# CVEs published 2026-03-11

337 CVEs were published on March 11, 2026: 35 critical, 108 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-3965](https://cve.now/CVE-2026-3965.md): whyour qinglong API express.ts protection mechanism (CVSS 5.3, whyour qinglong · @whyour/qinglong)
- [CVE-2026-2808](https://cve.now/CVE-2026-2808.md): Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider (CVSS 6.8, HashiCorp Consul · github.com/hashicorp/consul)
- [CVE-2026-3964](https://cve.now/CVE-2026-3964.md): OpenAkita Chat API Endpoint shell.py run os command injection (CVSS 4.8, OpenAkita)
- [CVE-2026-3963](https://cve.now/CVE-2026-3963.md): perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key (CVSS 6.3, perfree go-fastdfs-web)
- [CVE-2026-31988](https://cve.now/CVE-2026-31988.md): yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parser (CVSS 6.9, thejoshwolfe yauzl · yauzl)
- [CVE-2026-3962](https://cve.now/CVE-2026-3962.md): Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render\_template cross site scripting (CVSS 5.3, Jcharis Machine-Learning-Web-Apps)
- [CVE-2026-3942](https://cve.now/CVE-2026-3942.md): Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-3941](https://cve.now/CVE-2026-3941.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation… (CVSS 4.3, Google Chrome)
- [CVE-2026-3940](https://cve.now/CVE-2026-3940.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation… (CVSS 4.3, Google Chrome)
- [CVE-2026-3939](https://cve.now/CVE-2026-3939.md): Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions… (CVSS 6.5, Google Chrome)
- [CVE-2026-3938](https://cve.now/CVE-2026-3938.md): Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-3937](https://cve.now/CVE-2026-3937.md): Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via… (CVSS 6.5, Google Chrome)
- [CVE-2026-3936](https://cve.now/CVE-2026-3936.md): Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap… (CVSS 8.8, Google Chrome)
- [CVE-2026-3935](https://cve.now/CVE-2026-3935.md): Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-3934](https://cve.now/CVE-2026-3934.md): Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-3932](https://cve.now/CVE-2026-3932.md): Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation… (CVSS 6.5, Google Chrome)
- [CVE-2026-3931](https://cve.now/CVE-2026-3931.md): Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via… (CVSS 8.8, Google Chrome)
- [CVE-2026-3930](https://cve.now/CVE-2026-3930.md): Unsafe navigation in Navigation in Google Chrome on iOS prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions… (CVSS 6.5, Google Chrome)
- [CVE-2025-62328](https://cve.now/CVE-2025-62328.md): HCL Nomad server on Domino is affected by a missing default frame-ancestors directive (CVSS 3.7, HCLSoftware Nomad server on Domino)
- [CVE-2026-3929](https://cve.now/CVE-2026-3929.md): Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin… (CVSS 3.1, Google Chrome)
- [CVE-2026-3928](https://cve.now/CVE-2026-3928.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install… (CVSS 4.3, Google Chrome)
- [CVE-2026-3927](https://cve.now/CVE-2026-3927.md): Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-3926](https://cve.now/CVE-2026-3926.md): Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-3925](https://cve.now/CVE-2026-3925.md): Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI… (CVSS 4.3, Google Chrome)
- [CVE-2026-3924](https://cve.now/CVE-2026-3924.md): use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process… (CVSS 7.5, Google Chrome)
- [CVE-2026-3923](https://cve.now/CVE-2026-3923.md): Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-3922](https://cve.now/CVE-2026-3922.md): Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via… (CVSS 8.8, Google Chrome)
- [CVE-2026-3921](https://cve.now/CVE-2026-3921.md): Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption… (CVSS 8.8, Google Chrome)
- [CVE-2026-3920](https://cve.now/CVE-2026-3920.md): Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap… (CVSS 8.8, Google Chrome)
- [CVE-2026-3919](https://cve.now/CVE-2026-3919.md): Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious… (CVSS 8.8, Google Chrome)
