# CVEs published 2026-03-04

204 CVEs were published on March 4, 2026: 29 critical, 60 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-2836](https://cve.now/CVE-2026-2836.md): Cache poisoning via insecure-by-default cache key (CVSS 8.4, https://github.com/cloudflare/pingora · pingora-cache)
- [CVE-2026-2835](https://cve.now/CVE-2026-2835.md): HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing (CVSS 9.3, https://github.com/cloudflare/pingora · pingora-core)
- [CVE-2026-22052](https://cve.now/CVE-2026-22052.md): ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. (CVSS 5.3, NETAPP ONTAP)
- [CVE-2026-2833](https://cve.now/CVE-2026-2833.md): HTTP Request Smuggling via Premature Upgrade (CVSS 9.3, https://github.com/cloudflare/pingora · pingora-core)
- [CVE-2025-41257](https://cve.now/CVE-2025-41257.md): Suprema BioStar 2 Insecure Password Change (CVSS 4.8, Suprema BioStar)
- [CVE-2026-2297](https://cve.now/CVE-2026-2297.md): SourcelessFileLoader does not use io.open\_code() (CVSS 5.7, Python Software Foundation CPython)
- [CVE-2026-29085](https://cve.now/CVE-2026-29085.md): Hono: SSE Control Field Injection via CR/LF in writeSSE() (CVSS 6.5, honojs hono · hono)
- [CVE-2026-29045](https://cve.now/CVE-2026-29045.md): Hono: Arbitrary file access via serveStatic vulnerability (CVSS 7.5, honojs hono · hono)
- [CVE-2026-29086](https://cve.now/CVE-2026-29086.md): Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() (CVSS 5.4, honojs hono · hono)
- [CVE-2026-26002](https://cve.now/CVE-2026-26002.md): OnDemand susceptible to malicious input when navigating to a directory. (CVSS 6.3, OSC ondemand)
- [CVE-2026-25750](https://cve.now/CVE-2026-25750.md): LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl (CVSS 8.5, langchain-ai helm)
- [CVE-2026-22040](https://cve.now/CVE-2026-22040.md): NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash (CVSS 5.3, nanomq)
- [CVE-2025-68467](https://cve.now/CVE-2025-68467.md): Dark Reader gives users the ability to request style sheets from local web servers (CVSS 3.4, darkreader)
- [CVE-2026-29000](https://cve.now/CVE-2026-29000.md): pac4j-jwt JwtAuthenticator Authentication Bypass (CVSS 9.3, pac4j-jwt · org.pac4j:pac4j-jwt)
- [CVE-2025-66024](https://cve.now/CVE-2025-66024.md): XWiki Blog Application home page vulnerable to Stored XSS via Post Title (CVSS 8.6, xwiki-contrib application-blog-ui · org.xwiki.contrib.blog:…)
- [CVE-2026-27898](https://cve.now/CVE-2026-27898.md): Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher (CVSS 5.4, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-27803](https://cve.now/CVE-2026-27803.md): Vaultwarden: Collection Management Operations Allowed Without \`manage\` Verification for Manager Role (CVSS 8.3, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-27802](https://cve.now/CVE-2026-27802.md): Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager (CVSS 8.3, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-27801](https://cve.now/CVE-2026-27801.md): Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement (CVSS 6.0, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-28435](https://cve.now/CVE-2026-28435.md): Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib (CVSS 7.5, yhirose cpp-httplib)
- [CVE-2026-28434](https://cve.now/CVE-2026-28434.md): cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION\_WHAT response header (CVSS 5.3, yhirose cpp-httplib)
- [CVE-2026-28427](https://cve.now/CVE-2026-28427.md): OpenDeck affected by path traversal allows arbitrary file read (CVSS 5.9, nekename OpenDeck)
- [CVE-2026-3545](https://cve.now/CVE-2026-3545.md): Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a… (CVSS 9.6, Google Chrome)
- [CVE-2026-3544](https://cve.now/CVE-2026-3544.md): Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory… (CVSS 8.8, Google Chrome)
- [CVE-2026-3543](https://cve.now/CVE-2026-3543.md): Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds… (CVSS 8.8, Google Chrome)
- [CVE-2026-3542](https://cve.now/CVE-2026-3542.md): Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds… (CVSS 8.8, Google Chrome)
- [CVE-2026-3541](https://cve.now/CVE-2026-3541.md): Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory… (CVSS 8.8, Google Chrome)
- [CVE-2026-3540](https://cve.now/CVE-2026-3540.md): Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds… (CVSS 8.8, Google Chrome)
