CVE-2026 list

CVE-2026 records published in March 2026

Page two of six: records 1,001 to 2,000 of the 5,228 published in March 2026, newest first. The first page carries the figures for March 2026.

CVE-2026 records published in March 2026, newest first: records 1,001 to 2,000 of 5,228
CVE Summary CVSS EPSS Published Signals
CVE-2026-32501WP Configurator Pro WordPress plugin broken access control7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32500MetaMax WordPress theme local file inclusion8.1CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-32499ChatBot WordPress plugin SQL injection9.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32498RegistrationMagic WordPress plugin broken access control7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32497User Verification WordPress plugin email verification bypass vulnerability5.3CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32496Spam Protect for Contact Form 7 WordPress plugin arbitrary file deletion6.7CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32495WP Terms Popup WordPress plugin broken access control7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32494Image Slider by Ays WordPress plugin cross-site scripting (XSS)7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32493JobSearch WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-25Fix
CVE-2026-32492My Tickets WordPress plugin bypass vulnerability vulnerability5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32491WP Review Slider WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32490WP TripAdvisor Review Slider WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-32489B Blocks WordPress plugin broken access control6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32488User Registration WordPress plugin privilege escalation8.1CISA ADP v3.10.4%2026-03-25Exploit codeFix
CVE-2026-32485WP User Frontend WordPress plugin broken access control7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32484weForms WordPress plugin PHP object injection8.8CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32483Contact Form Email WordPress plugin broken access control6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-32482Ona WordPress theme arbitrary file upload9.9CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-32441Comments Import and Export WordPress plugin broken access control7.7CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-32326Sharp home 5G HR01 missing authentication6.9CNA v4.00.3%2026-03-25
CVE-2026-32120OpenEMR has IDOR in Fee Sheet Product Save6.5CNA v3.10.4%2026-03-25Fix
CVE-2026-31921Product Rearrange for WooCommerce WordPress plugin broken access control8.2CISA ADP v3.10.4%2026-03-25
CVE-2026-31920Product Rearrange for WooCommerce WordPress plugin SQL injection9.3CISA ADP v3.10.4%2026-03-25
CVE-2026-31914WP Courses LMS WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-31913Scape WordPress theme arbitrary file deletion8.6CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-31788Linux kernel Xen privcmd driver vulnerability8.2CNA v3.10.2%2026-03-25Fix
CVE-2026-30976Sonarr path traversal8.6CNA v3.10.7%2026-03-25Fix
CVE-2026-30975Sonarr authentication bypass8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-30587Seafile Server has multiple stored XSS8.7v3.10.3%2026-03-25Fix
CVE-2026-29785nats-io nats-server NATS server panic via malicious compression on leafnode port7.5CNA v3.11.0%2026-03-25Fix
CVE-2026-29187OpenEMR vulnerable to Authenticated Blind Boolean-based SQL injection in new_search_popup.php8.1CNA v3.10.6%2026-03-25Exploit codeFix
CVE-2026-29092Kiteworks Email Protection Gateway has an insufficient session expiration4.9CNA v3.10.3%2026-03-25Fix
CVE-2026-28895Apple iOS and iPadOS improper access control4.6CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28894Apple macOS denial of service7.5CISA ADP v3.10.7%2026-03-25Fix
CVE-2026-28893Apple macOS print preview vulnerability3.3v3.10.1%2026-03-25Fix
CVE-2026-28892Apple macOS insecure permissions5.5v3.10.2%2026-03-25Fix
CVE-2026-28891Apple macOS race condition8.1CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-28890Apple Xcode out-of-bounds read5.5CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-28889Apple Xcode improper privilege management6.2CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-28888Apple macOS race condition5.1CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-28886Apple macOS null pointer dereference5.9CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-28882This issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to enumerate a user's installed apps.4.0CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28881Apple macOS improper authorization5.5v3.10.2%2026-03-25Fix
CVE-2026-28880Apple macOS insecure permissions6.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-28879Apple macOS use-after-free6.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28878Apple macOS information disclosure6.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-28877Apple macOS information disclosure5.5v3.10.2%2026-03-25Fix
CVE-2026-28876Apple macOS information disclosure7.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-28875Apple iOS and iPadOS buffer overflow7.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-28874Apple iOS and iPadOS resource exhaustion7.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-28871Apple Safari cross-site scripting4.3CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-28870Apple macOS information disclosure5.5v3.10.2%2026-03-25Fix
CVE-2026-28868Apple macOS sensitive information in log files5.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28867Apple macOS information disclosure6.2CISA ADP v3.10.2%2026-03-25Exploit codeFix
CVE-2026-28866Apple macOS link following6.2CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28865Apple macOS improper authorization7.5CISA ADP v3.10.8%2026-03-25Fix
CVE-2026-28864Apple macOS incorrect authorization3.3CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-28863Apple tvOS insecure permissions6.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28862Apple macOS improper access control5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28861Apple Safari origin validation error4.3CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28859Apple Safari buffer overflow4.3CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-28858Apple iOS and iPadOS buffer overflow9.8CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-28857Apple Safari buffer overflow6.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-28856Apple visionOS improper access control4.6CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-28855Apple macOS insecure permissions7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28852Apple macOS stack-based buffer overflow5.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28845Apple macOS improper authorization5.5v3.10.1%2026-03-25Fix
CVE-2026-28844Apple macOS improper access control6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-28842Apple macOS heap-based buffer overflow7.5v3.10.4%2026-03-25Fix
CVE-2026-28841Apple macOS buffer overflow6.2CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28839Apple macOS improper authorization5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28838Apple macOS insecure permissions5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28837Apple macOS logic flaw7.5v3.10.3%2026-03-25Fix
CVE-2026-28835Apple macOS use-after-free6.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28834Apple macOS race condition5.1CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-28833Apple macOS insecure permissions6.2CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28832Apple macOS out-of-bounds read8.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28831Apple macOS information disclosure5.5v3.10.2%2026-03-25Fix
CVE-2026-28829Apple macOS incorrect permission assignment5.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28828Apple macOS insecure permissions5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28827Apple macOS path traversal9.3CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28826Apple macOS logic flaw4.0CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28825Apple macOS out-of-bounds write7.1CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28824Apple macOS information disclosure5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28823Apple macOS improper access control4.9v3.10.3%2026-03-25Fix
CVE-2026-28822Apple macOS type confusion6.2CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28821Apple macOS privilege escalation8.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28820Apple macOS information disclosure5.3v3.10.2%2026-03-25Fix
CVE-2026-28818Apple macOS information disclosure5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-28817Apple macOS race condition8.1CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-28816Apple macOS path traversal4.0CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-28529cryptodev-linux get_userbuf use-after-free LPE7.8v3.10.2%2026-03-25
CVE-2026-27889nats-io nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead7.5CNA v3.10.8%2026-03-25Fix
CVE-2026-27659Mattermost CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint4.6CNA v3.10.2%2026-03-25Fix
CVE-2026-27656Mattermost account takeover via Substring Matching in OpenID Connect Authentication5.7CNA v3.10.3%2026-03-25Fix
CVE-2026-27602Modoboa has an OS command injection7.2CNA v3.10.7%2026-03-25Fix
CVE-2026-27496n8n has In-Process Memory Disclosure in its Task Runner7.1CNA v4.00.5%2026-03-25Fix
CVE-2026-27095Bus Ticket Booking with Seat Reservation WordPress plugin PHP object injection9.8CNA v3.10.6%2026-03-25Fix
CVE-2026-27088Darna Framework WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-25
CVE-2026-27087Wolverine Framework WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-25
CVE-2026-27084Buisson WordPress theme PHP object injection9.8CNA v3.10.6%2026-03-25
CVE-2026-27083Work and Travel Company WordPress theme PHP object injection9.8CNA v3.10.6%2026-03-25
CVE-2026-27082Love Story WordPress theme PHP object injection9.8CNA v3.10.6%2026-03-25
CVE-2026-27081Rosebud WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25
CVE-2026-27080Deston WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-27079Amfissa WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-27078Emaurri WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-27077MultiOffice WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25
CVE-2026-27076LuxeDrive WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-27075Belfort WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-27073Addi Cuotas que se adaptan a ti WordPress plugin broken authentication7.5CNA v3.10.3%2026-03-25Fix
CVE-2026-27071WPCafe WordPress plugin broken access control9.1CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-27054Penci Soledad Data Migrator WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-25
CVE-2026-27051Golo WordPress theme privilege escalation9.8CNA v3.10.5%2026-03-25
CVE-2026-27049Jobica Core WordPress plugin account takeover9.8CNA v3.10.6%2026-03-25
CVE-2026-27048The Aisle Core WordPress plugin local file inclusion8.1CNA v3.10.6%2026-03-25
CVE-2026-27047Curly Core WordPress plugin local file inclusion8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-27046StoreCustomizer WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-27045WooCommerce Infinite Scroll WordPress plugin PHP object injection8.8CNA v3.10.5%2026-03-25
CVE-2026-27044Total Poll Lite WordPress plugin remote code execution (RCE)9.9CNA v3.10.5%2026-03-25
CVE-2026-27040WZone WordPress plugin arbitrary file deletion8.8CNA v3.10.5%2026-03-25
CVE-2026-27039WZone WordPress plugin SQL injection8.5CNA v3.10.4%2026-03-25
CVE-2026-26833Thumbler allows OS command injection9.8NVD v3.13.4%2026-03-25
CVE-2026-26832Zapolnoch Tesseract Ocr node-tesseract-ocr is vulnerable to OS command injection9.8CNA v3.12.7%2026-03-25
CVE-2026-26831Textract is vulnerable to OS command injection9.8NVD v3.13.7%2026-03-25
CVE-2026-26830pdf-image has an OS command injection vulnerability through its pdfFilePath parameter9.8CNA v3.13.4%2026-03-25
CVE-2026-26306OM Digital Solutions OM Workspace (Windows Edition) uncontrolled search path8.4CNA v4.00.2%2026-03-25
CVE-2026-26233Mattermost denial of service via HTTP/2 single packet attack on login endpoint4.3CNA v3.10.5%2026-03-25Fix
CVE-2026-25645requests has Insecure Temp File Reuse in its extract_zipped_paths utility function4.4CNA v3.10.2%2026-03-25Exploit codeFix
