Attribute View cover rendering stored cross-site scripting9.1CNA v3.10.7%2026-03-31Fix
CVE-2026-34443FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask6.9CNA v4.00.4%2026-03-31Fix
CVE-2026-34442FreeScout: Host header injection leading to External Resource Loading and open redirect in FreeScout5.4CNA v3.10.3%2026-03-31Fix
CVE-2026-34441cpp-httplib static file handler HTTP request smuggling4.8CNA v3.10.3%2026-03-31Fix
CVE-2026-34406APTRS: Privilege escalation via mass assignment of is_superuser in User Edit endpoint9.4CNA v4.00.8%2026-03-31Fix
CVE-2026-34405Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes6.1CNA v3.10.3%2026-03-31Fix
CVE-2026-34404Nuxt OG Image vulnerable to DoS via image generation6.9CNA v4.00.5%2026-03-31Fix
CVE-2026-34401Microsoft XmlNotepad XML Notepad: XML external entity injection6.5CNA v3.11.4%2026-03-31Fix
CVE-2026-34400alerta alerta-server has potential SQL injection vulnerability in Query String Syntax (q=) API6.9CNA v4.00.6%2026-03-31Fix
CVE-2026-34396AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel6.1CNA v3.10.3%2026-03-31
CVE-2026-34395AVideo: Mass User PII Disclosure via missing authorization in YPTWallet users.json.php6.5CNA v3.10.4%2026-03-31
CVE-2026-34394AVideo: CSRF on Admin Plugin Configuration enables Payment Credential Hijacking8.1CNA v3.10.3%2026-03-31
CVE-2026-34384Admidio: Missing CSRF Protection on Registration Approval Actions4.5CNA v3.10.2%2026-03-31Fix
CVE-2026-34383Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` parameter4.3CNA v3.10.2%2026-03-31Fix
CVE-2026-34382Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php4.6CNA v3.10.1%2026-03-31Fix
CVE-2026-34381Admidio: Unauthenticated access to Role-Restricted documents via neutralized .htaccess7.5CNA v3.10.5%2026-03-31Fix
CVE-2026-34377Zebra has a Consensus failure due to Improper Verification of V5 Transactions8.4CNA v4.00.4%2026-03-31Fix
CVE-2026-34373parse-community parse-server parse Server: GraphQL API endpoint ignores CORS origin restriction5.3CNA v4.00.2%2026-03-31Fix
CVE-2026-34372Sulu checks fix permissions for subentities endpoints5.3CNA v4.00.3%2026-03-31Fix
CVE-2026-34367InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes field7.6CNA v3.10.4%2026-03-31Fix
CVE-2026-34366InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes field7.6CNA v3.10.4%2026-03-31Fix
CVE-2026-34365InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes field7.6CNA v3.10.4%2026-03-31Fix
CVE-2026-34363Parse Server LiveQuery subscriptions race condition8.2CNA v4.00.4%2026-03-31Fix
CVE-2026-34361HAPI FHIR: Unauthenticated SSRF9.3CNA v3.10.4%2026-03-31Fix
CVE-2026-34360HAPI FHIR: Unauthenticated blind SSRF via /loadIG endpoint enables Internal Network Probing5.8CNA v3.10.3%2026-03-31Fix
CVE-2026-34359HAPI FHIR: Authentication credential leakage7.4CNA v3.10.2%2026-03-31Fix
CVE-2026-34243wenxian GitHub Actions workflow command injection9.8CNA v3.12.8%2026-03-31Exploit code
CVE-2026-34240jose vulnerable to untrusted JWK header key acceptance during signature verification7.5CNA v3.10.2%2026-03-31Fix
CVE-2026-34237MCP Java SDK has a Hard-coded Wildcard CORS (Access-Control-Allow-Origin: *)6.1CNA v3.10.3%2026-03-31Fix
CVE-2026-34235PJSIP: Heap OOB read in VPX unpacketizer6.9CNA v4.00.5%2026-03-31Fix
CVE-2026-34231Slippers: Cross-site scripting (XSS) in `attrs` Template Tag6.1CNA v3.10.3%2026-03-31Fix
CVE-2026-34227Sliver One-Click Remote Access: Insecure CORS and Unauthenticated MCP interface5.9CNA v4.00.5%2026-03-31Exploit codeFix
CVE-2026-34224Parse Server multi-factor authentication login race condition2.1CNA v4.00.3%2026-03-31Fix
CVE-2026-34221mikro-orm MikroORM has prototype pollution in Utils.merge8.3CNA v4.00.5%2026-03-31Fix
CVE-2026-34220mikro-orm MikroORM is vulnerable to SQL injection via specially crafted object9.3CNA v4.00.5%2026-03-31Exploit codeFix
CVE-2026-34219Libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow8.2CNA v4.00.5%2026-03-31Fix
CVE-2026-34218ClearanceKit opfilter policy enforcement privilege escalation6.3CNA v4.00.2%2026-03-31Fix
CVE-2026-34215parse-community parse-server parse Server: Auth data exposed via verify password endpoint8.2CNA v4.00.5%2026-03-31Fix
CVE-2026-34214Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON7.7CNA v3.10.2%2026-03-31Fix
CVE-2026-34210mppx has Stripe charge credential replay via missing idempotency check6.0CNA v4.00.6%2026-03-31Fix
CVE-2026-34209mppx session close voucher validation vulnerability7.5CNA v3.10.4%2026-03-31Fix
CVE-2026-34206libops captcha-protect captcha Protect: Reflected XSS in challenge page6.1CNA v3.10.3%2026-03-31Fix
CVE-2026-34204MinIO is vulnerable to SSE Metadata injection via Replication headers7.1CNA v4.00.2%2026-03-31Fix
CVE-2026-34203Nautobot: Management of users via REST API does not apply configured password validators2.7CNA v3.10.3%2026-03-31Fix
CVE-2026-34202Zebra node crash V5 transaction hash panic (P2P reachable)9.2CNA v4.00.9%2026-03-31Fix
CVE-2026-34200Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port7.7CNA v4.00.6%2026-03-31Exploit codeFix
CVE-2026-34172Giskard Agents have server-side template injection7.7CNA v4.00.8%2026-03-31Fix
CVE-2026-34165go-git integer underflow5.0CNA v3.10.1%2026-03-31Fix
CVE-2026-34163Server-side request forgery via MCP tools endpoint in FastGPT7.7CNA v3.10.4%2026-03-31Fix
CVE-2026-34162FastGPT: Unauthenticated SSRF via httpTools endpoint leads to Internal API Key Theft10.0CNA v3.10.6%2026-03-31Fix
CVE-2026-34156NocoBase affected by sandbox escape to RCE10.0CNA v3.16.8%2026-03-31NucleiExploit codeFix
CVE-2026-34155RAUC: Improper Signing of Plain Bundles Exceeding 2 GiB7.2CNA v4.00.2%2026-03-31Fix
CVE-2026-34073cryptography has incomplete DNS name constraint enforcement on peer names1.7CNA v4.00.2%2026-03-31Fix
CVE-2026-34070LangChain Core has path traversal vulnerabilites in legacy `load_prompt` functions7.5CNA v3.11.2%2026-03-31Fix
CVE-2026-34060Shopify ruby-lsp ruby LSP has arbitrary code execution through branch setting7.1CNA v4.00.6%2026-03-31Fix
CVE-2026-34054Microsoft vcpkg OpenSSL Windows build uncontrolled search path element7.8CNA v3.10.6%2026-03-31Fix
CVE-2026-34043Serialize JavaScript has CPU exhaustion denial of service via crafted array-like objects5.9CNA v3.10.6%2026-03-31Fix
CVE-2026-34042nektos act actions/cache server missing authorization8.2CNA v3.10.6%2026-03-31Fix
CVE-2026-34041nektos act set-env and add-path workflow commands vulnerability7.7CNA v4.00.7%2026-03-31Fix
CVE-2026-34040Moby: AuthZ plugin bypass with oversized request body8.8CNA v3.10.2%2026-03-31Fix
CVE-2026-34036Dolibarr Core Discloses Sensitive Data via authenticated local file inclusion in selectobject.php6.5CNA v3.11.5%2026-03-31NucleiExploit code
CVE-2026-33997Moby: Off-by-one error in plugin privilege validation6.8CNA v3.10.5%2026-03-31Fix
CVE-2026-33762go-git missing validation decoding Index v4 files leads to panic2.8CNA v3.10.2%2026-03-31Fix
CVE-2026-33581OpenClaw arbitrary file read via mediaUrl and fileUrl parameters8.6v3.10.6%2026-03-31Fix
CVE-2026-33580OpenClaw brute force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication6.5v3.10.4%2026-03-31Fix
CVE-2026-33579OpenClaw privilege escalation via Missing Caller Scope Validation in Device Pair Approval9.4CNA v4.00.5%2026-03-31Fix
CVE-2026-33578OpenClaw Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser extensions4.3v3.10.3%2026-03-31Fix
CVE-2026-33577OpenClaw Insufficient Scope Validation in node.pair.approve8.6CNA v4.00.4%2026-03-31Fix
CVE-2026-33576OpenClaw Unauthorized Media Download via Zalo Channel6.9CNA v4.00.4%2026-03-31Fix
CVE-2026-33415Discourse: Improper access control in discourse-ai allows Unauthorized Category Content Exposure5.1CNA v4.00.3%2026-03-31Fix
CVE-2026-33300Discourse category chatables endpoint information disclosure5.3CNA v4.00.4%2026-03-31Fix
CVE-2026-33276Checkmk XSS in Unified Search via Unescaped Host/Service Names8.6CNA v4.00.2%2026-03-31Fix
CVE-2026-33185Discourse: Group SMTP test endpoint susceptible to SSRF5.3CNA v4.00.3%2026-03-31Fix
CVE-2026-33074Discourse discourse-subscriptions plugin privilege escalation6.3CNA v4.00.3%2026-03-31Fix
CVE-2026-33073discourse discourse-subscriptions plugin leaking stripe API key in multisite environment2.0CNA v4.00.3%2026-03-31Fix
CVE-2026-32988OpenClaw Sandbox Boundary Bypass via Unvalidated Temporary File Creation5.8CNA v4.00.1%2026-03-31Fix
CVE-2026-32982OpenClaw Telegram Bot token exposure in Media Fetch Error Logs8.7CNA v4.00.5%2026-03-31Fix
CVE-2026-32977OpenClaw Sandbox Boundary Bypass via Unanchored writeFile Commit Path5.8CNA v4.00.1%2026-03-31Fix
CVE-2026-32976OpenClaw Account-Scoped configWrites Policy Bypass via Channel commands7.1CNA v4.00.3%2026-03-31Fix
CVE-2026-32971OpenClaw Node-Host Approval UI Mismatch allows Execution of Unintended commands8.0v3.10.4%2026-03-31Fix
CVE-2026-32970OpenClaw Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs3.3v3.10.1%2026-03-31Fix
CVE-2026-32951Discourse: Authorization bypass in oneboxer via user-controlled category id4.3CNA v3.10.3%2026-03-31Fix
CVE-2026-32921OpenClaw Script Content Modification via Mutable Operand Binding in system.run5.0v3.10.3%2026-03-31Fix
CVE-2026-32920OpenClaw arbitrary code execution via Auto-Discovery of Workspace plugins8.8v3.10.4%2026-03-31Fix
CVE-2026-32917OpenClaw remote command injection via Unsanitized iMessage Attachment Paths in SCP9.2CNA v4.03.2%2026-03-31Fix
CVE-2026-32916OpenClaw authorization bypass in Plugin Subagent Routes via Synthetic Admin Scopes9.8v3.10.6%2026-03-31Fix
CVE-2026-32734baserCMS is vulnerable to cross-site scripting7.1CNA v3.10.3%2026-03-31Fix
CVE-2026-32727SciTokens: Authorization bypass via path traversal in Scope Validation8.1CNA v3.10.5%2026-03-31Fix
CVE-2026-32726SciTokens C++: Sibling-path authorization bypass8.1CNA v3.10.4%2026-03-31Fix
CVE-2026-32725SciTokens C++: Relative path traversal8.3CNA v3.11.0%2026-03-31Fix
CVE-2026-32716SciTokens: Authorization bypass via Incorrect Scope Path Prefix Checking8.1CNA v3.10.4%2026-03-31Fix
CVE-2026-32714SciTokens vulnerable to SQL injection in KeyCache9.8CNA v3.10.6%2026-03-31Fix
CVE-2026-32620Discourse: Missing post-level authorization allows whisper metadata disclosure5.3CNA v4.00.3%2026-03-31Fix
CVE-2026-32619Discourse poll feature improper authorization6.3CNA v4.00.3%2026-03-31Fix
CVE-2026-32618Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id4.3CNA v3.10.3%2026-03-31Fix
CVE-2026-32615Discourse category group moderator permissions improper authorization5.3CNA v4.00.3%2026-03-31Fix
CVE-2026-32607Discourse: Stored XSS via unescaped assignee name2.1CNA v4.00.3%2026-03-31Fix
CVE-2026-32273Discourse: XSS on category description update via API5.4CNA v3.10.3%2026-03-31Fix
CVE-2026-32243Discourse: Stored XSS in discourse-ai shared conversations onebox5.3CNA v4.00.3%2026-03-31Fix
CVE-2026-32143Discourse: Admin-only report can be exported by moderators5.3CNA v4.00.4%2026-03-31Fix
CVE-2026-32113Discourse: Open redirect via `sso_destination_url` cookie in `enter`5.1CNA v4.00.3%2026-03-31Fix
CVE-2026-30940baserCMS: Path traversal in theme File API leads to arbitrary file write and RCE7.2CNA v3.11.1%2026-03-31Fix
CVE-2026-30880baserCMS: OS command injection vulnerability in installer9.2CNA v4.02.2%2026-03-31Fix
CVE-2026-30879baserCMS: Cross-site scripting vulnerability in blog post6.9CNA v4.00.3%2026-03-31Fix
CVE-2026-30878baserCMS: Mail Form Acceptance Bypass via Public API5.3CNA v3.10.5%2026-03-31Fix
CVE-2026-30877baserCMS: OS command injection in the baserCMS Update Functionality9.1CNA v3.12.1%2026-03-31Fix
CVE-2026-30521oretnom23 Loan Management System client-side enforcement of server-side security6.5v3.10.3%2026-03-31
CVE-2026-30520oretnom23 Loan Management System SourceCodester blind SQL injection5.4CISA ADP v3.10.3%2026-03-31
CVE-2026-30314Ridvay Auto-approval Module OS command injection9.8CISA ADP v3.12.2%2026-03-31
CVE-2026-30312DSAI-Cline command auto-approval whitelist command injection9.8CISA ADP v3.12.1%2026-03-31
CVE-2026-30311Ridvay Auto-approval Module OS command injection9.8CISA ADP v3.12.2%2026-03-31
CVE-2026-30310In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potenti9.8CISA ADP v3.11.0%2026-03-31
CVE-2026-30309Tokfinity Infcode OS command injection7.8CISA ADP v3.10.4%2026-03-31
CVE-2026-30290Intouchapp Intouch Contacts & Caller ID An arbitrary file write8.4CISA ADP v3.10.2%2026-03-31
CVE-2026-30286Funambol Zefiro An arbitrary file write9.8CISA ADP v3.10.8%2026-03-31
CVE-2026-30285Zora An arbitrary file write9.8CISA ADP v3.10.8%2026-03-31
CVE-2026-30284Uxgroupllc Voice Recorder arbitrary file write8.6CISA ADP v3.10.2%2026-03-31
CVE-2026-30283Peaksel Animal Sounds And Ringtones arbitrary file write9.8CISA ADP v3.10.8%2026-03-31
CVE-2026-30282Uxgroupllc Cast To TV arbitrary file write9.0CISA ADP v3.10.6%2026-03-31
