CVE-2026 list

CVE-2026 records published in March 2026

Page three of six: records 2,001 to 3,000 of the 5,228 published in March 2026, newest first. The first page carries the figures for March 2026.

CVE-2026 records published in March 2026, newest first: records 2,001 to 3,000 of 5,228
CVE Summary CVSS EPSS Published Signals
CVE-2026-3353Comment SPAM Wiper WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-03-21
CVE-2026-3350Image Alt Text Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21Fix
CVE-2026-3347Multi Functional Flexi Lightbox WordPress plugin stored cross-site scripting5.5CNA v3.10.4%2026-03-21
CVE-2026-3339Keep Backup Daily WordPress plugin limited path traversal2.7CNA v3.10.4%2026-03-21Fix
CVE-2026-3335Canto WordPress plugin missing authorization to unauthenticated file upload5.3CNA v3.11.3%2026-03-21NucleiFix
CVE-2026-3334CMS Commander WordPress plugin authenticated (Custom+) SQL injection via or_blogname parameter8.8CNA v3.10.5%2026-03-21
CVE-2026-3333MinhNhut Link Gateway WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21
CVE-2026-3332Xhanch - My Advanced Settings WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-03-21
CVE-2026-3331Lobot Slider Administrator WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-03-21
CVE-2026-3003Vagaro Booking Widget WordPress plugin unauthenticated stored cross-site scripting via vagaro_code7.2CNA v3.10.4%2026-03-21
CVE-2026-2941Linksy Search and Replace WordPress plugin unauthorized access8.8CNA v3.10.4%2026-03-21
CVE-2026-2837Ricerca advanced search WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-03-21
CVE-2026-2756OmniPEMF NeoRhythm BLE missing authentication2.3CNA v4.00.4%2026-03-21
CVE-2026-2723Post Snippits WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.2%2026-03-21
CVE-2026-2720Hr Press Lite WordPress plugin unauthorized access6.5CNA v3.10.4%2026-03-21Fix
CVE-2026-2503ElementCamp WordPress plugin authenticated (Author+) SQL injection via meta_query[compare] parameter6.5CNA v3.10.2%2026-03-21Fix
CVE-2026-2501Ed's Social Share WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21Fix
CVE-2026-2496Ed's Font Awesome WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21Fix
CVE-2026-2468Quentn WP WordPress plugin unauthenticated SQL injection via qntn_wp_access Cookie7.5CNA v3.10.4%2026-03-21Fix
CVE-2026-2440SurveyJS: Drag and Drop Form Builder WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-03-21
CVE-2026-2430Autoptimize WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21Fix
CVE-2026-2427itsukaita WordPress plugin reflected cross-site scripting via day_from parameter6.1CNA v3.10.3%2026-03-21
CVE-2026-2424Reward Video Ad for WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-03-21
CVE-2026-2375App Builder WordPress plugin privilege escalation6.5CNA v3.10.3%2026-03-21
CVE-2026-2352Autoptimize WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-21Fix
CVE-2026-2351Task Manager WordPress plugin authenticated (Subscriber+) arbitrary file read6.5CNA v3.10.3%2026-03-21
CVE-2026-2294UiPress lite WordPress plugin unauthorized access4.3CNA v3.10.2%2026-03-21
CVE-2026-2290Post Affiliate Pro WordPress plugin server-side request forgery3.8CNA v3.10.3%2026-03-21Fix
CVE-2026-2279myLinksDump WordPress plugin SQL injection7.2CNA v3.10.4%2026-03-21
CVE-2026-2277rexCrawler WordPress plugin reflected cross-site scripting via URL and regex parameters6.1CNA v3.10.3%2026-03-21
CVE-2026-2121Weaver Show Posts WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-03-21Fix
CVE-2026-1935Company Posts for LinkedIn WordPress plugin missing authorization4.3CNA v3.10.2%2026-03-21
CVE-2026-1914FuseDesk WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21Fix
CVE-2026-1911Twitter Feeds WordPress plugin cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1908Integration with Hubspot Forms WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1899Any Post Slider WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21Fix
CVE-2026-1891Simple Football Scoreboard WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1889Outgrow WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1886Go Night Pro WordPress Dark Mode plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1854Post Flagger WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1851iVysilani Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1822WP NG Weather WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1806Tour and Activity Operator Plugin for TourCMS WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1800Fonts Manager Custom Fonts WordPress plugin unauthenticated SQL injection7.5CNA v3.10.4%2026-03-21
CVE-2026-1648Performance Monitor WordPress plugin unauthenticated server-side request forgery via URL parameter7.2CNA v3.10.4%2026-03-21
CVE-2026-1647Comment Genius WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2026-03-21
CVE-2026-1575Schema Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1503login_register WordPress plugin cross-site request forgery4.3CNA v3.10.1%2026-03-21
CVE-2026-1397PQ Addons Creative Elementor Widgets WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1393omarnas Add Google Social Profiles to Knowledge Graph Box settings update cross-site request forgery4.3CNA v3.10.1%2026-03-21
CVE-2026-1392SR WP Minify HTML WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.1%2026-03-21
CVE-2026-1390Redirect countdown WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.1%2026-03-21
CVE-2026-1378WP Posts Re-order WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.1%2026-03-21
CVE-2026-1313MimeTypes Link Icons WordPress plugin server-side request forgery8.3CNA v3.10.3%2026-03-21Fix
CVE-2026-1278Mandatory Field WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-03-21
CVE-2026-1275Multi Post Carousel by Category WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21
CVE-2026-1253Group Chat and Video Chat by AtomChat WordPress plugin unauthorized access4.3CNA v3.10.3%2026-03-21Fix
CVE-2026-1247Survey WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-03-21
CVE-2026-1093WPFAQBlock- FAQ and Accordion Plugin For Gutenberg WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21Fix
CVE-2026-0609Logo Slider WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-21Fix
CVE-2026-33476SiYuan has an unauthenticated arbitrary file read via path traversal7.5CNA v3.13.1%2026-03-20NucleiFix
CVE-2026-33423Discourse staff can modify any user's group notification level1.3CNA v4.00.3%2026-03-20Fix
CVE-2026-33422Discourse exposes ip_address of flagged user3.5CNA v3.10.3%2026-03-20Fix
CVE-2026-33411Discourse's solved topic stream has potential stored XSS in topic title5.4CNA v3.10.3%2026-03-20Fix
CVE-2026-33372Synacor Zimbra Collaboration Suite cross-site request forgery5.4CISA ADP v3.10.2%2026-03-20Fix
CVE-2026-33371Synacor Zimbra Collaboration Suite XML external entity injection4.3CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-33370Synacor Zimbra Collaboration Suite cross-site scripting6.1CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-33369Synacor Zimbra Collaboration Suite LDAP injection4.3CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-33368Synacor Zimbra Collaboration Suite cross-site scripting6.1CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-33312Read-only Vikunja users can delete project background images via broken object-level authorization5.3CNA v4.00.3%2026-03-20Fix
CVE-2026-33291Discourse user can create Zendesk tickets even when it does not have access to topic5.1CNA v4.00.2%2026-03-20Fix
CVE-2026-33289SuiteCRM SuiterCRM has LDAP Filter injection in Authentication module8.8CNA v3.10.8%2026-03-20Fix
CVE-2026-33288SuiteCRM has authenticated SQL injection in Authentication module8.8CNA v3.10.5%2026-03-20Fix
CVE-2026-33251Discourse has a Hidden Solved topics permission bypass5.4CNA v3.10.3%2026-03-20Fix
CVE-2026-33243Pengutronix barebox FIT signature verification vulnerability8.3CNA v3.10.1%2026-03-20Fix
CVE-2026-33236NLTK has a Downloader path traversal vulnerability (AFO) arbitrary file overwrite8.1CNA v3.10.7%2026-03-20Fix
CVE-2026-33231NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app7.5CNA v3.11.5%2026-03-20Fix
CVE-2026-33230nltk vulnerable to cross-site scripting6.1CNA v3.10.4%2026-03-20Fix
CVE-2026-33228Prototype pollution via parse in NodeJS flatted8.9CNA v4.01.0%2026-03-20Fix
CVE-2026-33226Budibase Unrestricted server-side request forgery (SSRF) via REST Datasource Query Preview8.7CNA v3.10.4%2026-03-20
CVE-2026-33221Nhost Storage affected by MIME type spoofing2.1CNA v4.00.2%2026-03-20Fix
CVE-2026-33210Ruby JSON has a format string injection8.3CNA v4.01.0%2026-03-20Fix
CVE-2026-33209Avo has a XSS vulnerability on `return_to` param5.3CNA v4.00.3%2026-03-20Fix
CVE-2026-33204SimpleJWT has an unauthenticated denial of service via JWE header tampering7.5CNA v3.10.5%2026-03-20Fix
CVE-2026-33203SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass7.5CNA v3.10.6%2026-03-20Fix
CVE-2026-33194SiYuan has an Incomplete Fix for IsSensitivePath Denylist allows File Read from /opt, /usr, /home6.8CNA v3.10.5%2026-03-20Fix
CVE-2026-33192free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques8.7CNA v4.00.4%2026-03-20Fix
CVE-2026-33191free5GC UDM subscriber data management API denial of service8.7CNA v4.00.6%2026-03-20Fix
CVE-2026-33186gRPC-Go has an authorization bypass via missing leading slash in :path9.1CNA v3.11.6%2026-03-20Exploit codeFix
CVE-2026-33180hapifhir org.hl7.fhir.core HAPI FHIR HTTP authentication leak in redirects7.5CNA v3.10.5%2026-03-20Fix
CVE-2026-33179libfuse io_uring queue initialization null pointer dereference5.5CNA v3.10.2%2026-03-20Fix
CVE-2026-33177Statamic is missing authorization check on taxonomy term creation via fieldtype4.3CNA v3.10.3%2026-03-20Fix
CVE-2026-33172Statamic has stored XSS via SVG Sanitization Bypass8.7CNA v3.10.4%2026-03-20Fix
CVE-2026-33171Statamic has a path traversal in file dictionary fieldtype4.3CNA v3.10.3%2026-03-20Fix
CVE-2026-33166Allure Report has an arbitrary file read8.6CNA v3.10.5%2026-03-20Fix
CVE-2026-33165Heap out-of-bounds write in libde2655.5CNA v3.10.2%2026-03-20Fix
CVE-2026-33164Null pointer dereference in libde2658.7CNA v4.00.5%2026-03-20Fix
CVE-2026-33156NickeManarin ScreenToGif version.dll loading untrusted search path7.8CNA v3.10.2%2026-03-20
CVE-2026-33155DeepDiff has memory exhaustion DoS through SAFE_TO_IMPORT8.7CNA v4.00.5%2026-03-20Fix
CVE-2026-33154dynaconf affected by remote code execution (RCE) via Insecure Template Evaluation in @jinja Resolver7.5CNA v3.10.5%2026-03-20Fix
CVE-2026-33151Socket.io allows an unbounded number of binary attachments8.7CNA v4.00.6%2026-03-20Fix
CVE-2026-33150libfuse io_uring subsystem use-after-free7.8CNA v3.10.2%2026-03-20Fix
CVE-2026-33147GMT: Stack-based buffer overflow in gmt_remote_dataset_id7.3CNA v3.10.2%2026-03-20Exploit code
CVE-2026-33144GPAC MP4Box heap buffer overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)5.8CNA v3.10.2%2026-03-20
CVE-2026-33143OneUptime: WhatsApp Webhook missing signature verification8.7CNA v4.00.2%2026-03-20Fix
CVE-2026-33142OneUptime: ClickHouse SQL injection8.1CNA v3.10.4%2026-03-20Fix
CVE-2026-33140PySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript code execution5.3CNA v4.00.3%2026-03-20Fix
CVE-2026-33139PySpector: Plugin sandbox bypass leads to arbitrary code execution8.3CNA v4.00.2%2026-03-20Fix
CVE-2026-33136WeGIA has reflected cross-site scripting in `listar_memorandos_ativos.php`9.3CNA v3.10.3%2026-03-20Fix
CVE-2026-33135WeGIA has reflected cross-site scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter9.3CNA v3.10.4%2026-03-20Fix
CVE-2026-33134WeGIA has Authenticated Time-based blind SQL injection in `restaurar_produto.php`9.3CNA v3.10.5%2026-03-20Fix
CVE-2026-33133WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive8.6CNA v4.00.7%2026-03-20Fix
CVE-2026-33132ZITADEL is missing enforcement of organization scopes5.3CNA v3.10.5%2026-03-20Fix
CVE-2026-33131h3 has a middleware bypass with one gadget7.4CNA v3.10.4%2026-03-20Fix
CVE-2026-33130louislam uptime-kuma Uptime Kuma: SSTI in Notification templates allows arbitrary file read6.5CNA v3.10.5%2026-03-20Fix
CVE-2026-33129h3 has an observable timing discrepancy in basic auth utils5.9CNA v3.10.4%2026-03-20Fix
CVE-2026-33128h3 has a Server-Sent Events injection via Unsanitized Newlines in Event Stream fields7.5CNA v3.10.7%2026-03-20Fix
CVE-2026-33126Frigate has SSRF vulnerability in /ffprobe endpoint5.0CNA v3.10.3%2026-03-20Fix
CVE-2026-33125Frigate user account management improper authorization7.1CNA v3.10.4%2026-03-20Fix
CVE-2026-33124Frigate has insecure password change functionality8.6CNA v4.00.4%2026-03-20Fix
CVE-2026-33123pypdf has inefficient decoding of array-based streams5.1CNA v4.00.4%2026-03-20Fix
CVE-2026-33081PinchTab has blind SSRF via browser-side redirect bypass in /download URL validation5.8CNA v3.10.3%2026-03-20Fix
CVE-2026-33080Filament: Unvalidated Range and Values summarizer values can be used for XSS7.3CNA v3.10.4%2026-03-20Fix
CVE-2026-33075FastGPT has arbitrary code execution in GitHub Actions9.4CNA v4.00.3%2026-03-20Exploit code
CVE-2026-33072FileRise: Default Encryption Key enables Token Forgery and Config Decryption8.2CNA v3.10.2%2026-03-20Fix