- [CVE-2026-3918](https://cve.now/CVE-2026-3918.md): Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-3917](https://cve.now/CVE-2026-3917.md): Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-3916](https://cve.now/CVE-2026-3916.md): Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape… (CVSS 9.6, Google Chrome)
- [CVE-2026-3915](https://cve.now/CVE-2026-3915.md): Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read… (CVSS 8.8, Google Chrome)
- [CVE-2026-3914](https://cve.now/CVE-2026-3914.md): Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-3913](https://cve.now/CVE-2026-3913.md): Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via… (CVSS 8.8, Google Chrome)
- [CVE-2026-3961](https://cve.now/CVE-2026-3961.md): zyddnys manga-image-translator Translate Endpoints request\_extraction.py to\_pil\_image server-side request forgery (CVSS 5.3, zyddnys manga-image-translator)
- [CVE-2026-32133](https://cve.now/CVE-2026-32133.md): 2FAuth has Blind SSRF in image parameter allows internal network access and more (CVSS 7.8, Bubka 2FAuth)
- [CVE-2026-32136](https://cve.now/CVE-2026-32136.md): AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass (CVSS 9.8, AdguardTeam AdGuardHome · github.com/AdguardTeam/AdGuardHome)
- [CVE-2026-32132](https://cve.now/CVE-2026-32132.md): ZITADEL: Reactivation of Expired Passkey Registration Codes (CVSS 7.4, zitadel)
- [CVE-2026-32131](https://cve.now/CVE-2026-32131.md): ZITADEL Cross-Tenant Information Disclosure in Management API (CVSS 7.7, zitadel)
- [CVE-2026-32130](https://cve.now/CVE-2026-32130.md): ZITADEL SCIM Authentication Bypass via URL Encoding (CVSS 7.5, zitadel)
- [CVE-2026-3959](https://cve.now/CVE-2026-3959.md): 0xKoda WireMCP Tshark CLI index.js server.tool os command injection (CVSS 4.8, 0xKoda WireMCP)
- [CVE-2026-3958](https://cve.now/CVE-2026-3958.md): Woahai321 ListSync JSON api\_server.py requests.post server-side request forgery (CVSS 5.3, Woahai321 ListSync)
- [CVE-2026-32128](https://cve.now/CVE-2026-32128.md): FastGPT Python Sandbox Bypass of File-Write Restriction (CVSS 6.3, labring FastGPT)
- [CVE-2026-32117](https://cve.now/CVE-2026-32117.md): grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer) (CVSS 7.6, ekacnet grafanacubism-panel)
- [CVE-2026-27591](https://cve.now/CVE-2026-27591.md): Winter: Privilege escalation by authenticated backend users (CVSS 10.0, wintercms winter · winter/wn-backend-module)
- [CVE-2026-3957](https://cve.now/CVE-2026-3957.md): xierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injection (CVSS 5.1, xierongwkhd weimai-wetapp)
- [CVE-2026-32127](https://cve.now/CVE-2026-32127.md): SQL Injection Vulnerability in ajax graphs library (OpenEMR) (CVSS 8.8, openemr)
- [CVE-2026-32126](https://cve.now/CVE-2026-32126.md): OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans (CVSS 7.1, openemr)
- [CVE-2026-32125](https://cve.now/CVE-2026-32125.md): OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels (CVSS 5.4, openemr)
- [CVE-2026-32124](https://cve.now/CVE-2026-32124.md): OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS) (CVSS 5.4, openemr)
- [CVE-2026-32123](https://cve.now/CVE-2026-32123.md): OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced (CVSS 7.7, openemr)
- [CVE-2026-32122](https://cve.now/CVE-2026-32122.md): OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2) (CVSS 4.3, openemr)
- [CVE-2026-32121](https://cve.now/CVE-2026-32121.md): OpenEMR: Stored DOM XSS via \`.html()\` in Portal Signer Modal (CVSS 7.7, openemr)
- [CVE-2026-32118](https://cve.now/CVE-2026-32118.md): OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text (CVSS 5.4, openemr)
- [CVE-2026-32112](https://cve.now/CVE-2026-32112.md): ha-mcp has XSS via Unescaped HTML in OAuth Consent Form (CVSS 6.8, homeassistant-ai ha-mcp · ha-mcp)
- [CVE-2026-32111](https://cve.now/CVE-2026-32111.md): ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle (CVSS 5.3, homeassistant-ai ha-mcp · ha-mcp)
- [CVE-2026-32110](https://cve.now/CVE-2026-32110.md): SiYuan has a Full-Read SSRF via /api/network/forwardProxy (CVSS 8.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-3956](https://cve.now/CVE-2026-3956.md): xierongwkhd weimai-wetapp Admin\_AdminUserController.java getAdmins sql injection (CVSS 5.1, xierongwkhd weimai-wetapp)
- [CVE-2026-3955](https://cve.now/CVE-2026-3955.md): elecV2P jsfile Endpoint wbjs.js runJSFile code injection (CVSS 5.3, elecV2P)