CVE-2026-30281Maru Neo.maru An arbitrary file write9.8CISA ADP v3.10.9%2026-03-31
CVE-2026-30280Rareprob video-player An arbitrary file write5.3CISA ADP v3.10.2%2026-03-31
CVE-2026-30279Squareapps My Location Squareapps LLC arbitrary file write8.4CISA ADP v3.10.2%2026-03-31
CVE-2026-30278Funair Fly Is Fun An arbitrary file write9.8CISA ADP v3.10.8%2026-03-31
CVE-2026-30277Triumph-adler Mobile Print PDF Reader App: TA/UTAX arbitrary file write8.4CISA ADP v3.10.2%2026-03-31
CVE-2026-30276Deftpdf Document Translator arbitrary file write9.8CISA ADP v3.10.8%2026-03-31
CVE-2026-29870agentic-context-engine project versions up to path traversal7.6CISA ADP v3.10.8%2026-03-31
CVE-2026-27854PowerDNS DNSdist use-after-free when parsing EDNS options in Lua4.8CNA v3.11.3%2026-03-31Fix
CVE-2026-27853PowerDNS DNSdist out-of-bounds write when rewriting large DNS packets5.9CNA v3.11.5%2026-03-31Fix
CVE-2026-27697baserCMS: SQL injection vulnerability in blog post6.9CNA v4.00.5%2026-03-31Fix
CVE-2026-24165NVIDIA BioNeMo Framework deserialization of untrusted data7.8CNA v3.10.3%2026-03-31Fix
CVE-2026-24164NVIDIA BioNeMo Framework deserialization of untrusted data8.8CNA v3.10.5%2026-03-31Fix
CVE-2026-24154NVIDIA Jetson Xavier Series, Jetson Orin Series and Jetson Thor OS command injection7.6CNA v3.10.3%2026-03-31Fix
CVE-2026-24153NVIDIA Jetson Xavier Series, Jetson Orin Series and Jetson Thor trust boundary violation5.2CNA v3.10.1%2026-03-31Fix
CVE-2026-24148NVIDIA Jetson Xavier Series and Jetson Orin Series insecure default initialization8.3CNA v3.10.3%2026-03-31Fix
CVE-2026-24030PowerDNS DNSdist unbounded memory allocation for DoQ and DoH35.3CNA v3.10.5%2026-03-31Fix
CVE-2026-24029PowerDNS DNSdist DNS over HTTPS ACL bypass6.5CNA v3.10.1%2026-03-31Fix
CVE-2026-24028PowerDNS DNSdist out-of-bounds read when parsing DNS packets via Lua5.3CNA v3.11.0%2026-03-31Fix
CVE-2026-22569Zscaler Client Connector incorrect startup configuration in ZCC5.4CNA v3.10.2%2026-03-31Fix
CVE-2026-22561Anthropic Claude Desktop uncontrolled search path7.8v3.10.2%2026-03-31Fix
CVE-2026-21861baserCMS: OS command injection leading to remote code execution (RCE)9.1CNA v3.12.3%2026-03-31Fix
CVE-2026-20915Checkmk stored cross-site scripting in Pending Changes sidebar8.5CNA v4.00.1%2026-03-31Fix
CVE-2026-5237itsourcecode Payroll Management System parameter manage_user.php SQL injection6.9CNA v4.00.4%2026-03-31
CVE-2026-5236Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow4.8CNA v4.00.2%2026-03-31
CVE-2026-5235Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow4.8CNA v4.00.2%2026-03-31
CVE-2026-5215D-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control5.3v3.11.4%2026-03-31
CVE-2026-5214D-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow8.7CNA v4.01.2%2026-03-31
CVE-2026-5213D-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow8.7CNA v4.01.2%2026-03-31
CVE-2026-5212D-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow8.7CNA v4.01.2%2026-03-31
CVE-2026-5211D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow8.7CNA v4.01.2%2026-03-31
CVE-2026-5210SourceCodester Leave Application System file inclusion6.9CNA v4.00.5%2026-03-31
CVE-2026-5209SourceCodester Leave Application System User Management cross-site scripting4.8CNA v4.00.4%2026-03-31
CVE-2026-5206code-projects Simple Gym Management System Payment SQL injection5.3CNA v4.00.3%2026-03-31
CVE-2026-5205chatwoot Webhook API trigger.rb Trigger server-side request forgery5.3CNA v4.00.4%2026-03-31
CVE-2026-5204Tenda CH22 parameter webtypelibrary formWebTypeLibrary stack-based overflow8.7CNA v4.01.0%2026-03-31
CVE-2026-5203CMS Made Simple UserGuide module XML import path traversal5.1CNA v4.00.5%2026-03-31
CVE-2026-5201Gdk-Pixbuf: Gdk-Pixbuf: Denial of service7.5CNA v3.11.2%2026-03-31Exploit codeFix
CVE-2026-5198code-projects Student Membership System Admin Login index.php SQL injection6.9CNA v4.00.4%2026-03-31
CVE-2026-5197code-projects Student Membership System delete_user.php SQL injection5.3CNA v4.00.3%2026-03-31
CVE-2026-5196code-projects Student Membership System delete_member.php SQL injection5.3CNA v4.00.3%2026-03-31
CVE-2026-5195code-projects Student Membership System User Registration SQL injection6.9CNA v4.00.4%2026-03-31
CVE-2026-5190AWS C Event Stream Streaming Decoder stack buffer overflow7.7CNA v4.00.5%2026-03-31Fix
CVE-2026-5186Nothings stb Multi-frame GIF file stb_image.h stbi__load_gif_main double free4.8CNA v4.00.2%2026-03-31
CVE-2026-5185Nothings stb_image Multi-frame GIF file stb_image.h stbi__gif_load_next heap-based overflow4.8CNA v4.00.2%2026-03-31
CVE-2026-5184TRENDnet TEW-713RE setSysAdm command injection8.8v3.18.5%2026-03-31
CVE-2026-5183TRENDnet TEW-713RE addRouting sub_421494 command injection9.8v3.18.9%2026-03-31
CVE-2026-5182SourceCodester Teacher Record System parameter SQL injection6.9CNA v4.00.4%2026-03-31
CVE-2026-5181SourceCodester Simple Doctors Appointment System ajax.php unrestricted upload5.3CNA v4.00.3%2026-03-31
CVE-2026-5180SourceCodester Simple Doctors Appointment System ajax.php SQL injection6.9CNA v4.00.4%2026-03-31
CVE-2026-5179SourceCodester Simple Doctors Appointment System login.php SQL injection6.9CNA v4.00.4%2026-03-31
CVE-2026-5178Totolink A3300R cstecgi.cgi setIptvCfg command injection8.8v3.13.6%2026-03-31Emerging Threats
CVE-2026-5177Totolink A3300R cstecgi.cgi setWiFiBasicCfg command injection8.8v3.13.6%2026-03-31
CVE-2026-5176Totolink A3300R cstecgi.cgi setSyslogCfg command injection9.8v3.13.0%2026-03-31
CVE-2026-5157code-projects Online Food Ordering System Order order.php cross-site scripting5.3CNA v4.00.4%2026-03-31
CVE-2026-5156Tenda CH22 Parameter QuickIndex formQuickIndex stack-based overflow8.7CNA v4.01.0%2026-03-31
CVE-2026-5115Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices3.6CNA v4.00.3%2026-03-31Fix
CVE-2026-5087Pagi::Middleware::Session::Store::Cookie versions for Perl generates random bytes insecurely7.5CISA ADP v3.10.5%2026-03-31Fix
CVE-2026-4819Search Guard audit logs can contain under certain conditions user credentials4.9CNA v3.10.4%2026-03-31Fix
CVE-2026-4818floragunn Search Guard FLX data stream management missing authorization6.8CNA v3.10.3%2026-03-31Fix
CVE-2026-4800lodash vulnerable to code injection via `_.template` imports key names8.1CNA v3.12.6%2026-03-31Exploit codeFix
CVE-2026-4799Open redirect vulnerability in Search Guard Kibana plugin via manipulated requests4.3CNA v3.10.3%2026-03-31Fix
CVE-2026-4794Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF2.1CNA v4.00.2%2026-03-31Fix
CVE-2026-44001millionbot Millie chat insecure direct object reference6.5NVD v3.10.3%2026-03-31Fix
CVE-2026-43991millionbot Millie chat prompt injection7.5v3.10.5%2026-03-31Fix
CVE-2026-4317SQL inyection in Umami Software application9.3CNA v4.00.4%2026-03-31Fix
CVE-2026-4267Query Monitor WordPress plugin reflected cross-site scripting via request URI7.2CNA v3.10.4%2026-03-31Fix
CVE-2026-4146Loco Translate WordPress plugin reflected cross-site scripting via update_href parameter6.1CNA v3.10.4%2026-03-31Fix
CVE-2026-4020Gravity SMTP WordPress plugin unauthenticated sensitive information exposure via REST API7.5CNA v3.12.2%2026-03-31NucleiEmerging ThreatsExploit codeFix
CVE-2026-3881Performance Monitor for WordPress unauthenticated blind SSRF5.8CISA ADP v3.10.3%2026-03-31
CVE-2026-3470SonicWall Email Security improper input validation3.8CISA ADP v3.10.4%2026-03-31Fix
CVE-2026-3469SonicWall Email Security improper input validation2.7CISA ADP v3.10.5%2026-03-31Fix
CVE-2026-3468SonicWall Email Security cross-site scripting4.8CISA ADP v3.10.3%2026-03-31Fix
CVE-2026-3356Missing authentication for critical function vulnerability in Anritsu Remote Spectrum Monitor9.3CNA v4.00.6%2026-03-31
CVE-2026-3308Artifex Software Inc. *PyMuPDF* MuPDF 'pdf-image.c' in Artifex's integer overflow7.8CISA ADP v3.10.2%2026-03-31Fix
CVE-2026-3300Everest Forms Pro WordPress plugin unauthenticated remote code execution via Calculation field9.8CNA v3.14.4%2026-03-31NucleiExploit codeFix
CVE-2026-3191Minify HTML WordPress plugin cross-site request forgery to plugin settings update5.4CNA v3.10.2%2026-03-31Fix
CVE-2026-3139User Profile Builder WordPress plugin insecure direct object reference4.3CNA v3.10.3%2026-03-31Fix
CVE-2026-3107TeamPass stored cross-site scripting5.4NVD v3.10.2%2026-03-31Fix
CVE-2026-3106TeamPass Blind cross-site scripting5.4NVD v3.10.3%2026-03-31Fix
CVE-2026-2950lodash vulnerable to prototype pollution via array path bypass in `_.unset` and `_.omit`6.5CNA v3.10.4%2026-03-31Fix
CVE-2026-2480WP Shortcodes Plugin Shortcodes Ultimate WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-31Fix
CVE-2026-2123Privilege escalation vulnerability in Operations Agent8.6CNA v4.00.1%2026-03-31Fix
CVE-2026-1877Auto Post Scheduler WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.2%2026-03-31
CVE-2026-1834Ibtana - WordPress Website Builder plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-31Fix
CVE-2026-1797Truebooker - Appointment Booking and Scheduler WordPress plugin sensitive information exposure5.3CNA v3.10.2%2026-03-31Fix
CVE-2026-1710WooPayments WordPress plugin missing authorization unauthenticated plugin settings update6.5CNA v3.10.3%2026-03-31Fix
CVE-2026-1579PX4 Autopilot missing authentication for critical function9.3CNA v4.00.9%2026-03-31
CVE-2026-0596Command injection in MLflow/MLflow7.8NVD v3.11.3%2026-03-31Exploit codeFix
CVE-2026-0397PowerDNS DNSdist information disclosure via CORS misconfiguration3.1CNA v3.10.2%2026-03-31Fix
CVE-2026-0396PowerDNS DNSdist HTML injection in the web dashboard3.1CNA v3.10.1%2026-03-31Fix
CVE-2026-34714Vim OS command injection8.6NVD v3.10.3%2026-03-30Fix
CVE-2026-34558CI4MS: Methods Management Full account takeover for All-Roles and Privilege-Escalation9.1CNA v3.10.4%2026-03-30Fix
CVE-2026-34557CI4MS: Permissions Management Full account takeover for All-Roles and Privilege-Escalation9.1CNA v3.10.4%2026-03-30Fix
CVE-2026-34472ZTE Zxhn H188A wizard interface information disclosure7.1CISA ADP v3.12.3%2026-03-30Emerging ThreatsExploit code
CVE-2026-33995FreeRDP: Possible double free in kerberos_AcceptSecurityContext5.3CNA v3.10.5%2026-03-30Fix
CVE-2026-33987FreeRDP: Persistent Cache bmpSize Desync heap OOB write7.1CNA v3.10.1%2026-03-30Fix
CVE-2026-33986FreeRDP: H.264 YUV Buffer Dimension Desync heap OOB write7.5CNA v3.10.5%2026-03-30Fix
CVE-2026-33985FreeRDP: ClearCodec Glyph Cache Count Desync heap OOB read5.9CNA v3.10.2%2026-03-30Fix
CVE-2026-33984FreeRDP: ClearCodec resize_vbar_entry heap OOB write7.5CNA v3.10.7%2026-03-30Fix
CVE-2026-33983FreeRDP: Progressive Codec Quant BYTE Underflow UB + CPU DoS6.5CNA v3.10.8%2026-03-30Fix
CVE-2026-33982FreeRDP: Persistent Cache Allocator Mismatch heap OOB read7.1CNA v3.10.3%2026-03-30Fix
CVE-2026-33977FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)6.9CNA v4.00.4%2026-03-30Fix
CVE-2026-33952FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks6.0CNA v4.00.4%2026-03-30Fix
CVE-2026-33643Schemahero SQL injection7.4CISA ADP v3.10.3%2026-03-30
CVE-2026-33373Synacor Zimbra Collaboration Suite cross-site request forgery8.8CISA ADP v3.10.3%2026-03-30Fix
CVE-2026-330320xJacky nginx-ui Nginx UI: Unauthenticated MCP endpoint allows Remote Nginx takeover9.8CNA v3.12.5%2026-03-30Reported exploitedNucleiEmerging ThreatsExploit codeKCV
CVE-2026-330300xJacky nginx-ui Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys8.8CNA v3.10.4%2026-03-30
CVE-2026-330290xJacky nginx-ui Nginx UI: DoS via Negative Integer Input in Logrotate Interval6.9CNA v4.00.5%2026-03-30Fix
CVE-2026-330280xJacky nginx-ui Nginx UI: Race condition leads to Persistent Data Corruption and Service Collapse7.1CNA v4.00.6%2026-03-30Fix
CVE-2026-330270xJacky Nginx UI configuration path handling path traversal6.9CNA v4.00.5%2026-03-30Fix
CVE-2026-33026nginx-ui Backup Restore allows tampering with Encrypted Backups9.4CNA v4.00.2%2026-03-30Fix
CVE-2026-32884Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)5.9CNA v3.10.2%2026-03-30Fix
CVE-2026-32883Botan: Missing OCSP Response signature verification allows MitM Certificate Revocation Bypass5.9CNA v3.10.2%2026-03-30Fix
CVE-2026-32877Botan: Heap buffer over-read in SM2 Decryption via Undersized C3 Hash field8.2CNA v3.10.5%2026-03-30Fix
CVE-2026-32794Apache Airflow Provider for Databricks improper certificate validation4.8CISA ADP v3.10.4%2026-03-30Exploit codeFix
CVE-2026-32696NanoMQ HTTP authentication null pointer dereference3.1CNA v3.10.6%2026-03-30Fix
CVE-2026-32275Tautulli JSONP callback parameter cross-site scripting7.4CNA v4.00.4%2026-03-30Fix
CVE-2026-31946OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow9.8CNA v3.10.3%2026-03-30Fix
CVE-2026-31831Tautulli: Unauthenticated path traversal in `/newsletter/image/images` endpoint8.7CNA v4.01.9%2026-03-30NucleiFix