CVE-2026-25469ViaBill WooCommerce WordPress plugin settings Change vulnerability6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25465CP Multi View Event Calendar WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-03-25Fix
CVE-2026-25464Jannah WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25Fix
CVE-2026-25462avalex WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25461Listeo Core WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-25
CVE-2026-25460Ave Core WordPress plugin broken access control6.3CNA v3.10.3%2026-03-25
CVE-2026-25458Moments WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25
CVE-2026-25457Mixtape WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-25
CVE-2026-25456Automated FedEx live/manual rates with shipping labels WordPress plugin broken access control7.3CNA v3.10.3%2026-03-25
CVE-2026-25455Product Slider for WooCommerce WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25454The League WordPress theme broken access control6.5CNA v3.10.4%2026-03-25
CVE-2026-25452Remoji WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-25Fix
CVE-2026-25447Widget Wrangler WordPress plugin remote code execution (RCE)9.1CNA v3.10.5%2026-03-25Fix
CVE-2026-25437GZSEO WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25435Booking calendar, Appointment Booking System WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-25
CVE-2026-25430CRM Perks Integration for Mailchimp and Contact Form 7 missing authorization6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25429Nexa Blocks WordPress plugin PHP object injection9.8CNA v3.10.6%2026-03-25
CVE-2026-25417ProfileGrid WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-03-25Fix
CVE-2026-25414WPBookit Pro WordPress plugin privilege escalation8.8CNA v3.10.3%2026-03-25
CVE-2026-25413WPBookit Pro WordPress plugin arbitrary file upload9.9CNA v3.10.3%2026-03-25
CVE-2026-25406Tutor LMS Pro WordPress plugin broken authentication8.1CNA v3.10.3%2026-03-25Fix
CVE-2026-25401WPCargo Track and Trace WordPress plugin broken access control7.5CNA v3.10.3%2026-03-25
CVE-2026-25400Apicona WordPress theme PHP object injection8.8CNA v3.10.3%2026-03-25
CVE-2026-25398Vertex Addons for Elementor WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25397File Uploader for WooCommerce WordPress plugin path traversal7.5CNA v3.10.4%2026-03-25
CVE-2026-25396Commerce Coinbase For WooCommerce WordPress plugin broken access control7.5CISA ADP v3.10.3%2026-03-25
CVE-2026-25390New User Approve WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25383KiviCare WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25382IdealAuto WordPress theme local file inclusion8.1CNA v3.10.4%2026-03-25Fix
CVE-2026-25381LoveDate WordPress theme local file inclusion8.1CNA v3.10.4%2026-03-25Fix
CVE-2026-25380Feedy WordPress theme local file inclusion8.1CNA v3.10.4%2026-03-25Fix
CVE-2026-25379StreamVid WordPress theme local file inclusion8.1CNA v3.10.4%2026-03-25Fix
CVE-2026-25377Addon Jobsearch Chat WordPress plugin SQL injection9.3CNA v3.10.3%2026-03-25Fix
CVE-2026-25376Addon Jobsearch Chat WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25373Vayvo - Media Streaming and Membership WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25371Lumise Product Designer WordPress plugin SQL injection9.3CNA v3.10.3%2026-03-25Fix
CVE-2026-25366Woody ad snippets WordPress plugin remote code execution (RCE)9.9CNA v3.10.3%2026-03-25Fix
CVE-2026-25365Kargo Takip WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25361WpEvently WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25360Vex WordPress theme PHP object injection8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-25359Pendulum WordPress theme PHP object injection8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-25358Meloo WordPress theme PHP object injection8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-25357Ultimate Membership Pro WordPress plugin account takeover8.1CNA v3.10.3%2026-03-25Fix
CVE-2026-25356Yobazar WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25355Sanzo WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2026-03-25Fix
CVE-2026-25354Reebox WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25353Nooni WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25352MyDecor WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25351MyMedi WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25350Miti WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25349Loobek WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25347WP REST Cache WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25346FAQ Builder AYS WordPress plugin cross-site scripting (XSS)7.1CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-25345SimpLy Gallery WordPress plugin arbitrary code execution9.9CNA v3.10.4%2026-03-25Fix
CVE-2026-25344Review Schema WordPress plugin sensitive data exposure6.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-25342Boutique WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25341RSFirewall! WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25340Jobmonster WordPress theme SQL injection9.3CNA v3.10.3%2026-03-25Fix
CVE-2026-25339Contact Form by WPForms WordPress plugin sensitive data exposure6.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-25334Salon Booking System Pro WordPress plugin account takeover8.1CNA v3.10.3%2026-03-25Fix
CVE-2026-25328Product File Upload for WooCommerce WordPress plugin arbitrary file deletion6.8CNA v3.10.4%2026-03-25Fix
CVE-2026-25327Five Star Restaurant Reservations WordPress plugin broken access control6.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-25317Print Invoice and Delivery Notes for WooCommerce WordPress plugin broken access control7.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-25309PublishPress Authors WordPress plugin broken access control7.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25306XStore Core WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25304Jaroti WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25035Contest Gallery WordPress plugin account takeover9.8CNA v3.10.4%2026-03-25Fix
CVE-2026-25034KiviCare WordPress plugin broken access control6.5CNA v3.10.2%2026-03-25Fix
CVE-2026-25033Motta Addons WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25032Ricky WordPress theme PHP object injection9.8CNA v3.10.4%2026-03-25Fix
CVE-2026-25031Tasty Daily WordPress theme PHP object injection9.8CNA v3.10.4%2026-03-25Fix
CVE-2026-25030Goldish WordPress theme PHP object injection9.8CNA v3.10.4%2026-03-25Fix
CVE-2026-25029KIDZ WordPress theme PHP object injection9.8CNA v3.10.4%2026-03-25Fix
CVE-2026-25026RadiusTheme Team missing authorization7.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-25025VikRestaurants WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25018NaturaLife Extensions WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25017NaturaLife Extensions WordPress plugin local file inclusion8.1CNA v3.10.4%2026-03-25Fix
CVE-2026-25013Phox Hosting WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-25009Education Zone WordPress theme broken access control6.5CNA v3.10.2%2026-03-25Fix
CVE-2026-25007ElementInvader Addons for Elementor WordPress plugin SQL injection8.5CNA v3.10.3%2026-03-25Fix
CVE-2026-25002LearnPress Sepay Payment WordPress plugin broken authentication7.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-25001Post Snippets WordPress plugin remote code execution (RCE)8.5CNA v3.10.2%2026-03-25Fix
CVE-2026-24993Advanced WooCommerce Product Sales Reporting WordPress plugin SQL injection9.3CNA v3.10.3%2026-03-25Fix
CVE-2026-24989SUMO Affiliates Pro WordPress plugin PHP object injection9.8CNA v3.10.4%2026-03-25Fix
CVE-2026-24987WP System Log WordPress plugin broken access control6.5CNA v3.10.4%2026-03-25Fix
CVE-2026-24983UpSolution Core WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-24981Visionary Core WordPress plugin PHP object injection8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-24980Visionary Core WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-24979Jobica Core WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-24978Jobica Core WordPress plugin PHP object injection8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-24977Organici Library WordPress plugin SQL injection8.5CNA v3.10.3%2026-03-25Fix
CVE-2026-24976Organici Library WordPress plugin PHP object injection8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-24975Organici Library WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-24974CitiLights WordPress theme PHP object injection8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-24973CitiLights WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-24972Elated Listing WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-24971Search and Go WordPress theme privilege escalation9.8CNA v3.10.3%2026-03-25Fix
CVE-2026-24970Energox WordPress theme arbitrary file deletion7.7CNA v3.10.3%2026-03-25Fix
CVE-2026-24969Instant VA WordPress theme arbitrary file deletion7.7CNA v3.10.3%2026-03-25Fix
CVE-2026-24968Xagio SEO WordPress plugin privilege escalation9.8CNA v3.10.4%2026-03-25Fix
CVE-2026-24964Contest Gallery WordPress plugin server side request forgery (SSRF)6.4CNA v3.10.2%2026-03-25Fix
CVE-2026-24750Kiteworks Secure Data Forms vulnerable to cross-site scripting7.6CNA v3.10.2%2026-03-25Fix
CVE-2026-24391Car Dealer WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-24382News Magazine X WordPress theme broken access control7.5CNA v3.10.3%2026-03-25Fix
CVE-2026-24378EventPrime WordPress plugin PHP object injection9.8CNA v3.10.5%2026-03-25Fix
CVE-2026-24376WPVulnerability WordPress plugin broken access control6.5CNA v3.10.4%2026-03-25Fix
CVE-2026-24373RegistrationMagic WordPress plugin account takeover8.1CNA v3.10.4%2026-03-25Fix
CVE-2026-24372Subscriptions for WooCommerce WordPress plugin bypass vulnerability vulnerability7.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-24370The Grid WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-03-25Fix
CVE-2026-24369The Grid WordPress plugin broken access control7.1CNA v3.10.3%2026-03-25Fix
CVE-2026-24364WP User Frontend WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-24363WP Cost Estimation and Payment Forms Builder WordPress plugin broken access control7.5CNA v3.10.4%2026-03-25Fix
CVE-2026-24362Ultimate Post Kit WordPress plugin broken access control6.4CNA v3.10.2%2026-03-25Fix
CVE-2026-24359Dokan WordPress plugin broken authentication8.8CNA v3.10.5%2026-03-25Fix
CVE-2026-23979Gyan Elements WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-23977Helpdesk Support Ticket System for WooCommerce WordPress plugin broken access control7.5CNA v3.10.4%2026-03-25Fix
CVE-2026-23973Golo WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-23972Booking and Rental Manager WordPress plugin broken access control6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-23971WoodMart WordPress theme PHP object injection8.1CNA v3.10.3%2026-03-25Fix
CVE-2026-23807WP Telegram Widget and Join Link WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25Fix
CVE-2026-23806Jobs for WordPress plugin broken access control7.5CNA v3.10.4%2026-03-25Fix
CVE-2026-23636Kiteworks Secure Data Forms is vulnerable to an unrestricted upload of file with dangerous type5.5CNA v3.11.0%2026-03-25Fix
CVE-2026-23635Kiteworks Secure Data Forms has a potential unprotected transport of credentials6.5CNA v3.10.3%2026-03-25Fix
CVE-2026-23514Kiteworks Core is vulnerable to Improper Ownership Management8.8CNA v3.11.0%2026-03-25Fix
CVE-2026-23395Linux kernel L2CAP enhanced credit-based connections vulnerability8.8CNA v3.10.3%2026-03-25Fix
CVE-2026-23394Linux kernel AF_UNIX garbage collector race condition4.7v3.10.1%2026-03-25Fix
CVE-2026-23393Linux kernel bridge CFM peer MEP handling race condition7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23392Linux kernel nf_tables flowtable use-after-free7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23391Linux kernel xt_CT netfilter target templates vulnerability7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23390Linux kernel dma_map_sg tracepoint out-of-bounds write7.8v3.10.1%2026-03-25Fix
CVE-2026-23389Linux kernel ice memory leak5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23388Linux kernel Squashfs metadata reader out-of-bounds read7.1NVD v3.10.1%2026-03-25Fix
CVE-2026-23387Linux kernel cs42l43 pin controller driver double free7.8v3.10.1%2026-03-25Fix
CVE-2026-23386Linux kernel gve Ethernet driver vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23385Linux kernel nf_tables set flush handling vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23384Linux kernel RDMA/ionic memory leak5.5v3.10.1%2026-03-25Fix
