CVEs published March 4, 2026
204 CVEs were published on March 4, 2026: 29 critical, 60 high. 2 are now in CISA KEV.
- Published
- 204
- Critical
- 29
- High
- 60
- Medium
- 102
- Low
- 6
- Unrated
- 7
- Now in CISA KEV
- 2
- Fix available
- 74
Most affected products
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- 24
- Google Chrome
- 9
- Linux
- 9
- Cisco Secure Firewall Threat Defense (FTD) Software
- 8
- craftcms cms · craftcms/cms
- 8
- SEPPmail Secure Email Gateway
- 8
- Dell PowerScale OneFS
- 7
- Cisco Secure Firewall Management Center
- 6
- Concrete CMS · concrete5/concrete5
- 6
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- 6
Critical 29
- CVE-2026-2835HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsinghttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-2833HTTP Request Smuggling via Premature Upgradehttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-29000pac4j-jwt JwtAuthenticator Authentication Bypasspac4j-jwt · org.pac4j:pac4j-jwt
- CVE-2026-3545Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a…Google Chrome
- CVE-2026-20131Cisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-28783Craft has a Twig Function Blocklist Bypasscraftcms cms · craftcms/cms
- CVE-2026-28697Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templatescraftcms cms · craftcms/cms
- CVE-2026-27441PDF Password CMDiSEPPmail Secure Email Gateway
- CVE-2026-27446Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationApache Software Foundation org.apache.artemis:artemis-se… +2
- CVE-2026-27442zip_attachments Path TraversalSEPPmail Secure Email Gateway
- CVE-2026-29120Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite ReceiverInternational Datacasting IDC SFX2100 SuperFlex Satellite R…
- CVE-2026-28777Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) SFX2100 Satelli…
- CVE-2026-28775Unauthenticated RCE via SNMP Default Writable Community StringInternational Datacasting Corporation (IDC) SFX2100 Series…
- CVE-2026-28774Authenticated OS Command Injection via Traceroute Utility leads to Root RCEInternational Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28773Authenticated OS Command Injection via Ping Utility Leading to RCE as RootInternational Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2025-46108D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup.
- CVE-2025-66678An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to…
- CVE-2025-66944SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query…
- CVE-2025-69969A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd…
- CVE-2025-70218Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component.
- CVE-2025-70219Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot.
- CVE-2025-70220Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4.
- CVE-2025-70221Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.
- CVE-2025-70222Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.
Show all 29 entriesShow fewer entries
- CVE-2025-70223Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork.
- CVE-2025-70225Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component
- CVE-2025-70226Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard.
- CVE-2026-26478A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a…
High 60
- CVE-2026-2836Cache poisoning via insecure-by-default cache keyhttps://github.com/cloudflare/pingora · pingora-cache
- CVE-2026-29045Hono: Arbitrary file access via serveStatic vulnerabilityhonojs hono · hono
- CVE-2026-25750LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrllangchain-ai helm
- CVE-2025-66024XWiki Blog Application home page vulnerable to Stored XSS via Post Titlexwiki-contrib application-blog-ui · org.xwiki.contrib.blog:…
- CVE-2026-27803Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Roledani-garcia vaultwarden · vaultwarden
- CVE-2026-27802Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Managerdani-garcia vaultwarden · vaultwarden
- CVE-2026-28435Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplibyhirose cpp-httplib
- CVE-2026-3544Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory…Google Chrome
- CVE-2026-3543Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds…Google Chrome
- CVE-2026-3542Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds…Google Chrome
- CVE-2026-3541Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory…Google Chrome
- CVE-2026-3540Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds…Google Chrome
- CVE-2026-3538Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory…Google Chrome
- CVE-2026-3537Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit…Google Chrome
- CVE-2026-3536Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory…Google Chrome
- CVE-2026-0847Path Traversal in nltk/nltknltk/nltk · nltk
- CVE-2026-3125SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass@opennextjs/cloudflare
- CVE-2026-20082A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20062A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20049A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20014A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20105A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20103A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20101A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20100A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA)…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
Show all 60 entriesShow fewer entries
- CVE-2026-20002A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to…Cisco Secure Firewall Management Center
- CVE-2026-20039Cisco Adaptive Security Appliance and Firepower Threat Defense Software SSL VPN Authentication Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2019-25507Ashop Shopping Cart Software Lastest SQL Injection via index.phpAshopsoftware Ashop Shopping Cart Software
- CVE-2019-25506FreeSMS 2.1.2 Authentication Bypass via SQL InjectionFreeSMS
- CVE-2019-25505Tradebox 5.4 SQL Injection via symbol ParameterBdtask Tradebox
- CVE-2019-25504NCrypted Jobgator Lastest SQL Injection via agents Find-JobsNCrypted Jobgator
- CVE-2019-25503PHPads 2.0 SQL Injection via click.php3 bannerIDBlondish PHPads
- CVE-2019-25501Simple Job Script SQL Injection via delete_application_ajax.phpniteosoft Simple Job Script
- CVE-2019-25500Simple Job Script SQL Injection via register-recruiters endpointniteosoft Simple Job Script
- CVE-2019-25499Simple Job Script SQL Injection via get_job_applications_ajax.phpniteosoft Simple Job Script
- CVE-2019-25498Simple Job Script SQL Injection via searched Endpointniteosoft Simple Job Script
- CVE-2026-28784Craft is affected by potential authenticated Remote Code Execution via Twig SSTIcraftcms cms · craftcms/cms