CVE-2026-31804Tautulli pms_image_proxy endpoint server-side request forgery4.0CNA v3.10.4%2026-03-30Fix
CVE-2026-31799Tautulli: SQL injection in get_home_stats API endpoint via unsanitised filter parameters4.9CNA v3.10.4%2026-03-30Fix
CVE-2026-30566Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30565Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30564Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30563Ahsanriaz26gmailcom Sales and Inventory System SourceCodester stored cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30562Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting9.3CISA ADP v3.10.5%2026-03-30
CVE-2026-30561Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30560Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30559Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30558Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30557Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30556Ahsanriaz26gmailcom Sales and Inventory System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-30
CVE-2026-30313cline code injection9.8CISA ADP v3.12.2%2026-03-30
CVE-2026-30308Presidio Hai Build code injection9.8CISA ADP v3.11.0%2026-03-30
CVE-2026-30307Roo-Code code injection9.8CISA ADP v3.12.2%2026-03-30
CVE-2026-30306Rahmanazhar Sakadev code injection9.8CISA ADP v3.11.0%2026-03-30
CVE-2026-30305Orangecat Syntx code injection9.8CISA ADP v3.12.2%2026-03-30
CVE-2026-30082IngEstate Server software package list edit page stored cross-site scripting6.1CISA ADP v3.10.3%2026-03-30Exploit code
CVE-2026-30077Openairinterface crash7.5CISA ADP v3.10.5%2026-03-30
CVE-2026-29954Cloudark Kubeplus argument injection7.6CISA ADP v3.10.4%2026-03-30
CVE-2026-29953Schemahero SQL injection7.4CISA ADP v3.10.3%2026-03-30
CVE-2026-29925Invoice Ninja server-side request forgery7.7CISA ADP v3.10.4%2026-03-30
CVE-2026-29924getgrav grav XML external entity injection7.6CISA ADP v3.10.3%2026-03-30
CVE-2026-29909MRCMS forced browsing5.3CISA ADP v3.10.5%2026-03-30Exploit code
CVE-2026-29872Theunwindai Awesome LLM Apps information disclosure8.2CISA ADP v3.10.4%2026-03-30
CVE-2026-29597DDSN Interactive Acora CMS file_details.asp file manager endpoint improper access control6.5CISA ADP v3.10.4%2026-03-30
CVE-2026-28528BlueKitchen BTstack AVRCP Browsing Target GET_FOLDER_ITEMS Handler OOB read / undefined behavior4.6v3.10.2%2026-03-30Fix
CVE-2026-28527BlueKitchen BTstack AVRCP Controller GET_PLAYER_APPLICATION_SETTING_*_TEXT Handlers OOB read7.3v3.10.3%2026-03-30Fix
CVE-2026-28526BlueKitchen BTstack AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_* Handlers OOB read5.7v3.10.2%2026-03-30Fix
CVE-2026-28505Tautulli: RCE via eval sandbox bypass using lambda nested scope to escape co_names whitelist check7.5CNA v4.00.6%2026-03-30Fix
CVE-2026-28228OpenOLAT: Server-side template injection (SSTI) in Velocity templates allows remote code execution8.8CNA v3.10.5%2026-03-30Fix
CVE-2026-27599CI4MS mail settings fields vulnerability4.7CNA v3.10.4%2026-03-30Fix
CVE-2026-27508Smoothwall Express Update 13 reflected XSS in redirect.cgi via URL parameter6.1v3.10.3%2026-03-30Fix
CVE-2026-27018Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme7.8CNA v4.01.6%2026-03-30Fix
CVE-2026-26352Smoothwall Express Update 13 stored XSS in vpnmain.cgi via VPN_IP parameter5.1CNA v4.00.2%2026-03-30Fix
CVE-2026-25704pop-os cosmic-greeter incomplete privilege drop for com.system76.CosmicGreeter.GetUserData5.8CNA v4.00.1%2026-03-30
CVE-2026-25627NanoMQ MQTT over WebSocket transport out-of-bounds read6.5CNA v3.10.6%2026-03-30Fix
CVE-2026-21717Node.js Node weak hash5.9v3.10.3%2026-03-30Fix
CVE-2026-21716Node.js Node missing authorization3.3CNA v3.00.1%2026-03-30Fix
CVE-2026-21715Node.js Node incorrect permission assignment3.3CNA v3.00.2%2026-03-30Fix
CVE-2026-21714Node.js Node A memory leak5.3CNA v3.00.5%2026-03-30Fix
CVE-2026-21713Node.js Node timing side channel5.9CNA v3.00.4%2026-03-30Fix
CVE-2026-21712Node.js Node reachable assertion6.5v3.10.3%2026-03-30Fix
CVE-2026-21711Node.js Node improper access control5.3CNA v3.00.2%2026-03-30Fix
CVE-2026-21710Node.js Node resource exhaustion7.5CNA v3.025.0%2026-03-30Fix
CVE-2026-5170MongoDB Server users could trigger a crash of mongod primaries during promotion to sharded6.0CNA v4.00.3%2026-03-30Fix
CVE-2026-5165Virtio-win: Virtio-win: Memory corruption via use-after-free in virtio blk device reset6.7CNA v3.10.2%2026-03-30
CVE-2026-5164Virtio-win: Virtio-win: Denial of service via unvalidated descriptor count in unmap request6.7CNA v3.10.2%2026-03-30
CVE-2026-5155Tenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow8.7CNA v4.01.0%2026-03-30
CVE-2026-5154Tenda CH22 parameter setcfm fromSetCfm stack-based overflow8.7CNA v4.01.0%2026-03-30
CVE-2026-5153Tenda CH22 WriteFacMac FormWriteFacMac command injection8.8v3.16.5%2026-03-30
CVE-2026-5152Tenda CH22 createFileName formCreateFileName stack-based overflow8.7CNA v4.01.0%2026-03-30
CVE-2026-5150code-projects Accounting System parameter viewin_costumer.php SQL injection6.9CNA v4.00.4%2026-03-30
CVE-2026-5148YunaiV yudao-cloud page SQL injection5.1CNA v4.00.3%2026-03-30
CVE-2026-5147YunaiV yudao-cloud get-by-website SQL injection6.9CNA v4.00.4%2026-03-30
CVE-2026-5130Debugger and Troubleshooter WordPress plugin unauthenticated privilege escalation to Administrator8.8CNA v3.10.6%2026-03-30Fix
CVE-2026-5126SourceCodester RSS Feed Parser file_get_contents server-side request forgery5.3CNA v4.00.3%2026-03-30
CVE-2026-5125raine consult-llm-mcp server.ts child_process.execSync os command injection4.8CNA v4.01.1%2026-03-30Fix
CVE-2026-5124osrg GoBGP BGP header bgp.go BGPHeader.DecodeFromBytes access control6.3CNA v4.00.5%2026-03-30Fix
CVE-2026-5123osrg GoBGP bgp.go DecodeFromBytes off-by-one6.3CNA v4.00.7%2026-03-30Fix
CVE-2026-5122osrg GoBGP BGP OPEN message bgp.go DecodeFromBytes access control6.3CNA v4.00.5%2026-03-30Fix
CVE-2026-5121Libarchive: Libarchive: Arbitrary code execution via integer overflow in iso9660 image processing9.8CISA ADP v3.11.4%2026-03-30Fix
CVE-2026-5119Libsoup: Libsoup: Information disclosure8.2NVD v3.10.3%2026-03-30Fix
CVE-2026-5107FRRouting FRR EVPN Type-2 route bgp_evpn.c process_type2_route access control4.2v3.10.4%2026-03-30Fix
CVE-2026-5106code-projects Exam Form Submission update_fst.php cross-site scripting4.8v3.10.3%2026-03-30
CVE-2026-5105Totolink A3300R parameter cstecgi.cgi setVpnPassCfg command injection8.8v3.13.6%2026-03-30Emerging Threats
CVE-2026-5104Totolink A3300R cstecgi.cgi setStaticRoute command injection8.8v3.13.6%2026-03-30
CVE-2026-5103Totolink A3300R cstecgi.cgi setUPnPCfg command injection8.8v3.13.6%2026-03-30Emerging Threats
CVE-2026-5102Totolink A3300R parameter cstecgi.cgi setSmartQosCfg command injection8.8v3.13.6%2026-03-30
CVE-2026-4789Kyverno CEL HTTP functions server-side request forgery9.8CISA ADP v3.10.7%2026-03-30Fix
CVE-2026-4416GIGABYTE|Performance Library insecure deserialization8.5CNA v4.00.3%2026-03-30Fix
CVE-2026-4415GIGABYTE|Gigabyte Control Center arbitrary file write9.8v3.10.9%2026-03-30Fix
CVE-2026-4315WatchGuard Firebox cross-site request forgery (CSRF) in Fireware Web UI7.1CNA v4.00.2%2026-03-30Fix
CVE-2026-4266WatchGuard Firebox insecure deserialization in Fireware Access portal8.4CNA v4.00.4%2026-03-30Fix
CVE-2026-4257Contact Form by Supsystic WordPress plugin unauthenticated server-side template injection9.8CNA v3.132.8%2026-03-30Reported exploitedNucleiMetasploitExploit codeFix
CVE-2026-4046The GNU C Library glibc iconv crash due to assertion failure with untrusted input7.5CISA ADP v3.10.7%2026-03-30Fix
CVE-2026-3991Elevation of privileges in Symantec Data Loss Prevention Windows endpoint7.8CNA v3.10.2%2026-03-30Fix
CVE-2026-3945tinyproxy integer overflow in HTTP Chunked Transfer-Encoding parser leading to denial of service8.7CNA v4.01.0%2026-03-30Fix
CVE-2026-3502TrueConf Client download of code without integrity check7.8CNA v3.10.3%2026-03-30KEVExploit codeFix
CVE-2026-3321Authorization bypass in ON24 Q&A chat8.7CNA v4.00.4%2026-03-30
CVE-2026-3124Download Monitor WordPress plugin insecure direct object reference7.5CNA v3.10.4%2026-03-30Fix
CVE-2026-2328WAGO Device Sphere backend Access due to insufficient input validation7.5CNA v3.10.3%2026-03-30Fix
CVE-2026-2287CrewAI sandbox execution fallback code injection9.8CISA ADP v3.10.7%2026-03-30
CVE-2026-2286CrewAI RAG search tools server-side request forgery9.8CISA ADP v3.10.5%2026-03-30
CVE-2026-2285CrewAI JSON loader tool path traversal7.5CISA ADP v3.10.6%2026-03-30
CVE-2026-2275CrewAI CodeInterpreter tool vulnerability9.6CISA ADP v3.10.4%2026-03-30
CVE-2026-1612Hard-coded AWS Key in AL-KO Robolinho Update Software6.9CNA v4.00.4%2026-03-30
CVE-2026-34005Xiongmai DVR/NVR devices OS command injection8.8CNA v3.11.9%2026-03-29Exploit code
CVE-2026-33575OpenClaw Long-lived credential exposure in Pairing Setup Codes8.6CNA v4.00.4%2026-03-29Fix
CVE-2026-33574OpenClaw path traversal via Tools Root Rebinding in Skills Download4.7v3.10.1%2026-03-29Fix
CVE-2026-33573OpenClaw Workspace Boundary Bypass via Agent RPC parameters8.7CNA v4.00.5%2026-03-29Fix
CVE-2026-33572OpenClaw Insufficient File Permissions in Session Transcript files5.5NVD v3.10.2%2026-03-29Fix
CVE-2026-32987OpenClaw Bootstrap Setup Code Replay via Device Pairing9.3CNA v4.00.6%2026-03-29Fix
CVE-2026-32980OpenClaw resource exhaustion via Unauthenticated Telegram Webhook request8.7CNA v4.00.7%2026-03-29Fix
CVE-2026-32979OpenClaw Unbound Interpreter and Runtime Commands Bypass in node-host Approval6.7NVD v3.10.2%2026-03-29Fix
CVE-2026-32978OpenClaw Approval Bypass via Unrecognized Script Runners7.5NVD v3.10.3%2026-03-29Fix
CVE-2026-32975OpenClaw Weak Authorization via Mutable Group Names in Zalouser Allowlist6.9CNA v4.00.6%2026-03-29Fix
CVE-2026-32974OpenClaw Forged Event injection via Feishu Webhook Verification Token9.8v3.10.4%2026-03-29Fix
CVE-2026-32973OpenClaw Exec Allowlist Pattern Overmatch via POSIX Path Normalization8.8CNA v4.00.7%2026-03-29Fix
CVE-2026-32972OpenClaw authorization bypass in Browser Profile Management via browser.request7.1CNA v4.00.4%2026-03-29Fix
CVE-2026-32924OpenClaw authorization bypass via Misclassified Reaction Events in Feishu6.9CNA v4.00.5%2026-03-29Fix
CVE-2026-32923OpenClaw authorization bypass in Discord Guild Reaction Allowlist Enforcement5.3CNA v4.00.2%2026-03-29Fix
CVE-2026-32922OpenClaw privilege escalation via Unvalidated Scope in device.token.rotate9.4CNA v4.00.7%2026-03-29Fix
CVE-2026-32919OpenClaw Unauthorized Session Reset via agent Slash commands6.9CNA v4.00.1%2026-03-29Fix
CVE-2026-32918OpenClaw Session sandbox escape via session_status tool9.2CNA v4.00.1%2026-03-29Fix
CVE-2026-32915OpenClaw Sandbox Boundary Bypass via Subagent Control Surface9.3CNA v4.00.2%2026-03-29Fix
CVE-2026-32914OpenClaw insufficient access control in /config and /debug endpoints8.7CNA v4.00.4%2026-03-29Fix
CVE-2026-23400Linux kernel Rust Binder notification handling improper locking5.5v3.10.1%2026-03-29Fix
CVE-2026-5101Totolink A3300R parameter cstecgi.cgi setLanCfg command injection8.8v3.13.6%2026-03-29
CVE-2026-5046Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow8.7CNA v4.01.0%2026-03-29
CVE-2026-5045Tenda FH1201 Parameter WrlclientSet stack-based overflow8.7CNA v4.01.0%2026-03-29
CVE-2026-5044Belkin F9K1122 setting formSetSystemSettings stack-based overflow8.7CNA v4.01.1%2026-03-29
CVE-2026-5043Belkin F9K1122 parameter formSetPassword stack-based overflow8.7CNA v4.01.1%2026-03-29
CVE-2026-5042Belkin F9K1122 parameter formCrossBandSwitch stack-based overflow8.7CNA v4.01.1%2026-03-29
CVE-2026-5041code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection5.1CNA v4.02.1%2026-03-29
CVE-2026-5037mxml mxmlIndexNew mxml-index.c index_sort stack-based overflow4.8CNA v4.00.2%2026-03-29Fix
CVE-2026-5036Tenda 4G06 Endpoint DhcpListClient fromDhcpListClient stack-based overflow8.7CNA v4.00.9%2026-03-29
CVE-2026-5035code-projects Accounting System parameter view_work.php SQL injection9.8v3.10.6%2026-03-29
CVE-2026-5034code-projects Accounting System parameter edit_costumer.php SQL injection9.8v3.10.5%2026-03-29
CVE-2026-5033code-projects Accounting System parameter view_costumer.php SQL injection9.8v3.10.6%2026-03-29
CVE-2026-5031BichitroGan ISP Billing Software endpoint users-view resource injection5.3CNA v4.00.4%2026-03-29
CVE-2026-5030Totolink NR1800X Telnet service cstecgi.cgi NTPSyncWithHost command injection9.8v3.13.7%2026-03-29
CVE-2026-5024D-Link DIR-513 formSetEmail stack-based overflow8.7CNA v4.01.2%2026-03-29
CVE-2026-5023DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection4.8CNA v4.01.1%2026-03-29
CVE-2026-5021Tenda F453 httpd PPTPUserSetting fromPPTPUserSetting stack-based overflow8.7CNA v4.01.0%2026-03-29