CVE-2026-23383Linux kernel arm64 BPF JIT compiler vulnerability7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23382Linux kernel HID raw event handling null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23381Linux kernel bridge neighbor discovery suppression null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23380Linux kernel tracing ring buffer mmap reachable assertion5.5v3.10.1%2026-03-25Fix
CVE-2026-23379Linux kernel ETS queueing discipline offload divide by zero5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23378Linux kernel IFE action metadata list out-of-bounds write7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23377Linux kernel ice driver XDP receive queue vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23376In the Linux kernel, the following vulnerability has been resolved: nvmet-fcloop: Check remoteport port_state before calling done callback In nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when remoteport->port_state is FC_OBJSTATE_ONLINE. Otherwise, the nvme_fc_xmt_ls_rsp's LL5.5v3.10.1%2026-03-25Fix
CVE-2026-23375Linux kernel transparent huge page eligibility check reachable assertion5.5v3.10.1%2026-03-25Fix
CVE-2026-23374Linux kernel blktrace tracer vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23373Linux kernel rsi Wi-Fi driver mac80211 configuration vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23372Linux kernel NFC raw socket teardown use-after-free7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23371Linux kernel deadline scheduler priority inheritance integer underflow5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23370Linux kernel dell-wmi-sysman password handling information disclosure5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23369Linux kernel i801 kernel panic5.5v3.10.1%2026-03-25Fix
CVE-2026-23368Linux kernel PHY LED triggers deadlock5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23367Linux kernel radiotap parser vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23366Linux kernel DRM client mode setting null pointer dereference5.5v3.10.1%2026-03-25Fix
CVE-2026-23365Linux kernel kalmia crash5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23364Linux kernel ksmbd SMB server MAC comparison vulnerability7.4CNA v3.10.4%2026-03-25Fix
CVE-2026-23363Linux kernel mt7925 Wi-Fi driver out-of-bounds read7.1v3.10.1%2026-03-25Fix
CVE-2026-23362Linux kernel bcm improper locking5.5v3.10.1%2026-03-25Fix
CVE-2026-23361Linux kernel ep out-of-bounds write7.8NVD v3.10.1%2026-03-25Fix
CVE-2026-23360Linux kernel NVMe admin queue on controller reset memory leak5.5v3.10.1%2026-03-25Fix
CVE-2026-23359Linux kernel BPF devmap redirect out-of-bounds write7.8NVD v3.10.1%2026-03-25Fix
CVE-2026-23358Linux kernel drm/amdgpu uninitialized resource use5.5v3.10.1%2026-03-25Fix
CVE-2026-23357Linux kernel mcp251x CAN driver deadlock5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23356Linux kernel DRBD activity log reachable assertion5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23355Linux kernel libata deferred command scheduling vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23354Linux kernel x86/fred improper array index validation7.8v3.10.1%2026-03-25Fix
CVE-2026-23353Linux kernel ice Rx buffer allocation null pointer dereference5.5v3.10.1%2026-03-25Fix
CVE-2026-23352Linux kernel EFI boot services memory handling memory leak5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23351Linux kernel nft_set_pipapo use-after-free7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23350Linux kernel Xe GPU exec queue creation memory leak7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23349Linux kernel HID pidff force feedback driver null pointer dereference5.5v3.10.1%2026-03-25Fix
CVE-2026-23348Linux kernel CXL nvdimm bus registration null pointer dereference4.7v3.10.1%2026-03-25Fix
CVE-2026-23347Linux kernel f81604 CAN USB driver vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23346Linux kernel ioremap_prot user memory type handling vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23345Linux kernel gcs kernel panic5.5v3.10.1%2026-03-25Fix
CVE-2026-23344Linux kernel CCP SEV TSM initialization use-after-free7.8v3.10.1%2026-03-25Fix
CVE-2026-23343Linux kernel XDP tailroom calculation out-of-bounds write7.8NVD v3.10.1%2026-03-25Fix
CVE-2026-23342Linux kernel BPF cpumap race condition4.7v3.10.1%2026-03-25Fix
CVE-2026-23341Linux kernel amdxdna accelerator driver null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23340Linux kernel lockless qdisc reset and dequeue use-after-free7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23339Linux kernel NFC NCI transceive path memory leak5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23338Linux kernel amdgpu userq wait ioctl vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23337Linux kernel pinconf-generic memory leak5.5v3.10.1%2026-03-25Fix
CVE-2026-23336Linux kernel cfg80211 wiphy unregistration use-after-free7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23335Linux kernel irdma RDMA driver vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23334Linux kernel f81604 CAN USB driver vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23332Linux kernel intel_pstate driver null pointer dereference5.5v3.10.1%2026-03-25Fix
CVE-2026-23331Linux kernel UDP 4-tuple hash table vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23330Linux kernel NFC NCI device close handling memory leak5.5v3.10.1%2026-03-25Fix
CVE-2026-23329Linux kernel libie firmware logging vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23328Linux kernel accel/amdxdna null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23327Linux kernel CXL mailbox interface out-of-bounds read7.1NVD v3.10.1%2026-03-25Fix
CVE-2026-23326Linux kernel xsk out-of-bounds write7.8v3.10.1%2026-03-25Fix
CVE-2026-23325Linux kernel mt76 mt7996 Wi-Fi driver out-of-bounds read7.1v3.10.1%2026-03-25Fix
CVE-2026-23324Linux kernel etas_es58x CAN USB driver vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23323Linux kernel Apple Silicon SMC hwmon driver out-of-bounds write7.8v3.10.1%2026-03-25Fix
CVE-2026-23322Linux kernel IPMI message handler use-after-free7.8v3.10.1%2026-03-25Fix
CVE-2026-23321In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subfl5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23319Linux kernel BPF trampoline cgroup shim use-after-free7.8NVD v3.10.1%2026-03-25Fix
CVE-2026-23318Linux kernel ALSA USB-audio UAC3 driver out-of-bounds read7.1NVD v3.10.1%2026-03-25Fix
CVE-2026-23317Linux kernel vmwgfx driver vulnerability7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23316Linux kernel IPv4 multipath hash seed denial of service5.5v3.10.1%2026-03-25Fix
CVE-2026-23315Linux kernel mt76 Wi-Fi driver out-of-bounds read7.1NVD v3.10.1%2026-03-25Fix
CVE-2026-23314Linux kernel bq257xx regulator driver vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23313Linux kernel i40e NAPI poll tracepoint vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23312Linux kernel kaweth USB driver vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23311Linux kernel perf event scheduling improper locking5.5v3.10.1%2026-03-25Fix
CVE-2026-23310Linux kernel bonding XDP hash policy check vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23309Linux kernel histogram trigger parsing null pointer dereference5.5v3.10.1%2026-03-25Fix
CVE-2026-23308Linux kernel GPIO IRQ mask and ack handling vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23307Linux kernel ems_usb CAN driver vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23306Linux kernel pm8001 SAS driver use-after-free7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23305Linux kernel accel/rocket out-of-bounds read7.1v3.10.1%2026-03-25Fix
CVE-2026-23304Linux kernel IPv6 route lookup null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23303Linux kernel CIFS credential logging information disclosure5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23302Linux kernel socket data-ready and write-space callbacks race condition4.7NVD v3.10.1%2026-03-25Fix
CVE-2026-23301Linux kernel SDCA entity naming vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23300Linux kernel IPv6 nexthop handling null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23299Linux kernel Bluetooth socket error queue vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23298Linux kernel ucan CAN driver denial of service5.5v3.10.1%2026-03-25Fix
CVE-2026-23297Linux kernel NFSD netlink thread control memory leak5.5v3.10.1%2026-03-25Fix
CVE-2026-23296Linux kernel SCSI core tagset handling vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23295Linux kernel accel/amdxdna deadlock5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23294Linux kernel BPF devmap race condition7.0CNA v3.10.1%2026-03-25Fix
CVE-2026-23293Linux kernel VXLAN driver null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23292Linux kernel target configfs interface vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23291Linux kernel pn533 NFC driver vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23290Linux kernel pegasus USB Ethernet driver denial of service5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23289In the Linux kernel, the following vulnerability has been resolved: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Fix a user triggerable leak on the system call failure path.5.5v3.10.1%2026-03-25Fix
CVE-2026-23288Linux kernel accel/amdxdna out-of-bounds write7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23287Linux kernel SiFive PLIC driver vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23286Linux kernel ATM LANE ARP handling null pointer dereference5.5v3.10.1%2026-03-25Fix
CVE-2026-23285Linux kernel DRBD driver null pointer dereference5.5v3.10.1%2026-03-25Fix
CVE-2026-23284Linux kernel mtk_eth_soc XDP handling vulnerability5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-23283Linux kernel fp9931 regulator hwmon driver vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23282Linux kernel SMB2 unlink handling vulnerability5.5v3.10.1%2026-03-25Fix
CVE-2026-23281Linux kernel Libertas Wi-Fi driver use-after-free7.8NVD v3.10.1%2026-03-25Fix
CVE-2026-23280Linux kernel amdxdna accelerator driver vulnerability7.8CNA v3.10.1%2026-03-25Fix
CVE-2026-23279Linux kernel mac80211 mesh channel switch handling null pointer dereference5.5NVD v3.10.1%2026-03-25Fix
CVE-2026-22524Legacy Admin WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25
CVE-2026-22523Ultra WordPress Admin plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25
CVE-2026-22520Handmade Framework WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25
CVE-2026-22516Wizor's WordPress theme local file inclusion8.1CNA v3.10.4%2026-03-25
CVE-2026-22515VegaDays WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22514Unica WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22513Triompher WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22512Roisin WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25Fix
CVE-2026-22511NeoBeat WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25Fix
CVE-2026-22510Melody WordPress theme PHP object injection8.1CNA v3.10.4%2026-03-25
CVE-2026-22509Gioia WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22508Dentalux WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22507Beelove WordPress theme PHP object injection9.8CNA v3.10.5%2026-03-25
CVE-2026-22506Amoli WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25Fix
CVE-2026-22505Morning Records WordPress theme PHP object injection8.1CNA v3.10.4%2026-03-25
CVE-2026-22504ProLingua WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22503Nelson WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22502Mr. Cobbler WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22500m2 Construction and Tools Store WordPress theme PHP object injection9.8CNA v3.10.5%2026-03-25
CVE-2026-22499Lella WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22498Laurent WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22496Hypnotherapy WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22495Greenville WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22494Good Homes WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22493Gaspard WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-25
CVE-2026-22491My auctions allegro WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-03-25
CVE-2026-22485My Album Gallery WordPress plugin arbitrary file deletion6.5CNA v3.10.3%2026-03-25
CVE-2026-22484Lisfinity Core WordPress plugin SQL injection9.3CNA v3.10.4%2026-03-25
CVE-2026-22480Product Feed for WooCommerce WordPress plugin PHP object injection7.2CNA v3.10.5%2026-03-25Fix
CVE-2026-22448PitchPrint WordPress plugin arbitrary file deletion7.5CNA v3.10.6%2026-03-25Fix