- [CVE-2026-3538](https://cve.now/CVE-2026-3538.md): Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory… (CVSS 8.8, Google Chrome)
- [CVE-2026-3537](https://cve.now/CVE-2026-3537.md): Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit… (CVSS 8.8, Google Chrome)
- [CVE-2026-3536](https://cve.now/CVE-2026-3536.md): Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory… (CVSS 8.8, Google Chrome)
- [CVE-2026-20064](https://cve.now/CVE-2026-20064.md): A vulnerability in of Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to cause the device… (CVSS 6.5, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20025](https://cve.now/CVE-2026-20025.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated… (CVSS 6.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20024](https://cve.now/CVE-2026-20024.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated… (CVSS 6.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20023](https://cve.now/CVE-2026-20023.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat… (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20022](https://cve.now/CVE-2026-20022.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated… (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20021](https://cve.now/CVE-2026-20021.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat… (CVSS 4.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20020](https://cve.now/CVE-2026-20020.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated… (CVSS 6.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20016](https://cve.now/CVE-2026-20016.md): A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an… (CVSS 6.0, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-0847](https://cve.now/CVE-2026-0847.md): Path Traversal in nltk/nltk (CVSS 8.6, nltk/nltk · nltk)
- [CVE-2026-3125](https://cve.now/CVE-2026-3125.md): SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass (CVSS 7.7, @opennextjs/cloudflare)
- [CVE-2026-20073](https://cve.now/CVE-2026-20073.md): Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass… (CVSS 5.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20102](https://cve.now/CVE-2026-20102.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting… (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20070](https://cve.now/CVE-2026-20070.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Cross-Site Scripting… (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20069](https://cve.now/CVE-2026-20069.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request… (CVSS 4.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20068](https://cve.now/CVE-2026-20068.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20067](https://cve.now/CVE-2026-20067.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20066](https://cve.now/CVE-2026-20066.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Cisco…)
- [CVE-2026-20065](https://cve.now/CVE-2026-20065.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Cisco…)
- [CVE-2026-20063](https://cve.now/CVE-2026-20063.md): Cisco Secure FTD Software Authenticated Command Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20058](https://cve.now/CVE-2026-20058.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Cisco…)
- [CVE-2026-20057](https://cve.now/CVE-2026-20057.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20054](https://cve.now/CVE-2026-20054.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Infinite Loop Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20053](https://cve.now/CVE-2026-20053.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Heap Overflow Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20052](https://cve.now/CVE-2026-20052.md): Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20050](https://cve.now/CVE-2026-20050.md): Cisco Secure Firewall Threat Defense Decryption Policy Denial of Service Vulnerability (CVSS 6.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20017](https://cve.now/CVE-2026-20017.md): Cisco Secure FTD Software Authenticated Command Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20018](https://cve.now/CVE-2026-20018.md): Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability (CVSS 5.9, Cisco Secure Firewall Management Center · Cisco Secure Fire…)