CVE-2026-33071FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads4.3CNA v3.10.7%2026-03-20Fix
CVE-2026-33070FileRise has Unauthenticated Share Link Deletion3.7CNA v3.10.3%2026-03-20Fix
CVE-2026-33069PJSIP has an out-of-bounds read in SIP multipart parsing6.9CNA v4.00.4%2026-03-20Fix
CVE-2026-33068Anthropic Claude Code workspace trust dialog vulnerability7.7CNA v4.00.6%2026-03-20Fix
CVE-2026-33067SiYuan has stored XSS to RCE via Unsanitized Bazaar Package Metadata5.3CNA v4.00.7%2026-03-20Fix
CVE-2026-33066SiYuan has stored XSS to RCE via Unsanitized Bazaar README Rendering5.3CNA v4.00.7%2026-03-20Fix
CVE-2026-33065free5GC UDM sdm-subscriptions API vulnerability6.9CNA v4.00.4%2026-03-20Fix
CVE-2026-33064free5GC UDM DataChangeNotification Procedure panic due to Nil Pointer Dereference8.7CNA v4.00.8%2026-03-20Fix
CVE-2026-33063free5GC AUSF UE authentication panic on Nil SuciSupiMap Interface Conversion8.7CNA v4.00.9%2026-03-20Fix
CVE-2026-33062free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list parameter8.7CNA v4.01.0%2026-03-20Fix
CVE-2026-33061Jexactyl has Stored DOM cross-site scripting (XSS) via unescaped JSON in Blade template5.8CNA v3.10.2%2026-03-20
CVE-2026-33060ondata ckan-mcp-server CKAN MCP Server: SSRF via base_url allows access to internal networks5.3CNA v3.10.3%2026-03-20Fix
CVE-2026-33057Mesop affected by unauthenticated remote code execution via Test Suite route /exec-py9.8CNA v3.14.1%2026-03-20NucleiExploit codeFix
CVE-2026-33056tar-rs `unpack_in` can chmod arbitrary directories by following symlinks5.1CNA v4.00.4%2026-03-20Fix
CVE-2026-33055tar-rs incorrectly ignores PAX size headers if header size is nonzero5.1CNA v4.00.5%2026-03-20Fix
CVE-2026-33054Mesop file state session backend path traversal10.0CNA v3.10.7%2026-03-20Fix
CVE-2026-33053Langflow has Missing Ownership Verification in API Key Deletion (IDOR)6.1CNA v4.00.5%2026-03-20Fix
CVE-2026-33051Craft CMS vulnerable to stored XSS in Revision Context menu5.3CNA v4.00.3%2026-03-20Fix
CVE-2026-33043AVideo affected by session hijacking via Unauthenticated Session ID Disclosure with Permissive CORS8.1CNA v3.10.4%2026-03-20Fix
CVE-2026-33041AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php5.3CNA v3.10.4%2026-03-20Fix
CVE-2026-33040libp2p rust-libp2p libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow8.7CNA v4.00.5%2026-03-20Fix
CVE-2026-33039AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy8.6CNA v3.10.5%2026-03-20Fix
CVE-2026-33038AVideo affected by unauthenticated application takeover8.1CNA v3.10.5%2026-03-20Fix
CVE-2026-33037WWBN AVideo has predictable default admin credentials in official Docker deployment path8.1CNA v3.10.7%2026-03-20Fix
CVE-2026-33036fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits7.5CNA v3.10.7%2026-03-20Fix
CVE-2026-33035Unauthenticated reflected XSS via innerHTML in AVideo5.3CNA v4.00.4%2026-03-20Fix
CVE-2026-33025AVideo-Encoder is vulnerable to authenticated SQL injection via ORDER BY Clause8.6CNA v4.00.5%2026-03-20Fix
CVE-2026-33024AVideo-Encoder has unauthenticated blind server-side request forgery via Public Thumbnail Generator9.3CNA v4.00.5%2026-03-20Fix
CVE-2026-33022Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun6.5CNA v3.10.4%2026-03-20Fix
CVE-2026-33017Langflow code injection9.3CNA v4.024.8%2026-03-20KEVNucleiMetasploitExploit codeKCVFix
CVE-2026-33013Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices8.2CNA v4.00.8%2026-03-20Fix
CVE-2026-33012Micronaut Framework vulnerable to a denial of service in HTML error response caching7.5CNA v3.10.8%2026-03-20Fix
CVE-2026-33011Nest Fastify HEAD Request Middleware Bypass8.7CNA v4.00.5%2026-03-20Fix
CVE-2026-33010Mcp-memory-service's Wildcard CORS with Credentials enables Cross-Origin Memory Theft8.1CNA v3.10.5%2026-03-20Fix
CVE-2026-32989Precurio Intranet Portal: Cross-site request forgery leading to arbitrary file upload8.6CNA v4.00.3%2026-03-20
CVE-2026-32986Textpattern CMS: Second-order XSS via Atom Feed injection5.1CNA v4.00.3%2026-03-20
CVE-2026-32985Apereo Xerte Online Toolkits template import arbitrary file upload9.3CNA v4.01.9%2026-03-20MetasploitExploit code
CVE-2026-32954frappe erpnext ERP has a possibility SQL injection vulnerability due to missing validation7.1CNA v3.10.4%2026-03-20Fix
CVE-2026-32953Tillitis: TKey client has an Error in Protocol Implementation4.7CNA v4.00.2%2026-03-20Fix
CVE-2026-32950SQLBot: RCE via SQL injection in Excel upload endpoint8.6CNA v4.01.0%2026-03-20Fix
CVE-2026-32949SQLBot: SSRF to arbitrary file read (AFR) via Rogue MySQL8.7CNA v4.00.5%2026-03-20Fix
CVE-2026-32947Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)4.6CNA v4.00.5%2026-03-20Fix
CVE-2026-32946Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)4.6CNA v4.00.4%2026-03-20Fix
CVE-2026-32945PJSIP is vulnerable to heap-based buffer overflow through DNS parser8.4CNA v4.00.5%2026-03-20Exploit codeFix
CVE-2026-32942PJSIP has ICE session use-after-free race conditions8.0CNA v4.00.6%2026-03-20Fix
CVE-2026-32941Sliver vulnerable to Authenticated OOM via memory exhaustion in mTLS/WireGuard Transports5.7CNA v4.00.4%2026-03-20Exploit code
CVE-2026-32940SiYuan has a SanitizeSVG bypass via data:text/XML in getDynamicIcon (incomplete fix for)9.3CNA v3.10.5%2026-03-20Fix
CVE-2026-32939DataEase is Vulnerable to H2 JDBC RCE Bypass7.7CNA v4.00.6%2026-03-20Fix
CVE-2026-32938SiYuan has an arbitrary file read in its Desktop Publish service9.9CNA v3.10.6%2026-03-20Fix
CVE-2026-32937free5GC CHF has Out-of-Bounds Slice Access that leads to DoS7.1CNA v4.00.6%2026-03-20Fix
CVE-2026-32935Phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack8.2CNA v4.00.4%2026-03-20Fix
CVE-2026-32933AutoMapper vulnerable to denial of service (DoS) via uncontrolled recursion7.5CNA v3.10.7%2026-03-20Fix
CVE-2026-32891Anchorr privilege escalation: Jellyseerr User → Anchorr Admin via stored XSS9.1CNA v3.10.3%2026-03-20Fix
CVE-2026-32890Anchorr User Mapping dropdown stored cross-site scripting9.7CNA v3.10.6%2026-03-20Fix
CVE-2026-32889Denial of service via non-terminating SYLT frame parsing loop in tinytag6.5CNA v3.10.5%2026-03-20Fix
CVE-2026-32888Open Source Point of Sale is vulnerable to SQL injection through its Item Search Functionality8.8CNA v3.10.5%2026-03-20
CVE-2026-32887Effectful Effect AsyncLocalStorage context propagation race condition7.4CNA v3.10.3%2026-03-20Fix
CVE-2026-32881ewe has an Overly permissive list of allowed inputs5.3CNA v3.10.5%2026-03-20Fix
CVE-2026-32880ChurchCRM is vulnerable to stored XSS through JSON handling in SystemSettings.php6.4CNA v3.10.4%2026-03-20Fix
CVE-2026-32875UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop7.5CNA v3.10.8%2026-03-20Fix
CVE-2026-32874UltraJSON has a memory leak parsing large integers allows DoS7.5CNA v3.10.7%2026-03-20Fix
CVE-2026-32873Loop with unreachable exit condition (infinite loop) in ewe7.5CNA v3.10.6%2026-03-20Fix
CVE-2026-32844XinLiangCoder / php_api_doc reflected XSS via list_method.php5.1CNA v4.00.3%2026-03-20
CVE-2026-32829Lz4_flex's decompression can leak information from uninitialized memory or reused output buffer8.2CNA v4.00.7%2026-03-20Fix
CVE-2026-32828Akuity Kargo promotion http and http-download steps server-side request forgery5.1CNA v4.00.4%2026-03-20Fix
CVE-2026-32817Admidio is missing authorization and CSRF Protection on Document and Folder Deletion9.1CNA v3.10.5%2026-03-20Fix
CVE-2026-32813Admidio: Second-order SQL injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)8.0CNA v3.10.4%2026-03-20Fix
CVE-2026-32812Admidio vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata endpoint6.8CNA v3.10.5%2026-03-20Fix
CVE-2026-32811Heimdall: Path received via Envoy gRPC corrupted when containing query string8.2CNA v3.10.4%2026-03-20Fix
CVE-2026-32810Halloy has insecure file permissions on credential files4.8CNA v4.00.1%2026-03-20
CVE-2026-32808pyLoad: Arbitrary file deletion via path traversal during Encrypted 7z Password Verification8.1CNA v3.10.5%2026-03-20Fix
CVE-2026-32771Monitoring is vulnerable to Archive Slip due to missing checks in sanitization8.8CNA v4.00.7%2026-03-20Fix
CVE-2026-32769Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.1CNA v4.00.6%2026-03-20Fix
CVE-2026-32768Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.9CNA v4.00.5%2026-03-20Fix
CVE-2026-32767SiYuan: Authorization bypass allows arbitrary SQL Execution via Search API9.8CNA v3.10.7%2026-03-20Fix
CVE-2026-32766Astral-tokio-tar insufficiently validates PAX extensions during extraction1.7CNA v4.00.3%2026-03-20Fix
CVE-2026-32763Kysely JSON path compilation SQL injection8.2CNA v3.10.4%2026-03-20Fix
CVE-2026-32761filebrowser File Browser has an Authorization Policy Bypass in its Public Share Download Flow6.5CNA v3.10.5%2026-03-20Fix
CVE-2026-32760filebrowser File Browser Signup Grants Admin when Default Permissions Include Admin10.0CNA v4.00.7%2026-03-20Fix
CVE-2026-32759filebrowser File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely5.3CNA v4.02.2%2026-03-20Fix
CVE-2026-32758File Browser copy and rename destination handling path traversal6.5CNA v3.10.4%2026-03-20Fix
CVE-2026-32757Admidio: HTMLPurifier Bypass in eCard message allows HTML email injection5.4CNA v3.10.3%2026-03-20Fix
CVE-2026-32756Admidio: Unrestricted file upload via CSRF Token Validation Bypass in Documents and files module8.8CNA v3.11.0%2026-03-20Fix
CVE-2026-32733Halloy has a file transfer path traveral vulnerability8.7CNA v4.00.5%2026-03-20
CVE-2026-32711pydicom FileSet path resolution path traversal7.8CNA v3.10.2%2026-03-20Fix
CVE-2026-32710Heap-based buffer overflow in MariaDB8.6CNA v3.10.8%2026-03-20Exploit codeFix
CVE-2026-32701Qwik has array method pollution in FormData processing, allowing type confusion and DoS7.5CNA v3.10.5%2026-03-20Fix
CVE-2026-32697SuiteCRM RecordHandler insecure direct object reference6.5CNA v3.10.3%2026-03-20Fix
CVE-2026-32663IGL-Technologies eParking.fi insufficient session expiration6.5NVD v3.10.3%2026-03-20
CVE-2026-32595Traefik: BasicAuth Middleware Timing Attack allows Username Enumeration6.3CNA v4.00.4%2026-03-20Fix
CVE-2026-32318Cryptomator for iOS: Tampered vault configuration allows MITM attack on Hub API7.6CNA v3.10.1%2026-03-20Fix
CVE-2026-32317Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API7.6CNA v3.10.1%2026-03-20Fix
CVE-2026-32310Cryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths4.1CNA v3.10.4%2026-03-20Fix
CVE-2026-32309Cryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes8.7CNA v4.00.3%2026-03-20Fix
CVE-2026-32305Traefik mTLS bypass via fragmented ClientHello SNI extraction failure7.8CNA v4.00.5%2026-03-20Fix
CVE-2026-32303Cryptomator: Tampered vault configuration allows MITM attack on Hub API7.6CNA v3.10.2%2026-03-20Fix
CVE-2026-32114Discourse's unscoped status lookups leak restricted metadata5.3CNA v4.00.3%2026-03-20Fix
CVE-2026-31926IGL-Technologies eParking.fi insufficiently protected credentials6.9CNA v4.00.3%2026-03-20
CVE-2026-31904CTEK Chargeportal improper restriction of excessive authentication attempts8.7CNA v4.00.8%2026-03-20
CVE-2026-31903IGL-Technologies eParking.fi improper restriction of excessive authentication attempts8.7CNA v4.00.6%2026-03-20
CVE-2026-31869Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check5.3CNA v4.00.3%2026-03-20Fix
CVE-2026-31836Mass assignment privilege escalation in Checkmate8.1CNA v3.10.4%2026-03-20
CVE-2026-31805Discourse has a poll authorization bypass via post_id array parameter5.3CNA v3.10.4%2026-03-20Fix
CVE-2026-31382Gainsight Assist reflected XSS/HTML injection6.1NVD v3.10.3%2026-03-20Fix
CVE-2026-31381Gainsight Assist plugin information disclosure5.3CNA v3.10.3%2026-03-20Fix
CVE-2026-30891Discourse hasUnauthorized Exposure of Private User Action Types5.3CNA v4.00.4%2026-03-20Fix
CVE-2026-30889Discourse has unauthorized post data exposure in discourse-user-notes5.3CNA v4.00.3%2026-03-20Fix
CVE-2026-30888Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint2.2CNA v3.10.3%2026-03-20Fix
CVE-2026-30580leefish File Thingie path traversal4.3CISA ADP v3.10.6%2026-03-20
CVE-2026-30579leefish File Thingie cross-site scripting6.5CISA ADP v3.10.2%2026-03-20
CVE-2026-30578leefish File Thingie cross-site scripting6.5CISA ADP v3.10.2%2026-03-20
CVE-2026-29828DooTask cross-site scripting6.1CISA ADP v3.10.3%2026-03-20
CVE-2026-29796IGL-Technologies eParking.fi missing authentication for critical function9.8v3.10.7%2026-03-20
CVE-2026-29794Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed headers5.3CNA v3.10.5%2026-03-20Fix
CVE-2026-29189SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship endpoints8.1CNA v3.10.4%2026-03-20Fix
CVE-2026-29109SuiteCRM authenticated remote code execution8.6CNA v4.00.5%2026-03-20Fix
CVE-2026-29108Authenticated SuiteCRM Users can Retrieve the Password Hash of any User6.5CNA v3.10.4%2026-03-20Fix
CVE-2026-28204CTEK Chargeportal insufficiently protected credentials6.9CNA v4.00.4%2026-03-20
CVE-2026-27649CTEK Chargeportal insufficient session expiration6.5NVD v3.10.5%2026-03-20
CVE-2026-27625Stirling-PDF Zip Slip: Arbitrary file write via path traversal in Markdown-to-PDF ZIP Extraction8.1CNA v3.10.5%2026-03-20Fix
CVE-2026-25792Greenshot vulnerable to OS command injection via ExternalCommand plugin6.5CNA v3.10.2%2026-03-20
CVE-2026-25192CTEK Chargeportal missing authentication for critical function9.8v3.10.5%2026-03-20