- [CVE-2026-2640](https://cve.now/CVE-2026-2640.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local… (CVSS 6.8, Lenovo PC Manager)
- [CVE-2026-1717](https://cve.now/CVE-2026-1717.md): An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could… (CVSS 6.8, Lenovo Vantage · Lenovo Baiying)
- [CVE-2026-1716](https://cve.now/CVE-2026-1716.md): An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow… (CVSS 6.9, Lenovo Vantage · Lenovo Baiying)
- [CVE-2026-1715](https://cve.now/CVE-2026-1715.md): An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow… (CVSS 6.9, Lenovo Vantage · Lenovo Baiying)
- [CVE-2026-1653](https://cve.now/CVE-2026-1653.md): A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local… (CVSS 6.8, Lenovo Smart Connect)
- [CVE-2026-1652](https://cve.now/CVE-2026-1652.md): A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local… (CVSS 6.9, Lenovo Smart Connect)
- [CVE-2026-0940](https://cve.now/CVE-2026-0940.md): A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to… (CVSS 8.4, Lenovo ThinkPad T14 Gen 5 BIOS · Lenovo ThinkPad P14s Ge… +6)
- [CVE-2026-2368](https://cve.now/CVE-2026-2368.md): An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of… (CVSS 7.5, Lenovo FileZ)
- [CVE-2026-1068](https://cve.now/CVE-2026-1068.md): An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of… (CVSS 6.0, Lenovo FileZ)
- [CVE-2026-0520](https://cve.now/CVE-2026-0520.md): A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local… (CVSS 2.4, Lenovo FileZ)
- [CVE-2026-32109](https://cve.now/CVE-2026-32109.md): Copyparty has unexpected JavaScript execution via crafted URL to folder with \`.prologue.html\` (CVSS 3.7, 9001 copyparty · copyparty)
- [CVE-2026-32108](https://cve.now/CVE-2026-32108.md): Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access (CVSS 2.3, 9001 copyparty · copyparty)
- [CVE-2026-32104](https://cve.now/CVE-2026-32104.md): StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings (CVSS 5.4, withstudiocms studiocms · studiocms)
- [CVE-2026-32106](https://cve.now/CVE-2026-32106.md): StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts (CVSS 4.7, withstudiocms studiocms · studiocms)
- [CVE-2026-32103](https://cve.now/CVE-2026-32103.md): StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation (CVSS 6.8, withstudiocms studiocms · studiocms)
- [CVE-2026-32102](https://cve.now/CVE-2026-32102.md): OliveTin Unauthorized Action Output Disclosure via EventStream (CVSS 7.1, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-32101](https://cve.now/CVE-2026-32101.md): StudioCMS S3 Storage Manager Authorization Bypass via Missing \`await\` on Async Auth Check (CVSS 7.6, @studiocms s3-storage · @studiocms/s3-storage)
- [CVE-2026-3954](https://cve.now/CVE-2026-3954.md): OpenBMB XAgent workspace.py workspace path traversal (CVSS 6.9, OpenBMB XAgent)
- [CVE-2026-32234](https://cve.now/CVE-2026-32234.md): Parse Server has a SQL injection via query field name when using PostgreSQL (CVSS 5.1, parse-community parse-server · parse-server)
- [CVE-2026-32098](https://cve.now/CVE-2026-32098.md): Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-32097](https://cve.now/CVE-2026-32097.md): PingPong has improper access control in thread file endpoints allows access outside intended scope (CVSS 8.6, comppolicylab pingpong)
- [CVE-2026-32096](https://cve.now/CVE-2026-32096.md): Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns (CVSS 9.3, useplunk plunk)
- [CVE-2026-32095](https://cve.now/CVE-2026-32095.md): Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload (CVSS 5.4, useplunk plunk)
- [CVE-2026-32094](https://cve.now/CVE-2026-32094.md): Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash (CVSS 6.9, ericcornelissen shescape · shescape)
- [CVE-2026-31979](https://cve.now/CVE-2026-31979.md): himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache (CVSS 8.8, himmelblau-idm himmelblau)
- [CVE-2026-31976](https://cve.now/CVE-2026-31976.md): xygeni-action v5 tag poisoned with C2 backdoor (CVSS 9.3, xygeni-action)
- [CVE-2026-31974](https://cve.now/CVE-2026-31974.md): Blind SSRF on OpenProject instance via webhooks (CVSS 3.0, opf openproject)
- [CVE-2026-27703](https://cve.now/CVE-2026-27703.md): RIOT has an Out-of-Bounds Write in nanoCoAP Handler (CVSS 7.5, RIOT-OS RIOT)