CVE-2026-20719Mattermost DoS via URL Previews Rendering Malicious SVGs4.3CNA v3.10.4%2026-03-25Fix
CVE-2026-20701Apple macOS protection mechanism failure7.5CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-20699Apple macOS improper signature verification6.2CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-20698Apple macOS out-of-bounds write7.8v3.10.3%2026-03-25Fix
CVE-2026-20697Apple macOS insecure permissions5.3CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-20695Apple macOS information disclosure6.2CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-20694Apple macOS link following5.5v3.10.2%2026-03-25Fix
CVE-2026-20693Apple macOS incorrect permission assignment4.9CISA ADP v3.10.4%2026-03-25Fix
CVE-2026-20692Apple iOS, iPadOS and macOS Mail vulnerability5.3v3.10.4%2026-03-25Fix
CVE-2026-20691Apple Safari system information disclosure4.3CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-20690Apple macOS out-of-bounds read6.5CISA ADP v3.10.7%2026-03-25Fix
CVE-2026-20688Apple macOS path traversal9.3CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-20687Apple macOS use-after-free7.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-20686Apple iOS and iPadOS information disclosure5.3CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-20684Apple macOS insecure permissions3.3CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-20670Apple macOS information disclosure5.5v3.10.1%2026-03-25Fix
CVE-2026-20668Apple macOS sensitive information in log files5.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-20665Apple Safari protection mechanism failure6.5CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-20664Apple Safari buffer overflow4.3CISA ADP v3.10.7%2026-03-25Fix
CVE-2026-20657Apple macOS out-of-bounds read6.5CISA ADP v3.10.5%2026-03-25Fix
CVE-2026-20651Apple macOS insecure temporary file6.2CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-20639Apple macOS integer overflow7.5CISA ADP v3.10.6%2026-03-25Fix
CVE-2026-20637Apple macOS use-after-free6.2CISA ADP v3.10.2%2026-03-25Exploit codeFix
CVE-2026-20633Apple macOS link following5.5CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-20632Apple macOS information disclosure5.3v3.10.3%2026-03-25Fix
CVE-2026-20631Apple macOS logic flaw8.8v3.10.3%2026-03-25Fix
CVE-2026-20622Apple macOS improper access control7.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-20607Apple macOS improper privilege management4.0CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-20125Cisco IOS improper input validation7.7CNA v3.10.3%2026-03-25Fix
CVE-2026-20115Cisco IOS XE Software cleartext transmission of sensitive information6.1CNA v3.10.2%2026-03-25Fix
CVE-2026-20114Cisco IOS XE Software improper syntax validation5.4CNA v3.10.3%2026-03-25Fix
CVE-2026-20113Cisco IOS XE Software CRLF injection5.3CNA v3.10.3%2026-03-25Fix
CVE-2026-20112Cisco IOS XE Software cross-site scripting4.8CNA v3.10.2%2026-03-25Fix
CVE-2026-20110Cisco IOS XE Software incorrect privilege assignment6.5CNA v3.10.1%2026-03-25Fix
CVE-2026-20108Cisco Catalyst SD-WAN Manager cross-site scripting5.4CNA v3.10.2%2026-03-25Fix
CVE-2026-20104Cisco IOS XE Software buffer underflow6.1CNA v3.10.2%2026-03-25Fix
CVE-2026-20086Cisco IOS XE Software denial of service8.6CNA v3.10.4%2026-03-25Fix
CVE-2026-20084Cisco IOS XE Software denial of service8.6CNA v3.10.4%2026-03-25Fix
CVE-2026-20083Cisco IOS XE Software denial of service6.5CNA v3.10.1%2026-03-25Fix
CVE-2026-20012Cisco IOS memory leak8.6CNA v3.10.4%2026-03-25Fix
CVE-2026-20004Cisco IOS XE Software missing resource release7.4CNA v3.10.2%2026-03-25Fix
CVE-2026-4825SourceCodester Sales and Inventory System HTTP GET parameter update_sales.php SQL injection6.5v3.10.4%2026-03-25
CVE-2026-4824Enter Software Iperius Backup Backup Job Configuration file privileges management7.3CNA v4.00.1%2026-03-25Fix
CVE-2026-4823Enter Software Iperius Backup NTLM2 information disclosure2.0CNA v4.00.1%2026-03-25Fix
CVE-2026-4822Enter Software Iperius Backup Backup service temp file7.3CNA v4.00.2%2026-03-25Fix
CVE-2026-4816Reflected cross-site scripting (XSS) vulnerability in Support Board5.4v3.10.2%2026-03-25Fix
CVE-2026-4815SQL injection vulnerability in Support Board8.8v3.10.4%2026-03-25Reported exploitedFix
CVE-2026-4784code-projects Simple Laundry System parameter checkcheckout.php SQL injection9.8v3.10.6%2026-03-25
CVE-2026-4783itsourcecode College Management System parameter add-single-student-results.php SQL injection5.3CNA v4.00.3%2026-03-25
CVE-2026-4781SourceCodester Sales and Inventory System HTTP GET parameter update_purchase.php SQL injection8.8v3.10.5%2026-03-25
CVE-2026-4780SourceCodester Sales and Inventory System HTTP GET parameter update_out_standing.php SQL injection8.8v3.10.5%2026-03-25
CVE-2026-4766Easy Image Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-25Fix
CVE-2026-4761CODRA Panorama Suite incorrect permission assignment3.3CNA v4.00.2%2026-03-25Fix
CVE-2026-4760CODRA Panorama Suite potential unauthorized access to files on the Web HMI server host7.7CNA v4.00.5%2026-03-25Fix
CVE-2026-4363Incorrect authorization in GitLab3.7CNA v3.10.2%2026-03-25Fix
CVE-2026-3988Inefficient algorithmic complexity in GitLab7.5CNA v3.10.9%2026-03-25Fix
CVE-2026-3857Cross-site request forgery (CSRF) in GitLab8.1CNA v3.10.3%2026-03-25Fix
CVE-2026-3608Stack overflow in Kea daemons7.5CNA v3.11.2%2026-03-25Fix
CVE-2026-3591ISC BIND 9 A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass5.4CNA v3.10.3%2026-03-25Fix
CVE-2026-3218Responsive Favicons Moderately critical cross-site scripting SA-CONTRIB-2026-0194.8CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-3217SAML SSO Service Provider Critical cross-site scripting SA-CONTRIB-2026-0186.1CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-3216Drupal Canvas server-side request forgery5.0v3.10.3%2026-03-25Fix
CVE-2026-3215Islandora Moderately critical arbitrary file upload, cross-site scripting SA-CONTRIB-2026-0165.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-3214CAPTCHA Moderately critical Access bypass SA-CONTRIB-2026-0156.5CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-3213Anti-spam by CleanTalk Moderately critical cross-site scripting SA-CONTRIB-2026-0144.7CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-3212Tagify Moderately critical cross-site scripting SA-CONTRIB-2026-0135.4CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-3211Theme Negotiation by Rules Moderately critical cross-site request forgery SA-CONTRIB-2026-0124.3CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-3210Material Icons Moderately critical Access bypass SA-CONTRIB-2026-0115.3CISA ADP v3.10.3%2026-03-25Fix
CVE-2026-3119ISC BIND 9 authenticated query containing a TKEY record may cause named to terminate unexpectedly6.5CNA v3.10.6%2026-03-25Fix
CVE-2026-3104ISC BIND 9 memory leak in code preparing DNSSEC proofs of non-existence7.5CNA v3.11.2%2026-03-25Fix
CVE-2026-2995Improper neutralization of script-related HTML tags in a web page (basic XSS) in GitLab7.7CNA v3.10.3%2026-03-25Fix
CVE-2026-2973Improper neutralization of input during web page generation (cross-site scripting) in GitLab5.4CNA v3.10.3%2026-03-25Fix
CVE-2026-2745Authentication bypass using an alternate path or channel in GitLab6.8CNA v3.10.5%2026-03-25Fix
CVE-2026-2726Incorrect authorization in GitLab4.3CNA v3.10.3%2026-03-25Fix
CVE-2026-2485IBM InfoSphere Information Server cross-site scripting4.8CNA v3.10.2%2026-03-25Fix
CVE-2026-2484IBM InfoSphere Information Server information disclosure4.3CNA v3.10.3%2026-03-25Fix
CVE-2026-2483IBM InfoSphere Information Server cross-site scripting5.4CNA v3.10.2%2026-03-25Fix
CVE-2026-2414HYPR Server insecure direct object reference5.6CNA v4.00.3%2026-03-25Fix
CVE-2026-2349UI Icons Critical cross-site scripting SA-CONTRIB-2026-0106.1CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-2348Quick Edit Moderately critical cross-site scripting SA-CONTRIB-2026-0095.4CISA ADP v3.10.1%2026-03-25Fix
CVE-2026-2343PeproDev Ultimate Invoice WordPress plugin unauthenticated Invoice Archive download5.3CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-2072Hitachi Infrastructure Analytics Advisor cross-site scripting8.2CNA v3.10.2%2026-03-25Fix
CVE-2026-1917Login Disable Less critical Access bypass SA-CONTRIB-2026-0084.3CISA ADP v3.10.2%2026-03-25Fix
CVE-2026-1724Missing authentication for critical function in GitLab6.8CNA v3.10.5%2026-03-25Fix
CVE-2026-1712HYPR Server incorrect privilege assignment5.8CNA v4.00.3%2026-03-25Fix
CVE-2026-1561IBM WebSphere Application Server Liberty server-side request forgery5.4CNA v3.10.3%2026-03-25Fix
CVE-2026-1519ISC BIND 9 excessive NSEC3 iterations cause high CPU load during insecure delegation validation7.5CNA v3.11.6%2026-03-25Fix
CVE-2026-1262IBM InfoSphere Information Server information disclosure4.3CNA v3.10.2%2026-03-25Fix
CVE-2026-1166Open redirect vulnerability in Hitachi Ops Center Administrator4.3CNA v3.10.2%2026-03-25Fix
CVE-2026-1015IBM InfoSphere Information Server is vulnerable to server-side request forgery5.4CNA v3.10.2%2026-03-25Fix
CVE-2026-1014IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information6.5CNA v3.10.2%2026-03-25Fix
CVE-2026-1001Domoticz stored XSS via Hardware Configuration endpoint4.8v3.10.2%2026-03-25Fix
CVE-2026-33856Missing release of memory after effective lifetime in MolotovCherry Android-ImageMagick77.5CNA v3.10.4%2026-03-24
CVE-2026-33855Integer overflow or wraparound in MolotovCherry Android-ImageMagick77.5v3.10.2%2026-03-24
CVE-2026-33854Out-of-bounds write in MolotovCherry Android-ImageMagick79.8v3.10.2%2026-03-24
CVE-2026-33853Null pointer dereference in MolotovCherry Android-ImageMagick77.5v3.10.2%2026-03-24
CVE-2026-33852Missing release of memory after effective lifetime in MolotovCherry Android-ImageMagick77.5CNA v3.10.4%2026-03-24
CVE-2026-33851Improper restriction of operations within the bounds of a memory buffer in joncampbell123 doslib7.8CNA v3.10.2%2026-03-24
CVE-2026-33850Out-of-bounds write in WujekFoliarz DualSenseY-v27.8CNA v3.10.2%2026-03-24
CVE-2026-33849Improper restriction of operations within the bounds of a memory buffer in linkingvision rapidvms8.8CNA v3.10.4%2026-03-24
CVE-2026-33848Improper restriction of operations within the bounds of a memory buffer in linkingvision rapidvms8.8CNA v3.10.4%2026-03-24
CVE-2026-33847Improper restriction of operations within the bounds of a memory buffer in linkingvision rapidvms7.8CNA v3.10.2%2026-03-24
CVE-2026-33769Astro: Remote allowlist bypass via unanchored matchPathname wildcard2.9CNA v4.00.4%2026-03-24Fix
CVE-2026-33768Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`6.5CNA v3.10.5%2026-03-24Fix
CVE-2026-33700Vikunja link share deletion endpoint insecure direct object reference6.9CNA v4.00.3%2026-03-24Fix
CVE-2026-33680Vikunja vulnerable to Link Share hash disclosure via ReadAll endpoint enables permission escalation7.5CNA v3.10.5%2026-03-24Fix
CVE-2026-33679Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections6.4CNA v3.10.5%2026-03-24Fix
CVE-2026-33678Vikunja has IDOR in Task Attachment ReadOne allows Cross-Project File Access and Deletion8.1CNA v3.10.4%2026-03-24Fix
CVE-2026-33677go-vikunja vikunja Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API6.5CNA v3.10.4%2026-03-24Fix
CVE-2026-33676Vikunja has Cross-Project information disclosure6.5CNA v3.10.4%2026-03-24Fix
CVE-2026-33675Vikunja Todoist and Trello migration file downloader server-side request forgery6.4CNA v3.10.4%2026-03-24Fix
CVE-2026-33668Vikunja account status check incorrect authorization7.1CNA v4.00.6%2026-03-24Fix
CVE-2026-33627parse-community parse-server parse Server: Auth data exposed via /users/me endpoint7.1CNA v4.00.5%2026-03-24Fix
CVE-2026-33624Parse Platform Parse Server MFA recovery code validation race condition2.1CNA v4.00.3%2026-03-24Fix
CVE-2026-33554FreeIPMI stack-based buffer overflow7.5CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-33539parse-community parse-server parse Server: SQL injection8.6CNA v4.00.7%2026-03-24Fix
CVE-2026-33538parse-community parse-server parse Server: Denial of service8.7CNA v4.00.8%2026-03-24Fix
CVE-2026-33527Parse Platform Parse Server session update endpoint incorrect authorization5.3CNA v4.00.3%2026-03-24Fix
CVE-2026-33511Pyload-ng: Authentication bypass via host header injection in ClickNLoad8.8CNA v4.00.6%2026-03-24Fix
CVE-2026-33509Pyload-ng: SETTINGS Permission Users can Achieve remote code execution7.5CNA v3.10.6%2026-03-24Fix
CVE-2026-33508parse-community parse-server parse Server: LiveQuery subscription query depth bypass8.2CNA v4.00.6%2026-03-24Fix
CVE-2026-33498Parse Platform Parse Server query condition depth validation uncontrolled recursion8.7CNA v4.00.6%2026-03-24Fix