CVE-2026-23536Red Hat OpenShift AI (RHOAI) feast: Unauthenticated arbitrary file read7.5CNA v3.12.4%2026-03-20Nuclei
CVE-2026-23278Linux kernel nf_tables catchall elements vulnerability7.8CNA v3.10.2%2026-03-20Fix
CVE-2026-23277Linux kernel teql null pointer dereference5.5NVD v3.10.1%2026-03-20Fix
CVE-2026-23276Linux kernel IP tunnel transmit uncontrolled recursion5.5NVD v3.10.1%2026-03-20Fix
CVE-2026-23275Linux kernel io_uring ring resize vulnerability7.8CNA v3.10.1%2026-03-20Fix
CVE-2026-23274Linux kernel xt_IDLETIMER netfilter target vulnerability7.8CNA v3.10.2%2026-03-20Fix
CVE-2026-23273Linux kernel macvlan race condition7.8CNA v3.10.1%2026-03-20Fix
CVE-2026-23272Linux kernel nf_tables set element insertion vulnerability7.8CNA v3.10.1%2026-03-20Fix
CVE-2026-23271Linux kernel perf event overflow handling race condition7.8CNA v3.10.1%2026-03-20Fix
CVE-2026-22902QNAP QuNetSwitch OS command injection5.7CNA v4.00.5%2026-03-20Fix
CVE-2026-22901QNAP QuNetSwitch OS command injection6.3CNA v4.00.9%2026-03-20Fix
CVE-2026-22900QNAP QuNetSwitch hard-coded credentials6.8CNA v4.00.3%2026-03-20Fix
CVE-2026-22898QNAP QVR Pro missing authentication9.3CNA v4.00.7%2026-03-20Fix
CVE-2026-22897QNAP QuNetSwitch OS command injection8.1CNA v4.01.1%2026-03-20Fix
CVE-2026-22895QNAP QuFTP Service cross-site scripting6.2CNA v4.00.2%2026-03-20Fix
CVE-2026-22737Spring Framework Improper Path Limitation with script view templates5.9CNA v3.10.4%2026-03-20Fix
CVE-2026-22735Spring Foundation Server Sent Event stream corruption2.6CNA v3.10.1%2026-03-20Fix
CVE-2026-22733Spring Security authentication bypass under Actuator CloudFoundry endpoints8.2CNA v3.10.4%2026-03-20Fix
CVE-2026-22324Melania WordPress theme local file inclusion8.1CNA v3.10.5%2026-03-20
CVE-2026-22172OpenClaw Scope Elevation in WebSocket Shared-Auth Connections9.4CNA v4.00.6%2026-03-20Fix
CVE-2026-22163GPU Ddk Unsafe writing of MMU PT entries on systems with 32-bit host CPU7.8CISA ADP v3.10.1%2026-03-20Fix
CVE-2026-21992Oracle Identity Manager REST WebServices component takeover9.8CNA v3.11.0%2026-03-20Reported exploitedFix
CVE-2026-21732GPU Ddk libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation9.6CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4519Python CPython webbrowser.open allows leading dashes in URLs7.0CNA v4.00.4%2026-03-20Fix
CVE-2026-4508PbootCMS Member Login MemberController.php checkUsername SQL injection6.9CNA v4.00.4%2026-03-20
CVE-2026-4507Mindinventory MindSQL mindsql_core.py ask_db SQL injection5.3CNA v4.00.3%2026-03-20
CVE-2026-4506Mindinventory MindSQL mindsql_core.py ask_db code injection5.3CNA v4.00.4%2026-03-20
CVE-2026-4505eosphoros-ai DB-GPT FastAPI endpoint controller.py module_plugin.refresh_plugins unrestricted upload5.3CNA v4.00.3%2026-03-20
CVE-2026-4504eosphoros-ai db-gpt Incomplete Fix editor SQL injection6.9CNA v4.00.4%2026-03-20
CVE-2026-4500bagofwords1 bagofwords code_execution.py generate_df injection5.3CNA v4.00.6%2026-03-20Fix
CVE-2026-4499D-Link DIR-820LW SSDP ssdpcgi_main os command injection9.8v3.14.7%2026-03-20
CVE-2026-4497Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection9.8v3.12.9%2026-03-20
CVE-2026-4496sigmade Git-MCP-Server gitUtils.ts child_process.exec os command injection4.8CNA v4.01.4%2026-03-20
CVE-2026-4495atjiu pybbs CommentApiController.java create cross-site scripting5.1CNA v4.00.3%2026-03-20
CVE-2026-4494atjiu pybbs TopicApiController.java create cross-site scripting5.1CNA v4.00.3%2026-03-20
CVE-2026-4493Tenda A18 Pro MAC Filtering Configuration endpoint setMacFilterCfg sub_423B50 stack-based overflow8.7CNA v4.00.8%2026-03-20
CVE-2026-4492Tenda A18 Pro formSetQosBand set_qosMib_list stack-based overflow8.7CNA v4.00.8%2026-03-20
CVE-2026-4491Tenda A18 Pro SetIpMacBind fromSetIpMacBind stack-based overflow8.7CNA v4.00.8%2026-03-20
CVE-2026-4490Tenda A18 Pro openSchedWifi setSchedWifi stack-based overflow8.7CNA v4.00.8%2026-03-20
CVE-2026-4489Tenda A18 Pro fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow8.7CNA v4.00.8%2026-03-20
CVE-2026-4488UTT HiPER 1250GW setSysAdm strcpy buffer overflow8.7CNA v4.00.8%2026-03-20
CVE-2026-4487UTT HiPER 1200GW websHostFilter strcpy buffer overflow8.7CNA v4.00.8%2026-03-20
CVE-2026-4486D-Link DIR-513 Web service formEasySetPassword stack-based overflow8.7CNA v4.01.1%2026-03-20
CVE-2026-4485itsourcecode College Management System search_student.php SQL injection5.3CNA v4.00.3%2026-03-20
CVE-2026-4478Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification9.2CNA v4.00.3%2026-03-20
CVE-2026-4477Yi Technology YI Home Camera WPA/WPS hard-coded key2.3CNA v4.00.2%2026-03-20
CVE-2026-4476Yi Technology YI Home Camera CGI endpoint ipc missing authentication5.3CNA v4.00.4%2026-03-20
CVE-2026-4475Yi Technology YI Home Camera ipc hard-coded credentials8.7CNA v4.00.5%2026-03-20
CVE-2026-4474itsourcecode University Management System admin_single_student_update.php cross-site scripting6.1v3.10.4%2026-03-20
CVE-2026-4473itsourcecode Online Doctor Appointment System appointment_action.php SQL injection9.8v3.10.5%2026-03-20
CVE-2026-4472itsourcecode Online Frozen Foods Ordering System admin_edit_supplier.php SQL injection9.8v3.10.5%2026-03-20
CVE-2026-4471itsourcecode Online Frozen Foods Ordering System admin_edit_employee.php SQL injection9.8v3.10.5%2026-03-20
CVE-2026-4470itsourcecode Online Frozen Foods Ordering System admin_edit_menu.php SQL injection9.8v3.10.5%2026-03-20
CVE-2026-4469itsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php SQL injection9.8v3.10.5%2026-03-20
CVE-2026-4468Comfast CF-AC100 mbox-config command injection5.1CNA v4.03.4%2026-03-20
CVE-2026-4467Comfast CF-AC100 mbox-config command injection5.1CNA v4.03.4%2026-03-20
CVE-2026-4466Comfast CF-AC100 mbox-config command injection5.1CNA v4.03.4%2026-03-20
CVE-2026-4465D-Link DIR-513 formSysCmd os command injection8.8v3.15.2%2026-03-20
CVE-2026-4464Google Chrome ANGLE integer overflow8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4463Google Chrome WebRTC heap-based buffer overflow8.8CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-4462Google Chrome Blink out-of-bounds read8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4461Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-4460Google Chrome Skia out-of-bounds read8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4459Google Chrome WebAudio out-of-bounds read8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4458Google Chrome extensions use-after-free8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4457Google Chrome V8 type confusion8.8CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-4456Google Chrome Digital Credentials API use-after-free8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4455Google Chrome PDFium heap-based buffer overflow8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4454Google Chrome Network use-after-free8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4453Google Chrome Dawn integer overflow4.3CISA ADP v3.10.2%2026-03-20Fix
CVE-2026-4452Google Chrome ANGLE integer overflow8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4451Google Chrome sandbox escape8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4450Google Chrome V8 out-of-bounds write8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4449Google Chrome Blink use-after-free8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4448Google Chrome ANGLE heap-based buffer overflow8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4447Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-4446Google Chrome WebRTC use-after-free8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4445Google Chrome WebRTC use-after-free8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4444Google Chrome WebRTC stack-based buffer overflow8.8CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-4443Google Chrome WebAudio heap-based buffer overflow8.8CISA ADP v3.10.5%2026-03-20Fix
CVE-2026-4442Google Chrome CSS heap-based buffer overflow8.8v3.10.3%2026-03-20Fix
CVE-2026-4441Google Chrome Base use-after-free8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4440Google Chrome WebGL out-of-bounds read8.8CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4439Google Chrome WebGL out-of-bounds access8.8CISA ADP v3.10.4%2026-03-20Fix
CVE-2026-4438The GNU C Library glibc gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames5.4CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4437The GNU C Library glibc gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response7.5CISA ADP v3.10.3%2026-03-20Fix
CVE-2026-4434Devolutions Server PAM propagation WinRM connections improper certificate validation8.1CISA ADP v3.10.2%2026-03-20Fix
CVE-2026-4136Membership Plugin Restrict Content WordPress plugin unvalidated redirect in password reset Flow4.3CNA v3.10.3%2026-03-20Fix
CVE-2026-4038Aimogen Pro WordPress plugin unauthenticated privilege escalation via arbitrary function Call9.8CNA v3.10.5%2026-03-20Fix
CVE-2026-3864CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server6.5CNA v3.10.8%2026-03-20Fix
CVE-2026-3584Kali Forms WordPress plugin unauthenticated remote code execution via form_process9.8CNA v3.14.4%2026-03-20NucleiFix
CVE-2026-3550RockPress WordPress plugin missing authorization authenticated arbitrary modification5.3CNA v3.10.5%2026-03-20Fix
CVE-2026-2432CM Custom Reports WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-03-20Fix
CVE-2026-2421ilGhera Carta Docente for WooCommerce WordPress plugin path traversal to arbitrary file deletion6.5CNA v3.10.5%2026-03-20Fix
CVE-2026-2378Address bar spoofing risk in ArcSearch on Android7.4CNA v3.10.2%2026-03-20Fix
CVE-2026-0677TotalContest Lite WordPress plugin PHP object injection6.3CISA ADP v3.10.2%2026-03-20
CVE-2026-33410Discourse hardens chat DM channel creation and expansion5.4CNA v3.10.2%2026-03-19Fix
CVE-2026-33408Discourse has improper authorization in Post Edits Report for Moderators2.2CNA v3.10.4%2026-03-19Fix
CVE-2026-33395Discourse has stored click‑based XSS via Graphviz SVG javascript: Links4.4CNA v3.10.3%2026-03-19Fix
CVE-2026-33394Discourse leaks PM post edits to moderators2.7CNA v3.10.5%2026-03-19Fix
CVE-2026-33393Discourse fixes loose hostname matching in spam host allowlist4.3CNA v3.10.3%2026-03-19Fix
CVE-2026-33355Discourse filters whisper posts from private-posts feed6.5CNA v3.10.5%2026-03-19Fix
CVE-2026-33346OpenEMR has stored XSS in portal_payment.php via Unescaped table_args8.7CNA v3.11.0%2026-03-19Fix
CVE-2026-33321OpenEMR has Out-of-Band server-side request forgery (OOB SSRF)7.2CNA v4.00.3%2026-03-19Fix
CVE-2026-33305OpenEMR has authorization bypass in FaxSMS AppDispatch Constructor5.4CNA v3.10.3%2026-03-19Fix
CVE-2026-33304OpenEMR has authorization bypass in Dated Reminders Log6.5CNA v3.10.4%2026-03-19Fix
CVE-2026-33303OpenEMR vulnerable to stored XSS via Unescaped portal_login_username in Credential Print view5.4CNA v3.10.7%2026-03-19Fix
CVE-2026-33302OpenEMR: ZhAclCheck Ignores Explicit ACL Denies7.3CNA v4.00.4%2026-03-19Fix
CVE-2026-33301OpenEMR has arbitrary image file read via PDF generator7.1CNA v4.00.4%2026-03-19Fix
CVE-2026-33299OpenEMR has stored XSS in patient encounter Eye Exam form answers8.5CNA v4.00.7%2026-03-19Fix
CVE-2026-32869OPEXUS eComplaint and eCASE XSS via Name of Organization field5.4v3.10.2%2026-03-19Fix
CVE-2026-32868OPEXUS eComplaint and eCASE XSS via my information5.4v3.10.2%2026-03-19Fix
CVE-2026-32867OPEXUS eComplaint unauthenticated file upload9.8v3.10.4%2026-03-19Fix
CVE-2026-32866OPEXUS eComplaint and eCase stored XSS via profile first and last name5.4v3.10.2%2026-03-19Fix
CVE-2026-32865OPEXUS eComplaint and eCase insecure password reset9.8v3.10.5%2026-03-19Fix
CVE-2026-32843Linkit ONE Location Aware Sensor System (LASS) reflected XSS via PM25.php5.1CNA v4.00.6%2026-03-19
CVE-2026-32818Admidio is missing authorization on Forum Topic and Post Deletion6.5CNA v3.10.3%2026-03-19Fix
CVE-2026-32816Admidio has missing CSRF Validation on Role Delete, Activate, and Deactivate Actions5.7CNA v3.10.2%2026-03-19Fix
CVE-2026-32815B3LOG SiYuan WebSocket endpoint improper authentication5.3CNA v4.00.5%2026-03-19Fix
CVE-2026-32755Admidio is missing CSRF Protection on Role Membership Date Changes5.7CNA v3.10.2%2026-03-19Fix
CVE-2026-32754FreeScout email notification templates stored cross-site scripting9.3CNA v3.10.6%2026-03-19Fix
CVE-2026-32753FreeScout: Stored XSS through SVG file upload with filter bypass8.5CNA v4.00.3%2026-03-19Fix
CVE-2026-32752FreeScout thread improper access control0.0CNA v3.10.4%2026-03-19Fix
CVE-2026-32751SiYuan vulnerable to remote code execution via stored XSS in Notebook Name Mobile interface5.1CNA v4.00.8%2026-03-19Fix
CVE-2026-32750SiYuan importStdMd: Unvalidated localPath imports arbitrary host directories as persistent notes6.8CNA v3.10.5%2026-03-19Fix
CVE-2026-32749SiYuan importSY/importZipMd: Path traversal via multipart filename enables arbitrary file write7.6CNA v3.10.6%2026-03-19Fix
CVE-2026-32747SiYuan globalCopyFiles: Incomplete sensitive path blocklist allows reading /proc and Docker secrets6.8CNA v3.10.5%2026-03-19Fix
CVE-2026-32743PX4 Autopilot: Stack-based buffer overflow via Oversized Path Input in MAVLink Log Request Handling6.5CNA v3.10.3%2026-03-19Exploit code
CVE-2026-32721LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless client modal8.6CNA v3.10.3%2026-03-19Fix