- [CVE-2026-27478](https://cve.now/CVE-2026-27478.md): Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation (CVSS 9.1, unitycatalog · io.unitycatalog:unitycatalog-server)
- [CVE-2026-31961](https://cve.now/CVE-2026-31961.md): Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsing (CVSS 5.5, anchore quill · github.com/anchore/quill)
- [CVE-2026-3951](https://cve.now/CVE-2026-3951.md): LockerProject Locker Error Response registry.js authIsAwesome cross site scripting (CVSS 5.3, LockerProject Locker)
- [CVE-2026-31960](https://cve.now/CVE-2026-31960.md): DoS in Quill via unbounded read of HTTP response body during notarization (CVSS 5.3, anchore quill · github.com/anchore/quill)
- [CVE-2026-31959](https://cve.now/CVE-2026-31959.md): SSRF in Quill via unvalidated URL from Apple notarization log retrieval (CVSS 5.3, anchore quill · github.com/anchore/quill)
- [CVE-2026-31958](https://cve.now/CVE-2026-31958.md): Tornado has a DoS due to too many multipart parts (CVSS 8.7, tornadoweb tornado · tornado)
- [CVE-2026-31957](https://cve.now/CVE-2026-31957.md): Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments (CVSS 10.0, himmelblau-idm himmelblau)
- [CVE-2026-31954](https://cve.now/CVE-2026-31954.md): Emlog asynchronous media file deletion missing CSRF protection (CVSS 0.0, emlog)
- [CVE-2026-31901](https://cve.now/CVE-2026-31901.md): Parse Server has user enumeration via email verification endpoint (CVSS 6.3, parse-community parse-server · parse-server)
- [CVE-2026-31900](https://cve.now/CVE-2026-31900.md): Black's vulnerable version parsing leads to RCE in GitHub Action (CVSS 8.7, psf black · black)
- [CVE-2026-31896](https://cve.now/CVE-2026-31896.md): WeGIA has a Time-Based Blind SQL Injection in remover\_produto\_ocultar.php (CVSS 9.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-31895](https://cve.now/CVE-2026-31895.md): WeGIA has a SQL Injection via Direct Query Interpolation in restaurar\_produto.php (CVSS 8.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-31894](https://cve.now/CVE-2026-31894.md): WeGIA affected by arbitrary file read via symlink in backup restore (CVSS 6.9, LabRedesCefetRJ WeGIA)
- [CVE-2026-3950](https://cve.now/CVE-2026-3950.md): strukturag libheif stsz/stts track.cc load out-of-bounds (CVSS 4.8, strukturag libheif)
- [CVE-2026-24510](https://cve.now/CVE-2026-24510.md): Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerability. (CVSS 6.7, Dell Alienware Command Center)
- [CVE-2026-31889](https://cve.now/CVE-2026-31889.md): Shopware has a potential take over of app credentials (CVSS 8.9, shopware core · shopware platform +2)
- [CVE-2026-24508](https://cve.now/CVE-2026-24508.md): Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Certificate Validation vulnerability. (CVSS 2.5, Dell Alienware Command Center)
- [CVE-2026-31888](https://cve.now/CVE-2026-31888.md): Shopware has user enumeration via distinct error codes on Store API login endpoint (CVSS 5.3, shopware core · shopware platform +2)
- [CVE-2026-24509](https://cve.now/CVE-2026-24509.md): Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. (CVSS 3.6, Dell Alienware Command Center)
- [CVE-2026-31887](https://cve.now/CVE-2026-31887.md): Shopware unauthenticated data extraction possible through store-api.order endpoint (CVSS 8.9, shopware core · shopware platform +2)
- [CVE-2026-31881](https://cve.now/CVE-2026-31881.md): Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window (CVSS 7.7, runtipi)
- [CVE-2026-31879](https://cve.now/CVE-2026-31879.md): Frappe Workspace modification and stored XSS due to improper resource ownership checks (CVSS 5.1, frappe)
- [CVE-2026-3949](https://cve.now/CVE-2026-3949.md): strukturag libheif HEIF File decoder\_vvdec.cc vvdec\_push\_data2 out-of-bounds (CVSS 4.8, strukturag libheif)
- [CVE-2026-31878](https://cve.now/CVE-2026-31878.md): Frappe: Possible SSRF by any authenticated user (CVSS 5.0, frappe)
- [CVE-2026-31877](https://cve.now/CVE-2026-31877.md): Frappe SQL Injection due to improper field sanitization (CVSS 9.3, frappe)
- [CVE-2019-25487](https://cve.now/CVE-2019-25487.md): SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd (CVSS 9.3, Sapido RB-1732)
- [CVE-2019-25486](https://cve.now/CVE-2019-25486.md): Varient 1.6.1 SQL Injection via user\_id Parameter (CVSS 8.8, Varient SQL Inj.)