- CVE-2026-28781Craft Affected by Entries Authorship Spoofing via Mass Assignmentcraftcms cms · craftcms/cms
- CVE-2026-28696Craft affected by IDOR via GraphQL @parseRefscraftcms cms · craftcms/cms
- CVE-2026-3520Multer vulnerable to Denial of Service via uncontrolled recursionexpressjs multer · multer
- CVE-2026-28695Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetcraftcms cms · craftcms/cms
- CVE-2025-15558Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityDocker CLI · Docker Compose +4
- CVE-2025-59783OS Command Injection over API2N Telekomunikace a.s. 2N Access Commander
- CVE-2026-23236fbdev: smscufx: properly copy ioctl memory to kernelspaceLinux
- CVE-2026-23231netfilter: nf_tables: fix use-after-free in nf_tables_addchain()Linux
- CVE-2023-7337JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookierabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2026-2748S/MIME Certificate Subject WhitespaceSEPPmail Secure Email Gateway
- CVE-2026-27444Header Email Address ParsingSEPPmail Secure Email Gateway
- CVE-2026-27443S/MIME Decryption Tag Sanitization BypassSEPPmail Secure Email Gateway
- CVE-2026-3094File Parsing Out-Of-Bounds Write in CNCSoft-G2deltaww CNCSoft-G2
- CVE-2026-29119Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) SFX2100 Series…
- CVE-2026-28778Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100International Datacasting Corporation (IDC) IDC SFX2100 Sup…
- CVE-2026-28776Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) IDC SFX2100 Sup…
- CVE-2026-2025Mail Mint < 1.19.5 - Unauthenticated Emails DisclosureMail Mint
- CVE-2026-3452Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.Concrete CMS · concrete5/concrete5
- CVE-2026-1273PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpointswpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- CVE-2026-1945WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parametersiqonicdesign WPBookit
- CVE-2025-70341Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.
- CVE-2026-26514An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e.
- CVE-2026-26673An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service…
Medium, low and unrated 115
- CVE-2026-22052ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability.NETAPP ONTAP
- CVE-2025-41257Suprema BioStar 2 Insecure Password ChangeSuprema BioStar
- CVE-2026-2297SourcelessFileLoader does not use io.open_code()Python Software Foundation CPython
- CVE-2026-29085Hono: SSE Control Field Injection via CR/LF in writeSSE()honojs hono · hono
- CVE-2026-29086Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()honojs hono · hono
- CVE-2026-26002OnDemand susceptible to malicious input when navigating to a directory.OSC ondemand
- CVE-2026-22040NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crashnanomq
- CVE-2025-68467Dark Reader gives users the ability to request style sheets from local web serversdarkreader
- CVE-2026-27898Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipherdani-garcia vaultwarden · vaultwarden
- CVE-2026-27801Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcementdani-garcia vaultwarden · vaultwarden
- CVE-2026-28434cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response headeryhirose cpp-httplib
- CVE-2026-28427OpenDeck affected by path traversal allows arbitrary file readnekename OpenDeck
- CVE-2026-20064A vulnerability in of Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to cause the device…Cisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20025A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20024A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20023A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20022A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20021A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20020A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20016A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an…Cisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20073Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20102Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20070Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Cross-Site Scripting…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20069Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20068Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
Show all 115 entriesShow fewer entries
- CVE-2026-20067Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20066Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-20065Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-20063Cisco Secure FTD Software Authenticated Command Injection VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20058Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-20057Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20054Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Infinite Loop Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20053Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Heap Overflow Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20052Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20050Cisco Secure Firewall Threat Defense Decryption Policy Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20017Cisco Secure FTD Software Authenticated Command Injection VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20018Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal VulnerabilityCisco Secure Firewall Management Center · Cisco Secure Fire…
- CVE-2026-20007Cisco Secure Firewall Threat Defense Software Snort Deep Inspection Bypass VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20006Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20149A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.Cisco Webex Meetings
- CVE-2026-20015A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20013A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20106A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20003A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection…Cisco Secure Firewall Management Center
- CVE-2026-20044Cisco Secure Firewall Management Center Command Injection VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-20031ClamAV CSS Image Parsing Error Handling Denial of Service VulnerabilityCisco Secure Endpoint
- CVE-2019-25502Simple Job Script Cross-Site Scripting via job_type_value Parameterniteosoft Simple Job Script
- CVE-2026-20008Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Lua Code Injection VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20009Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-26949Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Incorrect Authorization vulnerability.Dell Device Management Agent