CVE-2026-32622SQLBot: Remote code execution via Terminology Poisoning8.6CNA v4.00.8%2026-03-19Fix
CVE-2026-32255Kan is vulnerable to unauthenticated SSRF via Attachment Download endpoint8.6CNA v3.11.7%2026-03-19NucleiExploit codeFix
CVE-2026-32238OpenEMR has remote code execution in backup functionality9.1CNA v3.12.6%2026-03-19Exploit codeFix
CVE-2026-32194Microsoft Bing Images remote code execution9.8CNA v3.11.1%2026-03-19Fix
CVE-2026-32191Microsoft Bing Images remote code execution9.8CNA v3.11.1%2026-03-19Fix
CVE-2026-32169Microsoft Azure Cloud Shell elevation of privilege10.0CNA v3.10.9%2026-03-19Fix
CVE-2026-32119OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page4.4CNA v3.10.6%2026-03-19Fix
CVE-2026-32099Discourse prevents hidden profile data leak via user onebox4.3CNA v3.10.4%2026-03-19Fix
CVE-2026-32041OpenClaw Unauthenticated Browser Control Access via Failed Auth Bootstrap7.8v3.10.2%2026-03-19Fix
CVE-2026-32040OpenClaw HTML injection via Unvalidated Image MIME Type in Data-URL Interpolation6.1v3.10.2%2026-03-19Fix
CVE-2026-32039OpenClaw Sender authorization bypass via Identity Collision in toolsBySender6.5v3.10.3%2026-03-19Fix
CVE-2026-32038OpenClaw Sandbox Network Isolation Bypass via docker.network=container parameter9.0v3.10.5%2026-03-19Fix
CVE-2026-32037OpenClaw Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling6.5v3.10.3%2026-03-19Fix
CVE-2026-32036OpenClaw authentication bypass via Encoded Dot-Segment Traversal in /API/channels8.2v3.10.7%2026-03-19Fix
CVE-2026-32035OpenClaw Missing Owner Flag Validation in Discord Voice Transcript handler7.1v3.10.2%2026-03-19Fix
CVE-2026-32034OpenClaw Insecure Control UI Authentication over Plaintext HTTP7.5NVD v3.10.7%2026-03-19Fix
CVE-2026-32033OpenClaw path traversal via @-prefixed Absolute Paths in Workspace Boundary Validation7.5NVD v3.10.5%2026-03-19Fix
CVE-2026-32032OpenClaw arbitrary Shell Execution via Unvalidated SHELL Environment variable7.8v3.10.2%2026-03-19Fix
CVE-2026-32031OpenClaw authentication bypass via Path Canonicalization Mismatch in /API/channels Gateway6.5v3.10.3%2026-03-19Fix
CVE-2026-32030OpenClaw Sensitive File Disclosure via stageSandboxMedia path traversal5.9NVD v3.10.5%2026-03-19Fix
CVE-2026-32029OpenClaw client IP spoofing via X-Forwarded-For Header Parsing5.3v3.10.3%2026-03-19Fix
CVE-2026-32028OpenClaw missing authorization Check in Discord DM Reaction Ingress4.3NVD v3.10.3%2026-03-19Fix
CVE-2026-32027OpenClaw improper authorization via DM Pairing Store Identity Inheritance in Group Allowlist7.1CNA v4.00.4%2026-03-19Fix
CVE-2026-32026OpenClaw arbitrary file read via Improper Temporary Path Validation in Sandbox8.6v3.10.5%2026-03-19Fix
CVE-2026-32025OpenClaw password brute-force via Browser-Origin WebSocket authentication bypass7.5v3.10.5%2026-03-19Fix
CVE-2026-32024OpenClaw Symlink Traversal in Avatar Handling7.5v3.10.5%2026-03-19Fix
CVE-2026-32023OpenClaw Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.run8.8NVD v3.10.5%2026-03-19Fix
CVE-2026-32022OpenClaw arbitrary file read via grep -e Flag Policy Bypass6.0CNA v4.00.5%2026-03-19Fix
CVE-2026-32021OpenClaw authorization bypass via Display Name Collision in Feishu allowFrom6.5v3.10.4%2026-03-19Fix
CVE-2026-32020OpenClaw arbitrary file read via symlink following in Static file handler5.5v3.10.2%2026-03-19Fix
CVE-2026-32019OpenClaw Incomplete IPv4 Special-Use Range Blocking in SSRF Guard5.3NVD v3.10.4%2026-03-19Fix
CVE-2026-32018OpenClaw race condition in Sandbox Registry Write Operations4.8v3.10.2%2026-03-19Fix
CVE-2026-32017OpenClaw arbitrary file write via Short-Option Bypass in exec Allowlist6.5NVD v3.10.5%2026-03-19Fix
CVE-2026-32016OpenClaw path traversal via Basename-Only Allowlist Matching on macOS7.8v3.10.2%2026-03-19Fix
CVE-2026-32015OpenClaw path Hijacking Bypass in tools.exec.safeBins Allowlist Validation7.8v3.10.2%2026-03-19Fix
CVE-2026-32014OpenClaw Node Reconnect Metadata spoofing via Unsigned Platform fields8.6CNA v4.00.3%2026-03-19Fix
CVE-2026-32013OpenClaw Symlink Traversal in agents.files Methods8.7CNA v4.00.8%2026-03-19Fix
CVE-2026-32011OpenClaw Slow-request denial of service via Pre-Auth Webhook Body Parsing8.7CNA v4.00.7%2026-03-19Fix
CVE-2026-32010OpenClaw Allowlist Bypass via sort --compress-program parameter8.8v3.10.4%2026-03-19Fix
CVE-2026-32009OpenClaw Binary Hijacking via Static Default Trusted Directories in safeBins7.8v3.10.2%2026-03-19Fix
CVE-2026-32008OpenClaw arbitrary Local File Read via Browser Navigation Guard7.1CNA v4.00.5%2026-03-19Fix
CVE-2026-32007OpenClaw sandbox bypass in apply_patch tool via Workspace-Only Check Bypass8.1v3.10.5%2026-03-19Fix
CVE-2026-32006OpenClaw authorization bypass via DM Pairing-Store Fallback in Group Allowlist4.3v3.10.4%2026-03-19Fix
CVE-2026-32005OpenClaw authorization bypass in Interactive Callbacks via Sender Check Skip8.1v3.10.4%2026-03-19Fix
CVE-2026-32004OpenClaw authentication bypass via Encoded Path in /API/channels route8.2v3.10.5%2026-03-19Fix
CVE-2026-32003OpenClaw remote code execution via SHELLOPTS/PS4 Environment injection in system.run7.2v3.10.8%2026-03-19Fix
CVE-2026-32002OpenClaw Sandbox Boundary Bypass via Image tool workspaceOnly Bypass6.5v3.10.4%2026-03-19Fix
CVE-2026-32001OpenClaw Node Role Device-Identity Bypass via WebSocket Authentication5.3CNA v4.00.4%2026-03-19Fix
CVE-2026-32000OpenClaw command injection via Windows Shell Fallback in Lobster Tool Execution7.8NVD v3.11.1%2026-03-19Fix
CVE-2026-31999OpenClaw Current Working Directory injection via Windows Wrapper Resolution Fallback7.8v3.10.4%2026-03-19Fix
CVE-2026-31998OpenClaw authorization bypass in Synology Chat plugin via Empty allowedUserIds9.8NVD v3.10.6%2026-03-19Fix
CVE-2026-31997OpenClaw Executable Rebind via Unbound path-token in system.run Approvals6.7v3.10.1%2026-03-19Fix
CVE-2026-31996OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags7.1NVD v3.10.2%2026-03-19Fix
CVE-2026-31995OpenClaw command injection via Windows Shell Fallback in Lobster extension7.0v3.10.8%2026-03-19Fix
CVE-2026-31994OpenClaw local command injection7.8v3.10.9%2026-03-19Fix
CVE-2026-31993OpenClaw Allowlist Parsing Mismatch in system.run Shell Chains6.4v3.10.5%2026-03-19Fix
CVE-2026-31992OpenClaw Allowlist Exec-Guard Bypass via env -S8.8v3.10.6%2026-03-19Fix
CVE-2026-31991OpenClaw authorization bypass via DM Pairing-Store Leakage in Signal Group Allowlist4.6v3.10.3%2026-03-19Fix
CVE-2026-31990OpenClaw Symlink Traversal in stageSandboxMedia Destination7.1v3.10.2%2026-03-19Fix
CVE-2026-31989OpenClaw server-side request forgery via web_search Citation Redirect6.3NVD v3.10.3%2026-03-19Fix
CVE-2026-30924qui CORS Misconfiguration: Arbitrary Origins Trusted9.0CNA v4.00.4%2026-03-19Fix
CVE-2026-30874OpenWrt procd hotplug_call function privilege escalation1.8CNA v4.00.3%2026-03-19Fix
CVE-2026-30873OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens2.4CNA v4.00.7%2026-03-19Fix
CVE-2026-30872OpenWrt Project has a stack-based buffer overflow vulnerability via IPv6 reverse DNS lookup9.5CNA v4.01.1%2026-03-19Fix
CVE-2026-30871OpenWrt Project has stack-based buffer overflow in DNS PTR Query9.5CNA v4.00.7%2026-03-19Fix
CVE-2026-30836smallstep certificates Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq10.0CNA v3.10.3%2026-03-19Fix
CVE-2026-30711Devome GRR session.inc.php SQL injection8.8CISA ADP v3.10.5%2026-03-19
CVE-2026-30694DedeCMS code injection9.8CISA ADP v3.11.0%2026-03-19
CVE-2026-30404Wgstart Wgcloud server-side request forgery7.5CISA ADP v3.10.4%2026-03-19
CVE-2026-30403Wgstart Wgcloud arbitrary file read7.5CISA ADP v3.10.5%2026-03-19
CVE-2026-30402Wgstart Wgcloud code injection9.8CISA ADP v3.10.9%2026-03-19
CVE-2026-29608OpenClaw Approval Integrity Bypass via system.run argv Rewriting6.7v3.10.2%2026-03-19Fix
CVE-2026-29607OpenClaw authorization bypass via allow-always Wrapper Persistence7.2NVD v3.10.8%2026-03-19Fix
CVE-2026-29107SuiteCRM vulnerable to authenticated SSRF via PDF export5.0CNA v3.10.3%2026-03-19Fix
CVE-2026-29106SuiteCRM has blind XSS in return_id parameter5.9CNA v3.10.3%2026-03-19Fix
CVE-2026-29105SuiteCRM has unauthenticated open redirect in leads WebToLead Capture5.4CNA v3.10.3%2026-03-19Fix
CVE-2026-29104SuiteCRM vulnerable to authenticated arbitrary file upload2.7CNA v3.10.4%2026-03-19Fix
CVE-2026-29103SuiteCRM vulnerable to remote code execution via Module Loader Package Scanner Bypass9.1CNA v3.10.9%2026-03-19Fix
CVE-2026-29102SuiteCRM has authenticated RCE in modules7.2CNA v3.10.9%2026-03-19Fix
CVE-2026-29101SuiteCRM vulnerable to directory traversal to DoS in modules4.9CNA v3.10.5%2026-03-19Fix
CVE-2026-29100SuiteCRM has reflected HTML injection in Login page via default_user_name parameter7.1CNA v3.10.3%2026-03-19Fix
CVE-2026-29099SuiteCRM has authenticated blind SQL injection in OutboundEmail Legacy Functionality8.8CNA v3.10.5%2026-03-19Fix
CVE-2026-29098SuiteCRM has relative path traversal via ModuleBuilder Modules ExportCustom action4.9CNA v3.10.5%2026-03-19Fix
CVE-2026-29097SuiteCRM server-side request forgery and denial of service via RSS Feed Dashlet7.1CNA v4.00.4%2026-03-19Fix
CVE-2026-29096SuiteCRM vulnerable to authenticated SQL injection via unsanitized field_function in Report fields8.1CNA v3.10.4%2026-03-19Fix
CVE-2026-29072Discourse missing permission check for policy creation in discourse-policy8.2CNA v4.00.3%2026-03-19Fix
CVE-2026-28461OpenClaw Unbounded Memory Growth in Zalo Webhook via Query String Key Churn8.7CNA v4.00.6%2026-03-19Fix
CVE-2026-28460OpenClaw Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run8.8NVD v3.10.7%2026-03-19Fix
CVE-2026-28449OpenClaw Webhook Replay Attack via Missing Durable Replay Suppression6.5v3.10.5%2026-03-19Fix
CVE-2026-28282Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin2.3CNA v4.00.4%2026-03-19Fix
CVE-2026-28073WP eMember WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-19
CVE-2026-28070WP eMember WordPress plugin broken access control5.3CNA v3.10.3%2026-03-19
CVE-2026-28044WP Rocket WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-03-19Fix
CVE-2026-27953ormar has a Pydantic Validation Bypass via Kwargs injection in Model Constructor7.1CNA v3.10.9%2026-03-19Fix
CVE-2026-27936Discourse discloses restricted post-action counts to non-privileged users6.9CNA v4.00.3%2026-03-19Fix
CVE-2026-27935Discourse leaks private topic metadata to non-authorized users6.9CNA v4.00.5%2026-03-19Fix
CVE-2026-27934Discourse leaks private topic title and post excerpt via user action API endpoint8.7CNA v4.00.4%2026-03-19NucleiFix
CVE-2026-27740Discourse has stored XSS in AI Triage Automation5.1CNA v4.00.3%2026-03-19Fix
CVE-2026-27670OpenClaw arbitrary file write via ZIP Extraction Parent Symlink race condition5.8CNA v4.00.1%2026-03-19Fix
CVE-2026-27570Discourse vulnerable to stored XSS via Shared AI Conversation Onebox5.1CNA v4.00.3%2026-03-19Fix
CVE-2026-27566OpenClaw Allowlist Bypass via Wrapper Binary Unwrapping in system.run8.8v3.10.8%2026-03-19Fix
CVE-2026-27542Woocommerce Wholesale Lead Capture WordPress plugin privilege escalation9.8CNA v3.11.8%2026-03-19NucleiExploit codeFix
CVE-2026-27540Woocommerce Wholesale Lead Capture WordPress plugin arbitrary file upload9.0CNA v3.11.6%2026-03-19Exploit codeFix
CVE-2026-27491Discourse has a bypass of official warnings messages by non-staff users6.9CNA v4.00.3%2026-03-19Fix
CVE-2026-27454Discourse has check revision visibility on posts endpoint5.3CNA v3.11.0%2026-03-19NucleiFix
CVE-2026-27413Profile Builder Pro WordPress plugin SQL injection9.3CNA v3.10.4%2026-03-19Fix
CVE-2026-27397Really Simple Security Pro WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.4%2026-03-19Fix
CVE-2026-27166Discourse vulnerable to HTML injection via prohibited iframe URLs4.1CNA v3.10.3%2026-03-19Fix
CVE-2026-27096ColorFolio - Freelance Designer WordPress theme deserialization of untrusted data8.1CNA v3.10.4%2026-03-19
CVE-2026-27093Tripgo WordPress theme local file inclusion8.1CNA v3.10.6%2026-03-19Fix
CVE-2026-27091UiPress lite WordPress plugin broken access control6.3CNA v3.10.3%2026-03-19Fix
CVE-2026-27070Everest Forms Pro WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-19Fix
CVE-2026-27068Website LLMs.txt WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-19Fix
CVE-2026-27067Mobile App Editor WordPress plugin arbitrary file upload9.1CNA v3.10.5%2026-03-19
CVE-2026-27065BuilderPress WordPress plugin local file inclusion9.8CNA v3.10.6%2026-03-19
CVE-2026-27043Photography WordPress theme arbitrary file upload7.2CNA v3.10.5%2026-03-19Fix
CVE-2026-26940Improper validation of specified quantity in input in Kibana leading to denial of service6.5CNA v3.10.5%2026-03-19Fix
CVE-2026-26939Missing authorization in Kibana leading to Unauthorized Endpoint Response Action Configuration6.5CNA v3.10.3%2026-03-19Fix
CVE-2026-26933Improper validation of array index in Packetbeat leading to denial of service5.7CNA v3.10.3%2026-03-19Fix
CVE-2026-26931Memory allocation with excessive size value in Metricbeat leading to denial of service5.7CNA v3.10.3%2026-03-19Fix
CVE-2026-26139Microsoft Purview elevation of privilege8.6CNA v3.11.0%2026-03-19Fix
CVE-2026-26138Microsoft Purview elevation of privilege8.6CNA v3.11.1%2026-03-19Fix
CVE-2026-26137Microsoft Exchange elevation of privilege9.9CNA v3.10.7%2026-03-19Fix
CVE-2026-26136Microsoft CoPilot information disclosure6.5CNA v3.10.9%2026-03-19Fix