CVE-2026-5020Totolink A3600R parameter cstecgi.cgi setNoticeCfg command injection9.8v3.13.7%2026-03-29
CVE-2026-5019code-projects Simple Food Order System parameter all-orders.php SQL injection9.8v3.10.6%2026-03-29
CVE-2026-4946NSA Ghidra Auto-Analysis Annotation command execution8.8CNA v3.10.8%2026-03-29Fix
CVE-2026-4851Grid::Machine versions for Perl allows arbitrary code execution via unsafe deserialization9.8NVD v3.10.8%2026-03-29
CVE-2026-4176Perl versions from, from, from contain a vulnerable version of Compress::Raw::Zlib9.8CISA ADP v3.10.8%2026-03-29Fix
CVE-2026-2602Twentig WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-29Fix
CVE-2026-2370Improper handling of parameters in GitLab8.1CNA v3.10.4%2026-03-29Fix
CVE-2026-0562Insecure direct object reference (IDOR) in parisneo/Lollms8.3v3.10.3%2026-03-29Fix
CVE-2026-0560Server-side request forgery (SSRF) in parisneo/Lollms7.5v3.11.8%2026-03-29NucleiFix
CVE-2026-0558Unauthenticated file upload in parisneo/Lollms9.8v3.11.9%2026-03-29NucleiFix
CVE-2026-23399Linux kernel nf_tables dynamic set expressions memory leak5.5NVD v3.10.1%2026-03-28Fix
CVE-2026-5018code-projects Simple Food Order System parameter register-router.php SQL injection9.8v3.10.6%2026-03-28
CVE-2026-5017code-projects Simple Food Order System parameter all-tickets.php SQL injection9.8v3.10.6%2026-03-28
CVE-2026-5016elecV2 elecV2P URL mock eAxios server-side request forgery6.9CNA v4.00.5%2026-03-28
CVE-2026-5015elecV2 elecV2P endpoint logs cross-site scripting5.3CNA v4.00.4%2026-03-28
CVE-2026-5014elecV2 elecV2P Wildcard log path.join path traversal6.9CNA v4.00.6%2026-03-28
CVE-2026-5013elecV2 elecV2P :key path.join path traversal6.9CNA v4.00.6%2026-03-28
CVE-2026-5012elecV2 elecV2P RPC pm2run os command injection6.9CNA v4.02.1%2026-03-28
CVE-2026-5011elecV2 elecV2P JSON webhook runJSFile code injection5.3CNA v4.00.4%2026-03-28
CVE-2026-5007kazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection4.8CNA v4.01.1%2026-03-28
CVE-2026-5004Wavlink WL-WN579X3-C UPNP firewall.cgi sub_4019FC stack-based overflow8.7CNA v4.01.1%2026-03-28
CVE-2026-5003PromtEngineer localGPT Web api_server.py handle_index information disclosure6.9CNA v4.00.5%2026-03-28
CVE-2026-5002PromtEngineer localGPT LLM Prompt server.py _route_using_overviews injection6.9CNA v4.00.5%2026-03-28
CVE-2026-5001PromtEngineer localGPT server.py do_POST unrestricted upload6.9CNA v4.00.5%2026-03-28
CVE-2026-5000PromtEngineer localGPT API endpoint server.py LocalGPTHandler missing authentication6.9CNA v4.00.7%2026-03-28Exploit code
CVE-2026-4999z-9527 admin isImg Check upload.js uploadFile path traversal5.3CNA v4.00.5%2026-03-28
CVE-2026-4998Sinaptik AI PandasAI Chat message code_executor.py CodeExecutor.execute code injection6.9CNA v4.00.7%2026-03-28
CVE-2026-4997Sinaptik AI PandasAI sql_sanitizer.py is_sql_query_safe path traversal6.9CNA v4.00.8%2026-03-28
CVE-2026-4996Sinaptik AI PandasAI pandasai-lancedb extension lancedb.py get_relevant_docs_by_id SQL injection6.9CNA v4.00.4%2026-03-28
CVE-2026-4995wandb OpenUI window Message Event index.html cross-site scripting5.1CNA v4.00.3%2026-03-28
CVE-2026-4994wandb OpenUI APIStatusError server.py generic_exception_handler information exposure5.1CNA v4.00.3%2026-03-28
CVE-2026-4993wandb OpenUI config.py hard-coded credentials4.8CNA v4.00.1%2026-03-28
CVE-2026-4987SureForms WordPress plugin unauthenticated Payment Amount validation bypass via form_id7.5CNA v3.11.2%2026-03-28NucleiFix
CVE-2026-3256HTTP::Session versions for Perl defaults to using insecurely generated session ids9.8NVD v3.10.7%2026-03-28Fix
CVE-2026-2595Quads Ads Manager for Google AdSense WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2026-03-28Fix
CVE-2026-2442Page Builder: Pagelayer WordPress plugin CRLF injection5.3CNA v3.10.3%2026-03-28Fix
CVE-2026-1307Ninja Forms WordPress plugin sensitive information disclosure6.5CNA v3.10.2%2026-03-28Fix
CVE-2026-34475varnish-software Varnish Cache cache poisoning9.8v3.10.2%2026-03-27Fix
CVE-2026-34411Appsmith Unauthenticated Instance Configuration Disclosure via Management APIs6.9CNA v4.00.4%2026-03-27Fix
CVE-2026-34391Fleet Vulnerable to Windows MDM cross-device command disclosure6.6CNA v4.00.3%2026-03-27Fix
CVE-2026-34389Fleet's user account creation via invite does not enforce invited email address4.9CNA v4.00.3%2026-03-27Fix
CVE-2026-34388Fleet vulnerable to denial of service via unhandled gRPC log type in launcher endpoint6.6CNA v4.00.5%2026-03-27Fix
CVE-2026-34387Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts5.7CNA v4.01.9%2026-03-27Fix
CVE-2026-34386Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin6.3CNA v4.00.4%2026-03-27Fix
CVE-2026-34385Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database6.2CNA v4.00.3%2026-03-27Fix
CVE-2026-34375AVideo vulnerable to reflected XSS via Unsanitized plugin parameter in YPTWallet Stripe Payment page8.2CNA v3.10.3%2026-03-27
CVE-2026-34374AVideo has SQL injection in Live_schedule::keyExists via Unparameterized Stream Key9.1CNA v3.10.5%2026-03-27
CVE-2026-34369WWBN AVideo video playback API missing authorization5.3CNA v3.10.4%2026-03-27
CVE-2026-34368AVideo vulnerable to Wallet Balance Double-Spend via TOCTOU race condition in transferBalance5.3CNA v3.10.2%2026-03-27
CVE-2026-34364WWBN AVideo category access control incorrect authorization5.3CNA v3.10.3%2026-03-27
CVE-2026-34362AVideo's WebSocket Token Never Expires due to Commented-Out Timeout Validation in verifyTokenSocket5.4CNA v3.10.3%2026-03-27
CVE-2026-34353OCaml integer overflow5.1v3.10.1%2026-03-27Fix
CVE-2026-34247WWBN AVideo live stream poster upload missing authorization5.4CNA v3.10.3%2026-03-27
CVE-2026-34245AVideo's missing authorization in Playlist Schedule Creation allows Cross-User Broadcast Hijacking6.3CNA v3.10.3%2026-03-27
CVE-2026-34226Happy DOM fetch credentials handling information disclosure7.5CNA v3.10.6%2026-03-27Fix
CVE-2026-34205Home Assistant: Unauthenticated App Endpoints Exposed to Local Network via Host Network Mode9.7CNA v3.10.3%2026-03-27Fix
CVE-2026-34046Langflow: Authenticated Users can Read, Modify, and Delete any Flow via Missing Ownership Check8.7CNA v4.00.7%2026-03-27Fix
CVE-2026-33996LibJWT has null/bounds validation in JWK octet and RSA PSS parsing5.8CNA v4.00.2%2026-03-27Fix
CVE-2026-33994Locutus prototype pollution due to incomplete fix for6.3CNA v4.00.8%2026-03-27Fix
CVE-2026-33993Locutus has prototype pollution via __proto__ Key injection in unserialize6.9CNA v4.00.8%2026-03-27Fix
CVE-2026-33992pyLoad: Server-side request forgery via Download Link Submission enables Cloud Metadata Exfiltration9.3CNA v4.00.5%2026-03-27Fix
CVE-2026-33991WeGIA has SQL injection in deletar_tag.php8.8CNA v3.10.6%2026-03-27Fix
CVE-2026-33989@mobilenext/mobile-mcp alllows arbitrary file write8.1CNA v3.10.5%2026-03-27Fix
CVE-2026-33981Changedetection.io Discloses Environment variables via jq env Builtin in Include Filters8.3CNA v4.00.5%2026-03-27Fix
CVE-2026-33980Azure Data Explorer MCP Server table schema tool handlers vulnerability8.3CNA v3.10.4%2026-03-27Exploit code
CVE-2026-33979Express XSS Sanitizer sanitization configuration cross-site scripting8.2CNA v3.10.4%2026-03-27Fix
CVE-2026-33976Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering9.7CNA v3.10.7%2026-03-27Fix
CVE-2026-33955Notesnook vulnerable to RCE via stored XSS in Note History diff viewer8.6CNA v3.10.3%2026-03-27Fix
CVE-2026-33954LinkAce discloses private notesto unauthorized authenticated users via the web link detail page6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-33953LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce8.5CNA v3.10.3%2026-03-27Fix
CVE-2026-33946MCP Ruby SDK: Insufficient Session Binding allows SSE Stream Hijacking via Session ID Replay8.2CNA v4.00.5%2026-03-27Fix
CVE-2026-33945lxc incus abitrary file write through systemd-creds option10.0CNA v3.10.5%2026-03-27Fix
CVE-2026-33943Happy DOM ECMAScriptModuleCompiler code injection8.8CNA v3.11.0%2026-03-27Fix
CVE-2026-33941Handlebars.js has JavaScript injection in CLI Precompiler via Unescaped Names and options8.3CNA v3.10.2%2026-03-27Fix
CVE-2026-33940Handlebars.js has JavaScript injection8.1CNA v3.10.8%2026-03-27Fix
CVE-2026-33939Handlebars.js has denial of service via Malformed Decorator Syntax in Template Compilation7.5CNA v3.10.8%2026-03-27Fix
CVE-2026-33938Handlebars.js has JavaScript injection via AST type confusion by tampering @partial-block8.1CNA v3.10.8%2026-03-27Fix
CVE-2026-33937Handlebars.js has JavaScript injection via AST type confusion9.8CNA v3.11.7%2026-03-27Exploit codeFix
CVE-2026-33936python-ecdsa DER parser denial of service5.3CNA v3.10.5%2026-03-27Exploit codeFix
CVE-2026-33935MyTube has Unauthenticated Account Lockout via Shared Login Attempt State7.7CNA v4.00.8%2026-03-27Fix
CVE-2026-33916Handlebars.js has prototype pollution leading to XSS through partial template injection4.7CNA v3.10.4%2026-03-27Fix
CVE-2026-33907Ella Core Panics during NAS Authentication Response/Failure with missing IEs6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-33906Ella Core has privilege escalation via Database Restore by NetworkManager role7.2CNA v3.10.6%2026-03-27Fix
CVE-2026-33904Ella Core has a denial of service via SCTP connection cleanup deadlock6.5CNA v3.10.3%2026-03-27Fix
CVE-2026-33903Ella Core panics when processing a crafted NGAP LocationReport message6.5CNA v3.10.3%2026-03-27Fix
CVE-2026-33898Local Incus UI web server vulnerable to nuthentication bypass8.8CNA v3.10.5%2026-03-27Fix
CVE-2026-33896Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)7.4CNA v3.10.5%2026-03-27Fix
CVE-2026-33895Digital Bazaar Forge Ed25519 improper signature verification7.5CNA v3.10.5%2026-03-27Fix
CVE-2026-33894Forge has signature forgery in RSA-PKCS due to ASN.1 extra field7.5CNA v3.10.4%2026-03-27Fix
CVE-2026-33891Forge has denial of service via infinite loop in BigInteger.modInverse with Zero Input7.5CNA v3.10.9%2026-03-27Fix
CVE-2026-33890MyTube has an unauthenticated admin privilege escalation via Passkey Registration8.9CNA v4.00.7%2026-03-27Fix
CVE-2026-33887Statamic revision controllers missing authorization5.4CNA v3.10.2%2026-03-27Fix
CVE-2026-33886Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-33885Statamic has an open redirect on unauthenticated endpoints via URL parsing differential6.1CNA v3.10.3%2026-03-27Fix
CVE-2026-33884Statamic's live preview token bypasses content protection for unrelated entries4.3CNA v3.10.3%2026-03-27Fix
CVE-2026-33883Statamic has reflected XSS via unescaped redirect parameter in its password reset form tag6.1CNA v3.10.3%2026-03-27Fix
CVE-2026-33882Statamic's Markdown preview endpoint exposes sensitive user data6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-33881Windmill NativeTS executor code injection7.3CNA v4.00.6%2026-03-27Fix
CVE-2026-33879FLIP doesn't have rate limiting or brute-force protection on login2.7CNA v4.00.5%2026-03-27Fix
CVE-2026-33875Authenticator vulnerable to Authentication Flow Hijack9.3CNA v3.10.5%2026-03-27Fix
CVE-2026-33874Authenticator vulnerable to remote code execution7.8CNA v3.10.3%2026-03-27Fix
CVE-2026-33873Langflow has authenticated code execution in Agentic Assistant Validation9.3CNA v4.01.8%2026-03-27Fix
CVE-2026-33872Revelry Labs elixir-nodejs worker protocol race condition7.1CNA v4.00.5%2026-03-27Fix
CVE-2026-33871Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass8.7CNA v4.01.2%2026-03-27Fix
CVE-2026-33870Netty: HTTP request smuggling via Chunked Extension Quoted-String Parsing7.5CNA v3.10.7%2026-03-27Fix
CVE-2026-33869Mastodon has a denial of service for quote authorization4.8CNA v3.10.3%2026-03-27Fix
CVE-2026-33868Mastodon web route open redirect4.3CNA v3.10.6%2026-03-27NucleiFix
CVE-2026-33867AVideo has Plaintext Video Password Storage9.1CNA v4.00.2%2026-03-27
CVE-2026-33770AVideo has SQL injection in category.php fixCleanTitle7.1CNA v4.00.6%2026-03-27
CVE-2026-33767AVideo has SQL injection via Partial Prepared Statement videos_id Concatenated Directly into Query7.1CNA v4.00.6%2026-03-27Fix
CVE-2026-33766AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download endpoints5.3CNA v4.00.3%2026-03-27
CVE-2026-33765Pi-hole Web Interface has a command injection8.9CNA v4.01.8%2026-03-27Fix
CVE-2026-33764AVideo: IDOR in AI plugin allows Stealing other Users' AI-Generated Metadata and Transcriptions4.3CNA v3.10.3%2026-03-27
CVE-2026-33763AVideo has an Unauthenticated Video Password brute-force vulnerability5.3CNA v3.10.4%2026-03-27
CVE-2026-33761WWBN AVideo Scheduler plugin missing authorization5.3CNA v3.10.4%2026-03-27
CVE-2026-33759AVideo: Unauthenticated IDOR in playlistsVideos.json.php exposes Private Playlist Contents5.3CNA v3.10.4%2026-03-27
CVE-2026-33758OpenBao has reflected XSS in its OIDC authentication error message9.4CNA v4.00.4%2026-03-27Fix