- [CVE-2026-20007](https://cve.now/CVE-2026-20007.md): Cisco Secure Firewall Threat Defense Software Snort Deep Inspection Bypass Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20006](https://cve.now/CVE-2026-20006.md): Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20149](https://cve.now/CVE-2026-20149.md): A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. (CVSS 6.1, Cisco Webex Meetings)
- [CVE-2026-20082](https://cve.now/CVE-2026-20082.md): A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software… (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20062](https://cve.now/CVE-2026-20062.md): A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an… (CVSS 7.2, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20049](https://cve.now/CVE-2026-20049.md): A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco… (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20015](https://cve.now/CVE-2026-20015.md): A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated… (CVSS 5.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20014](https://cve.now/CVE-2026-20014.md): A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated… (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20013](https://cve.now/CVE-2026-20013.md): A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated… (CVSS 5.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20106](https://cve.now/CVE-2026-20106.md): A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance… (CVSS 5.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20105](https://cve.now/CVE-2026-20105.md): A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure… (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20103](https://cve.now/CVE-2026-20103.md): A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure… (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20101](https://cve.now/CVE-2026-20101.md): A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an… (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20100](https://cve.now/CVE-2026-20100.md): A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA)… (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20003](https://cve.now/CVE-2026-20003.md): A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection… (CVSS 4.9, Cisco Secure Firewall Management Center)
- [CVE-2026-20002](https://cve.now/CVE-2026-20002.md): A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to… (CVSS 8.1, Cisco Secure Firewall Management Center)
- [CVE-2026-20131](https://cve.now/CVE-2026-20131.md): Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability (CVSS 10.0, KEV, Cisco Secure Firewall Management Center)
- [CVE-2026-20039](https://cve.now/CVE-2026-20039.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software SSL VPN Authentication Denial of Service Vulnerability (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20044](https://cve.now/CVE-2026-20044.md): Cisco Secure Firewall Management Center Command Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Management Center)
- [CVE-2026-20079](https://cve.now/CVE-2026-20079.md): Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability (CVSS 10.0, KEV, Cisco Secure Firewall Management Center)
- [CVE-2026-20031](https://cve.now/CVE-2026-20031.md): ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability (CVSS 5.3, Cisco Secure Endpoint)
- [CVE-2019-25507](https://cve.now/CVE-2019-25507.md): Ashop Shopping Cart Software Lastest SQL Injection via index.php (CVSS 8.8, Ashopsoftware Ashop Shopping Cart Software)
- [CVE-2019-25506](https://cve.now/CVE-2019-25506.md): FreeSMS 2.1.2 Authentication Bypass via SQL Injection (CVSS 8.8, FreeSMS)
- [CVE-2019-25505](https://cve.now/CVE-2019-25505.md): Tradebox 5.4 SQL Injection via symbol Parameter (CVSS 7.1, Bdtask Tradebox)
- [CVE-2019-25504](https://cve.now/CVE-2019-25504.md): NCrypted Jobgator Lastest SQL Injection via agents Find-Jobs (CVSS 8.8, NCrypted Jobgator)
- [CVE-2019-25503](https://cve.now/CVE-2019-25503.md): PHPads 2.0 SQL Injection via click.php3 bannerID (CVSS 7.1, Blondish PHPads)
- [CVE-2019-25502](https://cve.now/CVE-2019-25502.md): Simple Job Script Cross-Site Scripting via job\_type\_value Parameter (CVSS 5.1, niteosoft Simple Job Script)