CVE-2026-26120Microsoft Bing tampering6.5CNA v3.10.8%2026-03-19Fix
CVE-2026-25928OpenEMR vulnerable to path traversal when Zipping DICOM Folders6.5CNA v3.10.7%2026-03-19Fix
CVE-2026-25744OpenEMR: POST /API/.../vital Accepts Attacker-Supplied id and Overwrites arbitrary Vitals6.5CNA v3.10.4%2026-03-19Fix
CVE-2026-25667Microsoft .NET resource exhaustion7.5CISA ADP v3.14.2%2026-03-19Fix
CVE-2026-25471Admin Safety Guard WordPress plugin broken authentication8.1CNA v3.10.5%2026-03-19Fix
CVE-2026-25445WishList Member X WordPress plugin PHP object injection8.8CNA v3.10.5%2026-03-19Fix
CVE-2026-25443Fraud Prevention For Woocommerce WordPress plugin arbitrary content deletion vulnerability7.5CNA v3.10.4%2026-03-19Fix
CVE-2026-25442Kentha WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-03-19
CVE-2026-25438Gutenberg Blocks Unlimited blocks For Gutenberg WordPress plugin reflected cross-site scripting7.1CNA v3.10.3%2026-03-19Fix
CVE-2026-25312EventPrime WordPress plugin Payment bypass vulnerability7.5CNA v3.10.2%2026-03-19Fix
CVE-2026-24299M365 Copilot information disclosure5.3CNA v3.10.6%2026-03-19Fix
CVE-2026-23659Microsoft Azure Data Factory information disclosure8.6CNA v3.10.8%2026-03-19Fix
CVE-2026-23658Microsoft Azure DevOps: Msazure elevation of privilege8.6CNA v3.10.8%2026-03-19Fix
CVE-2026-22732Under some Conditions Spring Security HTTP headers are not Written9.1CNA v3.10.5%2026-03-19Exploit codeFix
CVE-2026-22731Spring Boot authentication bypass under Actuator Health groups paths8.2CNA v3.10.3%2026-03-19Fix
CVE-2026-22558Ubiquiti UniFi Network Application NoSQL injection7.7CNA v3.10.6%2026-03-19Fix
CVE-2026-22557Ubiquiti UniFi Network Application path traversal10.0CNA v3.128.1%2026-03-19NucleiEmerging ThreatsExploit codeFix
CVE-2026-22176OpenClaw command injection7.8v3.10.6%2026-03-19Fix
CVE-2026-21788HCL Connections is vulnerable to cross-site scripting (XSS)5.4CNA v3.10.2%2026-03-19Fix
CVE-2026-4428CRL Distribution Point Scope Check logic error in AWS-LC9.1CNA v4.00.3%2026-03-19Fix
CVE-2026-4426Libarchive: Libarchive: Denial of service via malformed iso file processing6.5CNA v3.10.6%2026-03-19Fix
CVE-2026-4424Libarchive: Libarchive: Information disclosure via heap out-of-bounds read in rar archive processing7.5CNA v3.11.1%2026-03-19Fix
CVE-2026-4395wolfSSL heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path1.3CNA v4.00.6%2026-03-19Fix
CVE-2026-4342ingress-nginx comment-based nginx configuration injection8.8CNA v3.10.6%2026-03-19Exploit codeFix
CVE-2026-4159wolfSSL wc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read1.2CNA v4.00.1%2026-03-19Fix
CVE-2026-4120Info Cards WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-03-19Fix
CVE-2026-4068The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add f4.3CNA v3.10.2%2026-03-19Fix
CVE-2026-4006Draft List WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-03-19Fix
CVE-2026-3849wolfSSL buffer overflow in HPKE via Oversized ECH Config6.9CNA v4.00.8%2026-03-19Fix
CVE-2026-3658Appointment Booking Calendar WordPress plugin unauthenticated SQL injection via fields parameter7.5CNA v3.10.5%2026-03-19Fix
CVE-2026-3580wolfSSL compiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V2.1CNA v4.00.1%2026-03-19Fix
CVE-2026-3579wolfSSL non-constant time multiplication subroutine __muldi3 on RISC-V RV32I2.1CNA v4.00.3%2026-03-19Fix
CVE-2026-3549wofSSL wolfSSL ECH parsing heap buffer overflow8.3CNA v4.00.6%2026-03-19Fix
CVE-2026-3548Buffer overflow in CRL number parsing in wolfSSL7.2CNA v4.00.6%2026-03-19Fix
CVE-2026-3547wolfSSL: Out-of-bounds read (DoS) in ALPN parsing due to incomplete validation7.5CNA v3.10.4%2026-03-19Fix
CVE-2026-3511Slovensko.Digital Autogram XMLUtils.java XML external entity injection8.6CNA v3.10.5%2026-03-19Fix
CVE-2026-3503wolfSSL (wolfCrypt) fault injection attack with ML-DSA and ML-KEM on ARM4.3CNA v4.00.2%2026-03-19Fix
CVE-2026-3475Instant Popup Builder email verification shortcode handler missing authorization5.3CNA v3.10.5%2026-03-19Fix
CVE-2026-3230wolfSSL improper key_share validation in TLS 1.3 HelloRetryRequest1.2CNA v4.00.4%2026-03-19Fix
CVE-2026-3229wofSSL wolfSSL integer overflow in Certificate Chain Allocation1.2CNA v4.00.1%2026-03-19Fix
CVE-2026-3029PyMuPDF has a path traversal in _main_.py7.5CISA ADP v3.10.4%2026-03-19Fix
CVE-2026-2646wolfSSL heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION function5.0CNA v4.00.2%2026-03-19Fix
CVE-2026-2645wolfSSL acceptance of CertificateVerify message before ClientKeyExchange in TLS 1.25.5CNA v4.00.2%2026-03-19Fix
CVE-2026-2571Download Manager WordPress plugin missing authorization authenticated user email enumeration4.3CNA v3.10.4%2026-03-19Fix
CVE-2026-2369Libsoup: Libsoup: Buffer overread due to integer underflow when handling zero-length resources9.1NVD v3.10.4%2026-03-19Fix
CVE-2026-1276IBM QRadar SIEM cross-site scripting5.4CNA v3.10.1%2026-03-19Fix
CVE-2026-1238SlimStat Analytics WordPress plugin unauthenticated stored cross-site scripting via fh7.2CNA v3.10.3%2026-03-19Fix
CVE-2026-1005wolfSSL integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path2.1CNA v4.00.3%2026-03-19Fix
CVE-2026-0819wolfSSL stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes2.2CNA v4.00.1%2026-03-19Fix
CVE-2026-33265LibreChat incorrect resource transfer9.0v3.10.2%2026-03-18
CVE-2026-33163parse-community parse-server parse Server leaks protected fields via LiveQuery afterEvent trigger8.2CNA v4.00.5%2026-03-18Fix
CVE-2026-33058Kanboard has authenticated SQL injection in Project Permissions handler8.4CNA v4.00.4%2026-03-18Fix
CVE-2026-33042Parse Platform Parse Server signup credential validation authentication bypass6.9CNA v4.00.4%2026-03-18Fix
CVE-2026-33004Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form4.3CISA ADP v3.10.3%2026-03-18Fix
CVE-2026-33003Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files4.3CISA ADP v3.10.2%2026-03-18Fix
CVE-2026-33002Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation7.5CISA ADP v3.10.4%2026-03-18Fix
CVE-2026-33001Jenkins has a link following vulnerability allows arbitrary file creation8.8CISA ADP v3.11.2%2026-03-18Fix
CVE-2026-32944parse-community parse-server parse Server crash via deeply nested query condition operators8.7CNA v4.00.6%2026-03-18Fix
CVE-2026-32943Parse Platform Parse Server password reset token validation race condition2.3CNA v4.00.2%2026-03-18Fix
CVE-2026-32886parse-community parse-server parse Server's Cloud function dispatch crashes server8.2CNA v4.00.7%2026-03-18Fix
CVE-2026-32878Parse Platform Parse Server schema deep copy prototype pollution5.3CNA v4.00.5%2026-03-18Fix
CVE-2026-32805Romeo is vulnerable to Archive Slip due to missing checks in sanitization8.3CNA v4.00.6%2026-03-18Fix
CVE-2026-32770Parse Platform Parse Server LiveQuery subscription matching denial of service5.9CNA v3.10.7%2026-03-18Fix
CVE-2026-32742Parse Platform Parse Server session creation endpoint mass assignment4.3CNA v3.10.4%2026-03-18Fix
CVE-2026-32737Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.9CNA v4.00.5%2026-03-18Fix
CVE-2026-32736Hytale Modding Wiki has insecure direct object reference / GDPR PII Exposure4.3CNA v3.10.3%2026-03-18Fix
CVE-2026-32735openapi-to-java-records-mustache-templates improper input validation2.3CNA v4.00.5%2026-03-18Fix
CVE-2026-32731ApostropheCMS has arbitrary file write (Zip Slip / path traversal) in Import-Export Gzip Extraction10.0CNA v3.10.6%2026-03-18Exploit codeFix
CVE-2026-32730ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware8.1CNA v3.10.5%2026-03-18Fix
CVE-2026-32728parse-community parse-server parse Server has a stored XSS filter bypass8.3CNA v4.00.4%2026-03-18Fix
CVE-2026-32723SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)4.8CNA v4.00.1%2026-03-18Fix
CVE-2026-32722Bloomberg memray memray-generated HTML reports vulnerable to stored XSS3.6CNA v3.10.4%2026-03-18Exploit codeFix
CVE-2026-32703OpenProject repository filename rendering vulnerability9.1CNA v3.10.3%2026-03-18Fix
CVE-2026-32700Devise email confirmation race condition6.0CNA v4.00.3%2026-03-18Fix
CVE-2026-32698OpenProject has a SQL injection via Custom Field Name that can be chained to remote code execution9.1CNA v3.10.4%2026-03-18Fix
CVE-2026-32694Insecure direct object reference attack via predictable secret ID in Juju6.6CNA v3.10.4%2026-03-18Fix
CVE-2026-32693Unauthorized access to Kubernetes secrets in Juju8.8CNA v3.10.4%2026-03-18Fix
CVE-2026-32692Canonical Juju unauthorized update of out-of-scope Vault secrets7.6CNA v3.10.3%2026-03-18Fix
CVE-2026-32691Canonical Juju timing ownership claim attack on new external back-end secrets5.3CNA v3.10.3%2026-03-18Fix
CVE-2026-32638StudioCMS REST getUsers exposes Owner Account Records to Admin Tokens2.7CNA v3.10.4%2026-03-18Fix
CVE-2026-32636ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash5.3CNA v3.10.6%2026-03-18Fix
CVE-2026-32634Glances Central Browser Autodiscovery leaks reusable credentials to Zeroconf-Spoofed Servers8.1CNA v3.10.2%2026-03-18Fix
CVE-2026-32633Glances's Browser API exposes Reusable Downstream Credentials via `/API/4/serverslist`9.1CNA v3.10.6%2026-03-18Fix
CVE-2026-32632Glances's REST/WebUI lacks Host Validation and Remains Exposed to DNS Rebinding5.9CNA v3.10.2%2026-03-18Fix
CVE-2026-32611Glances has a SQL injection in DuckDB Export via Unparameterized DDL Statements7.0CNA v3.10.4%2026-03-18Fix
CVE-2026-32610Glances's Default CORS Configuration allows Cross-Origin Credential Theft8.1CNA v3.10.5%2026-03-18Fix
CVE-2026-32609Glances args API endpoint information disclosure7.5CNA v3.10.6%2026-03-18Fix
CVE-2026-32608Glances has a command injection via Process Names in action command templates7.0CNA v3.10.2%2026-03-18Fix
CVE-2026-32606lxc incus-os IncusOS has a LUKS encryption bypass due to insufficient TPM policy7.7CNA v3.10.2%2026-03-18Exploit codeFix
CVE-2026-32596Glances exposes the REST API without authentication8.7CNA v4.01.7%2026-03-18NucleiFix
CVE-2026-32565Contextual Related Posts WordPress plugin broken access control5.3CNA v3.10.3%2026-03-18Fix
CVE-2026-32321ClipBucket v5 has time-based blind SQL injection in ajax.php that leads to Data Exfiltration8.8CNA v3.10.5%2026-03-18Exploit codeFix
CVE-2026-32268craftcms azure-blob azure Blob Storage for Craft CMS potential sensitive information disclosure8.7CNA v4.00.4%2026-03-18Fix
CVE-2026-32266craftcms google-cloud Google Cloud Storage for Craft CMS has an information disclosure2.4CNA v4.00.5%2026-03-18Fix
CVE-2026-32265craftcms aws-s3 amazon S3 for Craft CMS has an information disclosure6.9CNA v4.00.5%2026-03-18Fix
CVE-2026-32256music-metadata has an infinite loop vulnerability in ASF parser7.5CNA v3.10.5%2026-03-18Fix
CVE-2026-32254Kube-router proxy module improper access control7.1CNA v3.10.4%2026-03-18Fix
CVE-2026-31973Null pointer dereference in samtools cram-size6.9CNA v4.00.6%2026-03-18Fix
CVE-2026-31972samtools mpileup has use-after-free leading to an invalid read6.9CNA v4.00.7%2026-03-18Fix
CVE-2026-31971HTSlib CRAM decoder vulnerable to buffer overflow7.1CNA v4.00.5%2026-03-18Fix
CVE-2026-31970HTSlib BGZF index file reader has a heap buffer overflow7.1CNA v4.00.6%2026-03-18Fix
CVE-2026-31969HTSlib CRAM decoder has a heap buffer overflow7.1CNA v4.00.5%2026-03-18Fix
CVE-2026-31968HTSlib CRAM decoder vulnerable to buffer overflow8.8CNA v4.00.5%2026-03-18Fix
CVE-2026-31967HTSlib CRAM reader has out-of-bounds read due to improper validation of input6.9CNA v4.00.5%2026-03-18Fix
CVE-2026-31966HTSlib CRAM reader has out-of-bounds read due to improper validation of input6.9CNA v4.00.7%2026-03-18Fix
CVE-2026-31965HTSlib CRAM reader has out-of-bounds reads due to improper validation of input6.9CNA v4.00.5%2026-03-18Fix
CVE-2026-31964HTSlib CRAM decoder has a null pointer dereference6.9CNA v4.00.5%2026-03-18Fix
CVE-2026-31963HTSlib CRAM reader has heap buffer overflow due to improper validation of input8.8CNA v4.00.5%2026-03-18Fix
CVE-2026-31962HTSlib CRAM reader has heap buffer overflow due to improper validation of input8.8CNA v4.00.6%2026-03-18Fix
CVE-2026-31938jsPDF has HTML injection in New window paths9.6CNA v3.10.4%2026-03-18Fix
CVE-2026-31898jsPDF has a PDF object injection via FreeText color8.1CNA v3.10.6%2026-03-18Fix
CVE-2026-31891Cockpit CMS has SQL injection in MongoLite Aggregation Optimizer via toJsonExtractRaw7.7CNA v3.10.4%2026-03-18Fix
CVE-2026-31865Elysia Cookie Value prototype pollution6.5CNA v3.10.3%2026-03-18Fix
CVE-2026-30922pyasn1 vulnerable to denial of service via Unbounded Recursion7.5CNA v3.10.9%2026-03-18Fix
CVE-2026-30884Mdjnelson/moodle-mod_customcert vulnerable to authorization bypass through user-controlled key9.6CNA v3.10.3%2026-03-18Fix
CVE-2026-30704WiFi Extender WDR201A UART interface hidden functionality9.1CISA ADP v3.10.5%2026-03-18
CVE-2026-30703WiFi Extender WDR201A adm.cgi sysCMD parameter OS command injection9.8CISA ADP v3.12.0%2026-03-18
CVE-2026-30702WiFi Extender WDR201A login page authentication bypass9.8CISA ADP v3.10.7%2026-03-18
CVE-2026-30701WiFi Extender WDR201A login.shtml and settings.shtml hard-coded credentials9.1CISA ADP v3.10.7%2026-03-18
CVE-2026-30695Zucchetti Axess access control devices file_manager.cgi dirBrowse parameter cross-site scripting6.1CISA ADP v3.10.3%2026-03-18
CVE-2026-30345CTFd admin import path traversal7.5CISA ADP v3.10.5%2026-03-18Exploit code