CVE-2026-33497Langflow profile pictures endpoint path traversal8.7CNA v4.02.0%2026-03-24NucleiFix
CVE-2026-33484Langflow has unauthenticated IDOR on Image Downloads7.5CNA v3.10.6%2026-03-24Fix
CVE-2026-33475Langflow GitHub Actions Shell injection9.1CNA v3.12.1%2026-03-24Exploit codeFix
CVE-2026-33474Vikunja affected by DoS via Image Preview Generation6.5CNA v3.10.5%2026-03-24Fix
CVE-2026-33473Vikunja has TOTP Reuse during Validity window5.7CNA v3.10.4%2026-03-24Fix
CVE-2026-33429Parse Server LiveQuery protected field notifications vulnerability6.3CNA v4.00.4%2026-03-24Fix
CVE-2026-33421parse-community parse-server parse Server: LiveQuery bypasses CLP pointer permission enforcement7.1CNA v4.00.4%2026-03-24Fix
CVE-2026-33419MinIO: LDAP login brute-force via user enumeration and missing rate limit9.1CNA v4.00.5%2026-03-24Fix
CVE-2026-33418@dicebear/converter ensureSize vulnerable to SVG Dimension Capping Bypass via XML comment injection7.5CNA v3.10.5%2026-03-24Fix
CVE-2026-33417Wallos: Password Reset Tokens Never Expire6.5CNA v3.10.3%2026-03-24Fix
CVE-2026-33412Vim affected by command injection via newline in glob5.6CNA v3.10.9%2026-03-24Fix
CVE-2026-33409Parse Server third-party login authentication authentication bypass7.0CNA v4.00.6%2026-03-24Fix
CVE-2026-33407Wallos: SSRF via HTTP Proxy Environment variable8.3CNA v4.00.5%2026-03-24Fix
CVE-2026-33401Wallos: Incomplete fix for SSRF in AI and notification endpoints bypass ssrf_helper.php7.1CNA v4.00.4%2026-03-24Fix
CVE-2026-33400Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint5.4CNA v3.10.3%2026-03-24Fix
CVE-2026-33399Wallos: SSRF Bypass Incomplete Fix for/308407.7CNA v3.10.4%2026-03-24Fix
CVE-2026-33353Charm Soft Serve repository import missing authorization7.1CNA v4.00.4%2026-03-24Fix
CVE-2026-33349fast-xml-parser entity expansion limit check denial of service5.9CNA v3.10.5%2026-03-24Fix
CVE-2026-33347League/commonmark has an embed extension allowed_domains bypass6.3CNA v4.00.3%2026-03-24Fix
CVE-2026-33345Solidtime vulnerable to IDOR in private projects6.5CNA v3.10.4%2026-03-24Fix
CVE-2026-33344Dagu has an incomplete fix for path traversal via %2F-encoded slashes in locateDAG8.1CNA v3.10.5%2026-03-24Fix
CVE-2026-33340LoLLMs WEBUI has unauthenticated server-side request forgery (SSRF) in /API/proxy endpoint9.1CNA v3.11.7%2026-03-24NucleiExploit code
CVE-2026-33336Vikunja Desktop vulnerable to remote code execution via same-window navigation6.5CNA v4.00.9%2026-03-24Fix
CVE-2026-33335Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal6.4CNA v4.00.4%2026-03-24Fix
CVE-2026-33334Vikunja Desktop: Any frontend XSS escalates to remote code execution due to nodeIntegration6.5CNA v4.00.7%2026-03-24Fix
CVE-2026-33332NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion6.9CNA v4.00.7%2026-03-24Fix
CVE-2026-33331oRPC: Stored XSS in OpenAPI Reference plugin via unescaped JSON.stringify8.2CNA v3.10.3%2026-03-24Exploit codeFix
CVE-2026-33330FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback7.1CNA v3.10.4%2026-03-24Fix
CVE-2026-33329FileRise resumable upload handler path traversal8.1CNA v3.10.6%2026-03-24Fix
CVE-2026-33326keystonejs keystone @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany4.3CNA v3.10.3%2026-03-24Fix
CVE-2026-33323parse-community parse-server parse Server: Email verification resend page leaks user existence6.3CNA v4.00.4%2026-03-24Fix
CVE-2026-33322MinIO: JWT Algorithm Confusion in OIDC Authentication9.2CNA v4.00.6%2026-03-24Fix
CVE-2026-33320Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service6.2CNA v3.10.2%2026-03-24Fix
CVE-2026-33316Vikunja’s improper access control enables Bypass of Administrator-Imposed Account Disablement8.1CNA v3.10.4%2026-03-24Fix
CVE-2026-33315Vikunja has a 2FA Bypass via Caldav Basic Auth6.9CNA v4.00.4%2026-03-24Fix
CVE-2026-33314Pyload-ng: Improper authentication and origin validation error6.5CNA v3.10.2%2026-03-24Fix
CVE-2026-33313Vikunja has an IDOR in Task Comments allows Reading arbitrary Comments5.3CNA v4.00.3%2026-03-24Fix
CVE-2026-33311@dicebear/core and @dicebear/initials vulnerable to SVG injection via Unsanitized options4.7CNA v3.10.2%2026-03-24Fix
CVE-2026-33310Intake has a command injection via shell Expansion in Parameter Defaults8.8CNA v3.10.5%2026-03-24Exploit codeFix
CVE-2026-33309Langflow has an arbitrary file write (RCE) via v2 API10.0CNA v3.11.0%2026-03-24Reported exploitedEmerging ThreatsFix
CVE-2026-33308mod_gnutls missing key purpose check in client certificate verification6.8CNA v3.10.2%2026-03-24Fix
CVE-2026-33307mod_gnutls client certificate verification stack-based buffer overflow7.5CNA v3.10.3%2026-03-24Fix
CVE-2026-33306bcrypt-ruby JRuby BCrypt implementation integer overflow4.5CNA v4.00.3%2026-03-24Fix
CVE-2026-33298llama.cpp has a heap buffer overflow via integer overflow in GGUF Tensor Parsing7.8CNA v3.10.4%2026-03-24Fix
CVE-2026-33290WPGraphQL updateComment mutation missing authorization4.3CNA v3.10.3%2026-03-24Fix
CVE-2026-33286Graphiti affected by arbitrary Method Execution via Unvalidated Relationship Names9.1CNA v3.10.9%2026-03-24Fix
CVE-2026-33283Ella Core panics on malformed ULNASTransport message without a Request Type6.5CNA v3.10.5%2026-03-24Fix
CVE-2026-33282Ella Core panics on malformed NGAP Location Report7.5CNA v3.10.5%2026-03-24Fix
CVE-2026-33281Ella Core panics on invalid PDU Session IDs in NGAP messages6.5CNA v3.10.5%2026-03-24Fix
CVE-2026-33252MCP Go SDK allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion7.1CNA v3.10.2%2026-03-24Fix
CVE-2026-33250longturn freeciv21 crash when receiving specially-crafted packets7.5CNA v3.11.2%2026-03-24Fix
CVE-2026-33242Salvo has a path traversal in salvo-proxy::encode_url_path allows API Gateway Bypass7.5CNA v3.10.6%2026-03-24Fix
CVE-2026-33241Salvo affected by denial of service via Unbounded Memory Allocation in Form Data Parsing8.7CNA v4.00.5%2026-03-24Fix
CVE-2026-33215nats-io nats-server NATS is vulnerable to MQTT hijacking via Client ID6.5CNA v3.10.3%2026-03-24Fix
CVE-2026-33202Rails Active Storage has possible glob injection in its DiskService6.6CNA v4.00.8%2026-03-24Fix
CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpers6.6CNA v4.01.0%2026-03-24Fix
CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests6.6CNA v4.00.7%2026-03-24Fix
CVE-2026-33173Rails Active Storage has possible content type bypass via metadata in direct uploads5.3CNA v4.00.4%2026-03-24Fix
CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%5.3CNA v4.00.4%2026-03-24Fix
CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimited6.9CNA v4.00.6%2026-03-24Fix
CVE-2026-33162Craft CMS move-to-section endpoint missing authorization4.9CNA v4.00.4%2026-03-24Fix
CVE-2026-33161Craft CMS image editor endpoint missing authorization1.3CNA v4.00.3%2026-03-24Fix
CVE-2026-33160Craft CMS: Anonymous generate transform calls for assets can expose private assets via transform URL2.7CNA v4.00.4%2026-03-24Fix
CVE-2026-33159Craft CMS: Unauthenticated Users can Perform Restricted Project Config Sync Operations6.9CNA v4.00.4%2026-03-24Fix
CVE-2026-33158Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)4.9CNA v4.00.4%2026-03-24Fix
CVE-2026-33157Craft CMS: Potential authenticated remote code execution via malicious attached Behavior8.6CNA v4.01.1%2026-03-24Exploit codeFix
CVE-2026-32948sbt VCS command execution OS command injection6.7CNA v4.00.3%2026-03-24Fix
CVE-2026-32854LibVNCServer httpd proxy null pointer dereference7.5v3.15.3%2026-03-24Fix
CVE-2026-32853LibVNCServer UltraZip Encoding Heap out-of-bounds read8.1v3.10.4%2026-03-24Fix
CVE-2026-32647F5 NGINX MP4 module out-of-bounds read8.5CNA v4.00.3%2026-03-24Fix
CVE-2026-32642Apache Artemis: Unauthorized Temporary Address Creation via OpenWire protocol2.3CNA v4.00.6%2026-03-24Fix
CVE-2026-30932Froxlor is vulnerable to BIND zone file injection8.6CNA v4.00.7%2026-03-24Fix
CVE-2026-30662Concrete CMS ConcreteCMS is vulnerable to denial of service during Bulk Downloads6.5v3.10.3%2026-03-24
CVE-2026-30661Idreamsoft iCMS cross-site scripting6.1CISA ADP v3.10.3%2026-03-24
CVE-2026-30655Esiclivre Solicitante::resetaSenha SQL injection6.5CISA ADP v3.10.4%2026-03-24
CVE-2026-30653free5gc denial of service7.5v3.10.4%2026-03-24
CVE-2026-29840jizhiCMS cross-site scripting5.4CISA ADP v3.10.3%2026-03-24
CVE-2026-29839DedeCMS cross-site request forgery8.8CISA ADP v3.10.2%2026-03-24
CVE-2026-29772Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands5.9CNA v3.10.4%2026-03-24Fix
CVE-2026-28755F5 NGINX stream SSL module vulnerability5.3CNA v4.00.2%2026-03-24Fix
CVE-2026-28753F5 NGINX SMTP proxy module CRLF injection6.3CNA v4.00.3%2026-03-24Fix
CVE-2026-27784F5 NGINX Open Source mp4 module integer overflow8.5CNA v4.01.0%2026-03-24Fix
CVE-2026-27654F5 NGINX Open Source heap-based buffer overflow8.8CNA v4.025.1%2026-03-24Exploit codeFix
CVE-2026-27651F5 NGINX mail auth HTTP module null pointer dereference8.7CNA v4.00.9%2026-03-24Fix
CVE-2026-24159NVIDIA NeMo Framework contains a vulnerability leading to remote code execution7.8CNA v3.10.6%2026-03-24Fix
CVE-2026-24158NVIDIA Triton Inference Server excessive memory allocation7.5CNA v3.10.4%2026-03-24Fix
CVE-2026-24157NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading7.8CNA v3.10.7%2026-03-24Fix
CVE-2026-24152NVIDIA Megatron-LM deserialization of untrusted data7.8CNA v3.10.2%2026-03-24Fix
CVE-2026-24151NVIDIA Megatron-LM deserialization of untrusted data7.8CNA v3.10.2%2026-03-24Fix
CVE-2026-24150NVIDIA Megatron-LM deserialization of untrusted data7.8CNA v3.10.2%2026-03-24Fix
CVE-2026-24141NVIDIA Model Optimizer deserialization of untrusted data7.8CNA v3.10.2%2026-03-24Fix
CVE-2026-23924Zabbix agent 2 Docker plugin arbitrary file read via Docker API injection6.1CNA v4.00.2%2026-03-24Fix
CVE-2026-23923Zabbix unauthenticated arbitrary PHP class instantiation6.9CNA v4.00.3%2026-03-24Fix
CVE-2026-23921Blind, read-only SQL injection in Zabbix API via sortfield parameter8.7CNA v4.04.1%2026-03-24Exploit codeFix
CVE-2026-23920Zabbix host and event action scripts OS command injection7.7CNA v4.00.3%2026-03-24Fix
CVE-2026-23919Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server7.1CNA v4.00.2%2026-03-24Fix
CVE-2026-22739Spring Cloud Config Server: Path traversal via Profile parameter allows arbitrary File Access8.6CNA v3.11.2%2026-03-24NucleiFix
CVE-2026-22559Ubiquiti UniFi Network Server An improper input validation8.8CNA v3.10.4%2026-03-24Fix
CVE-2026-21790HCL Traveler is susceptible to a weak default HTTP header validation vulnerability6.3CNA v3.10.2%2026-03-24Fix
CVE-2026-21783HCL Traveler is affected by sensitive information disclosure4.3CNA v3.10.3%2026-03-24Fix
CVE-2026-4779SourceCodester Sales and Inventory System update_customer_details.php SQL injection8.8v3.10.5%2026-03-24
CVE-2026-4778SourceCodester Sales and Inventory System HTTP GET parameter update_category.php SQL injection6.5v3.10.4%2026-03-24
CVE-2026-4777SourceCodester Sales and Inventory System POST parameter view_supplier.php SQL injection6.5v3.10.4%2026-03-24
CVE-2026-4775LibTIFF: LibTIFF: Arbitrary code execution or denial of service7.8CNA v3.10.4%2026-03-24Fix
CVE-2026-4756Out-of-bounds write in MolotovCherry Android-ImageMagick77.8CNA v3.10.2%2026-03-24
CVE-2026-4755Android-ImageMagick7 improper input validation9.8CNA v3.10.5%2026-03-24
CVE-2026-4754Android-ImageMagick7 cross-site scripting6.1CNA v3.10.2%2026-03-24
CVE-2026-4753Out-of-bounds read in slajerek RetroDebugger9.1CNA v3.10.5%2026-03-24
CVE-2026-4752No-Chicken Echo-Mate use-after-free6.4CNA v3.10.1%2026-03-24
CVE-2026-4751Null pointer dereference in tmate-io tmate5.3CNA v3.10.4%2026-03-24
CVE-2026-4750Out-of-bounds read in fabiangreffrath woof9.1CNA v3.10.5%2026-03-24Fix
CVE-2026-4749NVD-CWE-noinfo vulnerability in albfan miraclecast.This issue affects miraclecast: before v1.0.6.5CNA v3.10.3%2026-03-24
CVE-2026-4746Heap Buffer Over-Write Vulenrabilty in timeplus-io/proton10.0CNA v4.00.4%2026-03-24
CVE-2026-4745Arbitrary code execution via Crafted Bytecode in dendibakh/perf-ninja10.0CNA v4.00.4%2026-03-24
CVE-2026-4744Notepad3 Bundled Oniguruma compile_string_node heap buffer overflow9.3CNA v4.00.2%2026-03-24
CVE-2026-4743Null-pointer dereference vulnerability in taurusxin/ncmdump5.2CNA v4.00.2%2026-03-24
CVE-2026-4742HTTP request smuggling in visualfc/liteide2.9CNA v4.00.3%2026-03-24
CVE-2026-4741Path traversal vulnerability in TeamJCD/JoyConDroid8.6CNA v4.00.5%2026-03-24
CVE-2026-4739Integer overflow vulnerabilities in InsightSoftwareConsortium/ITK9.4CNA v4.00.4%2026-03-24
CVE-2026-4738OSGeo GDAL bundled zlib vulnerability9.4CNA v4.00.4%2026-03-24Fix
CVE-2026-4737No-Chicken Echo-Mate use-after-free7.3CNA v4.00.1%2026-03-24