CVE-2026-33757OpenBao lacks user confirmation for OIDC direct callback mode9.6CNA v3.10.6%2026-03-27Fix
CVE-2026-33755Intermesh groupoffice authenticated SQL injection in Contact/query addressBookIds filter8.8CNA v3.10.5%2026-03-27Fix
CVE-2026-33750brace-expansion sequence expansion denial of service6.5CNA v3.10.6%2026-03-27Fix
CVE-2026-33748BuildKit Git URL subdir component can cause access to restricted files8.2CNA v4.00.5%2026-03-27Fix
CVE-2026-33747BuildKit vulnerable to malicious frontend causing file escape outside of storage root8.4CNA v3.10.6%2026-03-27Fix
CVE-2026-33745cpp-httplib client leaks authentication credentials to Untrusted Hosts on Cross-Origin HTTP Redirect7.4CNA v3.10.4%2026-03-27Fix
CVE-2026-33744BentoML has Dockerfile command injection via system_packages in bentofile.yaml7.8CNA v3.10.2%2026-03-27Fix
CVE-2026-33739fogproject FOG has stored XSS in multiple Management pages5.7CNA v3.10.3%2026-03-27Fix
CVE-2026-33735MyTube has an improper access control that allows Complete application takeover7.4CNA v4.00.6%2026-03-27Fix
CVE-2026-33730Open Source Point of Sale has an IDOR in Password Change (Home)6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-33729OpenFGA has an authorization bypass through cached keys5.8CNA v4.00.3%2026-03-27Fix
CVE-2026-33728Datadog dd-trace-java RMI instrumentation insecure deserialization9.3CNA v4.01.0%2026-03-27Fix
CVE-2026-33726Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic5.4CNA v3.10.3%2026-03-27Fix
CVE-2026-33725Metabase vulnerable to RCE and arbitrary file read7.2CNA v3.10.8%2026-03-27Exploit codeFix
CVE-2026-33721MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing5.3CNA v3.10.8%2026-03-27Fix
CVE-2026-33718OpenHands is vulnerable to command injection through its Git Diff handler7.6CNA v3.13.0%2026-03-27Exploit codeFix
CVE-2026-33701OpenTelemetry: Unsafe deserialization in RMI Instrumentation may lead to remote code execution9.3CNA v4.01.1%2026-03-27Exploit codeFix
CVE-2026-33699pypdf PDF dictionary object parser infinite loop4.6CNA v4.00.6%2026-03-27Fix
CVE-2026-33697CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys7.5CNA v3.10.1%2026-03-27Fix
CVE-2026-33693Lemmy's Activitypub-Federation has SSRF via bypass in activitypub-federation-rust v4_is_invalid6.5CNA v3.10.4%2026-03-27Exploit codeFix
CVE-2026-33654HKUDS nanobot Zero-Click Indirect prompt injection and authentication bypass via Email Polling8.9CNA v4.00.7%2026-03-27Fix
CVE-2026-33559MiKa OpenStreetMap cross-site scripting5.1CNA v4.00.3%2026-03-27Fix
CVE-2026-33433Traefik vulnerable to BasicAuth/DigestAuth Identity spoofing via Non-Canonical headerField5.1CNA v4.00.6%2026-03-27Fix
CVE-2026-33366BUFFALO Wi-Fi router products missing authentication6.9CNA v4.00.6%2026-03-27Fix
CVE-2026-33284globaleaks-whistleblowing-software GlobalLeaks has insufficient URL validation in user support API1.2CNA v4.00.3%2026-03-27Fix
CVE-2026-33280BUFFALO Wi-Fi router products hidden functionality9.8v3.10.7%2026-03-27Fix
CVE-2026-33206calibre has a path traversal8.2CNA v4.00.2%2026-03-27Fix
CVE-2026-33205calibre has server-side request forgery in ebook viewer backend4.8CNA v4.00.2%2026-03-27Fix
CVE-2026-33045home-assistant core home Assistant has stored XSS in history-graphs7.3CNA v4.00.2%2026-03-27Fix
CVE-2026-33044home-assistant core home Assistant has stored XSS in Map-card through malicious device name7.3CNA v4.00.3%2026-03-27Fix
CVE-2026-32984wazuh heap buffer overflow in wazuh-authd5.3CNA v4.00.4%2026-03-27
CVE-2026-32983SSL/TLS Renegotiation DoS in Wazuh Manager authd service7.5v3.10.5%2026-03-27Fix
CVE-2026-32859ByteDance DeerFlow stored XSS via Inline Artifact Rendering5.1CNA v4.00.3%2026-03-27
CVE-2026-32695Traefik has Knative Ingress Rule injection that allows Host Restriction Bypass6.3CNA v4.00.5%2026-03-27Fix
CVE-2026-32678BUFFALO Wi-Fi router products authentication bypass8.7CNA v4.00.5%2026-03-27Fix
CVE-2026-32669BUFFALO Wi-Fi router products code injection9.8v3.10.5%2026-03-27Fix
CVE-2026-32241Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection7.5CNA v3.12.4%2026-03-27Fix
CVE-2026-31951LibreChat's MCP server header injection enables OAuth Token Theft6.8CNA v3.10.4%2026-03-27
CVE-2026-31950LibreChat SSE stream subscription insecure direct object reference5.3CNA v3.10.3%2026-03-27Fix
CVE-2026-31945LibreChat server-side request forgery using DNS resolution7.7CNA v3.10.4%2026-03-27Fix
CVE-2026-31943LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP8.5CNA v3.10.3%2026-03-27Fix
CVE-2026-30689anjoy8 Blog.Core incorrect authorization7.5CISA ADP v3.10.3%2026-03-27
CVE-2026-30637OTCMS AnnounContent of the /admin/read.php server-side request forgery7.5CISA ADP v3.10.6%2026-03-27
CVE-2026-30576Senior-walter Web-based Pharmacy Product Management System logic flaw7.5CISA ADP v3.10.4%2026-03-27
CVE-2026-30575Senior-walter Web-based Pharmacy Product Management System improper quantity validation7.5CISA ADP v3.10.5%2026-03-27
CVE-2026-30574Senior-walter Web-based Pharmacy Product Management System improper workflow enforcement7.5CISA ADP v3.10.4%2026-03-27
CVE-2026-30571Ahsanriaz26gmailcom Inventory System SourceCodester Sales and reflected cross-site scripting6.1v3.10.3%2026-03-27
CVE-2026-30570Ahsanriaz26gmailcom Inventory System SourceCodester Sales and reflected cross-site scripting6.1v3.10.3%2026-03-27
CVE-2026-30569Ahsanriaz26gmailcom Inventory System SourceCodester Sales and reflected cross-site scripting6.1v3.10.3%2026-03-27
CVE-2026-30568Ahsanriaz26gmailcom Inventory System SourceCodester Sales and reflected cross-site scripting4.8CISA ADP v3.10.3%2026-03-27
CVE-2026-30567Ahsanriaz26gmailcom Inventory System SourceCodester Sales and reflected cross-site scripting6.1v3.10.3%2026-03-27
CVE-2026-30534oretnom23 Online Food Ordering System SourceCodester SQL injection8.3CISA ADP v3.10.4%2026-03-27
CVE-2026-30533oretnom23 Online Food Ordering System SourceCodester SQL injection9.8CISA ADP v3.10.5%2026-03-27
CVE-2026-30532oretnom23 Online Food Ordering System SourceCodester SQL injection9.8CISA ADP v3.10.5%2026-03-27
CVE-2026-30531oretnom23 Online Food Ordering System SourceCodester SQL injection8.8CISA ADP v3.10.5%2026-03-27
CVE-2026-30530oretnom23 Online Food Ordering System SourceCodester SQL injection9.8CISA ADP v3.10.5%2026-03-27
CVE-2026-30529oretnom23 Online Food Ordering System SourceCodester SQL injection8.8CISA ADP v3.10.5%2026-03-27
CVE-2026-30527oretnom23 Online Food Ordering System SourceCodester stored cross-site scripting5.4v3.10.2%2026-03-27
CVE-2026-30304Tianguaduizhang AI Code prompt injection9.6CISA ADP v3.10.7%2026-03-27
CVE-2026-30303Matterai Axon Code OS command injection9.8CISA ADP v3.12.4%2026-03-27
CVE-2026-30302Coderider-kilo Coderider OS command injection10.0CISA ADP v3.12.1%2026-03-27
CVE-2026-29871Theunwindai Awesome LLM Apps path traversal7.5CISA ADP v3.10.7%2026-03-27
CVE-2026-29180Fleet's team maintainer can transfer hosts from any team via missing source team authorization4.9CNA v4.00.4%2026-03-27Fix
CVE-2026-29071open-webui open WebUI's insecure direct object reference allows access to other users' memories3.1CNA v3.10.3%2026-03-27Fix
CVE-2026-29070open-webui open WebUI has unauthorized deletion of knowledge files5.4CNA v3.10.4%2026-03-27Fix
CVE-2026-28788Open WebUI file batch processing endpoint insecure direct object reference7.1CNA v3.10.4%2026-03-27Fix
CVE-2026-28786open-webui open WebUI vulnerable to path traversal in `POST /API/v1/audio/transcriptions`4.3CNA v3.10.4%2026-03-27Fix
CVE-2026-28375Grafana Testdata datasource can issue unbounded memory allocations6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-28369Red Hat JBoss Enterprise Application Platform HTTP request smuggling8.7CNA v3.10.9%2026-03-27Fix
CVE-2026-28368Red Hat JBoss Enterprise Application Platform HTTP request smuggling8.7CNA v3.10.9%2026-03-27Fix
CVE-2026-28367Red Hat JBoss Enterprise Application Platform HTTP request smuggling8.7CNA v3.10.9%2026-03-27Fix
CVE-2026-27880Grafana OpenFeature evaluation API reads input data with no bounds7.5CNA v3.10.6%2026-03-27Fix
CVE-2026-27879Grafana query resampling can cause unbounded memory allocations6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-27877Grafana public dashboards discloses all direct mode datasources6.5CNA v3.10.4%2026-03-27Fix
CVE-2026-27876RCE on Grafana via sqlExpressions9.1CNA v3.11.4%2026-03-27Exploit codeFix
CVE-2026-27860Open-Xchange OX Dovecot Pro LDAP injection3.7CNA v3.10.3%2026-03-27Fix
CVE-2026-27859Open-Xchange OX Dovecot Pro resource exhaustion5.3CNA v3.10.4%2026-03-27Fix
CVE-2026-27858Open-Xchange OX Dovecot Pro resource exhaustion7.5CNA v3.11.0%2026-03-27Fix
CVE-2026-27857Open-Xchange OX Dovecot Pro resource exhaustion4.3CNA v3.10.8%2026-03-27Fix
CVE-2026-27856Open-Xchange OX Dovecot Pro improper authentication7.4CNA v3.10.4%2026-03-27Fix
CVE-2026-27855Open-Xchange OX Dovecot Pro authentication bypass by replay6.8CNA v3.10.4%2026-03-27Fix
CVE-2026-27650BUFFALO Wi-Fi router products OS command injection9.8v3.11.4%2026-03-27Fix
CVE-2026-27309Adobe Substance3D Stager use-after-free7.8CNA v3.10.4%2026-03-27Fix
CVE-2026-26061Fleet's unbounded request body read allows remote denial of service8.7CNA v4.00.5%2026-03-27Fix
CVE-2026-26060Fleet: Password reset tokens remain valid after password change for 24 hours6.0CNA v4.00.5%2026-03-27Fix
CVE-2026-25101Session fixation in Bludit9.8v3.10.4%2026-03-27Fix
CVE-2026-25100Stored XSS via SVG file upload in Bludit5.4v3.10.2%2026-03-27Fix
CVE-2026-25099Remote code execution via unrestricted file upload in Bludit8.8v3.11.9%2026-03-27Exploit codeFix
CVE-2026-24031Open-Xchange OX Dovecot Pro SQL injection7.7CNA v3.10.4%2026-03-27Exploit codeFix
CVE-2026-22744Spring AI Redis Store has TAG Field Query injection7.5CNA v3.10.3%2026-03-27Fix
CVE-2026-22743Spring AI server-side request forgery via Filter Expression Keys in Neo4jVectorStore7.5CNA v3.10.3%2026-03-27Fix
CVE-2026-22742Spring AI server-side request forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching8.6CNA v3.10.4%2026-03-27Fix
CVE-2026-22738Spring AI SpEL injection9.8CNA v3.11.1%2026-03-27Exploit codeFix
CVE-2026-5027Langflow path traversal arbitrary file write via upload_user_file8.8CNA v3.14.8%2026-03-27NucleiEmerging ThreatsExploit code
CVE-2026-5026Langflow stored XSS via Malicious SVG upload5.4NVD v3.10.3%2026-03-27
CVE-2026-5025Langflow Application Logs Exposed to All Authenticated Users6.5CNA v3.10.4%2026-03-27
CVE-2026-5022Langflow missing authorization on download_image endpoint5.3NVD v3.10.3%2026-03-27
CVE-2026-5010Reflected cross-site scripting (XSS) in Sanoma’s Clickedu5.1CNA v4.00.4%2026-03-27Fix
CVE-2026-4992wandb OpenUI HTMLAnnotator server.py get_share HTML injection5.3CNA v4.00.4%2026-03-27
CVE-2026-4991QDOCS Smart School Management System Admission Enquiry enquiry cross-site scripting5.1CNA v4.00.3%2026-03-27
CVE-2026-4990chatwoot Signup endpoint login improper authorization6.9CNA v4.00.5%2026-03-27
CVE-2026-4988Open5GS CCA message smf_s6b denial of service5.9v3.10.7%2026-03-27
CVE-2026-4985dloebl CGIF GIF Image cgif.c cgif_addframe integer overflow5.3CNA v4.00.6%2026-03-27Fix
CVE-2026-4984Botpress credential disclosure via Twilio Webhook handler8.2CNA v3.10.2%2026-03-27
CVE-2026-4982pretix Venueless unauthorized access to chat contents7.3CNA v4.00.4%2026-03-27Fix
CVE-2026-4980Improper restriction of XML external entity reference in Inkscape6.3CNA v3.10.2%2026-03-27Fix
CVE-2026-4976Totolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflow8.7CNA v4.01.0%2026-03-27
CVE-2026-4975Tenda AC15 POST request setcfm formSetCfm memory corruption8.7CNA v4.01.0%2026-03-27
CVE-2026-4974Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption8.7CNA v4.01.0%2026-03-27
CVE-2026-4973SourceCodester Online Quiz System add-question.php cross-site scripting5.1CNA v4.00.3%2026-03-27
CVE-2026-4972code-projects Online Reviewer System btn_functions.php cross-site scripting4.8CNA v4.00.4%2026-03-27
CVE-2026-4971SourceCodester Note Taking App cross-site request forgery5.3CNA v4.00.2%2026-03-27
CVE-2026-4970code-projects Social Networking Site endpoint delete_photos.php SQL injection5.3CNA v4.00.3%2026-03-27
CVE-2026-4969code-projects Social Networking Site Alert home.php cross-site scripting5.1CNA v4.00.3%2026-03-27
CVE-2026-4968SourceCodester Diary App diary.php cross-site request forgery5.3CNA v4.00.2%2026-03-27
CVE-2026-4966itsourcecode Free Hotel Reservation System index.php SQL injection5.3CNA v4.00.3%2026-03-27
CVE-2026-4965letta-ai Letta Incomplete Fix ast_parsers.py resolve_type eval injection9.8v3.10.8%2026-03-27
CVE-2026-4964Letta File URL handler server-side request forgery6.5v3.10.4%2026-03-27
CVE-2026-4963huggingface smolagents Incomplete Fix local_python_executor.py evaluate_with code injection10.0v3.10.7%2026-03-27