CVE-2026-30048NotChatbot WebChat has a stored cross-site scripting (XSS)5.4CISA ADP v3.10.3%2026-03-18
CVE-2026-29859aaPanel arbitrary file upload9.8CISA ADP v3.10.8%2026-03-18
CVE-2026-29858aaPanel remote file inclusion7.5CISA ADP v3.10.4%2026-03-18
CVE-2026-29856aaPanel regular expression denial of service7.5CISA ADP v3.10.5%2026-03-18
CVE-2026-29112@dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions7.5CNA v3.10.6%2026-03-18Fix
CVE-2026-29057Next.js: HTTP request smuggling in rewrites6.3CNA v4.00.5%2026-03-18Fix
CVE-2026-29056Kanboard's privilege escalation7.0CNA v4.00.6%2026-03-18Fix
CVE-2026-28674xiaoheiFS vulnerable to RCE via arbitrary Payment plugin Upload (Automatic Execution)7.2CNA v3.10.5%2026-03-18Fix
CVE-2026-28673xiaoheiFS vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation)7.2CNA v3.10.9%2026-03-18Fix
CVE-2026-28500Linux Foundation ONNX onnx.hub.load vulnerability8.6CNA v3.10.3%2026-03-18Fix
CVE-2026-28499vapor leaf-kit LeafKit's HTML escaping may be skipped for Collection values, enabling XSS6.9CNA v4.00.3%2026-03-18Fix
CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storage6.9CNA v4.00.8%2026-03-18Fix
CVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoS6.9CNA v4.00.8%2026-03-18Fix
CVE-2026-27978Next.js: Null origin can bypass server actions CSRF checks5.3CNA v4.00.2%2026-03-18Exploit codeFix
CVE-2026-27977Next.js: Null origin can bypass dev HMR websocket CSRF checks2.3CNA v4.00.2%2026-03-18Fix
CVE-2026-27895LDAP Account Manager PDF export unrestricted file upload4.3CNA v3.10.8%2026-03-18Fix
CVE-2026-27894LAM has authenticated local file inclusion (LFI) in PDF export8.8CNA v3.10.7%2026-03-18Fix
CVE-2026-27811Roxy-WI has a command injection via diff parameter in config comparison allows authenticated RCE8.8CNA v3.13.0%2026-03-18Fix
CVE-2026-27545OpenClaw Approval Bypass via Parent Symlink Current Working Directory Rebind4.7v3.10.1%2026-03-18Fix
CVE-2026-27524OpenClaw prototype pollution via Debug Override Path4.3v3.10.4%2026-03-18Fix
CVE-2026-27523OpenClaw Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths7.5v3.10.4%2026-03-18Fix
CVE-2026-27522OpenClaw arbitrary file read via sendAttachment and setGroupIcon Message Actions5.5NVD v3.10.4%2026-03-18Fix
CVE-2026-27448pyOpenSSL TLS server name callback improper error handling1.7CNA v4.00.4%2026-03-18Fix
CVE-2026-27135nghttp2 denial of service: Assertion failure due to the missing state validation7.5CNA v3.10.9%2026-03-18Fix
CVE-2026-26948Integrated Dell Remote Access Controller information disclosure4.9CNA v3.10.5%2026-03-18Fix
CVE-2026-26945Integrated Dell Remote Access Controller code execution5.3CNA v3.10.3%2026-03-18Fix
CVE-2026-26740giflib buffer overflow8.2CISA ADP v3.11.0%2026-03-18Fix
CVE-2026-26004Sentry allows unauthorized access to event data across organizational boundaries6.5NVD v3.10.4%2026-03-18Fix
CVE-2026-26001GLPI Inventory plugin has SQL injection on dropdown_calendar Report7.1CNA v3.10.4%2026-03-18Fix
CVE-2026-25937glpi improper authentication6.5CNA v3.10.4%2026-03-18Fix
CVE-2026-25873OmniGen2-RL Reward Server unsafe deserialization RCE9.3CNA v4.01.5%2026-03-18
CVE-2026-25745OpenEMR's Message Update Ignores Patient id6.5CNA v3.10.4%2026-03-18
CVE-2026-25449Traveler WordPress theme PHP object injection9.8CNA v3.10.6%2026-03-18Fix
CVE-2026-24063World-writable uninstall script executed as root in Arturia Software Center8.2CISA ADP v3.10.1%2026-03-18
CVE-2026-24062Insufficient XPC client validation leading to local privilege escalation in Arturia Software Center7.8CISA ADP v3.10.1%2026-03-18
CVE-2026-23270Linux kernel net/sched use-after-free7.8CNA v3.10.1%2026-03-18Fix
CVE-2026-23269Linux kernel AppArmor DFA unpacking out-of-bounds read7.1CNA v3.10.1%2026-03-18Fix
CVE-2026-23268Linux kernel AppArmor policy management vulnerability7.8CNA v3.10.1%2026-03-18Fix
CVE-2026-23267Linux kernel f2fs atomic write checkpoint vulnerability5.5v3.10.1%2026-03-18Fix
CVE-2026-23266Linux kernel rivafb NV3 arbitration divide by zero5.5v3.10.1%2026-03-18Fix
CVE-2026-23265Linux kernel f2fs node footer validation vulnerability5.5v3.10.1%2026-03-18Fix
CVE-2026-23264Linux kernel amdgpu ASPM support denial of service5.5v3.10.1%2026-03-18Fix
CVE-2026-23263Linux kernel io_uring/zcrx memory leak5.5v3.10.1%2026-03-18Fix
CVE-2026-23262Linux kernel gve driver stats reporting out-of-bounds write7.8v3.10.1%2026-03-18Fix
CVE-2026-23261Linux kernel NVMe-FC admin tag set memory leak5.5v3.10.1%2026-03-18Fix
CVE-2026-23260Linux kernel regmap Maple tree cache memory leak5.5v3.10.1%2026-03-18Fix
CVE-2026-23259Linux kernel io_uring buffered I/O iovec cache vulnerability5.5NVD v3.10.1%2026-03-18Fix
CVE-2026-23258Linux kernel LiquidIO NIC device setup memory leak5.5v3.10.1%2026-03-18Fix
CVE-2026-23257Linux kernel LiquidIO PF NIC device setup cleanup off-by-one error5.5v3.10.1%2026-03-18Fix
CVE-2026-23256Linux kernel LiquidIO VF NIC device setup cleanup off-by-one error5.5v3.10.1%2026-03-18Fix
CVE-2026-23255Linux kernel /proc/net/ptype listing vulnerability5.5NVD v3.10.1%2026-03-18Fix
CVE-2026-23254Linux kernel GRO UDP encapsulation checksum handling vulnerability5.5v3.10.1%2026-03-18Fix
CVE-2026-23253Linux kernel DVB core DVR ring buffer reopen handling vulnerability7.8CNA v3.10.1%2026-03-18Fix
CVE-2026-23252Linux kernel XFS online scrub debug descriptors vulnerability5.5v3.10.1%2026-03-18Fix
CVE-2026-23251Linux kernel XFS online scrub xfarray and xfblob null pointer dereference5.5v3.10.1%2026-03-18Fix
CVE-2026-23250Linux kernel XFS online scrub subordinate creation null pointer dereference5.5v3.10.1%2026-03-18Fix
CVE-2026-23249Linux kernel XFS online btree repair revalidation null pointer dereference5.5v3.10.1%2026-03-18Fix
CVE-2026-23248Linux kernel perf event memory mapping use-after-free7.8CNA v3.10.1%2026-03-18Fix
CVE-2026-23247Linux kernel TCP timestamp offset generation information disclosure5.5NVD v3.10.1%2026-03-18Fix
CVE-2026-23246Linux kernel mac80211 multi-link reconfiguration parsing out-of-bounds write8.8CNA v3.10.3%2026-03-18Fix
CVE-2026-23245In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gate: snapshot parameters with RCU on replace The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list. Convert the parameters to an RCU-protected snapshot and swap updat7.8CNA v3.10.1%2026-03-18Fix
CVE-2026-23244Linux kernel nvme out-of-bounds read7.1v3.10.1%2026-03-18Fix
CVE-2026-23243Linux kernel RDMA user MAD write interface out-of-bounds write7.8CNA v3.10.1%2026-03-18Fix
CVE-2026-23242Linux kernel RDMA siw header processing null pointer dereference7.5CNA v3.10.5%2026-03-18Fix
CVE-2026-22730SQL injection in Spring AI MariaDBFilterExpressionConverter8.8CNA v3.10.5%2026-03-18Exploit codeFix
CVE-2026-22729JSONPath injection in Spring AI Vector Stores FilterExpressionConverter8.6CNA v3.10.5%2026-03-18Fix
CVE-2026-22323Phoenix Contact FL SWITCH 2005 Cross‑Site Request Forgery in Link Aggregation Configuration7.1CNA v3.10.2%2026-03-18Fix
CVE-2026-22322Phoenix Contact FL SWITCH 2005 Stored Cross‑Site Scripting in Link Aggregation Name Handling7.1CNA v3.10.3%2026-03-18Fix
CVE-2026-22321Phoenix Contact FL SWITCH 2005 stack-based buffer overflow in CLI Login Username Handling over CLI5.3CNA v3.10.4%2026-03-18Fix
CVE-2026-22320Phoenix Contact FL SWITCH 2005 CLI's TFTP file‑transfer command handling stack-based buffer overflow6.5CNA v3.10.3%2026-03-18Fix
CVE-2026-22319Phoenix Contact FL SWITCH 2005 stack-based buffer overflow in File Install Parameter Handling4.9CNA v3.10.3%2026-03-18Fix
CVE-2026-22318Phoenix Contact FL SWITCH 2005 stack-based buffer overflow in File Transfer Parameter Handling4.9CNA v3.10.3%2026-03-18Fix
CVE-2026-22317Phoenix Contact FL SWITCH 2005 command injection7.2CNA v3.11.0%2026-03-18Fix
CVE-2026-22316Phoenix Contact FL SWITCH 2005 buffer overflow using TFTP Filename6.5CNA v3.10.4%2026-03-18Fix
CVE-2026-22217OpenClaw arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback7.8NVD v3.10.1%2026-03-18Fix
CVE-2026-22181OpenClaw DNS Pinning Bypass via Environment Proxy Configuration in web_fetch7.6v3.10.2%2026-03-18Fix
CVE-2026-22180OpenClaw Path Confinement Bypass in Browser Output and File Write Operations5.3v3.10.1%2026-03-18Fix
CVE-2026-22179OpenClaw Allowlist Bypass via Command Substitution in system.run6.6NVD v3.10.6%2026-03-18Fix
CVE-2026-22178OpenClaw ReDoS and Regex injection via Unescaped Feishu Mention Metadata8.2v3.10.3%2026-03-18Fix
CVE-2026-22177OpenClaw Environment variable injection via Config env.vars8.8v3.10.4%2026-03-18Fix
CVE-2026-22175OpenClaw Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappers7.1CNA v4.00.3%2026-03-18Fix
CVE-2026-22174OpenClaw Gateway token disclosure via Chrome CDP Probe6.1NVD v3.10.1%2026-03-18Fix
CVE-2026-22171OpenClaw path traversal in Feishu Media Temporary File Naming9.1v3.10.3%2026-03-18Fix
CVE-2026-22170OpenClaw BlueBubbles Access Control Bypass via Empty allowFrom Configuration4.8NVD v3.10.3%2026-03-18Fix
CVE-2026-22169OpenClaw Allowlist Bypass via sort Configuration in safeBins7.0NVD v3.10.2%2026-03-18Fix
CVE-2026-22168OpenClaw command injection via cmd.exe /c Trailing arguments in system.run8.8v3.10.4%2026-03-18Fix
CVE-2026-4407Out-of-bounds array write in Xpdf due to missing validation2.1CNA v4.00.1%2026-03-18
CVE-2026-4396Devolutions Hub Reporting Service improper certificate validation8.1v3.10.1%2026-03-18Fix
CVE-2026-4366Keycloak-services: Blind server-side request forgery (SSRF) via HTTP redirect handling in keycloak5.8CNA v3.10.4%2026-03-18Fix
CVE-2026-4356itsourcecode University Management System add_result.php cross-site scripting4.8CNA v4.00.4%2026-03-18
CVE-2026-4355Portabilis i-Educar endpoint educar_servidor_curso_lst.php cross-site scripting5.1CNA v4.00.3%2026-03-18
CVE-2026-4354TRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross-site scripting5.1CNA v4.00.3%2026-03-18
CVE-2026-4268WP Go Maps WordPress plugin missing authorization authenticated stored cross-site scripting6.4CNA v3.10.3%2026-03-18Fix
CVE-2026-3512Writeprint Stylometry WordPress plugin reflected cross-site scripting via p parameter6.1CNA v3.10.3%2026-03-18
CVE-2026-3479Python CPython pkgutil.get_data does not enforce documented restrictions0.0CNA v4.00.2%2026-03-18Fix
CVE-2026-3278XSS vulnerability discovered in OpenText™ ZENworks Service Desk7.4CNA v4.00.2%2026-03-18Fix
CVE-2026-3090Post SMTP WordPress plugin unauthenticated stored cross-site scripting via event_type7.2CNA v3.10.4%2026-03-18Fix
CVE-2026-2992KiviCare WordPress plugin missing authorization unauthenticated privilege escalation8.2CNA v3.10.4%2026-03-18Fix
CVE-2026-2991KiviCare Clinic and Patient Management System WordPress plugin unauthenticated authentication bypass7.3CNA v3.10.5%2026-03-18Exploit codeFix
CVE-2026-2603Keycloak: Keycloak: Unauthorized authentication via disabled saml identity provider8.1CNA v3.10.7%2026-03-18Fix
CVE-2026-2575Keycloak: Keycloak: Denial of service due to excessive samlrequest decompression5.3CNA v3.10.8%2026-03-18Fix
CVE-2026-2559Post SMTP WordPress plugin unauthorized access5.3CNA v3.10.3%2026-03-18Fix
CVE-2026-2512Code Embed WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-03-18Fix
CVE-2026-2092Keycloak-services: Keycloak: Unauthorized access7.7CNA v3.10.4%2026-03-18Fix
CVE-2026-1926Subscriptions for WooCommerce WordPress plugin unauthorized access5.3CNA v3.10.3%2026-03-18Fix
CVE-2026-1780Paid Link Manager WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-03-18Fix
CVE-2026-1463Photo Gallery, Sliders, Proofing and Themes NextGEN Gallery WordPress plugin local file inclusion8.8CNA v3.10.5%2026-03-18Fix
CVE-2026-1217Yoast Duplicate Post WordPress plugin missing authorization arbitrary post Duplication and Overwrite5.4CNA v3.10.2%2026-03-18Fix
CVE-2026-32981Ray Dashboard path traversal leading to Local File Disclosure8.7CNA v4.01.1%2026-03-17Fix
CVE-2026-32842Edimax Gs-5008pl Admin Credentials Stored in Cleartext7.1CNA v4.00.3%2026-03-17
CVE-2026-32841Edimax Gs-5008pl Global Authentication State across All Clients9.2CNA v4.00.8%2026-03-17
CVE-2026-32840Edimax Gs-5008pl stored XSS via Device Name5.1CNA v4.00.3%2026-03-17
CVE-2026-32839Edimax Gs-5008pl CSRF via Management CGI endpoints6.5v3.10.2%2026-03-17
CVE-2026-32838Edimax Gs-5008pl Transmits Credentials over Cleartext HTTP5.9NVD v3.10.2%2026-03-17
CVE-2026-32837mackron / miniaudio out-of-bounds read in BEXT Coding History Parsing5.5NVD v3.10.2%2026-03-17Fix
CVE-2026-32836mackron / dr_libs dr_flac.h excessive memory allocation in PICTURE Metadata Parsing5.5NVD v3.10.2%2026-03-17Fix
CVE-2026-32586Booster for WooCommerce WordPress plugin broken access control5.3CNA v3.10.4%2026-03-17Fix
CVE-2026-32298Angeet ES3 KVM OS command injection8.5CNA v4.00.7%2026-03-17
CVE-2026-32297Angeet ES3 KVM unauthenticated arbitrary file write9.3CNA v4.00.6%2026-03-17
CVE-2026-32296Sipeed NanoKVM unauthenticated Wi-Fi configuration endpoint8.8CNA v4.00.5%2026-03-17Fix
CVE-2026-32295JetKVM insufficient login rate limiting9.3CNA v4.00.5%2026-03-17Fix
CVE-2026-32294JetKVM insufficient firmware verification7.0CNA v4.00.1%2026-03-17Fix
CVE-2026-32293GL-iNet Comet (GL-RM1) KVM insufficient certificate validation6.3CNA v4.00.3%2026-03-17Fix
CVE-2026-32292GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting9.3CNA v4.00.6%2026-03-17Fix