CVE-2026-4736No-Chicken Echo-Mate netfilter subsystem vulnerability7.3CNA v4.00.1%2026-03-24
CVE-2026-4735A stack overflow and DoS vulnerability in DTStack/chunjun8.7CNA v4.00.5%2026-03-24
CVE-2026-4734Heap buffer overflow in yoyofr/modizer9.4CNA v4.00.4%2026-03-24
CVE-2026-4733Information disclosure in ixray-1.6-stcop5.3CNA v3.10.4%2026-03-24
CVE-2026-4732Out-of-bounds read Overflow in tildearrow/Furnace8.4CNA v4.00.2%2026-03-24
CVE-2026-4731An integer overflow vulnerability in artraweditor/ART8.5CNA v4.00.2%2026-03-24
CVE-2026-4729Mozilla memory safety bugs fixed in Firefox 149 and Thunderbird 1499.8CISA ADP v3.10.5%2026-03-24Fix
CVE-2026-4728Mozilla Firefox spoofing issue in the Privacy: Anti-Tracking component6.5v3.10.2%2026-03-24Fix
CVE-2026-4727Mozilla Firefox denial of service in the Libraries component in NSS7.5v3.10.5%2026-03-24Fix
CVE-2026-4726Mozilla Firefox denial of service in the XML component7.5v3.10.5%2026-03-24Fix
CVE-2026-4725Mozilla Firefox sandbox escape due to use-after-free in the Graphics: Canvas2D component10.0v3.10.3%2026-03-24Fix
CVE-2026-4724Mozilla Firefox undefined behavior in the Audio/Video component9.1v3.10.3%2026-03-24Fix
CVE-2026-4723Mozilla Firefox use-after-free in the JavaScript Engine component9.8v3.10.4%2026-03-24Fix
CVE-2026-4722Mozilla Firefox privilege escalation in the IPC component8.8CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4721Mozilla Firefox memory safety bugs9.8CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4720Mozilla memory safety bugs fixed in Firefox ESR, Thunderbird ESR, Firefox 149 and Thunderbird 1499.8CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4719Mozilla Firefox incorrect boundary conditions in the Graphics: Text component7.5v3.10.4%2026-03-24Fix
CVE-2026-4718Mozilla Firefox undefined behavior in the WebRTC: Signaling component8.1v3.10.3%2026-03-24Fix
CVE-2026-4717Mozilla Firefox privilege escalation in the Netmonitor component9.8v3.10.4%2026-03-24Fix
CVE-2026-4716Mozilla Firefox and Thunderbird JavaScript engine vulnerability9.1v3.10.4%2026-03-24Fix
CVE-2026-4715Mozilla Firefox uninitialized memory in the Graphics: Canvas2D component9.1v3.10.4%2026-03-24Fix
CVE-2026-4714Mozilla Firefox incorrect boundary conditions in the Audio/Video component7.5v3.10.4%2026-03-24Fix
CVE-2026-4713Mozilla Firefox incorrect boundary conditions in the Graphics component7.5v3.10.4%2026-03-24Fix
CVE-2026-4712Mozilla Firefox information disclosure in the Widget: Cocoa component7.5v3.10.4%2026-03-24Fix
CVE-2026-4711Mozilla Firefox use-after-free in the Widget: Cocoa component9.8v3.10.4%2026-03-24Fix
CVE-2026-4710Mozilla Firefox incorrect boundary conditions in the Audio/Video component9.8v3.10.4%2026-03-24Fix
CVE-2026-4709Mozilla Firefox incorrect boundary conditions in the Audio/Video: GMP component7.5v3.10.5%2026-03-24Fix
CVE-2026-4708Mozilla Firefox incorrect boundary conditions in the Graphics component7.5v3.10.4%2026-03-24Fix
CVE-2026-4707Mozilla Firefox incorrect boundary conditions in the Graphics: Canvas2D component7.5v3.10.6%2026-03-24Fix
CVE-2026-4706Mozilla Firefox incorrect boundary conditions in the Graphics: Canvas2D component7.5v3.10.5%2026-03-24Fix
CVE-2026-4705Mozilla Firefox undefined behavior in the WebRTC: Signaling component9.8v3.10.4%2026-03-24Fix
CVE-2026-4704Mozilla Firefox denial of service in the WebRTC: Signaling component7.5v3.10.4%2026-03-24Fix
CVE-2026-4702Mozilla Firefox JIT miscompilation in the JavaScript Engine component9.8v3.10.5%2026-03-24Fix
CVE-2026-4701Mozilla Firefox use-after-free in the JavaScript Engine component9.8v3.10.5%2026-03-24Fix
CVE-2026-4700Mozilla Firefox mitigation bypass in the Networking: HTTP component9.8v3.10.5%2026-03-24Fix
CVE-2026-4699Mozilla Firefox incorrect boundary conditions in the Layout: Text and Fonts component7.5v3.10.7%2026-03-24Fix
CVE-2026-4698Mozilla Firefox JIT miscompilation in the JavaScript Engine: JIT component9.8v3.10.8%2026-03-24Fix
CVE-2026-4697Mozilla Firefox incorrect boundary conditions in the Audio/Video: Web Codecs component7.5v3.10.7%2026-03-24Fix
CVE-2026-4696Mozilla Firefox use-after-free in the Layout: Text and Fonts component9.8v3.10.5%2026-03-24Fix
CVE-2026-4695Mozilla Firefox incorrect boundary conditions in the Audio/Video: Web Codecs component7.5v3.10.7%2026-03-24Fix
CVE-2026-4694Mozilla Firefox incorrect boundary conditions, integer overflow in the Graphics component7.5v3.10.8%2026-03-24Fix
CVE-2026-4693Mozilla Firefox incorrect boundary conditions in the Audio/Video: Playback component7.5v3.10.7%2026-03-24Fix
CVE-2026-4692Mozilla Firefox sandbox escape in the Responsive Design Mode component10.0v3.10.5%2026-03-24Fix
CVE-2026-4691Mozilla Firefox use-after-free in the CSS Parsing and Computation component9.8v3.10.5%2026-03-24Fix
CVE-2026-4690Mozilla Firefox and Thunderbird XPCOM integer overflow8.6NVD v3.10.8%2026-03-24Fix
CVE-2026-4689Mozilla Firefox and Thunderbird XPCOM integer overflow10.0v3.10.7%2026-03-24Fix
CVE-2026-4688Mozilla Firefox sandbox escape due to use-after-free in the Disability Access APIs component10.0v3.10.5%2026-03-24Fix
CVE-2026-4687Mozilla Firefox sandbox escape due to incorrect boundary conditions in the Telemetry component8.6NVD v3.10.5%2026-03-24Fix
CVE-2026-4686Mozilla Firefox incorrect boundary conditions in the Graphics: Canvas2D component7.5v3.10.7%2026-03-24Fix
CVE-2026-4685Mozilla Firefox incorrect boundary conditions in the Graphics: Canvas2D component7.5v3.10.7%2026-03-24Fix
CVE-2026-4684Mozilla Firefox race condition, use-after-free in the Graphics: WebRender component7.5CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4680Google Chrome FedCM use-after-free8.8CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4679Google Chrome Fonts integer overflow8.8CISA ADP v3.10.3%2026-03-24Fix
CVE-2026-4678Google Chrome WebGPU use-after-free8.8CISA ADP v3.10.5%2026-03-24Fix
CVE-2026-4677Google Chrome WebAudio inappropriate implementation8.8CISA ADP v3.10.3%2026-03-24Fix
CVE-2026-4676Google Chrome Dawn use-after-free8.8CISA ADP v3.10.3%2026-03-24Fix
CVE-2026-4675Google Chrome WebGL heap-based buffer overflow8.8CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4674Google Chrome CSS out-of-bounds read8.8CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4673Google Chrome WebAudio heap-based buffer overflow8.8CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-4662JetEngine WordPress plugin unauthenticated SQL injection via Listing Grid filtered_query parameter7.5CNA v3.10.5%2026-03-24Fix
CVE-2026-4649KNIME Business Hub auth bypass in Apache Artemis allows reading all internal messages5.3CNA v4.00.5%2026-03-24Fix
CVE-2026-4640Galaxy Software Services｜Vitals ESP missing authentication8.7CNA v4.00.7%2026-03-24Fix
CVE-2026-4639Galaxy Software Services｜Vitals ESP incorrect authorization8.7CNA v4.00.5%2026-03-24Fix
CVE-2026-4632itsourcecode Online Enrollment System parameter index.php SQL injection6.9CNA v4.00.4%2026-03-24
CVE-2026-4627D-Link DIR-825 command injection8.6CNA v4.03.4%2026-03-24
CVE-2026-4626Projectworlds Lawyer Management System lawyer_booking.php cross-site scripting5.4v3.10.3%2026-03-24
CVE-2026-4625SourceCodester Online Admission System programmes.php SQL injection6.9CNA v4.00.4%2026-03-24
CVE-2026-4624SourceCodester Online Library Management System parameter home.php SQL injection6.9CNA v4.00.4%2026-03-24
CVE-2026-4623DefaultFuction Jeson Customer Relationship Management System server-side request forgery6.9CNA v4.00.5%2026-03-24
CVE-2026-4617SourceCodester Patients Waiting Area Queue Management System improper authorization6.9CNA v4.00.5%2026-03-24
CVE-2026-4616bolo-blog Article Title article cross-site scripting4.8CNA v4.00.4%2026-03-24
CVE-2026-4615SourceCodester Online Catering Reservation search.php SQL injection6.9CNA v4.00.4%2026-03-24
CVE-2026-4614itsourcecode sanitize or validate this input parameter subjects.php SQL injection5.3CNA v4.00.3%2026-03-24
CVE-2026-4613SourceCodester E-Commerce Site products.php SQL injection6.9CNA v4.00.4%2026-03-24
CVE-2026-4433Tenable Operation Technology configuration weakness1.9CNA v4.00.3%2026-03-24
CVE-2026-4371Mozilla Thunderbird out-of-bounds read in IMAP parsing7.4CISA ADP v3.10.6%2026-03-24Fix
CVE-2026-4283legalweb WP DSGVO Tools (GDPR) super-unsubscribe AJAX action missing authorization9.1CNA v3.10.7%2026-03-24Fix
CVE-2026-4056User Registration and Membership WordPress plugin unauthorized access5.4CNA v3.10.3%2026-03-24Fix
CVE-2026-4021Contest Gallery WordPress plugin unauthenticated privilege escalation admin account takeover8.1CNA v3.10.7%2026-03-24Fix
CVE-2026-4001Woocommerce Custom Product Addons Pro WordPress plugin unauthenticated remote code execution9.8CNA v3.11.0%2026-03-24Fix
CVE-2026-3912TIBCO ActiveMatrix BusinessWorks injection8.7CNA v4.00.4%2026-03-24Fix
CVE-2026-3889Mozilla spoofing issue in Thunderbird6.5CISA ADP v3.10.4%2026-03-24Fix
CVE-2026-3533JupiterX Core WordPress plugin missing authorization limited file upload8.8CNA v3.11.0%2026-03-24Fix
CVE-2026-3509CODESYS Control Audit Log format string DoS7.5CNA v3.10.6%2026-03-24Fix
CVE-2026-3138WBW Product Filter for WooCommerce filter deletion AJAX handler missing authorization6.5CNA v3.10.5%2026-03-24Fix
CVE-2026-3079LearnDash LMS WordPress plugin SQL injection6.5CNA v3.10.5%2026-03-24Fix
CVE-2026-2417Missing authentication for critical function in Pharos Controls Mosaic Show Controller9.3CNA v4.00.6%2026-03-24Fix
CVE-2026-1995IDrive Cloud Backup Client for Windows contains a privilege escalation7.8CISA ADP v3.10.2%2026-03-24
CVE-2026-33723AVideo vulnerable to SQL injection in Subscribe endpoint7.1CNA v3.10.2%2026-03-23
CVE-2026-33719AVideo vulnerable to Unauthenticated CDN Configuration takeover8.6CNA v3.10.5%2026-03-23
CVE-2026-33717AVideo vulnerable to remote code execution8.8CNA v3.10.5%2026-03-23
CVE-2026-33716WWBN AVideo live stream control token verification improper authentication9.4CNA v3.10.6%2026-03-23
CVE-2026-33690AVideo vulnerable to IP Address spoofing via Untrusted HTTP headers in getRealIpAddr5.3CNA v3.10.3%2026-03-23
CVE-2026-33688AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery endpoint5.3CNA v3.10.4%2026-03-23
CVE-2026-33685WWBN AVideo ad campaign reports endpoint missing authorization5.3CNA v3.10.4%2026-03-23
CVE-2026-33683AVideo vulnerable to stored XSS5.4CNA v3.10.2%2026-03-23
CVE-2026-33681AVideo has path traversal in pluginRunDatabaseScript.json.php enables arbitrary SQL File Execution7.2CNA v3.10.6%2026-03-23
CVE-2026-33651AVideo has a blind SQL injection in Live Schedule Reminder8.1CNA v3.10.5%2026-03-23
CVE-2026-33650AVideo's Video Moderator privilege escalation7.6CNA v3.10.3%2026-03-23
CVE-2026-33649AVideo's GET-based CSRF in setPermission.json.php enables privilege escalation8.1CNA v3.10.2%2026-03-23
CVE-2026-33648AVideo vulnerable to OS command injection8.8CNA v3.10.9%2026-03-23
CVE-2026-33647AVideo vulnerable to remote code execution via MIME/Extension Mismatch in ImageGallery file upload8.8CNA v3.10.8%2026-03-23
CVE-2026-33634Aquasecurity Trivy embedded malicious code9.4CNA v4.01.7%2026-03-23KEVExploit codeFix
CVE-2026-33548MantisBT has stored HTML injection / XSS when displaying Tags in Timeline8.6CNA v4.00.3%2026-03-23Fix
CVE-2026-33517MantisBT vulnerable to stored HTML injection in Tag Delete Confirmation8.6CNA v4.00.4%2026-03-23Fix
CVE-2026-33513AVideo has an unauthenticated local file inclusion in API locale (RCE possible with writable PHP)8.6CNA v3.10.7%2026-03-23
CVE-2026-33512AVideo has an unauthenticated decrypt oracle leaking any ciphertext7.5CNA v3.10.3%2026-03-23
CVE-2026-33507AVideo affected by CSRF on Plugin Import endpoint enables unauthenticated remote code execution8.8CNA v3.10.3%2026-03-23
CVE-2026-33502AVideo has unauthenticated SSRF via plugin/Live/test.php9.3CNA v3.10.4%2026-03-23
CVE-2026-33501AVideo has unauthenticated information disclosure of User Group Permission Mappings5.3CNA v3.10.5%2026-03-23
CVE-2026-33500AVideo vulnerable to stored XSS5.4CNA v3.10.3%2026-03-23
CVE-2026-33499AVideo has reflected XSS via unlockPassword parameter in forbiddenPage.php and warningPage.php6.1CNA v3.10.3%2026-03-23
CVE-2026-33493WWBN AVideo import.json.php path traversal7.1CNA v3.10.4%2026-03-23
CVE-2026-33492AVideo has session fixation via GET PHPSESSID parameter with Disabled Login Session Regeneration7.3CNA v3.10.4%2026-03-23
CVE-2026-33488WWBN AVideo LoginControl PGP two-factor authentication vulnerability7.4CNA v3.10.3%2026-03-23
CVE-2026-33485AVideo has an unauthenticated blind SQL injection in RTMP on_publish Callback7.5CNA v3.10.5%2026-03-23
CVE-2026-33483WWBN AVideo encoder chunk upload endpoint resource exhaustion7.5CNA v3.10.7%2026-03-23
CVE-2026-33482AVideo has an OS command injection via $ Shell Substitution Bypass in sanitizeFFmpegCommand8.1CNA v3.14.7%2026-03-23