- [CVE-2019-25501](https://cve.now/CVE-2019-25501.md): Simple Job Script SQL Injection via delete\_application\_ajax.php (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2019-25500](https://cve.now/CVE-2019-25500.md): Simple Job Script SQL Injection via register-recruiters endpoint (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2019-25499](https://cve.now/CVE-2019-25499.md): Simple Job Script SQL Injection via get\_job\_applications\_ajax.php (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2019-25498](https://cve.now/CVE-2019-25498.md): Simple Job Script SQL Injection via searched Endpoint (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2026-20008](https://cve.now/CVE-2026-20008.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Lua Code Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20009](https://cve.now/CVE-2026-20009.md): Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability (CVSS 5.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-26949](https://cve.now/CVE-2026-26949.md): Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Incorrect Authorization vulnerability. (CVSS 5.5, Dell Device Management Agent)
- [CVE-2026-20001](https://cve.now/CVE-2026-20001.md): Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities (CVSS 6.5, Cisco Secure Firewall Management Center)
- [CVE-2026-20005](https://cve.now/CVE-2026-20005.md): Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote… (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Ci… +1)
- [CVE-2026-22760](https://cve.now/CVE-2026-22760.md): Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability. (CVSS 3.3, Dell Device Management Agent)
- [CVE-2026-29069](https://cve.now/CVE-2026-29069.md): Craft has an unauthenticated activation email trigger with potential user enumeration (CVSS 6.9, craftcms cms · craftcms/cms)
- [CVE-2026-28784](https://cve.now/CVE-2026-28784.md): Craft is affected by potential authenticated Remote Code Execution via Twig SSTI (CVSS 8.6, craftcms cms · craftcms/cms)
- [CVE-2026-28783](https://cve.now/CVE-2026-28783.md): Craft has a Twig Function Blocklist Bypass (CVSS 9.4, craftcms cms · craftcms/cms)
- [CVE-2026-28782](https://cve.now/CVE-2026-28782.md): Craft has a Permission Bypass and IDOR in Duplicate Entry Action (CVSS 5.3, craftcms cms · craftcms/cms)
- [CVE-2026-28781](https://cve.now/CVE-2026-28781.md): Craft Affected by Entries Authorship Spoofing via Mass Assignment (CVSS 7.1, craftcms cms · craftcms/cms)
- [CVE-2026-28697](https://cve.now/CVE-2026-28697.md): Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates (CVSS 9.4, craftcms cms · craftcms/cms)
- [CVE-2026-28696](https://cve.now/CVE-2026-28696.md): Craft affected by IDOR via GraphQL @parseRefs (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-3520](https://cve.now/CVE-2026-3520.md): Multer vulnerable to Denial of Service via uncontrolled recursion (CVSS 8.7, expressjs multer · multer)
- [CVE-2026-28695](https://cve.now/CVE-2026-28695.md): Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget (CVSS 7.5, craftcms cms · craftcms/cms)
- [CVE-2025-15558](https://cve.now/CVE-2025-15558.md): Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.0, Docker CLI · Docker Compose +4)
- [CVE-2026-23812](https://cve.now/CVE-2026-23812.md): Security Boundary Bypass via Routing Node Impersonation (CVSS 4.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23811](https://cve.now/CVE-2026-23811.md): Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation (CVSS 4.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23810](https://cve.now/CVE-2026-23810.md): Cross-BSSID GTK Re-encryption and Traffic Injection (CVSS 4.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23809](https://cve.now/CVE-2026-23809.md): MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection (CVSS 5.4, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23808](https://cve.now/CVE-2026-23808.md): Client Isolation Bypass via GTK Manipulation (CVSS 5.4, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23601](https://cve.now/CVE-2026-23601.md): Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise (CVSS 5.4, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-22285](https://cve.now/CVE-2026-22285.md): Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. (CVSS 4.4, Dell Device Management Agent)
- [CVE-2025-59787](https://cve.now/CVE-2025-59787.md): HTTP 5XX Internal Server Errors (CVSS 5.3, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-59786](https://cve.now/CVE-2025-59786.md): Cookies are not Invalidated upon Logout and Password Change (CVSS 6.0, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-59785](https://cve.now/CVE-2025-59785.md): API - Insufficient Input Validation (CVSS 5.3, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-59784](https://cve.now/CVE-2025-59784.md): Log Pollution - Control Characters Not Escaped (CVSS 6.9, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-12801](https://cve.now/CVE-2025-12801.md): Nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1)