CVE-2026-32291GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console7.0CNA v4.00.3%2026-03-17Fix
CVE-2026-32290GL-iNet Comet (GL-RM1) KVM insufficient firmware verification7.0CNA v4.00.1%2026-03-17Fix
CVE-2026-30911Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization8.1CISA ADP v3.10.7%2026-03-17Fix
CVE-2026-30707SpeedExam Online Examination System ReviewAnswerDetails PageMethod improper access control8.1CISA ADP v3.10.4%2026-03-17
CVE-2026-28779Apache Airflow: Path of session token in cookie does not consider base_url session hijacking7.5CISA ADP v3.10.8%2026-03-17Fix
CVE-2026-28563Apache Airflow: DAG authorization bypass4.3v3.10.4%2026-03-17Fix
CVE-2026-28506Outline's information disclosure in Activity Logs allows User Enumeration of Private Drafts4.3CNA v3.10.3%2026-03-17Fix
CVE-2026-27459pyOpenSSL DTLS cookie callback buffer overflow7.2CNA v4.00.9%2026-03-17Fix
CVE-2026-26929Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and leaks Metadata6.5CISA ADP v3.10.6%2026-03-17Fix
CVE-2026-25936GLPI vulnerable to authenticated SQL injection6.5CNA v3.10.4%2026-03-17Fix
CVE-2026-25790Wazuh has stack-based buffer overflow in Security Configuration Assessment JSON parser4.9CNA v3.10.6%2026-03-17Fix
CVE-2026-25772Wazuh Database Synchronization vulnerable to stack-based buffer overflow4.9CNA v3.10.5%2026-03-17Fix
CVE-2026-25771Wazuh vulnerable to denial of service5.3CNA v3.10.7%2026-03-17Fix
CVE-2026-25770Wazuh has privilege escalation to Root via Cluster protocol File Write9.1CNA v3.11.0%2026-03-17Fix
CVE-2026-25769Wazuh Cluster vulnerable to remote code execution via insecure deserialization9.1CNA v3.10.9%2026-03-17Exploit codeFix
CVE-2026-25534Spinnaker URL hostname validation server-side request forgery9.1CNA v3.10.4%2026-03-17Fix
CVE-2026-24901Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts8.1CNA v3.10.3%2026-03-17Fix
CVE-2026-23759Perle IOLAN STS/SCS authenticated command injection via shell ps8.6CNA v4.01.5%2026-03-17Fix
CVE-2026-23241Linux kernel audit read syscall class vulnerability5.5v3.10.1%2026-03-17Fix
CVE-2026-22882Canva Affinity EMF functionality out-of-bounds read7.1v3.10.3%2026-03-17Fix
CVE-2026-22727Cloud Foundry unprotected internal endpoints7.5CNA v3.10.2%2026-03-17
CVE-2026-21994Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit Desktop component takeover9.8CNA v3.10.4%2026-03-17Fix
CVE-2026-21886OpenCTI's GraphQL Mutations allow Deletion of Unrelated Entities6.5CNA v3.10.2%2026-03-17Fix
CVE-2026-21570Atlassian Bamboo Data Center code injection8.6CNA v4.00.6%2026-03-17Fix
CVE-2026-20726Canva Affinity EMF functionality out-of-bounds read7.1v3.10.3%2026-03-17Fix
CVE-2026-20643Apple Safari origin validation error5.4CISA ADP v3.10.4%2026-03-17Exploit codeFix
CVE-2026-4359MongoDB C Driver heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer2.0CNA v4.00.2%2026-03-17Fix
CVE-2026-4358MongoDB Server memory safety issues in slot-based execution hash table spill6.1CNA v4.00.4%2026-03-17Fix
CVE-2026-4349Duende IdentityServer4 Token Renewal endpoint authorize improper authentication6.3CNA v4.00.5%2026-03-17
CVE-2026-4324Red Hat Satellite rubygem-katello: Katello: Denial of service and potential information disclosure5.4CNA v3.10.4%2026-03-17Fix
CVE-2026-4319code-projects Simple Food Order System add-item.php SQL injection9.8v3.10.6%2026-03-17
CVE-2026-4318UTT HiPER 810G formApLbConfig strcpy buffer overflow8.7CNA v4.00.8%2026-03-17
CVE-2026-4312DrangSoft｜GCB/FCB Audit Software missing authentication9.3CNA v4.00.8%2026-03-17Fix
CVE-2026-4308Frdel/agent0ai Agent-Zero document_query.py handle_pdf_document server-side request forgery5.3CNA v4.00.3%2026-03-17
CVE-2026-4307Frdel/agent0ai Agent-Zero files.py get_abs_path path traversal5.3CNA v4.00.5%2026-03-17
CVE-2026-4295Arbitrary code execution via crafted project files in Kiro IDE8.5CNA v4.00.2%2026-03-17Fix
CVE-2026-4289Tiandy Easy7 Integrated Management Platform getRecByTemplateId SQL injection6.9CNA v4.00.4%2026-03-17
CVE-2026-4288Tiandy Easy7 Integrated Management Platform endpoint getDevDetailedInfo SQL injection6.9CNA v4.00.4%2026-03-17
CVE-2026-4287Tiandy Easy7 Integrated Management Platform endpoint queryResources SQL injection6.9CNA v4.00.4%2026-03-17
CVE-2026-4285taoofagi easegen-admin Pdf2MdUtil.java recognizeMarkdown path traversal5.1CNA v4.00.6%2026-03-17
CVE-2026-4271Libsoup: Libsoup: Denial of service via use-after-free in HTTP/2 server7.5NVD v3.11.3%2026-03-17Fix
CVE-2026-4258sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey8.7CNA v4.00.3%2026-03-17Fix
CVE-2026-4208Authentication bypass in extension E-Mail MFA Provider (mfa_email)7.7CNA v4.00.5%2026-03-17Fix
CVE-2026-4202Broken access control in extension Redirect Tab2.3CNA v4.00.3%2026-03-17Fix
CVE-2026-4148MongoDB Server aggregation pipeline use-after-free8.7CNA v4.00.6%2026-03-17Fix
CVE-2026-4147MongoDB Server stack memory disclosure in filemd5 command7.1CNA v4.00.4%2026-03-17Fix
CVE-2026-4064Devolutions PowerShell Universal missing authorization8.3CISA ADP v3.10.4%2026-03-17Fix
CVE-2026-3888Canonical Ubuntu local privilege escalation in snapd7.8CNA v3.10.5%2026-03-17Exploit codeFix
CVE-2026-3856IBM Db2 Recovery Expert missing integrity check5.3CNA v3.10.2%2026-03-17Fix
CVE-2026-3634Libsoup: Libsoup: Http header injection and response splitting6.5NVD v3.10.3%2026-03-17Fix
CVE-2026-3633Libsoup: Libsoup: Header and HTTP request injection via CRLF injection6.5NVD v3.10.4%2026-03-17Fix
CVE-2026-3632Libsoup: Libsoup: Http smuggling and server-side request forgery via malformed hostnames5.5NVD v3.10.3%2026-03-17
CVE-2026-3564ScreenConnect Instance Level Cryptographic Material Exposure9.0CNA v3.10.3%2026-03-17Reported exploited
CVE-2026-3563Devolutions PowerShell Universal apps and endpoints configuration improper input validation5.5CISA ADP v3.10.4%2026-03-17Fix
CVE-2026-3237Octopus Deploy Octopus Server improper authorization2.3CNA v4.00.3%2026-03-17Fix
CVE-2026-3207TIBCO BPM Enterprise remote code execution (RCE)8.7CNA v4.00.6%2026-03-17Fix
CVE-2026-2809Netskope Endpoint DLP Module for Netskope Client DLL injector integer overflow6.7CNA v4.00.2%2026-03-17Fix
CVE-2026-2579WowStore WordPress plugin SQL injection7.5CNA v3.10.5%2026-03-17Fix
CVE-2026-2373Royal Addons for Elementor WordPress plugin information disclosure5.3CNA v3.10.2%2026-03-17Fix
CVE-2026-1376IBM i denial of service7.5CNA v3.10.5%2026-03-17Fix
CVE-2026-1323Insecure deserialization in extension Mailqueue (mailqueue)5.2CNA v4.00.2%2026-03-17Fix
CVE-2026-1267IBM Planning Analytics information disclosure6.5CNA v3.10.3%2026-03-17Fix
CVE-2026-1264IBM Sterling B2B Integrator and IBM Sterling File Gateway Improper Access Controls7.1CNA v3.10.2%2026-03-17Fix
CVE-2026-0708Libucl: Libucl: Denial of service via embedded null byte in ucl input6.5NVD v3.10.4%2026-03-17
CVE-2026-32778libexpat null pointer dereference5.5NVD v3.10.2%2026-03-16Fix
CVE-2026-32777libexpat infinite loop5.5NVD v3.10.2%2026-03-16Fix
CVE-2026-32776libexpat null pointer dereference5.5NVD v3.10.2%2026-03-16Fix
CVE-2026-32775libexif integer underflow7.8v3.10.2%2026-03-16Fix
CVE-2026-32772GNU InetUtils incorrect resource transfer4.7v3.10.2%2026-03-16Fix
CVE-2026-32732XSS in @leanprover/unicode-input-component0.0CNA v4.00.5%2026-03-16Fix
CVE-2026-32729Runtipi has a TOTP two-factor authentication bypass8.1CNA v3.10.5%2026-03-16Fix
CVE-2026-32724PX4 autopilot has a heap use-after-free in MavlinkShell::available via SERIAL_CONTROL race condition5.3CNA v3.10.2%2026-03-16Fix
CVE-2026-32720Improper access control in github.com/ctfer-io/monitoring7.1CNA v4.00.4%2026-03-16Fix
CVE-2026-32719mintplex-labs anything-llm AnythingLLM has a Zip Slip path traversal and code execution4.2CNA v3.10.5%2026-03-16
CVE-2026-32717Mintplex Labs AnythingLLM browser extension API key authentication incorrect authorization2.7CNA v3.10.3%2026-03-16
CVE-2026-32715mintplex-labs anything-llm system-preferences endpoints incorrect authorization3.8CNA v3.10.3%2026-03-16
CVE-2026-32713Dronecode PX4 Autopilot MAVLink FTP session handling vulnerability4.3CNA v3.10.3%2026-03-16Fix
CVE-2026-32709PX4 Autopilot MAVLink FTP unauthenticated path traversal (arbitrary file read/Write/Delete)5.4CNA v3.10.3%2026-03-16Fix
CVE-2026-32708Zenoh uORB Subscriber allows arbitrary Stack Allocation (PX4/PX4-Autopilot)7.8CNA v3.10.3%2026-03-16Fix
CVE-2026-32707Dronecode PX4 Autopilot tattu_can CAN driver stack-based buffer overflow5.2CNA v3.10.3%2026-03-16Exploit codeFix
CVE-2026-32706PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet7.1CNA v3.10.3%2026-03-16Fix
CVE-2026-32705PX4 autopilot BST Device Name Length can Overflow Driver Buffer6.8CNA v3.10.3%2026-03-16Fix
CVE-2026-32704SiYuan renderSprig: Missing admin check allows any user to read full workspace DB6.5CNA v3.10.4%2026-03-16Fix
CVE-2026-32702Cleanuparr has Username Enumeration via Timing Attack6.9CNA v4.00.4%2026-03-16
CVE-2026-32635Angular has XSS in i18n attribute bindings8.6CNA v4.00.5%2026-03-16Fix
CVE-2026-32630file-type affected by ZIP decompression bomb DoS via [Content_Types].xml entry5.3CNA v3.10.4%2026-03-16Fix
CVE-2026-32628mintplex-labs anything-llm AnythingLLM has SQL injection in Built-in SQL agent plugin7.7CNA v4.00.4%2026-03-16
CVE-2026-32627cpp-httplib has a Silent TLS certificate verification bypass on HTTPS Redirect via Proxy8.7CNA v3.10.2%2026-03-16Fix
CVE-2026-32626mintplex-labs anything-llm AnythingLLM has a Streaming Phase XSS to RCE via LLM Response injection9.7CNA v3.10.7%2026-03-16
CVE-2026-32621Apollo Federation has prototype pollution via incomplete key sanitization9.9CNA v3.10.6%2026-03-16Fix
CVE-2026-32617mintplex-labs anything-llm AnythingLLM Permissable CORS policy7.1CNA v3.10.4%2026-03-16
CVE-2026-32616Pigeon has a host header injection in email verification flow8.2CNA v3.10.3%2026-03-16Fix
CVE-2026-32614emmansun gmsm go ShangMi SM9 Infinity-Point Ciphertext Forgery vulnerability7.5CNA v3.10.2%2026-03-16Fix
CVE-2026-32600SimpleSAMLphp xml-security AES-GCM encryption vulnerability8.2CNA v3.10.2%2026-03-16Fix
CVE-2026-32594parse-community parse-server parse Server GraphQL WebSocket endpoint bypasses security middleware6.9CNA v4.00.5%2026-03-16Fix
CVE-2026-32587WP EasyPay WordPress plugin broken access control5.4CNA v3.10.3%2026-03-16Fix
CVE-2026-32583Modern Events Calendar WordPress plugin broken access control5.3CNA v3.10.8%2026-03-16NucleiFix
CVE-2026-32314Yamux remote panic via malformed Data frame with SYN set and len = 2621458.7CNA v4.00.6%2026-03-16Fix
CVE-2026-32313xmlseclibs AES-GCM encryption vulnerability8.2CNA v3.10.2%2026-03-16Fix
CVE-2026-32267Craft CMS vulnerable to privilege escalation/Bypass7.7CNA v4.00.5%2026-03-16Fix
CVE-2026-32264Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController8.6CNA v4.00.7%2026-03-16Fix
CVE-2026-32263Craft CMS vulnerable to behavior injection RCE via EntryTypesController8.6CNA v4.00.7%2026-03-16Fix
CVE-2026-32262Craft CMS has a path traversal vulnerability in AssetsController5.3CNA v4.00.4%2026-03-16Fix
CVE-2026-32261RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin8.5CNA v4.00.4%2026-03-16Fix
CVE-2026-31386LiteSpeed Technologies OpenLiteSpeed OS command injection8.6CNA v4.02.1%2026-03-16
CVE-2026-30882Chamilo LMS: Reflected XSS in the session category listing page6.1CNA v3.10.3%2026-03-16Fix
CVE-2026-30881Chamilo LMS: SQL injection in the statistics AJAX endpoint8.8CNA v3.10.5%2026-03-16Fix
CVE-2026-30876Chamilo LMS: User enumeration vulnerability via response6.3CNA v4.00.3%2026-03-16Fix
CVE-2026-30875Chamilo LMS: Authenticated RCE via H5P Import8.8CNA v3.10.9%2026-03-16Fix
CVE-2026-30405GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute7.5CISA ADP v3.10.5%2026-03-16Fix
CVE-2026-29522ZwickRoell Test Data Management path traversal LFI8.7CNA v4.01.0%2026-03-16Fix
CVE-2026-29521Hereta Eth-imc408m CSRF via Configuration Setup5.1CNA v4.00.2%2026-03-16
CVE-2026-29520Hereta Eth-imc408m reflected XSS via ping_ipaddr parameter5.1CNA v4.00.3%2026-03-16
CVE-2026-29516Buffalo TeraStation TS5400R Excessive File Permissions information disclosure6.9CNA v4.00.6%2026-03-16
CVE-2026-29513Hereta Eth-imc408m stored XSS via Device Location5.1CNA v4.00.2%2026-03-16
CVE-2026-29510Hereta Eth-imc408m stored XSS via Device Name5.1CNA v4.00.2%2026-03-16
CVE-2026-28522arduino-TuyaOpen WiFiUDP null pointer dereference denial of service7.1CNA v4.00.3%2026-03-16Fix
CVE-2026-28521arduino-TuyaOpen TuyaIoT Out-of-bounds memory read information disclosure7.0CNA v4.00.2%2026-03-16Fix
CVE-2026-28520arduino-TuyaOpen WiFiMulti Single-Byte buffer overflow remote code execution8.6CNA v4.00.2%2026-03-16Fix
CVE-2026-28519arduino-TuyaOpen DnsServer heap-based buffer overflow remote code execution8.7CNA v4.00.4%2026-03-16Fix
CVE-2026-28498Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding8.2CNA v4.00.3%2026-03-16Fix
CVE-2026-28490Authlib vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle8.3CNA v4.00.2%2026-03-16Fix
CVE-2026-28430Chamilo LMS vulnerable to unauthenticated SQL injection in chamiko-lms model.ajax.php9.3CNA v4.00.6%2026-03-16Fix
CVE-2026-27962Authlib JWS JWK header injection: Signature verification Bypass9.1CNA v3.10.5%2026-03-16Fix
CVE-2026-26304Mattermost permission bypass in Playbook Run Creation4.3CNA v3.10.3%2026-03-16Fix
CVE-2026-26246Mattermost memory exhaustion via Malformed PSD file upload4.3CNA v3.10.4%2026-03-16Fix