- CVE-2026-20001Cisco Secure Firewall Management Center Software SQL Injection VulnerabilitiesCisco Secure Firewall Management Center
- CVE-2026-20005Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote…Cisco Secure Firewall Threat Defense (FTD) Software · Ci… +1
- CVE-2026-22760Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability.Dell Device Management Agent
- CVE-2026-29069Craft has an unauthenticated activation email trigger with potential user enumerationcraftcms cms · craftcms/cms
- CVE-2026-28782Craft has a Permission Bypass and IDOR in Duplicate Entry Actioncraftcms cms · craftcms/cms
- CVE-2026-23812Security Boundary Bypass via Routing Node ImpersonationHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23811Unauthorized Bi-Directional Traffic Interception via L2/L3 ManipulationHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23810Cross-BSSID GTK Re-encryption and Traffic InjectionHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23809MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic RedirectionHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23808Client Isolation Bypass via GTK ManipulationHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23601Frame Injection via Shared GTK Allows Traffic Spoofing and Client CompromiseHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-22285Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability.Dell Device Management Agent
- CVE-2025-59787HTTP 5XX Internal Server Errors2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-59786Cookies are not Invalidated upon Logout and Password Change2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-59785API - Insufficient Input Validation2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-59784Log Pollution - Control Characters Not Escaped2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-12801Nfs-utils: rpc.mountd in the nfs-utils privilege escalationRed Hat Enterprise Linux · Red Hat OpenShift Container P… +1
- CVE-2025-62879Rancher Backup Operator pod's logs leak S3 tokensSUSE Rancher · github.com/rancher/backup-restore-operator
- CVE-2026-23238romfs: check sb_set_blocksize() return valueLinux
- CVE-2026-23237platform/x86: classmate-laptop: Add missing NULL pointer checksLinux
- CVE-2026-23235f2fs: fix out-of-bounds access in sysfs attribute read/writeLinux
- CVE-2026-23234f2fs: fix to avoid UAF in f2fs_write_end_io()Linux
- CVE-2026-23233f2fs: fix to avoid mapping wrong physical block for swapfileLinux
- CVE-2026-23232Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"Linux
- CVE-2025-71238scsi: qla2xxx: Fix bsg_done() causing double freeLinux
- CVE-2025-40896Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0Nozomi Networks Arc
- CVE-2025-40895HTML injection in Sensor Map in CMC before 25.6.0Nozomi Networks CMC
- CVE-2025-40894HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-3103Deletion of passwords via RestApiCheckmk
- CVE-2026-25907Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability.Dell PowerScale OneFS
- CVE-2026-21422Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability.Dell PowerScale OneFS
- CVE-2026-21424Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary…Dell PowerScale OneFS
- CVE-2026-21421Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary…Dell PowerScale OneFS
- CVE-2026-21426Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary…Dell PowerScale OneFS
- CVE-2026-21423Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions…Dell PowerScale OneFS
- CVE-2026-22270Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element…Dell PowerScale OneFS,
- CVE-2026-21425Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment…Dell PowerScale OneFS
- CVE-2026-24732Improper permission checks in Extension:NSFileRepoHallo Welt! BlueSpice
- CVE-2026-3058Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actorseraphinitesoft Seraphinite Accelerator
- CVE-2026-3056Seraphinite Accelerator <= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearingseraphinitesoft Seraphinite Accelerator
- CVE-2026-1674Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+)…saadiqbal Gutena Forms – Contact Form, Survey Form, Feedbac…
- CVE-2026-2355My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesjoedolson My Calendar – Accessible Event Manager
- CVE-2026-1706All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameterplugins360 All-in-One Video Gallery
- CVE-2026-3439A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a…SonicWall SonicOS
- CVE-2026-27445PGP Signature ReflectionSEPPmail Secure Email Gateway
- CVE-2026-2747PGP Mixed Plaintext and Encrypted ContentSEPPmail Secure Email Gateway
- CVE-2025-66168Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly…Apache Software Foundation org.apache.activemq:apache-ac… +4
- CVE-2026-2746Missing PGP Signature TagSEPPmail Secure Email Gateway
- CVE-2026-1236Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via…smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…
- CVE-2026-28772Reflected XSS in IDC_Logging Index endpointInternational Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28771Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101International Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28770XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101International Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28769LFI in /IDC_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management…International Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-2732Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replaceshortpixel Enable Media Replace
- CVE-2026-2363WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attributecbutlerjr WP-Members Membership Plugin
- CVE-2026-2994Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist GroupConcrete CMS · concrete5/concrete5
- CVE-2026-3240Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy formConcrete CMS · concrete5/concrete5
- CVE-2026-3241Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.Concrete CMS · concrete5/concrete5
- CVE-2026-3242Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language blockConcrete CMS · concrete5/concrete5
- CVE-2026-3244Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page NamesConcrete CMS · concrete5/concrete5
- CVE-2026-1651Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parametericegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2026-2292Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Fieldbandido Morkva UA Shipping
- CVE-2026-1980WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposureiqonicdesign WPBookit
- CVE-2026-2289Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' FieldTaskbuilder – Project Management & Task Management Tool Wit…
- CVE-2025-70342erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json.