CVE-2026-4962UltraVNC service version.dll uncontrolled search path7.3CNA v4.00.2%2026-03-27
CVE-2026-4961Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow8.7CNA v4.01.0%2026-03-27
CVE-2026-4960Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow8.7CNA v4.01.0%2026-03-27
CVE-2026-4959OpenBMB XAgent ShareServer WebSocket endpoint share.py check_user missing authentication7.5v3.10.8%2026-03-27
CVE-2026-4958OpenBMB XAgent WebSocket endpoint replayer.py ReplayServer.send_data authorization6.5v3.10.5%2026-03-27
CVE-2026-4957OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file5.1CNA v4.00.5%2026-03-27
CVE-2026-4956Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do SQL injection6.9CNA v4.00.4%2026-03-27
CVE-2026-4955Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do SQL injection6.9CNA v4.00.4%2026-03-27
CVE-2026-4954MingSoft MCMS Web Content List Endpoint ContentAction.java list SQL injection5.3CNA v4.00.3%2026-03-27
CVE-2026-4953MingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery6.9CNA v4.00.5%2026-03-27
CVE-2026-4948A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leadi5.5CNA v3.10.2%2026-03-27Fix
CVE-2026-4910Shenzhen Ruiming Technology Streamax Crocus Endpoint RemoteFormat.do SQL injection6.9CNA v4.00.4%2026-03-27
CVE-2026-4909code-projects Exam Form Submission update_s7.php cross-site scripting4.8CNA v4.00.4%2026-03-27
CVE-2026-4908code-projects Simple Laundry System parameter modstaffinfo.php SQL injection9.8v3.10.6%2026-03-27
CVE-2026-4907Page-Replica Page Replica endpoint sitemap sitemap.fetch server-side request forgery5.3CNA v4.00.3%2026-03-27
CVE-2026-4906Tenda AC5 POST Request WizardHandle decodePwd stack-based overflow8.7CNA v4.01.0%2026-03-27
CVE-2026-4905Tenda AC5 POST Request WifiWpsOOB formWifiWpsOOB stack-based overflow8.7CNA v4.01.0%2026-03-27
CVE-2026-4904Tenda AC5 POST request setcfm formSetCfm stack-based overflow8.7CNA v4.01.0%2026-03-27
CVE-2026-4622NEC Platforms Aterm WG2600HS OS command injection7.1CNA v4.01.2%2026-03-27Fix
CVE-2026-4621NEC Platforms Aterm W1200EX(-MS) hidden functionality6.3CNA v4.00.3%2026-03-27Fix
CVE-2026-4620NEC Platforms Aterm WX1500HP OS command injection7.1CNA v4.01.2%2026-03-27Fix
CVE-2026-4619NEC Platforms Aterm WX3600HP path traversal6.0CNA v4.00.5%2026-03-27Fix
CVE-2026-4309NEC Platforms Aterm W1200EX(-MS) missing authorization6.3CNA v4.00.2%2026-03-27Fix
CVE-2026-4248Ultimate Member WordPress plugin sensitive information exposure to account takeover8.0CNA v3.10.4%2026-03-27Fix
CVE-2026-3457Stored XSS vulnerability in Sentinel ACC7.0CNA v4.00.2%2026-03-27Fix
CVE-2026-3098Smart Slider 3 WordPress plugin authenticated (Subscriber+) arbitrary file read via actionExportAll6.5CNA v3.10.4%2026-03-27Exploit codeFix
CVE-2026-1679zephyrproject-rtos Zephyr net: Eswifi socket send payload length not bounded7.3CNA v3.10.2%2026-03-27
CVE-2026-1496Coverity CLI authentication bypass9.3CNA v4.00.5%2026-03-27Fix
CVE-2026-0394Open-Xchange OX Dovecot Pro path traversal5.3CNA v3.10.4%2026-03-27Fix
CVE-2026-34352TigerVNC incorrect permission assignment9.8v3.10.2%2026-03-26Fix
CVE-2026-34071Stirling-PDF has stored cross-site scripting (XSS) via EML-to-HTML Export5.4CNA v3.10.3%2026-03-26
CVE-2026-34056OpenEMR has a privilege escalation that allows a Low-Level User to View Admin-Only Data7.7CNA v3.10.4%2026-03-26
CVE-2026-34055OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification8.1CNA v3.10.4%2026-03-26Fix
CVE-2026-34053OpenEMR missing authorization in Procedure Order AJAX Deletion handler7.1CNA v3.10.6%2026-03-26Fix
CVE-2026-34051OpenEMR has Improper ACL on Import/Export Popup5.4CNA v3.10.3%2026-03-26Fix
CVE-2026-33942Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)8.1CNA v4.00.9%2026-03-26Fix
CVE-2026-33934OpenEMR show-signature.php missing authorization4.3CNA v3.10.4%2026-03-26Fix
CVE-2026-33933openemr reflected XSS via Unescaped contextName parameter in Custom Template Editor6.1CNA v3.10.9%2026-03-26Fix
CVE-2026-33932OpenEMR has stored XSS in CCDA Preview via Unsanitized linkHtml attributes7.6CNA v3.10.3%2026-03-26Fix
CVE-2026-33931OpenEMR has IDOR in Portal Payment page that allows Cross-Patient Record Access6.5CNA v3.10.5%2026-03-26Fix
CVE-2026-33918OpenEMR missing authorization on Claim File Download endpoint7.6CNA v3.10.5%2026-03-26Fix
CVE-2026-33917OpenEMR has SQL injection in CAMOS form8.8CNA v3.10.6%2026-03-26Exploit codeFix
CVE-2026-33915OpenEMR Missing ACL Checks on Insurance Company API Routes5.4CNA v3.10.3%2026-03-26Fix
CVE-2026-33914OpenEMR has SQL injection in PostCalendar Category Delete7.2CNA v3.10.5%2026-03-26Fix
CVE-2026-33897Incus vulnerable to arbitrary file read and write through pongo templates10.0CNA v3.10.5%2026-03-26Fix
CVE-2026-33743Incus vulnerable to denial of source through crafted bucket backup file6.5CNA v3.10.4%2026-03-26Fix
CVE-2026-33742Invoice Ninja has stored XSS via Markdown HTML injection in Product Notes5.4CNA v3.10.2%2026-03-26Fix
CVE-2026-33738Lychee vulnerable to stored XSS4.8CNA v4.00.4%2026-03-26Fix
CVE-2026-33732srvx is vulnerable to middleware bypass via absolute URI in request line4.8CNA v3.10.4%2026-03-26Fix
CVE-2026-33711Incus vulnerable to local privilege escalation through VM screenshot path4.7CNA v4.00.2%2026-03-26Fix
CVE-2026-33687Sharp has unrestricted file upload via Client-Controlled Validation Rules8.8CNA v3.10.7%2026-03-26Fix
CVE-2026-33686Sharp is vulnerable to path traversal via Unsanitized extension in FileUtil8.8CNA v3.10.6%2026-03-26Fix
CVE-2026-33682Streamlit on Windows has unauthenticated SSRF vulnerability (NTLM credential exposure)4.7CNA v3.10.4%2026-03-26Fix
CVE-2026-33674PrestaShop: Improper Use of Validation Framework2.0CNA v3.10.3%2026-03-26Fix
CVE-2026-33673PrestaShop has multiple stored XSS vulnerabilities via unprotected template variables7.7CNA v3.10.4%2026-03-26Fix
CVE-2026-33672Picomatch: Method injection in POSIX Character Classes causes incorrect Glob Matching5.3CNA v3.10.5%2026-03-26Fix
CVE-2026-33671Picomatch has a ReDoS vulnerability via extglob quantifiers7.5CNA v3.10.5%2026-03-26Exploit codeFix
CVE-2026-33670SiYuan has directory traversal within its publishing service9.8CNA v3.10.6%2026-03-26Fix
CVE-2026-33669SiYuan has arbitrary Document Reading within the Publishing service9.8CNA v3.10.5%2026-03-26Fix
CVE-2026-33664Kestra vulnerable to stored cross-site scripting via Flow YAML fields7.3CNA v3.10.3%2026-03-26
CVE-2026-33661WeChat Pay callback signature verification bypassed when host header is localhost8.6CNA v3.10.7%2026-03-26Fix
CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests2.3CNA v4.00.6%2026-03-26Fix
CVE-2026-33653Uploady vulnerable to stored cross-site scripting (XSS)4.6CNA v3.10.3%2026-03-26Fix
CVE-2026-33645Fireshare has path traversal arbitrary file write in `/API/uploadChunked`7.1CNA v3.10.5%2026-03-26Fix
CVE-2026-33644Lychee has SSRF bypass2.3CNA v4.00.3%2026-03-26Fix
CVE-2026-33640Outline has a rate limit bypass that allows brute force of email login OTP9.1CNA v4.00.5%2026-03-26Fix
CVE-2026-33638Ech0 authenticated user-list exposed data via public `/API/allusers` endpoint5.3CNA v3.10.6%2026-03-26Fix
CVE-2026-33636LIBPNG has ARM NEON Palette Expansion out-of-bounds read on AArch647.6CNA v3.10.4%2026-03-26Fix
CVE-2026-33635iCalendar has ICS injection via unsanitized URI property values4.3CNA v3.10.4%2026-03-26Fix
CVE-2026-33632ClearanceKit: Opfilter policy bypass via exchangedata and clone operations8.4CNA v4.00.1%2026-03-26Fix
CVE-2026-33631ClearanceKit: Opfilter policy bypass via non-open file operations8.7CNA v3.10.1%2026-03-26Fix
CVE-2026-33628Invoice Ninja Denylist Bypass may lead to stored XSS via Invoice Line Items5.4CNA v3.10.3%2026-03-26Fix
CVE-2026-33623PinchTab: OS command injection6.7CNA v3.13.4%2026-03-26Fix
CVE-2026-33622A PinchTab Security Policy Bypass in /wait allows arbitrary JavaScript Execution6.1CNA v4.00.8%2026-03-26
CVE-2026-33621PinchTab: Unapplied Rate Limiting Middleware allows Unbounded brute-force of API Token4.8CNA v3.10.4%2026-03-26Fix
CVE-2026-33620PinchTab: API Bearer Token Exposed in URL Query parameter via Server Logs and Intermediary Systems4.3CNA v3.10.4%2026-03-26Fix
CVE-2026-33619PinchTab has unauthenticated blind SSRF in Task Scheduler via Unvalidated callbackUrl4.1CNA v3.10.4%2026-03-26Fix
CVE-2026-33545MobSF has SQL injection in its SQLite Database Viewer Utils5.3CNA v3.10.4%2026-03-26Fix
CVE-2026-33542Incus does not verify combined fingerprint when downloading images from simplestreams servers5.7CNA v4.00.2%2026-03-26Fix
CVE-2026-33541WikiTide TSPortal user validation logic resource exhaustion6.5CNA v3.10.4%2026-03-26Fix
CVE-2026-33537Lychee has SSRF bypass5.3CNA v4.00.3%2026-03-26Fix
CVE-2026-33536ImageMagick has an out-of-bounds write via InterpretImageFilename5.1CNA v3.10.1%2026-03-26Fix
CVE-2026-33535ImageMagick has an out-of-bounds write of a zero byte in its X11 display interaction4.0CNA v3.10.1%2026-03-26Fix
CVE-2026-33532yaml is vulnerable to stack overflow via deeply nested YAML collections4.3CNA v3.10.5%2026-03-26Fix
CVE-2026-33531InvenTree has path traversal in Report templates4.9CNA v4.00.4%2026-03-26Exploit codeFix
CVE-2026-33530InvenTree vulnerable to ORM Filter injection7.7CNA v3.10.2%2026-03-26Fix
CVE-2026-33529Zoraxy: Authenticated path traversal in Config Import leads to RCE3.3CNA v3.10.5%2026-03-26Fix
CVE-2026-33528GoDoxy has a path traversal vulnerability in its File API6.5CNA v3.10.5%2026-03-26Fix
CVE-2026-33526Squid vulnerable to denial of service in ICP request handling9.2CNA v4.08.9%2026-03-26Fix
CVE-2026-33525Authelia login page template cross-site scripting0.5CNA v4.00.3%2026-03-26Fix
CVE-2026-33515Squid has issues in ICP message handling6.9CNA v4.02.2%2026-03-26Fix
CVE-2026-33506DOM-based XSS in Ory Polis Login page8.8CNA v3.10.4%2026-03-26Fix
CVE-2026-33505Ory Keto has a SQL injection via forged pagination tokens7.2CNA v3.10.3%2026-03-26Fix
CVE-2026-33504Ory Hydra has a SQL injection via forged pagination tokens7.2CNA v3.10.4%2026-03-26Fix
CVE-2026-33503Ory Kratos has a SQL injection via forged pagination tokens7.2CNA v3.10.3%2026-03-26Fix
CVE-2026-33496Ory Oathkeeper has an authentication bypass by cache key confusion8.1CNA v3.10.5%2026-03-26Fix
CVE-2026-33495Ory Oathkeeper has an authentication bypass by usage of untrusted header6.5CNA v3.10.3%2026-03-26Fix
CVE-2026-33494Ory Oathkeeper has a path traversal authorization bypass10.0CNA v3.10.6%2026-03-26Fix
CVE-2026-33491zenc-lang zenc Zen-C has stack-based buffer overflow in Identifier Mangling7.8CNA v3.10.2%2026-03-26Fix
CVE-2026-33490h3js H3 mount path prefix matching vulnerability3.7CNA v3.10.3%2026-03-26Fix
CVE-2026-33487goxmldsig has validateSignature Loop Variable Capture Signature Bypass7.5CNA v3.10.4%2026-03-26Fix
CVE-2026-33486Roadiz has server-side request forgery (SSRF) in roadiz/documents6.8CNA v3.10.4%2026-03-26Fix
CVE-2026-33481Syft improper temporary file cleanup5.3CNA v3.10.5%2026-03-26Fix
CVE-2026-33477FileRise file snippet endpoint incorrect authorization4.3CNA v3.10.3%2026-03-26Fix
CVE-2026-33470Frigate camera snapshot endpoint missing authorization6.5CNA v3.10.3%2026-03-26
CVE-2026-33469Authenticated Frigate users can read the full unredacted configuration via `/API/config/raw6.5CNA v3.10.4%2026-03-26
CVE-2026-33468Kysely has a MySQL SQL injection8.1CNA v3.10.4%2026-03-26Fix
CVE-2026-33442Kysely has a MySQL SQL injection8.1CNA v3.10.4%2026-03-26Fix
CVE-2026-33438Stirling-PDF vulnerable to DoS via add-watermark6.5CNA v3.10.4%2026-03-26Fix
CVE-2026-33430Briefcase: Windows MSI Installer privilege escalation via Insecure Directory Permissions7.3CNA v3.10.1%2026-03-26Fix
CVE-2026-33416LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`7.5CNA v3.11.1%2026-03-26Fix
CVE-2026-33413Etcd: Authorization bypasses in multiple APIs8.8CNA v4.00.3%2026-03-26Fix
CVE-2026-33402SAK-52311: Sakai site-manage group titles can contain XSS content1.3CNA v4.00.3%2026-03-26Fix
CVE-2026-33397Angular SSR vulnerable to Protocol-Relative URL injection via Single Backslash Bypass6.9CNA v4.00.3%2026-03-26Fix
CVE-2026-33396HackerBay OneUptime synthetic monitor sandbox sandbox escape10.0CNA v3.10.8%2026-03-26Fix
CVE-2026-33375Grafana MSSQL Data Source Plugin: Restriction Bypass leading to OOM DoS6.5CNA v3.10.5%2026-03-26Fix
CVE-2026-33343Etcd: Nested Etcd transactions bypass RBAC authorization checks0.0CNA v3.10.3%2026-03-26Fix
CVE-2026-33287LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern7.5CNA v3.10.5%2026-03-26Fix
CVE-2026-33285LiquidJS: MemoryLimit Bypass through Negative Range Values leads to Process crash7.5CNA v3.10.6%2026-03-26Fix
CVE-2026-33201GREEN HOUSE Digital Photo Frame GH-WDF10A active debug code7.0CNA v4.00.3%2026-03-26