CVE-2026-26230Mattermost Team Admin privilege escalation to Demote Members to Guest3.8CNA v3.10.3%2026-03-16Fix
CVE-2026-25783Mattermost denial of service via malformed User-Agent header in getBrowserVersion4.3CNA v3.10.4%2026-03-16Fix
CVE-2026-25780Mattermost memory exhaustion via Malformed DOC file upload4.3CNA v3.10.4%2026-03-16Fix
CVE-2026-25369Flexmls® IDX WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-03-16Fix
CVE-2026-25083GROWI missing authorization8.7CNA v4.00.3%2026-03-16
CVE-2026-24692Mattermost guest users can bypass read permissions via search API4.3CNA v3.10.2%2026-03-16Fix
CVE-2026-24458Mattermost DoS attack via login attempts with multi-megabyte passwords7.5CNA v3.10.3%2026-03-16Fix
CVE-2026-23862Dell ThinOS 10 command injection7.8CNA v3.10.4%2026-03-16Fix
CVE-2026-23489Fields GLPI plugin vulnerable to RCE in dropdown generation9.1CNA v3.10.3%2026-03-16Exploit codeFix
CVE-2026-22545Mattermost Password Change Bypass via Auth Switch endpoint3.1CNA v3.10.1%2026-03-16Fix
CVE-2026-21991Oracle Linux path traversal5.5CNA v3.10.2%2026-03-16Fix
CVE-2026-21386Mattermost private channel enumeration via /mute slash command4.3CNA v3.10.2%2026-03-16Fix
CVE-2026-21005Samsung Mobile Smart Switch path traversal7.1CNA v4.00.2%2026-03-16Fix
CVE-2026-21004Samsung Mobile Smart Switch improper authentication6.9CNA v4.00.2%2026-03-16Fix
CVE-2026-21002Samsung Mobile Galaxy Store improper signature verification5.9CNA v4.00.1%2026-03-16Fix
CVE-2026-21001Samsung Mobile Galaxy Store path traversal5.9CNA v4.00.1%2026-03-16Fix
CVE-2026-21000Samsung Mobile Galaxy Store improper access control7.0CNA v4.00.1%2026-03-16Fix
CVE-2026-20999Samsung Mobile Smart Switch authentication bypass by replay7.1CNA v4.00.3%2026-03-16Fix
CVE-2026-20998Samsung Mobile Smart Switch improper authentication7.1CNA v4.00.5%2026-03-16Fix
CVE-2026-20997Samsung Mobile Smart Switch improper signature verification5.3CNA v4.00.3%2026-03-16Fix
CVE-2026-20996Samsung Mobile Smart Switch weak cryptographic algorithm7.1CNA v4.00.2%2026-03-16Fix
CVE-2026-20995Samsung Mobile Smart Switch missing authentication5.3CNA v4.00.3%2026-03-16Fix
CVE-2026-20994Samsung Mobile Samsung Account open redirect6.9CNA v4.00.1%2026-03-16Fix
CVE-2026-20993Samsung Mobile Samsung Assistant improper export of Android application components4.8CNA v4.00.1%2026-03-16Fix
CVE-2026-20992Samsung Mobile Devices settings improper authorization4.8CNA v4.00.1%2026-03-16Fix
CVE-2026-20991Samsung Mobile Devices ThemeManager improper privilege management6.7CNA v4.00.1%2026-03-16Fix
CVE-2026-20990Samsung Mobile Devices Secure Folder improper export of Android application components8.4CNA v4.00.2%2026-03-16Fix
CVE-2026-20989Samsung Mobile Devices Font settings improper signature verification5.1CNA v4.00.1%2026-03-16Fix
CVE-2026-20988Samsung Mobile Devices settings improper intent verification6.8CNA v4.00.1%2026-03-16Fix
CVE-2026-4284taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery5.1CNA v4.00.4%2026-03-16
CVE-2026-4276LibreChat RAG API code injection7.5CISA ADP v3.10.5%2026-03-16
CVE-2026-4270AWS API MCP file access restriction bypass6.8CNA v4.00.2%2026-03-16Fix
CVE-2026-4269AWS bedrock-agentcore-starter-toolkit predictable identifiers5.8CNA v4.00.4%2026-03-16Fix
CVE-2026-4265Mattermost guest user can upload files without permission across teams4.3CNA v3.10.4%2026-03-16Fix
CVE-2026-4255thermalright TR-VISION HOME DLL injection privilege escalation7.8v3.10.2%2026-03-16Exploit codeFix
CVE-2026-4254Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow9.3CNA v4.01.3%2026-03-16
CVE-2026-4253Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection7.2NVD v3.18.6%2026-03-16
CVE-2026-4252Tenda AC8 IPv6 check_is_ipv6 ip address for authentication9.3CNA v4.02.0%2026-03-16
CVE-2026-4251CityData CityChat ai.CityData.CityChat credentials.json credentials storage2.0CNA v4.00.1%2026-03-16
CVE-2026-4250Albert Sağlık Hizmetleri ve Ticaret Albert Health plaintext password storage2.0CNA v4.00.1%2026-03-16
CVE-2026-4243La Nacion App app.lanacion.activity BuildConfig.java credentials storage2.0CNA v4.00.1%2026-03-16
CVE-2026-4242BabyChakra Pregnancy and Parenting App Configuration.java vulnerability2.0CNA v4.00.1%2026-03-16
CVE-2026-4241itsourcecode College Management System time-table.php SQL injection5.3CNA v4.00.3%2026-03-16
CVE-2026-4240Open5GS CCA smf_s6b_sta_cb denial of service7.5v3.10.9%2026-03-16Fix
CVE-2026-4239Lagom WHMCS Template Datatables prototype pollution5.1CNA v4.00.4%2026-03-16
CVE-2026-4238itsourcecode College Management System courses.php SQL injection5.1CNA v4.00.3%2026-03-16
CVE-2026-4237itsourcecode Free Hotel Reservation System index.php SQL injection6.9CNA v4.00.4%2026-03-16
CVE-2026-4236itsourcecode Online Enrollment System index.php SQL injection6.9CNA v4.00.4%2026-03-16
CVE-2026-4235itsourcecode Online Enrollment System login.php SQL injection6.9CNA v4.00.4%2026-03-16
CVE-2026-4234SSCMS DDL SitesAddController.Submit.cs SQL injection5.3CNA v4.00.3%2026-03-16
CVE-2026-4233ThingsGateway download path traversal5.3CNA v4.00.5%2026-03-16
CVE-2026-4232Tiandy Integrated Management Platform getAuthorityByUserId SQL injection6.9CNA v4.00.4%2026-03-16
CVE-2026-4231vanna-ai vanna endpoint __init__.py run_sql server-side request forgery6.9CNA v4.00.5%2026-03-16
CVE-2026-4230vanna-ai vanna endpoint __init__.py update_sql SQL injection5.3CNA v4.00.3%2026-03-16
CVE-2026-4229vanna-ai vanna bigquery_vector.py remove_training_data SQL injection6.9CNA v4.00.4%2026-03-16
CVE-2026-4228LB-LINK BL-WR9000 set_wifi sub_458754 command injection9.8v3.18.9%2026-03-16
CVE-2026-4227LB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflow7.5v3.11.1%2026-03-16
CVE-2026-4226LB-LINK BL-WR9000 get_virtual_cfg sub_44E8D0 stack-based overflow9.8v3.11.1%2026-03-16
CVE-2026-4225CMS Made Simple User Management listusers.php cross-site scripting4.8CNA v4.00.4%2026-03-16
CVE-2026-4224Python CPython stack overflow parsing XML with deeply nested DTD content models6.0CNA v4.00.7%2026-03-16Fix
CVE-2026-4223itsourcecode Payroll Management System manage_employee.php SQL injection9.8v3.10.6%2026-03-16
CVE-2026-4222SSCMS download PathUtils.RemoveParentPath path traversal5.1CNA v4.00.6%2026-03-16
CVE-2026-4221Tiandy Easy7 Integrated Management Platform endpoint uploadLedImage unrestricted upload6.9CNA v4.00.5%2026-03-16
CVE-2026-4220Technologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload6.9CNA v4.00.5%2026-03-16
CVE-2026-4219INDEX Conferences and Exhibitions Organization YWF BPOF APGCS App hard-coded credentials4.8CNA v4.00.1%2026-03-16
CVE-2026-4218myAEDES App aedes.me.beta EngageBayUtils.java information disclosure2.0CNA v4.00.1%2026-03-16
CVE-2026-4217XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage2.0CNA v4.00.1%2026-03-16
CVE-2026-4216i-SENS SmartLog App air.SmartLog.android hard-coded credentials4.8CNA v4.00.1%2026-03-16
CVE-2026-4215FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery5.3CNA v4.00.3%2026-03-16
CVE-2026-4214D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow9.8v3.11.4%2026-03-16
CVE-2026-4213D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflow9.8v3.11.3%2026-03-16
CVE-2026-4212D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow9.8v3.11.4%2026-03-16
CVE-2026-4211D-Link DNS-1550-04 local_backup_mgr.cgi Local_Backup_Info stack-based overflow9.8v3.11.4%2026-03-16
CVE-2026-4210D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection9.8v3.15.5%2026-03-16
CVE-2026-4209D-Link DNS-1550-04 account_mgr.cgi cgi_chg_admin_pw command injection9.8v3.15.8%2026-03-16Emerging Threats
CVE-2026-4207D-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injection9.8v3.15.8%2026-03-16Emerging Threats
CVE-2026-4206D-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injection9.8v3.15.1%2026-03-16Emerging Threats
CVE-2026-4205D-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injection9.8v3.15.1%2026-03-16
CVE-2026-4204D-Link DNS-1550-04 gui_mgr.cgi cgi_mycloud_auto_downlaod command injection9.8v3.15.5%2026-03-16
CVE-2026-4203D-Link DNS-1550-04 network_mgr.cgi cgi_dhcpd command injection9.8v3.16.1%2026-03-16
CVE-2026-4201glowxq glowxq-oj SysFileController.java upload unrestricted upload6.9CNA v4.01.3%2026-03-16
CVE-2026-4200glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery6.9CNA v4.00.5%2026-03-16Fix
CVE-2026-4199bazinga012 mcp_code_executor index.ts installDependencies command injection4.8CNA v4.01.1%2026-03-16
CVE-2026-4198hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection4.8CNA v4.01.1%2026-03-16
CVE-2026-4197D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection9.8v3.123.7%2026-03-16
CVE-2026-4196D-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injection9.8v3.15.8%2026-03-16
CVE-2026-4195D-Link DNS-1550-04 wizard_mgr.cgi command injection9.8v3.15.5%2026-03-16
CVE-2026-4194D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control9.8v3.13.0%2026-03-16
CVE-2026-4193D-Link DIR-823G goahead UpdateClientInfo access control7.5v3.11.8%2026-03-16
CVE-2026-4192AvinashBole quip-mcp-server index.ts setupToolHandlers command injection5.3CNA v4.01.8%2026-03-16
CVE-2026-4191JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload6.9CNA v4.00.5%2026-03-16
CVE-2026-4190JawherKl node-api-postgres user.js User.getAll SQL injection6.9CNA v4.00.4%2026-03-16
CVE-2026-4189PhpIPAM Section edit-result.php SQL injection5.1CNA v4.00.3%2026-03-16
CVE-2026-4188D-Link DIR-619L boa formSchedule stack-based overflow8.7CNA v4.00.8%2026-03-16
CVE-2026-4187Tiandy Easy7 Integrated Management Platform UpdateLocalDevInfo.jsp missing authentication6.9CNA v4.00.7%2026-03-16
CVE-2026-4186UEditor JSONP Callback controller.php cross-site scripting5.1CNA v4.00.3%2026-03-16
CVE-2026-4185GPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflow5.3CNA v4.00.4%2026-03-16
CVE-2026-4184D-Link DIR-816 goahead form2Wl5BasicSetup.cgi stack-based overflow9.3CNA v4.01.9%2026-03-16
CVE-2026-4183D-Link DIR-816 goahead form2WlanBasicSetup.cgi stack-based overflow9.3CNA v4.01.9%2026-03-16
CVE-2026-4182D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow9.3CNA v4.01.9%2026-03-16
CVE-2026-4181D-Link DIR-816 goahead form2RepeaterStep2.cgi stack-based overflow9.3CNA v4.01.9%2026-03-16
CVE-2026-4180D-Link DIR-816 goahead redirect.asp access control9.8v3.13.0%2026-03-16
CVE-2026-4177YAML::Syck YAML emitter heap-based buffer overflow9.1CISA ADP v3.10.6%2026-03-16Fix
CVE-2026-4175Aureus ERP Chatter message content-text-entry.blade.php cross-site scripting5.1CNA v4.00.3%2026-03-16Fix
CVE-2026-4174Radare2 Mach-O file mach0.c walk_exports_trie resource consumption4.8CNA v4.00.2%2026-03-16Fix
CVE-2026-4173CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure SQL injection5.3CNA v4.00.3%2026-03-16
CVE-2026-4172TRENDnet TEW-632BRP HTTP POST request ping_response.cgi stack-based overflow8.6CNA v4.00.9%2026-03-16
CVE-2026-4171CodeGenieApp serverless-express API Endpoint TodoList.ts authorization5.3CNA v4.00.4%2026-03-16
CVE-2026-4170Topsec TopACM HTTP request nmc_sync.php os command injection9.3CNA v4.04.3%2026-03-16
CVE-2026-4169Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross-site scripting4.8CNA v4.00.4%2026-03-16Fix
CVE-2026-4168Tecnick TCExam Group tce_edit_group.php cross-site scripting4.8CNA v4.00.4%2026-03-16
CVE-2026-4167Belkin F9K1122 formReboot stack-based overflow8.7CNA v4.00.8%2026-03-16
CVE-2026-4166Wavlink WL-NU516U1 login.cgi sub_404F68 cross-site scripting5.1CNA v4.00.3%2026-03-16
CVE-2026-4165Worksuite HR, CRM and Project Management create cross-site scripting4.8CNA v4.00.3%2026-03-16
CVE-2026-4164Wavlink WL-WN578W2 POST request wireless.cgi GuestWifi command injection9.3CNA v4.03.6%2026-03-16Fix
CVE-2026-4163Wavlink WL-WN579A3 POST request wireless.cgi GuestWifi command injection9.3CNA v4.03.6%2026-03-16Fix
CVE-2026-3839Unraid Authentication request path traversal authentication bypass7.3CNA v3.00.7%2026-03-16
CVE-2026-3838Unraid Update request path traversal remote code execution8.8CNA v3.01.1%2026-03-16
CVE-2026-3644Python CPython incomplete control character validation in http.cookies6.0CNA v4.00.5%2026-03-16Fix
CVE-2026-3562Philips Hue Bridge hk_hap Ed25519 signature verification authentication bypass8.8v3.10.3%2026-03-16
CVE-2026-3561Philips Hue Bridge hk_hap characteristics heap-based buffer overflow remote code execution8.0CNA v3.00.6%2026-03-16
CVE-2026-3560Philips Hue Bridge HomeKit hk_hap_pair_storage_put heap-based buffer overflow remote code execution8.8CNA v3.00.5%2026-03-16
CVE-2026-3559Philips Hue Bridge HomeKit Accessory Protocol Static Nonce authentication bypass8.1CNA v3.00.4%2026-03-16
CVE-2026-3558Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode authentication bypass8.1CNA v3.00.4%2026-03-16
CVE-2026-3557Philips Hue Bridge hap_pair_verify_handler heap-based buffer overflow8.0CNA v3.00.6%2026-03-16
CVE-2026-3556Philips Hue Bridge HomeKit Pair-Setup heap-based buffer overflow remote code execution8.8CNA v3.00.5%2026-03-16
CVE-2026-3555Philips Hue Bridge Zigbee custom command handler heap-based buffer overflow8.0CNA v3.00.4%2026-03-16
CVE-2026-3476Code injection vulnerability affecting Solidworks Desktop from Release 2025 through Release 20267.8CNA v3.10.2%2026-03-16Fix
CVE-2026-3227Authenticated command injection on TP-Link TL-WR802N, TL-WR841N and Tl-wr840n8.5CNA v4.01.8%2026-03-16Exploit codeFix