- [CVE-2019-25485](https://cve.now/CVE-2019-25485.md): R 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR Bypass (CVSS 6.9, R-Project R)
- [CVE-2019-25484](https://cve.now/CVE-2019-25484.md): WinMPG iPod Convert 3.0 Register Field Buffer Overflow DoS (CVSS 6.9, WinMPG iPod Convert)
- [CVE-2019-25483](https://cve.now/CVE-2019-25483.md): Comtrend AR-5310 GE31-412SSG-C01\_R10.A2pG039u.d24k Restricted Shell Escape (CVSS 8.6, Comtrend AR-5310)
- [CVE-2019-25480](https://cve.now/CVE-2019-25480.md): ARMBot Unrestricted File Upload via upload.php (CVSS 8.7, ARMBot)
- [CVE-2019-25478](https://cve.now/CVE-2019-25478.md): GetGo Download Manager 6.2.2.3300 Buffer Overflow DoS (CVSS 8.7, Getgosoft GetGo Download Manager)
- [CVE-2019-25477](https://cve.now/CVE-2019-25477.md): RAR Password Recovery 1.80 Denial of Service Buffer Overflow (CVSS 6.9, Top-Password RAR Password Recovery)
- [CVE-2019-25476](https://cve.now/CVE-2019-25476.md): Outlook Password Recovery 2.10 Denial of Service Buffer Overflow (CVSS 6.9, Top-Password Outlook Password Recovery Denial of Service Ex…)
- [CVE-2019-25475](https://cve.now/CVE-2019-25475.md): SQL Server Password Changer 1.90 Denial of Service Buffer Overflow (CVSS 6.9, Top-Password SQL Server Password Changer Denial of Service…)
- [CVE-2019-25474](https://cve.now/CVE-2019-25474.md): Easy MP3 Downloader 4.7.8.8 Denial of Service Buffer Overflow (CVSS 6.9, Easy MP3 Downloader Denial of Service)
- [CVE-2019-25472](https://cve.now/CVE-2019-25472.md): IntelBras Telefone IP TIP200/200 LITE Arbitrary File Read via dumpConfigFile (CVSS 8.7, Intelbras Telefone IP TIP)
- [CVE-2019-25471](https://cve.now/CVE-2019-25471.md): FileThingie 2.5.7 Arbitrary File Upload via ft2.php (CVSS 9.3, FileThingie)
- [CVE-2019-25470](https://cve.now/CVE-2019-25470.md): eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm (CVSS 8.7, eWON)
- [CVE-2019-25469](https://cve.now/CVE-2019-25469.md): Folder Lock 7.7.9 Denial of Service via Serial Number Field (CVSS 6.9, Newsoftwares Folder Lock)
- [CVE-2019-25468](https://cve.now/CVE-2019-25468.md): NetGain EM Plus 10.1.68 Remote Code Execution via script\_test.jsp (CVSS 9.3, NetGain Systems NetGain EM Plus)
- [CVE-2019-25467](https://cve.now/CVE-2019-25467.md): Verypdf docPrint Pro 8.0 Local SEH Buffer Overflow (CVSS 8.6, Verypdf docPrint Pro)
- [CVE-2019-25466](https://cve.now/CVE-2019-25466.md): Easy File Sharing Web Server 7.2 Local SEH Overflow (CVSS 8.6, Sharing-File Easy File Sharing Web Server)
- [CVE-2019-25465](https://cve.now/CVE-2019-25465.md): Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal (CVSS 8.7, Hisilicon HiIpcam)
- [CVE-2019-25464](https://cve.now/CVE-2019-25464.md): InputMapper 1.6.10 Local Denial of Service via Username Field (CVSS 6.7, DSD Consulting Services LLC. InputMapper)
- [CVE-2019-25463](https://cve.now/CVE-2019-25463.md): SpotIE Internet Explorer Password Recovery 2.9.5 Key Field DoS (CVSS 6.9, Nsauditor SpotIE Internet Explorer Password Recovery)
- [CVE-2018-25159](https://cve.now/CVE-2018-25159.md): Epross AVCON6 OGNL Remote Code Execution via login.action (CVSS 9.3, Epross AVCON6 systems management platform)
- [CVE-2026-31876](https://cve.now/CVE-2026-31876.md): Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (\`tweetToEmbed\`) (CVSS 5.4, streetwriters notesnook)
- [CVE-2026-31874](https://cve.now/CVE-2026-31874.md): Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration (CVSS 9.8, Taskosaur)
- [CVE-2026-31875](https://cve.now/CVE-2026-31875.md): Parse Server MFA recovery codes not consumed after use (CVSS 8.2, parse-community parse-server · parse-server)