CVE-2026-33480AVideo has a SSRF Protection Bypass8.6CNA v3.10.4%2026-03-23
CVE-2026-33479AVideo has PHP code injection8.8CNA v3.10.7%2026-03-23
CVE-2026-33478AVideo Multi-Chain Attack: Unauthenticated remote code execution10.0CNA v3.111.2%2026-03-23Reported exploitedNuclei
CVE-2026-33354WWBN AVideo encoder chunk upload endpoint vulnerability7.6CNA v3.10.3%2026-03-23
CVE-2026-33352AVideo has an unauthenticated SQL injection via `doNotShowCats` Parameter (Backslash Escape Bypass)9.8CNA v3.10.5%2026-03-23Fix
CVE-2026-33351AVideo has unauthenticated SSRF9.1CNA v3.10.5%2026-03-23Fix
CVE-2026-33297AVideo has an IDOR any Admin can Set another User's Channel Password via setPassword.json.php5.1CNA v4.00.5%2026-03-23Fix
CVE-2026-33211Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod9.6CNA v3.10.7%2026-03-23Fix
CVE-2026-33195Rails Active Storage has possible path traversal in DiskService8.0CNA v4.00.7%2026-03-23Fix
CVE-2026-33168Rails has a possible XSS vulnerability in its action view tag helpers2.3CNA v4.00.9%2026-03-23Fix
CVE-2026-33167Rails has a possible XSS vulnerability in its Action Pack debug exceptions1.3CNA v4.00.3%2026-03-23Fix
CVE-2026-33046Indico discloses local files resulting in remote code execution through LaTeX injection7.7CNA v4.01.0%2026-03-23Fix
CVE-2026-32969MB connect line mbCONNECT24 Pre-Auth Blind SQLi in userinfo endpoint7.5CNA v3.10.6%2026-03-23Fix
CVE-2026-32968MB connect line mbCONNECT24 unauthenticated RCE in com_mb24sysapi9.8CNA v3.10.8%2026-03-23Fix
CVE-2026-32913OpenClaw Custom Authorization Header Leakage via Cross-Origin Redirects9.1NVD v3.10.4%2026-03-23Fix
CVE-2026-32879QuantumNous New API passkey step-up verification improper authentication4.9CNA v3.10.5%2026-03-23Fix
CVE-2026-32852MailEnable reflected XSS via FreeBusy.aspx StartDate parameter6.1v3.10.5%2026-03-23Fix
CVE-2026-32851MailEnable reflected XSS via FreeBusy.aspx StartDate parameter6.1v3.10.5%2026-03-23Fix
CVE-2026-32850MailEnable reflected XSS via ManageShares.aspx SelectedIndex parameter6.1v3.10.5%2026-03-23Fix
CVE-2026-32845jkuhlmann / cgltf Sparse Accessor Validation integer overflow6.9CNA v4.00.2%2026-03-23
CVE-2026-32300Connect-CMS My Page profile update feature improper authorization8.1CNA v3.10.4%2026-03-23Fix
CVE-2026-32299opensource-workshop connect-cms connect CMS: Information disclosure due to improper authorization7.5CNA v3.10.5%2026-03-23Fix
CVE-2026-32279Connect-CMS Page Management plugin server-side request forgery6.8CNA v3.10.5%2026-03-23Fix
CVE-2026-32278Connect-CMS Form plugin file field stored cross-site scripting8.2CNA v3.10.4%2026-03-23Fix
CVE-2026-32277Connect-CMS has DOM-based cross-site scripting (XSS) in the Cabinet Plugin List view8.7CNA v3.10.4%2026-03-23Fix
CVE-2026-32276Connect-CMS has arbitrary code execution by an Authenticated User in its Code Study plugin8.8CNA v3.10.8%2026-03-23Fix
CVE-2026-31851Nexxt Nebula 300+ lack of Rate Limiting enables brute-force Attacks9.8v3.10.7%2026-03-23
CVE-2026-31850Plaintext storage of Credentials in Configuration Backup in Nexxt Nebula 300+4.9v3.10.3%2026-03-23
CVE-2026-31849Missing CSRF Protection on Administrative endpoints in Nexxt Nebula 300+6.5NVD v3.10.2%2026-03-23
CVE-2026-31848Reversible ecos_pw Cookie allows authentication bypass in Nexxt Nebula 300+9.8v3.10.5%2026-03-23
CVE-2026-31847Hidden functionality enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+8.8v3.10.7%2026-03-23
CVE-2026-31846Unauthenticated credential disclosure via /goform/ate in Nexxt Nebula 300+7.1CNA v4.00.4%2026-03-23
CVE-2026-30886QuantumNous new-api new API: IDOR in VideoProxy allows cross-user video content access6.5CNA v3.10.4%2026-03-23Fix
CVE-2026-30849MantisBT SOAP API has an authentication bypass vulnerability on MySQL9.3CNA v4.02.4%2026-03-23NucleiExploit codeFix
CVE-2026-30007XnView Nconvert use-after-free6.2CISA ADP v3.10.2%2026-03-23
CVE-2026-30006XnView Nconvert buffer overflow6.2CISA ADP v3.10.2%2026-03-23
CVE-2026-29111systemd PID 1 IPC API denial of service5.5CNA v3.10.2%2026-03-23Fix
CVE-2026-28809XXE in esaml SAML library allows local file read and potential SSRF5.3NVD v3.10.5%2026-03-23Fix
CVE-2026-27646OpenClaw sandbox escape via /acp spawn command7.1NVD v3.10.2%2026-03-23Fix
CVE-2026-27183OpenClaw Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch5.3v3.10.2%2026-03-23Fix
CVE-2026-27131putyourlightson Sprig Sprig Playground information disclosure5.5CNA v3.10.4%2026-03-23Fix
CVE-2026-26829safe_atou64 function null pointer dereference7.5CISA ADP v3.11.6%2026-03-23
CVE-2026-26828daap_reply_playlists function null pointer dereference7.5CISA ADP v3.10.6%2026-03-23
CVE-2026-26209cbor2 has a denial of service via uncontrolled recursion in cbor2.loads7.5CNA v3.00.6%2026-03-23Fix
CVE-2026-25075strongSwan EAP-TTLS AVP Parsing integer underflow8.7CNA v4.01.1%2026-03-23Fix
CVE-2026-24516DigitalOcean Droplet agent: Command injection via Metadata service endpoint8.8CISA ADP v3.12.6%2026-03-23Exploit code
CVE-2026-23882Blinko: Admin RCE MCP server command injection8.6CNA v4.00.4%2026-03-23Fix
CVE-2026-23555Xen xenstored DoS by unprivileged domain7.1v3.10.2%2026-03-23Fix
CVE-2026-23554Xen use-after-free of paging structures in EPT7.8CISA ADP v3.10.1%2026-03-23Fix
CVE-2026-23488Blinko: Multiple interfaces in the comment feature allow unauthorized access6.9CNA v4.00.3%2026-03-23Fix
CVE-2026-23487Blinko: IDOR user.detail endpoint leaks superadmin token6.0CNA v4.00.2%2026-03-23Fix
CVE-2026-23486Blinko: Unauthorized user information leak6.9CNA v4.00.7%2026-03-23NucleiFix
CVE-2026-23485Blinko: Unauthorized path traversal File Enumeration music-metadata6.9CNA v4.00.3%2026-03-23Fix
CVE-2026-23484Blinko: Authenticated arbitrary file write saveDevPlugin5.3CNA v4.00.3%2026-03-23Fix
CVE-2026-23483Blinko: Unauthorized arbitrary file read /plugins6.9CNA v4.00.8%2026-03-23NucleiFix
CVE-2026-23482Blinko: Unauthorized arbitrary file read /API/file/temp8.2CNA v4.01.5%2026-03-23NucleiFix
CVE-2026-23481Blinko: Authenticated arbitrary file write saveAdditionalDevFile5.3CNA v4.00.4%2026-03-23Fix
CVE-2026-23480Blinko: Low privilege user privilege escalation upsertUser endpoint5.3CNA v4.00.3%2026-03-23Fix
CVE-2026-4681Critical remote code execution vulnerability reported in Windchill9.3CNA v4.00.8%2026-03-23Fix
CVE-2026-4647Binutils: Out-of-bounds read in xcoff relocation processing in GNU Binutils bfd library6.1NVD v3.10.2%2026-03-23Fix
CVE-2026-4633Keycloak: Keycloak: User enumeration via differential error messages3.7CNA v3.10.5%2026-03-23Fix
CVE-2026-4628Red Hat build of Keycloak improper access control4.3CNA v3.10.3%2026-03-23Fix
CVE-2026-4612itsourcecode Free Hotel Reservation System parameter index.php SQL injection6.9CNA v4.00.4%2026-03-23
CVE-2026-4611TOTOLINK X6000R shttpd setLanCfg privilege escalation8.8v3.15.3%2026-03-23
CVE-2026-4606GeoVision ERM Improper Privilege Assignment leads to SYSTEM-Level Privilege10.0CNA v4.00.4%2026-03-23
CVE-2026-4603jsrsasign divide by zero5.3v3.10.1%2026-03-23Fix
CVE-2026-4602jsrsasign incorrect numeric conversion8.7CNA v4.00.9%2026-03-23Fix
CVE-2026-4601jsrsasign missing cryptographic step9.1v3.10.5%2026-03-23Fix
CVE-2026-4600jsrsasign improper signature verification9.1v3.10.3%2026-03-23Fix
CVE-2026-4599Kjur jsrsasign DSA nonce generation vulnerability9.3CNA v4.00.8%2026-03-23Fix
CVE-2026-4598jsrsasign is vulnerable to DoS through infinite loop when processing zero or negative inputs8.7CNA v4.01.0%2026-03-23Fix
CVE-2026-4597648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll SQL injection5.3CNA v4.00.3%2026-03-23
CVE-2026-4596Projectworlds Lawyer Management System lawyers.php cross-site scripting5.4v3.10.3%2026-03-23
CVE-2026-4595code-projects Exam Form Submission update_s6.php cross-site scripting4.8CNA v4.00.4%2026-03-23
CVE-2026-4594erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy SQL injection6.9CNA v4.00.4%2026-03-23
CVE-2026-4593erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery SQL injection5.3CNA v4.00.3%2026-03-23
CVE-2026-4592kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication6.3CNA v4.00.6%2026-03-23
CVE-2026-4591kalcaddle kodbox fileThumb endpoint app.php checkBin os command injection5.1CNA v4.03.4%2026-03-23
CVE-2026-4590kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery2.3CNA v4.00.2%2026-03-23
CVE-2026-4589kalcaddle kodbox fileGet endpoint editor.class.php PathDriverUrl server-side request forgery5.3CNA v4.00.3%2026-03-23
CVE-2026-4588kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key6.3CNA v4.00.4%2026-03-23
CVE-2026-4587HybridAuth SSL Curl.php certificate validation6.3CNA v4.00.3%2026-03-23
CVE-2026-4586CodePhiliaX Chat2DB JDBC driver Upload JdbcDriverController.java upload unrestricted upload5.3CNA v4.00.4%2026-03-23
CVE-2026-4585Tiandy Easy7 Integrated Management Platform Configuration Handler OS command injection9.3CNA v4.05.7%2026-03-23
CVE-2026-4584Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission2.3CNA v4.00.2%2026-03-23
CVE-2026-4583Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay2.3CNA v4.00.4%2026-03-23
CVE-2026-4582Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication2.3CNA v4.00.4%2026-03-23
CVE-2026-4581code-projects Simple Laundry System parameters checklogin.php SQL injection9.8v3.10.5%2026-03-23
CVE-2026-4580code-projects Simple Laundry System parameters checkupdatestatus.php SQL injection9.8v3.10.6%2026-03-23
CVE-2026-4579code-projects Simple Laundry System parameters viewdetail.php SQL injection9.8v3.10.6%2026-03-23
CVE-2026-4578code-projects Exam Form Submission update_s3.php cross-site scripting4.8CNA v4.00.4%2026-03-23
CVE-2026-4577code-projects Exam Form Submission update_s4.php cross-site scripting4.8CNA v4.00.4%2026-03-23
CVE-2026-4576code-projects Exam Form Submission update_s5.php cross-site scripting4.8CNA v4.00.4%2026-03-23
CVE-2026-4575code-projects Exam Form Submission update_s2.php cross-site scripting4.8CNA v4.00.4%2026-03-23
CVE-2026-4574SourceCodester Simple E-Learning System User Profile Update SQL injection5.3CNA v4.00.3%2026-03-23
CVE-2026-4573SourceCodester Simple E-Learning System HTTP GET parameter delete_post.php SQL injection5.3CNA v4.00.3%2026-03-23
CVE-2026-4572SourceCodester Sales and Inventory System HTTP POST request view_product.php SQL injection6.5v3.10.4%2026-03-23
CVE-2026-4571SourceCodester Sales and Inventory System HTTP POST request view_payments.php SQL injection6.5v3.10.4%2026-03-23
CVE-2026-4570SourceCodester Sales and Inventory System HTTP POST request view_customers.php SQL injection8.8v3.10.5%2026-03-23
CVE-2026-4569SourceCodester Sales and Inventory System HTTP POST request view_category.php SQL injection6.5v3.10.4%2026-03-23
CVE-2026-4568SourceCodester Sales and Inventory System HTTP GET request update_supplier.php SQL injection6.5v3.10.4%2026-03-23
CVE-2026-4567Tenda A15 UploadCfg stack-based overflow9.3CNA v4.01.3%2026-03-23
CVE-2026-4566Belkin F9K1122 formWISP5G stack-based overflow8.7CNA v4.01.1%2026-03-23
CVE-2026-4565Tenda AC21 SetNetControlList formSetQosBand buffer overflow8.7CNA v4.01.0%2026-03-23
CVE-2026-4564yangzongzhuan RuoYi Quartz Job job code injection5.1CNA v4.00.4%2026-03-23
CVE-2026-4563MacCMS Member Order Detail User.php order_info authorization5.3CNA v4.00.4%2026-03-23
CVE-2026-4562MacCMS Timming API Endpoint Timming.php weak authentication6.9CNA v4.00.7%2026-03-23
CVE-2026-4404Harbor allows the use of the default password for web UI login9.4CISA ADP v3.10.6%2026-03-23Fix
CVE-2026-4368NetScaler ADC race condition leading to User Session Mixup7.7CNA v4.00.3%2026-03-23
CVE-2026-4306WP Job Portal WordPress plugin unauthenticated SQL injection via radius parameter7.5CNA v3.10.5%2026-03-23Fix
CVE-2026-4066Smart Custom Fields WordPress plugin unauthorized access4.3CNA v3.10.3%2026-03-23Fix
CVE-2026-3635Fastify trustProxy header handling vulnerability6.1CNA v3.10.2%2026-03-23Fix
CVE-2026-3587WAGO Lean Managed Switch 852-1812 Hidden CLI function allows Root Access10.0CNA v3.10.7%2026-03-23Fix
CVE-2026-3225LearnPress WordPress plugin missing authorization authenticated arbitrary Quiz Answer deletion4.3CNA v3.10.3%2026-03-23Fix
CVE-2026-3055Citrix NetScaler out-of-bounds read9.3CNA v4.04.0%2026-03-23KEVNucleiMetasploitEmerging ThreatsExploit codeFix
CVE-2026-2580WP Maps WordPress plugin SQL injection7.5CNA v3.10.5%2026-03-23Fix
CVE-2026-2412Quiz and Survey Master (QSM) WordPress plugin SQL injection6.5CNA v3.10.3%2026-03-23Fix
CVE-2026-2298Salesforce Marketing Cloud Engagement command improper neutralization9.4CISA ADP v3.10.4%2026-03-23Fix
CVE-2026-1969ThemeREX Addons AJAX action handler arbitrary file upload5.3CISA ADP v3.10.3%2026-03-23Fix
CVE-2026-1958Hard-coded passwords in KlinikaXP8.7CNA v4.00.3%2026-03-23Fix