CVE-2026-33183Saloon has a Fixture Name path traversal8.0CNA v4.00.7%2026-03-26Fix
CVE-2026-33182Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL6.6CNA v4.00.5%2026-03-26Fix
CVE-2026-33153Tandoor Recipes recipe API debug parameter information disclosure7.7CNA v4.00.5%2026-03-26Fix
CVE-2026-33152Tandoor Recipes vulnerable to Unrestricted brute-force via BasicAuthentication9.1CNA v3.10.5%2026-03-26Fix
CVE-2026-33149Tandoor Recipes vulnerable to host header injection8.1CNA v3.10.4%2026-03-26
CVE-2026-33148Tandoor Recipes FDC food search API injection6.5CNA v3.10.5%2026-03-26Fix
CVE-2026-33015EVerest has RemoteStop Bypass via BCB Toggle Session Restart5.2CNA v3.10.2%2026-03-26Fix
CVE-2026-33014EVerest has Delayed Authorization Response Bypasses Termination after RemoteStop5.2CNA v3.10.2%2026-03-26Fix
CVE-2026-33009EVerest: MQTT Switch-Phases command data race causing Charger State Corruptio8.2CNA v3.10.3%2026-03-26Fix
CVE-2026-32857Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation7.8CNA v4.00.5%2026-03-26Fix
CVE-2026-32846OpenClaw Media Parsing path traversal to arbitrary file read7.5NVD v3.10.7%2026-03-26Fix
CVE-2026-32748Squid has denial of service in ICP Response handling8.7CNA v4.08.9%2026-03-26Fix
CVE-2026-32680RATOC RAID Monitoring Manager incorrect default permissions8.5CNA v4.00.2%2026-03-26
CVE-2026-32287Infinite loop in github.com/Antchfx/XPATH7.5CISA ADP v3.10.7%2026-03-26Fix
CVE-2026-32286Denial of service in github.com/jackc/Pgproto3/v27.5CISA ADP v3.10.7%2026-03-26Exploit codeFix
CVE-2026-32285Denial of service in github.com/buger/Jsonparser7.5CISA ADP v3.11.0%2026-03-26Fix
CVE-2026-32284Denial of service in github.com/Shamaton/Msgpack7.5CISA ADP v3.10.7%2026-03-26Fix
CVE-2026-30892Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation0.0CNA v3.10.2%2026-03-26Fix
CVE-2026-30463Thedaylightstudio Fuel CMS SQL injection7.7CISA ADP v3.10.3%2026-03-26
CVE-2026-30458Thedaylightstudio Fuel CMS unverified password change9.1CISA ADP v3.10.4%2026-03-26
CVE-2026-30457Thedaylightstudio Fuel CMS code injection9.8CISA ADP v3.10.8%2026-03-26
CVE-2026-30162Auntvt Timo cross-site scripting6.1CISA ADP v3.10.3%2026-03-26
CVE-2026-29976Zerbea Hcxtools buffer overflow6.2CISA ADP v3.10.2%2026-03-26
CVE-2026-29969Workflowfirst Staffwiki wff_cols_pref.css.aspx endpoint cross-site scripting6.1CISA ADP v3.10.4%2026-03-26
CVE-2026-29934Lightcms /admin/menus component reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-26
CVE-2026-29933YzmCMS /index/login.html component reflected cross-site scripting6.1CISA ADP v3.10.3%2026-03-26
CVE-2026-29905getkirby kirby unchecked return value6.5CISA ADP v3.10.6%2026-03-26
CVE-2026-29055Tandoor Recipes image upload EXIF handling vulnerability5.3CNA v3.10.4%2026-03-26Fix
CVE-2026-29044EVerest: Charging Continues when WithdrawAuthorization is Processed before TransactionStarted5.0CNA v3.10.3%2026-03-26Fix
CVE-2026-28760RATOC RAID Monitoring Manager uncontrolled search path8.4CNA v4.00.2%2026-03-26
CVE-2026-28503Tandoor Recipes SyncViewSet insecure direct object reference5.5CNA v4.00.4%2026-03-26Fix
CVE-2026-28377Grafana Tempo S3 SSE-C Encryption Key Exposed in Plaintext via Config endpoint ( Pattern)7.5CNA v3.10.2%2026-03-26Fix
CVE-2026-28298SolarWinds Observability Self-Hosted stored cross-site scripting5.9CNA v3.10.4%2026-03-26Fix
CVE-2026-28297SolarWinds Observability Self-Hosted stored cross-site scripting6.1CNA v3.10.4%2026-03-26Fix
CVE-2026-27893VLLM's hard-coded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out8.8CNA v3.11.8%2026-03-26Fix
CVE-2026-27828EVerest: ISO15118 session_setup use-after-free can crash EVSE process5.5CNA v4.00.3%2026-03-26Fix
CVE-2026-27816EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state5.5CNA v4.00.3%2026-03-26Fix
CVE-2026-27815EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state5.5CNA v4.00.3%2026-03-26Fix
CVE-2026-27814EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition4.2CNA v3.10.2%2026-03-26Fix
CVE-2026-27813EVerest has use-after-free in auth timeout timer via race condition5.3CNA v3.10.2%2026-03-26Fix
CVE-2026-27664Siemens CPCI85 Central Processing/Communication out-of-bounds write8.7CNA v4.00.5%2026-03-26Fix
CVE-2026-27663Siemens CPCI85 Central Processing/Communication resource exhaustion7.1CNA v4.00.3%2026-03-26Fix
CVE-2026-26213thingino-firmware api.cgi unauthenticated command injection in Captive portal9.8v3.14.1%2026-03-26Fix
CVE-2026-26074EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race7.0CNA v3.10.2%2026-03-26Fix
CVE-2026-26073EVerest: OCPP heap corruption caused by lock-free insertion in event_queue5.9CNA v3.10.4%2026-03-26Fix
CVE-2026-26072EVerest has race-condition-induced std::map corruption in OCPP evse_soc_map4.2CNA v3.10.1%2026-03-26Fix
CVE-2026-26071EVerest: OCPP EVCCID data race leads to Heap Use‑After‑Free4.2CNA v3.10.1%2026-03-26Fix
CVE-2026-26070EVerest: OCPP EV SoC Update Race causes Charge Point crash4.6CNA v3.10.1%2026-03-26Fix
CVE-2026-26008EVerest has OOB via EVSE ID Indexing Mismatch in OCPP UpdateAllowedEnergyTransferModes7.5CNA v3.10.5%2026-03-26Fix
CVE-2026-24068Vienna Symphonic Library Vienna Assistant XPC helper tool missing authentication8.8CISA ADP v3.10.4%2026-03-26
CVE-2026-23995EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ8.4CNA v3.10.2%2026-03-26Fix
CVE-2026-23398Linux kernel ICMP PMTU error handling null pointer dereference5.5NVD v3.10.1%2026-03-26Exploit codeFix
CVE-2026-23397Linux kernel netfilter OS fingerprint matching out-of-bounds read7.1NVD v3.10.1%2026-03-26Fix
CVE-2026-23396Linux kernel mac80211 null pointer dereference5.5NVD v3.10.1%2026-03-26Fix
CVE-2026-22790EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload8.8CNA v3.10.5%2026-03-26Fix
CVE-2026-22593EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing8.4CNA v3.10.1%2026-03-26Fix
CVE-2026-21724Grafana OSS Missing Protected-field Authorization in Provisioning Contact Points API5.4CNA v3.10.3%2026-03-26Fix
CVE-2026-4933Unpublished Node Permissions Critical Access bypass SA-CONTRIB-2026-0297.5CISA ADP v3.10.4%2026-03-26Fix
CVE-2026-4926path-to-regexp vulnerable to denial of service via sequential optional groups7.5CNA v3.10.9%2026-03-26Fix
CVE-2026-4923path-to-regexp vulnerable to regular expression denial of service via multiple wildcards5.9CNA v3.10.4%2026-03-26Fix
CVE-2026-4903Tenda AC5 POST Request QuickIndex formQuickIndex memory corruption8.7CNA v4.01.0%2026-03-26
CVE-2026-4902Tenda AC5 POST request addressNat fromAddressNat memory corruption8.7CNA v4.01.0%2026-03-26
CVE-2026-4900code-projects Online Food Ordering System localhost.sql privilege escalation6.9CNA v4.00.5%2026-03-26
CVE-2026-4899code-projects Online Food Ordering System food.php cross-site scripting4.8CNA v4.00.4%2026-03-26
CVE-2026-4898code-projects Online Food Ordering System contact.php cross-site scripting5.3CNA v4.00.4%2026-03-26
CVE-2026-4897Polkit: Polkit: Denial of service via unbounded input processing through standard input5.5CNA v3.10.2%2026-03-26Fix
CVE-2026-4887Gimp: Gimp:memory disclosure and denial of service via specially crafted pcx image7.1NVD v3.10.5%2026-03-26Fix
CVE-2026-4877itsourcecode Payroll Management System index.php cross-site scripting5.3CNA v4.00.4%2026-03-26
CVE-2026-4876itsourcecode Free Hotel Reservation System index.php SQL injection5.3CNA v4.00.3%2026-03-26
CVE-2026-4875itsourcecode Free Hotel Reservation System index.php unrestricted upload5.1CNA v4.00.4%2026-03-26
CVE-2026-4874Keycloak server-side request forgery via OIDC token endpoint manipulation3.1CNA v3.10.3%2026-03-26Fix
CVE-2026-4867path-to-regexp vulnerable to regular expression denial of service via multiple route parameters7.5CNA v3.10.6%2026-03-26Fix
CVE-2026-4862UTT HiPER 1250GW parameter formConfigDnsFilterGlobal strcpy buffer overflow8.7CNA v4.00.8%2026-03-26
CVE-2026-4861Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow8.7CNA v4.01.1%2026-03-26
CVE-2026-4860wvp-GB28181-pro RedisTemplateConfig deserialization of untrusted data6.9CNA v4.00.5%2026-03-26
CVE-2026-4850code-projects Simple Laundry System parameter checkregisitem.php SQL injection9.8v3.10.6%2026-03-26
CVE-2026-4849code-projects Simple Laundry System parameter modify.php cross-site scripting6.1v3.10.5%2026-03-26
CVE-2026-4848dameng100 muucmf list.html cross-site scripting5.3CNA v4.00.4%2026-03-26
CVE-2026-4847dameng100 muucmf list.html cross-site scripting5.3CNA v4.00.4%2026-03-26
CVE-2026-4846dameng100 muucmf autoReply.html cross-site scripting5.3CNA v4.00.4%2026-03-26
CVE-2026-4845dameng100 muucmf index.html cross-site scripting5.3CNA v4.00.4%2026-03-26
CVE-2026-4844code-projects Online Food Ordering System Admin Login admin.php SQL injection6.9CNA v4.00.4%2026-03-26
CVE-2026-4842itsourcecode Online Enrollment System parameter index.php SQL injection6.9CNA v4.00.4%2026-03-26
CVE-2026-4841code-projects Online Food Ordering System Shopping Cart cart.php SQL injection6.9CNA v4.00.4%2026-03-26
CVE-2026-4840Netcore Power 15AX Diagnostic tool netis.cgi setTools os command injection8.7CNA v4.03.8%2026-03-26
CVE-2026-4839SourceCodester Food Ordering System parameter purchase.php SQL injection6.9CNA v4.00.4%2026-03-26
CVE-2026-4838SourceCodester Malawi Online Market display.php SQL injection6.9CNA v4.00.4%2026-03-26
CVE-2026-4836code-projects Accounting System delete.php SQL injection5.3CNA v4.00.3%2026-03-26
CVE-2026-4835code-projects Accounting System Web application add_costumer.php cross-site scripting5.1CNA v4.00.3%2026-03-26
CVE-2026-4833Orc discount Markdown markdown.c compile recursion4.8CNA v4.00.2%2026-03-26Fix
CVE-2026-4831kalcaddle kodbox Password-protected Share auth.class.php can improper authentication6.3CNA v4.00.6%2026-03-26
CVE-2026-4830kalcaddle kodbox Public Share userShare.class.php add privilege escalation6.3CNA v4.00.4%2026-03-26
CVE-2026-4826SourceCodester Sales and Inventory System HTTP GET parameter update_stock.php SQL injection8.8v3.10.5%2026-03-26
CVE-2026-4809Unsafe Client MIME Type Handling can Enable arbitrary file upload in plank/laravel-mediable9.3CNA v4.01.1%2026-03-26
CVE-2026-4758WP Job Portal WordPress plugin arbitrary file deletion8.8CNA v3.11.0%2026-03-26Fix
CVE-2026-4747FreeBSD remote code execution via RPCSEC_GSS packet validation8.8CISA ADP v3.11.1%2026-03-26Exploit codeFix
CVE-2026-4652FreeBSD remote denial of service via null pointer dereference7.5CISA ADP v3.10.5%2026-03-26Fix
CVE-2026-4484Masteriyo LMS WordPress plugin privilege escalation8.8CNA v3.10.5%2026-03-26Exploit codeFix
CVE-2026-4393Automated Logout Moderately critical cross-site request forgery SA-CONTRIB-2026-0304.3CISA ADP v3.10.2%2026-03-26Fix
CVE-2026-4389DSGVO snippet for Leaflet Map and its Extensions WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-26Fix
CVE-2026-4346TP-Link TL-WR850N serial interface cleartext storage of sensitive information5.1CNA v4.00.2%2026-03-26Fix
CVE-2026-4335ShortPixel Image Optimizer WordPress plugin stored cross-site scripting5.4CNA v3.10.3%2026-03-26Fix
CVE-2026-4331pr-gateway Blog2Social: Social Media Auto Post and Scheduler missing authorization4.3CNA v3.10.4%2026-03-26Fix
CVE-2026-4329Blackhole for Bad Bots WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-03-26Fix
CVE-2026-4281FormLift for Infusionsoft Web Forms WordPress plugin missing authorization5.3CNA v3.10.6%2026-03-26Fix
CVE-2026-4278Simple Download Counter WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-26Fix
CVE-2026-4274Mattermost has an incorrect authorization issue5.4CNA v3.10.2%2026-03-26Fix
CVE-2026-4263Incorrect authorization in HiJiffy Chatbot6.9CNA v4.00.4%2026-03-26
CVE-2026-4262Incorrect authorization in HiJiffy Chatbot6.9CNA v4.00.4%2026-03-26
CVE-2026-4247FreeBSD TCP: Remotely exploitable DoS vector (mbuf leak)7.5CISA ADP v3.11.4%2026-03-26Fix
CVE-2026-4075BWL Advanced FAQ Manager Lite WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-26Fix
CVE-2026-3650Grassroots DICOM missing release of memory after effective lifetime8.7CNA v4.00.6%2026-03-26Fix
CVE-2026-3622Denial of service vulnerability in UPnP component of TP Link's TL-WR841N7.1CNA v4.00.7%2026-03-26Fix
CVE-2026-3573AI (Artificial Intelligence) Moderately critical information disclosure SA-CONTRIB-2026-0287.5CISA ADP v3.10.4%2026-03-26Fix
CVE-2026-3532OpenID Connect / OAuth client Less critical Access bypass SA-CONTRIB-2026-0274.2v3.10.1%2026-03-26Fix
CVE-2026-3531OpenID Connect / OAuth client Moderately critical Access bypass SA-CONTRIB-2026-0266.5CISA ADP v3.10.4%2026-03-26Fix
CVE-2026-3530Drupal OpenID Connect / OAuth client server-side request forgery4.3CISA ADP v3.10.3%2026-03-26Fix
CVE-2026-3529Google Analytics GA4 Moderately critical cross-site scripting SA-CONTRIB-2026-0246.1CISA ADP v3.10.3%2026-03-26Fix
CVE-2026-3528Calculation Fields Moderately critical cross-site scripting SA-CONTRIB-2026-0236.1CISA ADP v3.10.3%2026-03-26Fix