- [CVE-2026-0231](https://cve.now/CVE-2026-0231.md): Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability (CVSS 5.7, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2026-31872](https://cve.now/CVE-2026-31872.md): Parse Server has a protected fields bypass via dot-notation in query and sort (CVSS 8.7, parse-community parse-server · parse-server)
- [CVE-2026-0230](https://cve.now/CVE-2026-0230.md): Cortex XDR Agent: Local Administrator can disable the agent on macOS (CVSS 4.0, Palo Alto Networks Cortex XDR Agent)
- [CVE-2026-31871](https://cve.now/CVE-2026-31871.md): Parse Server has a SQL Injection via dot-notation sub-key name in \`Increment\` operation on PostgreSQL (CVSS 9.3, parse-community parse-server · parse-server)
- [CVE-2026-31870](https://cve.now/CVE-2026-31870.md): cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header (CVSS 7.5, yhirose cpp-httplib)
- [CVE-2026-31868](https://cve.now/CVE-2026-31868.md): Parse Server has Stored XSS via file upload of HTML-renderable file types (CVSS 6.3, parse-community parse-server · parse-server)
- [CVE-2026-31867](https://cve.now/CVE-2026-31867.md): Craft Commerce has a Potential IDOR in Commerce carts (CVSS 6.3, craftcms commerce · craftcms/commerce)
- [CVE-2026-31866](https://cve.now/CVE-2026-31866.md): Allocation of Resources Without Limits or Throttling in flagd (CVSS 7.5, open-feature flagd · github.com/open-feature/flagd/flagd)
- [CVE-2026-30226](https://cve.now/CVE-2026-30226.md): devalue has prototype pollution in devalue.parse and devalue.unflatten (CVSS 6.3, sveltejs devalue · devalue)
- [CVE-2026-31863](https://cve.now/CVE-2026-31863.md): Improper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heart (CVSS 3.6, anyproto anytype-heart · anyproto anytype-cli +3)
- [CVE-2026-31859](https://cve.now/CVE-2026-31859.md): Craft has Reflective XSS via incomplete return URL sanitization (CVSS 6.9, craftcms cms · craftcms/cms)
- [CVE-2026-31858](https://cve.now/CVE-2026-31858.md): CraftCMS's \`ElementSearchController\` Affected by Blind SQL Injection (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-31857](https://cve.now/CVE-2026-31857.md): CraftCMS has an RCE vulnerability via relational conditionals in the control panel (CVSS 8.1, craftcms cms · craftcms/cms)
- [CVE-2026-31975](https://cve.now/CVE-2026-31975.md): Cloud CLI WebSocket shell injection (CVSS 8.7, siteboon claudecodeui · @siteboon/claude-code-ui)
- [CVE-2026-31861](https://cve.now/CVE-2026-31861.md): Shell Command Injection in Git Routes \[CloudCLI UI\] (CVSS 8.7, siteboon claudecodeui · @siteboon/claude-code-ui)
- [CVE-2026-31862](https://cve.now/CVE-2026-31862.md): Cloud CLI has Command Injection via Multiple Parameters (CVSS 9.1, siteboon claudecodeui · @siteboon/claude-code-ui +1)
- [CVE-2026-31856](https://cve.now/CVE-2026-31856.md): Parse Server has a SQL injection via \`Increment\` operation on nested object field in PostgreSQL (CVSS 9.3, parse-community parse-server · parse-server)
- [CVE-2026-31854](https://cve.now/CVE-2026-31854.md): Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass (CVSS 8.7, cursor)
- [CVE-2026-31853](https://cve.now/CVE-2026-31853.md): ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder (CVSS 5.7, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-31852](https://cve.now/CVE-2026-31852.md): Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation (CVSS 10.0, jellyfin code-quality.yml)
- [CVE-2026-31840](https://cve.now/CVE-2026-31840.md): Parse Server has a SQL injection via dot-notation field name in PostgreSQL (CVSS 9.3, parse-community parse-server · parse-server)