CVE-2026-1940Red Hat Enterprise Linux 10 out-of-bounds read7.5NVD v3.10.2%2026-03-23Fix
CVE-2026-0898Pegasystems Pega Robot Studio browser extension arbitrary file write9.0CNA v4.00.3%2026-03-23
CVE-2026-33550Alinto SOGo single-factor authentication2.6v3.10.1%2026-03-22Fix
CVE-2026-33549SPIP author data structure editing vulnerability8.8v3.10.2%2026-03-22Fix
CVE-2026-33319AVideo vulnerable to OS command injection via Unescaped URL in LinkedIn Video Upload Shell command5.9CNA v3.10.4%2026-03-22Fix
CVE-2026-33296AVideo has an open redirect via Unvalidated redirectUri in userLogin.php2.1CNA v4.00.3%2026-03-22Fix
CVE-2026-33295AVideo vulnerable to stored XSS via Unescaped Video Title in CDN downloadButtons.php8.2CNA v4.00.2%2026-03-22Fix
CVE-2026-33294AVideo has SSRF in BulkEmbed Thumbnail Fetch that allows Reading Internal Network Resources5.0CNA v3.10.3%2026-03-22Fix
CVE-2026-33293AVideo affected by arbitrary file deletion via path traversal in CloneSite deleteDump parameter8.1CNA v3.10.6%2026-03-22Fix
CVE-2026-33292AVideo has authorization bypass7.5CNA v3.10.6%2026-03-22Fix
CVE-2026-4558Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection8.7CNA v4.07.8%2026-03-22
CVE-2026-4557code-projects Exam Form Submission update_s1.php cross-site scripting5.3CNA v4.00.4%2026-03-22
CVE-2026-4555D-Link DIR-513 boa formEasySetTimezone memory corruption8.7CNA v4.01.2%2026-03-22
CVE-2026-4554Tenda F453 WriteFacMac FormWriteFacMac privilege escalation8.8v3.16.5%2026-03-22
CVE-2026-4553Tenda F453 Parameters Natlimit fromNatlimit stack-based overflow8.7CNA v4.01.0%2026-03-22
CVE-2026-4552Tenda F453 Parameters VirtualSer fromVirtualSer memory corruption8.7CNA v4.01.0%2026-03-22
CVE-2026-4551Tenda F453 Parameters SafeClientFilter fromSafeClientFilter memory corruption8.7CNA v4.01.0%2026-03-22
CVE-2026-4550code-projects Simple Gym Management System func.php SQL injection5.1CNA v4.00.3%2026-03-22
CVE-2026-4549next-saas-stripe-starter Stripe customer portal action authorization bypass2.3CNA v4.00.3%2026-03-22
CVE-2026-4548mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization5.3CNA v4.00.3%2026-03-22
CVE-2026-4547mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error5.3CNA v4.00.4%2026-03-22
CVE-2026-4546Flos Freeware Notepad2 TextShaping.dll uncontrolled search path7.3CNA v4.00.2%2026-03-22
CVE-2026-4545Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path7.3CNA v4.00.2%2026-03-22
CVE-2026-4544Wavlink WL-WN578W2 POST request login.cgi cross-site scripting4.8v3.10.4%2026-03-22
CVE-2026-4543Wavlink WL-WN578W2 POST request firewall.cgi command injection5.3CNA v4.04.9%2026-03-22
CVE-2026-4542SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal5.3CNA v4.00.4%2026-03-22
CVE-2026-4541janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification2.0CNA v4.00.1%2026-03-22Fix
CVE-2026-4540Projectworlds Online Notes Sharing System parameters login.php SQL injection6.9CNA v4.00.4%2026-03-22
CVE-2026-4539pygments archetype.py AdlLexer redos4.8CNA v4.00.2%2026-03-22Fix
CVE-2026-4538PyTorch pt2 Loading deserialization7.8v3.10.4%2026-03-22Fix
CVE-2026-4537Cudy TR1200 ipsec.lua action_ipsec_conn command injection5.1CNA v4.02.1%2026-03-22
CVE-2026-4536Acrel Environmental Monitoring Cloud Platform unrestricted upload6.9CNA v4.00.5%2026-03-22
CVE-2026-4535Tenda FH451 WrlclientSet stack-based overflow8.7CNA v4.01.0%2026-03-22
CVE-2026-4534Tenda FH451 WrlExtraSet formWrlExtraSet stack-based overflow8.7CNA v4.01.0%2026-03-22
CVE-2026-4533code-projects Simple Food Ordering System all-tickets.php SQL injection8.8v3.10.5%2026-03-22
CVE-2026-4532code-projects Simple Food Ordering System Database Backup food.sql file access7.5v3.10.7%2026-03-22
CVE-2026-4531Free5GC AMF handler.go HandleRegistrationComplete denial of service6.9CNA v4.00.7%2026-03-22Fix
CVE-2026-4530apconw Aix-DB terminology_retriever.py SQL injection4.8CNA v4.00.2%2026-03-22
CVE-2026-4314The Ultimate WordPress Toolkit WP Extended plugin privilege escalation8.8CNA v3.10.5%2026-03-22Fix
CVE-2026-4115PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification6.3CNA v4.00.2%2026-03-22Fix
CVE-2026-3427Yoast SEO WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-22Fix
CVE-2026-33428Discourse allows unauthorized access to Deleted Posts Index via Group Membership4.9CNA v4.00.3%2026-03-21Fix
CVE-2026-33427Discourse Authorization Page Displays unvalidated redirect Domain2.7CNA v4.00.4%2026-03-21Fix
CVE-2026-33426Discourse users can edit or synonymize hidden tags they can't see3.5CNA v3.10.3%2026-03-21Fix
CVE-2026-33425Discourse has inferable private group membership or existence via exclude_groups parameter6.9CNA v4.00.3%2026-03-21NucleiFix
CVE-2026-33424discourse PM access granted through invites after access revocation5.9CNA v3.10.3%2026-03-21Fix
CVE-2026-33238AVideo has a path traversal in listFiles.json.php that enables Server Filesystem Enumeration4.3CNA v3.10.4%2026-03-21Fix
CVE-2026-33237AVideo has SSRF in Scheduler plugin via callbackURL Missing `isSSRFSafeURL` Validation5.5CNA v3.10.4%2026-03-21Fix
CVE-2026-32899OpenClaw Sender Policy Bypass in Slack Reaction and Pin Event Handlers5.3CNA v4.00.3%2026-03-21Fix
CVE-2026-32898OpenClaw ACP Permission auto-approval bypass via Untrusted Tool Metadata5.3CNA v4.00.3%2026-03-21Fix
CVE-2026-32897OpenClaw Authentication Token Reuse in Owner ID Prompt Hashing Fallback5.3v3.10.5%2026-03-21Fix
CVE-2026-32896OpenClaw Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles plugin6.5v3.10.4%2026-03-21Fix
CVE-2026-32895OpenClaw Sender authorization bypass in Slack System Event Handlers5.3CNA v4.00.3%2026-03-21Fix
CVE-2026-32666Automated Logic WebCTRL Premium Server authentication bypass by spoofing7.5CNA v3.10.5%2026-03-21Fix
CVE-2026-32067OpenClaw Cross-account authorization bypass in DM Pairing Store8.1v3.10.3%2026-03-21Fix
CVE-2026-32065OpenClaw Approval Identity Mismatch in system.run command execution6.5v3.10.5%2026-03-21Fix
CVE-2026-32064OpenClaw Missing VNC Authentication in Sandbox Browser noVNC Observer9.1NVD v3.10.5%2026-03-21Fix
CVE-2026-32058OpenClaw Approval Context-Binding Weakness in system.run via host=node6.5v3.10.3%2026-03-21Fix
CVE-2026-32057OpenClaw authentication bypass via Control UI client.id parameter8.1NVD v3.10.6%2026-03-21Fix
CVE-2026-32056OpenClaw remote code execution via Shell Startup Environment variable injection in system.run9.8v3.11.0%2026-03-21Fix
CVE-2026-32055OpenClaw Workspace Path Boundary Bypass via Non-existent Symlink8.2v3.10.5%2026-03-21Fix
CVE-2026-32054OpenClaw Symlink Traversal in Browser Trace/Download Path Handling7.8v3.10.2%2026-03-21Fix
CVE-2026-32053OpenClaw Twilio Webhook Replay Bypass via Randomized Event ID Normalization6.5v3.10.5%2026-03-21Fix
CVE-2026-32052OpenClaw Hidden command execution via Shell-Wrapper Positional argv Carriers9.8v3.11.6%2026-03-21Fix
CVE-2026-32051OpenClaw authorization bypass in Agent Runs via Owner-Only Tool Access8.7CNA v4.00.5%2026-03-21Fix
CVE-2026-32050OpenClaw Unauthorized Reaction Status Event Enqueue via Access Check Bypass5.3v3.10.4%2026-03-21Fix
CVE-2026-32049OpenClaw denial of service via Inbound Media Download Byte Limit Bypass8.7CNA v4.00.8%2026-03-21Fix
CVE-2026-32048OpenClaw sandbox escape via Cross-Agent sessions_spawn9.9v3.10.4%2026-03-21Fix
CVE-2026-32046OpenClaw OS-level sandbox bypass via --no-sandbox Flag9.8v3.10.4%2026-03-21Fix
CVE-2026-32045OpenClaw authentication bypass in HTTP Gateway Routes via Tokenless Tailscale Auth9.1v3.10.6%2026-03-21Fix
CVE-2026-32044OpenClaw Tar Archive Safety Bypass in Skills Installation6.7CNA v4.00.2%2026-03-21Fix
CVE-2026-32043OpenClaw time-of-check-time-of-use via Mutable Symlink in system.run cwd parameter7.0v3.10.1%2026-03-21Fix
CVE-2026-32042OpenClaw privilege escalation via Unpaired Device Identity in Shared Gateway Authentication8.7CNA v4.00.6%2026-03-21Fix
CVE-2026-25086Automated Logic WebCTRL Premium Server multiple Binds to the Same Port7.7CNA v3.10.2%2026-03-21Fix
CVE-2026-24060Automated Logic WebCTRL Premium Server cleartext transmission of sensitive information9.1CNA v3.10.2%2026-03-21Fix
CVE-2026-4529D-Link DHP-1320 SOAP redirect_count_down_page stack-based overflow8.7CNA v4.01.6%2026-03-21
CVE-2026-4528trueleaf ApiFlow URL validation handler server-side request forgery6.9CNA v4.00.5%2026-03-21
CVE-2026-4516Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injection5.3CNA v4.00.4%2026-03-21
CVE-2026-4515Foundation Agents MetaGPT operator.py code_generate code injection5.3CNA v4.00.4%2026-03-21
CVE-2026-4514PbootCMS Backend UserController.php access control5.3CNA v4.00.3%2026-03-21
CVE-2026-4513vanna-ai vanna base.py ask SQL injection5.3CNA v4.00.3%2026-03-21
CVE-2026-4511vanna-ai vanna legacy exec injection5.3CNA v4.00.4%2026-03-21
CVE-2026-4510PbootCMS Parameter MemberController.php alert_location cross-site scripting5.3CNA v4.00.4%2026-03-21
CVE-2026-4509PbootCMS file upload file.php incomplete blacklist5.3CNA v4.00.4%2026-03-21
CVE-2026-4373JetFormBuilder WordPress plugin unauthenticated arbitrary file read via Media field7.5CNA v3.10.6%2026-03-21Fix
CVE-2026-4302WowOptin: Next-Gen Popup Maker WordPress plugin unauthenticated server-side request forgery7.2CNA v3.10.5%2026-03-21Fix
CVE-2026-4261Expire Users WordPress plugin privilege escalation to Administrator8.8CNA v3.10.4%2026-03-21
CVE-2026-4161Review Map by RevuKangaroo WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-03-21
CVE-2026-4143Neos Connector for Fakturama WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-03-21
CVE-2026-4127Speedup Optimization WordPress plugin missing authorization authenticated plugin settings update4.3CNA v3.10.3%2026-03-21
CVE-2026-4087Pre* Party Resource Hints WordPress plugin SQL injection6.5CNA v3.10.5%2026-03-21
CVE-2026-4086WP Random Button WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-4084fyyd podcast shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-21
CVE-2026-4083Scoreboard for HTML5 Games Lite WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-21Fix
CVE-2026-4077Ecover Builder For Dummies WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-4072WordPress PayPal Donation plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-4069Alfie Feed WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.4%2026-03-21
CVE-2026-4067Ad Short WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-4022Show Posts list WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-21
CVE-2026-4004Task Manager WordPress plugin arbitrary shortcode execution via task_id parameter6.5CNA v3.10.5%2026-03-21
CVE-2026-3997Text Toggle WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-21
CVE-2026-3996WP Games Embed WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-21
CVE-2026-3651Build App Online WordPress plugin missing authorization arbitrary post Author modification5.3CNA v3.10.5%2026-03-21
CVE-2026-3645Punnel WordPress plugin missing authorization authenticated settings update5.3CNA v3.10.5%2026-03-21
CVE-2026-3641Appmax WordPress plugin missing authorization order Status manipulation and arbitrary order creation5.3CNA v3.10.5%2026-03-21
CVE-2026-3629Import and export users and customers WordPress plugin privilege escalation to Administrator8.1CNA v3.10.6%2026-03-21Fix
CVE-2026-3619Sheets2Table WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-3617Paypal Shortcodes WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-3577Keep Backup Daily WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-03-21Fix
CVE-2026-3572iTracker360 WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.4%2026-03-21Fix
CVE-2026-3570Smarter Analytics WordPress plugin missing authorization unauthenticated plugin settings reset5.3CNA v3.10.5%2026-03-21
CVE-2026-3567RepairBuddy WordPress plugin missing authorization authenticated plugin settings modification5.3CNA v3.10.4%2026-03-21Fix
CVE-2026-3554Sherk Custom Post Type Displays WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-3546e-shot WordPress plugin missing authorization authenticated sensitive information exposure5.3CNA v3.10.4%2026-03-21
CVE-2026-3516Contact List WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-21Exploit codeFix
CVE-2026-3506WP-Chatbot for Messenger WordPress plugin authorization bypass5.3CNA v3.10.5%2026-03-21
CVE-2026-3478Content Syndication Toolkit WordPress plugin unauthenticated server-side request forgery7.2CNA v3.10.5%2026-03-21
CVE-2026-3474EmailKit WordPress plugin path traversal4.9CNA v3.10.6%2026-03-21Fix
CVE-2026-3460REST API TO MiniProgram WordPress plugin insecure direct object reference5.3CNA v3.10.4%2026-03-21
CVE-2026-3368Injection Guard WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-03-21Fix
CVE-2026-3354Wikilookup WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-03-21