- [CVE-2025-59783](https://cve.now/CVE-2025-59783.md): OS Command Injection over API (CVSS 8.8, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-62879](https://cve.now/CVE-2025-62879.md): Rancher Backup Operator pod's logs leak S3 tokens (CVSS 6.8, SUSE Rancher · github.com/rancher/backup-restore-operator)
- [CVE-2026-23238](https://cve.now/CVE-2026-23238.md): romfs: check sb\_set\_blocksize() return value (no CVSS, Linux)
- [CVE-2026-23237](https://cve.now/CVE-2026-23237.md): platform/x86: classmate-laptop: Add missing NULL pointer checks (no CVSS, Linux)
- [CVE-2026-23236](https://cve.now/CVE-2026-23236.md): fbdev: smscufx: properly copy ioctl memory to kernelspace (CVSS 7.3, Linux)
- [CVE-2026-23235](https://cve.now/CVE-2026-23235.md): f2fs: fix out-of-bounds access in sysfs attribute read/write (no CVSS, Linux)
- [CVE-2026-23234](https://cve.now/CVE-2026-23234.md): f2fs: fix to avoid UAF in f2fs\_write\_end\_io() (no CVSS, Linux)
- [CVE-2026-23233](https://cve.now/CVE-2026-23233.md): f2fs: fix to avoid mapping wrong physical block for swapfile (no CVSS, Linux)
- [CVE-2026-23232](https://cve.now/CVE-2026-23232.md): Revert "f2fs: block cache/dio write during f2fs\_enable\_checkpoint()" (no CVSS, Linux)
- [CVE-2025-71238](https://cve.now/CVE-2025-71238.md): scsi: qla2xxx: Fix bsg\_done() causing double free (no CVSS, Linux)
- [CVE-2025-40896](https://cve.now/CVE-2025-40896.md): Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0 (CVSS 6.3, Nozomi Networks Arc)
- [CVE-2025-40895](https://cve.now/CVE-2025-40895.md): HTML injection in Sensor Map in CMC before 25.6.0 (CVSS 2.0, Nozomi Networks CMC)
- [CVE-2025-40894](https://cve.now/CVE-2025-40894.md): HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0 (CVSS 2.1, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-3103](https://cve.now/CVE-2026-3103.md): Deletion of passwords via RestApi (CVSS 5.3, Checkmk)
- [CVE-2026-25907](https://cve.now/CVE-2026-25907.md): Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2026-23231](https://cve.now/CVE-2026-23231.md): netfilter: nf\_tables: fix use-after-free in nf\_tables\_addchain() (CVSS 7.8, Linux)
- [CVE-2026-21422](https://cve.now/CVE-2026-21422.md): Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability. (CVSS 3.4, Dell PowerScale OneFS)
- [CVE-2026-21424](https://cve.now/CVE-2026-21424.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary… (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-21421](https://cve.now/CVE-2026-21421.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary… (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-21426](https://cve.now/CVE-2026-21426.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary… (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-21423](https://cve.now/CVE-2026-21423.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions… (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-22270](https://cve.now/CVE-2026-22270.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element… (CVSS 6.7, Dell PowerScale OneFS,)
- [CVE-2026-21425](https://cve.now/CVE-2026-21425.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment… (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-24732](https://cve.now/CVE-2026-24732.md): Improper permission checks in Extension:NSFileRepo (CVSS 6.6, Hallo Welt! BlueSpice)
- [CVE-2026-3058](https://cve.now/CVE-2026-3058.md): Seraphinite Accelerator \<= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, seraphinitesoft Seraphinite Accelerator)
- [CVE-2026-3056](https://cve.now/CVE-2026-3056.md): Seraphinite Accelerator \<= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearing (CVSS 4.3, seraphinitesoft Seraphinite Accelerator)
- [CVE-2026-1674](https://cve.now/CVE-2026-1674.md): Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder \<= 1.6.0 - Authenticated (Contributor+)… (CVSS 6.5, saadiqbal Gutena Forms – Contact Form, Survey Form, Feedbac…)
- [CVE-2026-2355](https://cve.now/CVE-2026-2355.md): My Calendar – Accessible Event Manager \<= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, joedolson My Calendar – Accessible Event Manager)