- [CVE-2026-31839](https://cve.now/CVE-2026-31839.md): Striae has a hash validation utility vulnerability (CVSS 8.2, striae-org striae · @striae-org/striae)
- [CVE-2026-31813](https://cve.now/CVE-2026-31813.md): Supabase Auth has insecure Apple and Azure authentication with ID tokens (CVSS 4.8, supabase auth)
- [CVE-2026-30868](https://cve.now/CVE-2026-30868.md): Cross-Site Request Forgery (CSRF) in opnsense/core (CVSS 6.3, opnsense core)
- [CVE-2026-20118](https://cve.now/CVE-2026-20118.md): Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XR Software)
- [CVE-2026-20117](https://cve.now/CVE-2026-20117.md): Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Unified Contact Center Express)
- [CVE-2026-20116](https://cve.now/CVE-2026-20116.md): Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Unified Contact Center Express)
- [CVE-2026-20046](https://cve.now/CVE-2026-20046.md): Cisco IOS XR Software CLI Privilege Escalation Vulnerability (CVSS 8.8, Cisco IOS XR Software)
- [CVE-2026-20074](https://cve.now/CVE-2026-20074.md): Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2026-20040](https://cve.now/CVE-2026-20040.md): Cisco IOS XR Software CLI Privilege Escalation Vulnerability (CVSS 8.8, Cisco IOS XR Software)
- [CVE-2026-1471](https://cve.now/CVE-2026-1471.md): Caching of authentication context (CVSS 2.1, Neo4j Enterprise edition)
- [CVE-2026-30239](https://cve.now/CVE-2026-30239.md): OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets (CVSS 6.5, opf openproject)
- [CVE-2026-30236](https://cve.now/CVE-2026-30236.md): OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate (CVSS 4.3, opf openproject)
- [CVE-2026-20163](https://cve.now/CVE-2026-20163.md): Remote Command Execution (RCE) through the '/splunkd/\_\_upload/indexing/preview' REST endpoint in Splunk Enterprise (CVSS 8.0, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20162](https://cve.now/CVE-2026-20162.md): Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise (CVSS 6.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20166](https://cve.now/CVE-2026-20166.md): Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise (CVSS 5.4, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20164](https://cve.now/CVE-2026-20164.md): Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise (CVSS 6.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20165](https://cve.now/CVE-2026-20165.md): Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise (CVSS 6.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-3429](https://cve.now/CVE-2026-3429.md): Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api (CVSS 4.2, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-1524](https://cve.now/CVE-2026-1524.md): Auth misconfiguration when multiple providers enabled (CVSS 2.1, neo4j Enterprise Edition)
- [CVE-2025-12555](https://cve.now/CVE-2025-12555.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-30235](https://cve.now/CVE-2026-30235.md): Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering (CVSS 6.5, opf openproject)
- [CVE-2025-12576](https://cve.now/CVE-2025-12576.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-12697](https://cve.now/CVE-2025-12697.md): Improper Encoding or Escaping of Output in GitLab (CVSS 2.2, GitLab)
- [CVE-2025-12704](https://cve.now/CVE-2025-12704.md): Missing Authorization in GitLab (CVSS 3.5, GitLab)