CVE-2026-3527AJAX Dashboard Critical Access bypass SA-CONTRIB-2026-0226.5CISA ADP v3.10.3%2026-03-26Fix
CVE-2026-3526File Access Fix (deprecated) Moderately critical Access bypass SA-CONTRIB-2026-0215.3CISA ADP v3.10.3%2026-03-26Fix
CVE-2026-3525File Access Fix (deprecated) Moderately critical Access bypass SA-CONTRIB-2026-0205.3CISA ADP v3.10.3%2026-03-26Fix
CVE-2026-3328Frontend Admin by DynamiApps WordPress plugin PHP object injection7.2CNA v3.11.0%2026-03-26Fix
CVE-2026-3190Keycloak: Keycloak: Information disclosure via improper role enforcement in uma protection API4.3CNA v3.10.3%2026-03-26Fix
CVE-2026-3121Keycloak: Org.keycloak/keycloak-services: Keycloak: Privilege escalation6.5CNA v3.10.5%2026-03-26Fix
CVE-2026-3116Mattermost improper input validation in Zoom Plugin Webhook handler4.9CNA v3.10.4%2026-03-26Fix
CVE-2026-3115Mattermost guest users can view group member IDs without respecting view restrictions4.3CNA v3.10.3%2026-03-26Fix
CVE-2026-3114Mattermost zip bomb denial of service via Unrestricted Archive Decompression6.5CNA v3.10.4%2026-03-26Fix
CVE-2026-3113Mattermost mmctl export download command doesn’t restrict permissions to created file to file owner5.0CNA v3.10.1%2026-03-26Fix
CVE-2026-3112Mattermost arbitrary file read via Advanced Logging Support Packet6.8CNA v3.10.5%2026-03-26Fix
CVE-2026-3109Mattermost missing timestamp validation in Zoom webhook handler2.2CNA v3.10.3%2026-03-26Fix
CVE-2026-3108Mattermost terminal Escape injection in mmctl Report Posts command8.0CNA v3.10.3%2026-03-26Fix
CVE-2026-2931Amelia Booking WordPress plugin insecure direct object reference to arbitrary user password Change8.8CNA v3.10.5%2026-03-26Fix
CVE-2026-2511JS Help Desk AI-Powered Support and Ticketing System WordPress plugin unauthenticated SQL injection7.5CNA v3.10.3%2026-03-26Fix
CVE-2026-2436Libsoup: Libsoup: Denial of service via use-after-free in soupserver during TLS handshake8.2NVD v3.10.4%2026-03-26Fix
CVE-2026-2389Complianz GDPR/CCPA Cookie Consent WordPress plugin stored cross-site scripting4.9CNA v3.10.2%2026-03-26Fix
CVE-2026-2272Gimp: Gimp: Memory corruption due to integer overflow in ico file handling6.5NVD v3.10.8%2026-03-26Fix
CVE-2026-2271Gimp: Gimp: Denial of service via crafted psp image file5.5NVD v3.10.5%2026-03-26Fix
CVE-2026-2239Gimp: Gimp: Application crash (DoS) via crafted psd file due to heap-buffer-overflow6.5NVD v3.10.5%2026-03-26Fix
CVE-2026-2231Fluent Booking WordPress plugin unauthenticated stored cross-site scripting via Multiple parameters7.2CNA v3.10.3%2026-03-26Fix
CVE-2026-2100P11-kit: Null dereference via c_derivekey with specific null parameters7.5NVD v3.11.3%2026-03-26Fix
CVE-2026-1986FloristPress for Woo WordPress plugin reflected cross-site scripting via noresults parameter6.1CNA v3.10.3%2026-03-26Fix
CVE-2026-1961Red Hat Satellite forman: Foreman: Remote code execution via command injection in websocket proxy8.0CNA v3.11.9%2026-03-26Exploit codeFix
CVE-2026-1890LeadConnector WordPress plugin unauthenticated rest Call5.3CISA ADP v3.10.7%2026-03-26NucleiFix
CVE-2026-1556Information disclosure via file URI overwrite in File (Field) Paths6.9CNA v4.00.4%2026-03-26Fix
CVE-2026-1430WP Lightbox 2 WordPress plugin Admin+ stored XSS4.8CISA ADP v3.10.2%2026-03-26Fix
CVE-2026-1206Elementor Website Builder WordPress plugin incorrect authorization4.3CNA v3.10.3%2026-03-26Fix
CVE-2026-1032Conditional Menus WordPress plugin cross-site request forgery to Menu options update4.3CNA v3.10.2%2026-03-26Fix
CVE-2026-0968Libssh: Libssh: Denial of service due to malformed sftp message3.1NVD v3.10.4%2026-03-26Fix
CVE-2026-0967Libssh: Libssh: Denial of service via inefficient regular expression processing5.5NVD v3.10.2%2026-03-26Fix
CVE-2026-0966Libssh: Libssh: Denial of service via zero-length input in ssh_get_hexa8.2NVD v3.10.6%2026-03-26Fix
CVE-2026-0965Libssh: Libssh: Denial of service via improper configuration file handling3.3CNA v3.00.2%2026-03-26Fix
CVE-2026-0964Libssh: Improper sanitation of paths received from scp servers6.3NVD v3.10.4%2026-03-26Fix
CVE-2026-0748Access bypass in Drupal 7 i18n_node translation UI5.3CNA v4.00.4%2026-03-26
CVE-2026-34085fontconfig off-by-one error7.8v3.10.1%2026-03-25Fix
CVE-2026-33913OpenEMR: XInclude injection in CCDA Import allows Reading arbitrary Server files7.7CNA v3.10.5%2026-03-25Fix
CVE-2026-33912OpenEMR has reflected XSS in ajax_download.php via reportID parameter5.4CNA v3.10.3%2026-03-25Fix
CVE-2026-33911OpenEMR vulnerable to reflected XSS in graphs.php via title parameter5.4CNA v3.10.3%2026-03-25Fix
CVE-2026-33910OpenEMR has a SQL injection vulnerability in patient selection7.2CNA v3.10.6%2026-03-25Exploit codeFix
CVE-2026-33909OpenEMR vulnerable to SQL injection via Unsanitized variables in MedEx Recall/Reminder Processing5.9CNA v3.10.4%2026-03-25Fix
CVE-2026-33809OOM from malicious IFD offset in golang.org/x/image/TIFF5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-33751n8n vulnerable to LDAP Filter injection in LDAP Node6.3CNA v4.00.3%2026-03-25Fix
CVE-2026-33749n8n vulnerable to XSS via Binary Data Inline HTML Rendering6.3CNA v4.00.4%2026-03-25Fix
CVE-2026-33724N8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no6.3CNA v4.00.3%2026-03-25Fix
CVE-2026-33722n8n has External Secrets authorization bypass in Credential Saving7.3CNA v4.00.3%2026-03-25Fix
CVE-2026-33720n8n has authorization bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK6.3CNA v4.00.2%2026-03-25Fix
CVE-2026-33713n8n vulnerable to SQL injection in Data Table Node via orderByColumn Expression8.7CNA v4.00.5%2026-03-25Fix
CVE-2026-33696n8n Vulnerable to prototype pollution in XML and GSuiteAdmin node parameters lead to RCE9.4CNA v4.00.8%2026-03-25Fix
CVE-2026-33665n8n LDAP account linking improper authentication8.8CNA v4.00.4%2026-03-25Fix
CVE-2026-33663n8n credential permission checker insecure direct object reference8.5CNA v4.00.5%2026-03-25Fix
CVE-2026-33660n8n has multiple remote code execution vulnerabilities in Merge Node AlaSQL SQL Mode9.4CNA v4.00.9%2026-03-25Fix
CVE-2026-33348OpenEMR has stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC38.7CNA v3.11.0%2026-03-25Fix
CVE-2026-33268Nanoleaf Lines unauthenticated firmware file store6.9CNA v4.00.6%2026-03-25Fix
CVE-2026-33253SANYO DENKI SANUPS SOFTWARE unquoted search path8.4CNA v4.00.2%2026-03-25
CVE-2026-33249nats-io nats-server NATS: Message tracing can be redirected to arbitrary subject4.3CNA v3.10.3%2026-03-25Fix
CVE-2026-33248nats-io nats-server NATS has mTLS verify_and_map authentication bypass4.2CNA v3.10.2%2026-03-25Fix
CVE-2026-33247nats-io nats-server NATS credentials are exposed in monitoring port via command-line argv7.4CNA v3.10.5%2026-03-25Fix
CVE-2026-33246nats-io nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers6.4CNA v3.10.2%2026-03-25Fix
CVE-2026-33223NATS Server request header stripping vulnerability6.4CNA v3.10.2%2026-03-25Fix
CVE-2026-33222nats-io nats-server NATS JetStream has an authorization bypass through its Management API4.9CNA v3.10.3%2026-03-25Fix
CVE-2026-33219nats-io nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service5.3CNA v3.11.0%2026-03-25Fix
CVE-2026-33218nats-io nats-server NATS has pre-auth server panic via leafnode handling7.5CNA v3.10.8%2026-03-25Fix
CVE-2026-33217nats-io nats-server NATS allows MQTT clients to bypass ACL checks7.1CNA v3.10.4%2026-03-25Fix
CVE-2026-33216nats-io nats-server NATS has MQTT plaintext password disclosure8.6CNA v3.10.6%2026-03-25Fix
CVE-2026-32573Nelio AB Testing WordPress plugin remote code execution (RCE)9.1CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32567YML for Yandex Market WordPress plugin arbitrary file deletion6.8CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32562PPWP WordPress plugin broken access control5.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32546StellarWP Restrict Content missing authorization7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32545Taboola Pixel WordPress plugin reflected cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32544OOPSpam Anti-Spam WordPress plugin cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32542Fusion Builder WordPress plugin reflected cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32541Premmerce Redirect Manager WordPress plugin broken access control6.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32540Bookly WordPress plugin reflected cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32539PublishPress Revisions WordPress plugin SQL injection9.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32538SMTP Mailer WordPress plugin sensitive data exposure7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32537Visual Portfolio, Photo Gallery and Post Grid WordPress plugin local file inclusion7.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32536Green Downloads WordPress plugin arbitrary file upload9.9CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32535JS Help Desk WordPress plugin insecure direct object references (IDOR)6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32534JS Help Desk WordPress plugin SQL injection8.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32533LatePoint WordPress plugin insecure direct object references (IDOR)6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32532Contact Form and Lead Form Elementor Builder WordPress plugin cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32531Kunco WordPress theme local file inclusion8.1CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-32530Creator LMS WordPress plugin privilege escalation8.8CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32529Molla WordPress theme reflected cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32528Riode Multi-Purpose WooCommerce WordPress theme reflected cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32527CRM Perks WP Insightly for Contact Form 7 missing authorization6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32526Abandoned Cart Recovery for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32525JetFormBuilder WordPress plugin remote code execution (RCE)9.9CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32524Photo Engine WordPress plugin arbitrary file upload9.1CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32523WPJAM Basic WordPress plugin arbitrary file upload9.9CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32522WooCommerce Support Ticket System WordPress plugin arbitrary file deletion8.6CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32521WP Custom Admin Interface WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32520RewardsWP WordPress plugin privilege escalation9.8CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32519Bit SMTP WordPress plugin broken authentication9.0CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32518Gaea WordPress theme reflected cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32517Contact Manager WordPress plugin reflected cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32516Miraculous Core WordPress plugin SQL injection8.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32515Miraculous WordPress theme broken access control7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32514Petitioner WordPress plugin broken access control6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32513JS Archive List WordPress plugin PHP object injection8.8CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32512Pelicula WordPress theme PHP object injection9.8CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-32511Stål WordPress theme arbitrary object Instantiation vulnerability5.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32510Kamperen WordPress theme arbitrary object Instantiation vulnerability5.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32509Gracey WordPress theme arbitrary object Instantiation vulnerability5.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32508Halstein WordPress theme arbitrary object Instantiation vulnerability5.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32507Leroux WordPress theme arbitrary object Instantiation vulnerability5.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32506Archicon WordPress theme arbitrary object Instantiation vulnerability5.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32505Kiddy WordPress theme local file inclusion8.1CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-32504VintWood WordPress theme local file inclusion8.1CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-32503Trendustry WordPress theme local file inclusion8.1CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-32502Borgholm WordPress theme PHP object injection9.8CISA ADP v3.10.6%2026-03-25Fix