- [CVE-2026-1706](https://cve.now/CVE-2026-1706.md): All-in-One Video Gallery \<= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter (CVSS 6.1, plugins360 All-in-One Video Gallery)
- [CVE-2023-7337](https://cve.now/CVE-2023-7337.md): JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie (CVSS 7.5, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2026-3439](https://cve.now/CVE-2026-3439.md): A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a… (CVSS 4.9, SonicWall SonicOS)
- [CVE-2026-27441](https://cve.now/CVE-2026-27441.md): PDF Password CMDi (CVSS 9.5, SEPPmail Secure Email Gateway)
- [CVE-2026-2748](https://cve.now/CVE-2026-2748.md): S/MIME Certificate Subject Whitespace (CVSS 7.8, SEPPmail Secure Email Gateway)
- [CVE-2026-27446](https://cve.now/CVE-2026-27446.md): Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation (CVSS 9.3, Apache Software Foundation org.apache.artemis:artemis-se… +2)
- [CVE-2026-27442](https://cve.now/CVE-2026-27442.md): zip\_attachments Path Traversal (CVSS 9.3, SEPPmail Secure Email Gateway)
- [CVE-2026-27445](https://cve.now/CVE-2026-27445.md): PGP Signature Reflection (CVSS 6.9, SEPPmail Secure Email Gateway)
- [CVE-2026-27444](https://cve.now/CVE-2026-27444.md): Header Email Address Parsing (CVSS 7.8, SEPPmail Secure Email Gateway)
- [CVE-2026-2747](https://cve.now/CVE-2026-2747.md): PGP Mixed Plaintext and Encrypted Content (CVSS 6.9, SEPPmail Secure Email Gateway)
- [CVE-2026-27443](https://cve.now/CVE-2026-27443.md): S/MIME Decryption Tag Sanitization Bypass (CVSS 8.2, SEPPmail Secure Email Gateway)
- [CVE-2025-66168](https://cve.now/CVE-2025-66168.md): Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly… (CVSS 5.4, Apache Software Foundation org.apache.activemq:apache-ac… +4)
- [CVE-2026-2746](https://cve.now/CVE-2026-2746.md): Missing PGP Signature Tag (CVSS 6.9, SEPPmail Secure Email Gateway)
- [CVE-2026-3094](https://cve.now/CVE-2026-3094.md): File Parsing Out-Of-Bounds Write in CNCSoft-G2 (CVSS 7.8, deltaww CNCSoft-G2)
- [CVE-2026-1236](https://cve.now/CVE-2026-1236.md): Envira Gallery for WordPress \<= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified\_gallery\_theme' Parameter via… (CVSS 6.4, smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…)
- [CVE-2026-29120](https://cve.now/CVE-2026-29120.md): Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver (CVSS 9.2, International Datacasting IDC SFX2100 SuperFlex Satellite R…)
- [CVE-2026-29119](https://cve.now/CVE-2026-29119.md): Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver (CVSS 8.8, International Datacasting Corporation (IDC) SFX2100 Series…)
- [CVE-2026-28778](https://cve.now/CVE-2026-28778.md): Hardcoded FTP Credentials and LPE(via Insecure Permissions) for \`xd\` Local Account on IDC SFX2100 (CVSS 7.9, International Datacasting Corporation (IDC) IDC SFX2100 Sup…)
- [CVE-2026-28777](https://cve.now/CVE-2026-28777.md): Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver (CVSS 9.2, International Datacasting Corporation (IDC) SFX2100 Satelli…)
- [CVE-2026-28776](https://cve.now/CVE-2026-28776.md): Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver (CVSS 7.8, International Datacasting Corporation (IDC) IDC SFX2100 Sup…)
- [CVE-2026-28775](https://cve.now/CVE-2026-28775.md): Unauthenticated RCE via SNMP Default Writable Community String (CVSS 10.0, International Datacasting Corporation (IDC) SFX2100 Series…)
- [CVE-2026-28774](https://cve.now/CVE-2026-28774.md): Authenticated OS Command Injection via Traceroute Utility leads to Root RCE (CVSS 9.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28773](https://cve.now/CVE-2026-28773.md): Authenticated OS Command Injection via Ping Utility Leading to RCE as Root (CVSS 9.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28772](https://cve.now/CVE-2026-28772.md): Reflected XSS in IDC\_Logging Index endpoint (CVSS 5.1, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28771](https://cve.now/CVE-2026-28771.md): Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101 (CVSS 5.1, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28770](https://cve.now/CVE-2026-28770.md): XML injection In /IDC\_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101 (CVSS 5.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28769](https://cve.now/CVE-2026-28769.md): LFI in /IDC\_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management… (CVSS 5.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-2732](https://cve.now/CVE-2026-2732.md): Enable Media Replace \<= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace (CVSS 5.4, shortpixel Enable Media Replace)
- [CVE-2026-2363](https://cve.now/CVE-2026-2363.md): WP-Members Membership Plugin \<= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order\_by' Shortcode Attribute (CVSS 6.5, cbutlerjr WP-Members Membership Plugin)
- [CVE-2026-2025](https://cve.now/CVE-2026-2025.md): Mail Mint \< 1.19.5 - Unauthenticated Emails Disclosure (CVSS 7.5, Mail Mint)
- [CVE-2026-2994](https://cve.now/CVE-2026-2994.md): Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3240](https://cve.now/CVE-2026-3240.md): Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3241](https://cve.now/CVE-2026-3241.md): Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block. (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3242](https://cve.now/CVE-2026-3242.md): Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3244](https://cve.now/CVE-2026-3244.md): Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3452](https://cve.now/CVE-2026-3452.md): Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block. (CVSS 8.9, Concrete CMS · concrete5/concrete5)
- [CVE-2026-1651](https://cve.now/CVE-2026-1651.md): Email Subscribers & Newsletters \<= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow\_ids' Parameter (CVSS 6.5, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2026-2292](https://cve.now/CVE-2026-2292.md): Morkva UA Shipping \<= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field (CVSS 4.4, bandido Morkva UA Shipping)
- [CVE-2026-1273](https://cve.now/CVE-2026-1273.md): PostX \<= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints (CVSS 7.2, wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…)
- [CVE-2026-1980](https://cve.now/CVE-2026-1980.md): WPBookit \<= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure (CVSS 5.3, iqonicdesign WPBookit)
- [CVE-2026-2289](https://cve.now/CVE-2026-2289.md): Taskbuilder \<= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field (CVSS 4.4, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2026-1945](https://cve.now/CVE-2026-1945.md): WPBookit \<= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb\_user\_name' and 'wpb\_user\_email' Parameters (CVSS 7.2, iqonicdesign WPBookit)
- [CVE-2025-46108](https://cve.now/CVE-2025-46108.md): D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup. (CVSS 9.8)
- [CVE-2025-66678](https://cve.now/CVE-2025-66678.md): An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to… (CVSS 9.8)
- [CVE-2025-66944](https://cve.now/CVE-2025-66944.md): SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query… (CVSS 9.8)
- [CVE-2025-69969](https://cve.now/CVE-2025-69969.md): A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd… (CVSS 9.6)
- [CVE-2025-70218](https://cve.now/CVE-2025-70218.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component. (CVSS 9.8)
- [CVE-2025-70219](https://cve.now/CVE-2025-70219.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot. (CVSS 9.8)
- [CVE-2025-70220](https://cve.now/CVE-2025-70220.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN\_wizard4. (CVSS 9.8)
- [CVE-2025-70221](https://cve.now/CVE-2025-70221.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin. (CVSS 9.8)
- [CVE-2025-70222](https://cve.now/CVE-2025-70222.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode. (CVSS 9.8)
- [CVE-2025-70223](https://cve.now/CVE-2025-70223.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork. (CVSS 9.8)
- [CVE-2025-70225](https://cve.now/CVE-2025-70225.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component (CVSS 9.8)
- [CVE-2025-70226](https://cve.now/CVE-2025-70226.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard. (CVSS 9.8)
- [CVE-2025-70341](https://cve.now/CVE-2025-70341.md): Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files. (CVSS 7.8)
- [CVE-2025-70342](https://cve.now/CVE-2025-70342.md): erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. (CVSS 6.6)
- [CVE-2026-26478](https://cve.now/CVE-2026-26478.md): A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a… (CVSS 9.8)
- [CVE-2026-26514](https://cve.now/CVE-2026-26514.md): An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. (CVSS 7.5)
- [CVE-2026-26673](https://cve.now/CVE-2026-26673.md): An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service… (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.