- [CVE-2025-13690](https://cve.now/CVE-2025-13690.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-13929](https://cve.now/CVE-2025-13929.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-14513](https://cve.now/CVE-2025-14513.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-0602](https://cve.now/CVE-2026-0602.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-1069](https://cve.now/CVE-2026-1069.md): Uncontrolled Recursion in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-1090](https://cve.now/CVE-2026-1090.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-1230](https://cve.now/CVE-2026-1230.md): Use of Incorrectly-Resolved Name or Reference in GitLab (CVSS 4.1, GitLab)
- [CVE-2026-1663](https://cve.now/CVE-2026-1663.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-30234](https://cve.now/CVE-2026-30234.md): OpenProject BIM BCF XML Import: \<Snapshot\> Path Traversal Leads to Arbitrary Local File Read (AFR) (CVSS 6.5, opf openproject)
- [CVE-2026-29777](https://cve.now/CVE-2026-29777.md): Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values (CVSS 6.1, traefik · github.com/traefik/traefik +2)
- [CVE-2026-28803](https://cve.now/CVE-2026-28803.md): Open Forms possible to view submission details of other people than intended (CVSS 6.5, open-formulieren open-forms)
- [CVE-2026-1497](https://cve.now/CVE-2026-1497.md): Incorrect privilege assignment in composite databases (CVSS 2.0, neo4j Enterprise Edition)
- [CVE-2026-31892](https://cve.now/CVE-2026-31892.md): WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode (CVSS 8.9, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-28229](https://cve.now/CVE-2026-28229.md): Argo Workflows has unauthorized access to Argo Workflows Template (CVSS 9.8, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-1732](https://cve.now/CVE-2026-1732.md): Improper Removal of Sensitive Information Before Storage or Transfer in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-3848](https://cve.now/CVE-2026-3848.md): Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab (CVSS 5.0, GitLab)
- [CVE-2025-12690](https://cve.now/CVE-2025-12690.md): Local Privilege Escalation in NGFW Engine (CVSS 7.3, Forcepoint NGFW Engine)
- [CVE-2026-27897](https://cve.now/CVE-2026-27897.md): Vociferous Unauthenticated Remote Path Traversal (RCE via CSRF) (CVSS 10.0, WanderingAstronomer Vociferous)
- [CVE-2026-22248](https://cve.now/CVE-2026-22248.md): GLPI affected by Remote Code Execution via malicious upload (CVSS 8.1, glpi-project glpi)
- [CVE-2026-21888](https://cve.now/CVE-2026-21888.md): MQTT v5 Variable Byte Integer parsing out-of-bounds: get\_var\_integer() (CVSS 7.5, nanomq)
- [CVE-2026-32229](https://cve.now/CVE-2026-32229.md): In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled (CVSS 6.8, JetBrains Hub)
- [CVE-2026-3946](https://cve.now/CVE-2026-3946.md): PHPEMS index.php cross site scripting (CVSS 5.1, PHPEMS)
- [CVE-2026-3013](https://cve.now/CVE-2026-3013.md): Path Traversal in Coppermine Photo Gallery (CVSS 8.7, Coppermine Photo Gallery)
- [CVE-2026-30903](https://cve.now/CVE-2026-30903.md): External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to… (CVSS 9.6, Zoom Communications Zoom Workplace)
- [CVE-2026-30902](https://cve.now/CVE-2026-30902.md): Zoom Clients for Windows - Improper Privilege Management (CVSS 7.8, Zoom Communications Zoom Workplace)
- [CVE-2026-30901](https://cve.now/CVE-2026-30901.md): Zoom Rooms for Windows - Improper Input Validation (CVSS 7.0, Zoom Communications Zoom Rooms)
- [CVE-2026-30900](https://cve.now/CVE-2026-30900.md): Zoom Workplace Clients for Windows - Improper Check (CVSS 7.8, Zoom Communications Zoom Workplace)
- [CVE-2026-32063](https://cve.now/CVE-2026-32063.md): OpenClaw 2026.2.19-2 \< 2026.2.21 - Command Injection via Newline in systemd Unit Generation (CVSS 6.9, openclaw)
- [CVE-2026-32062](https://cve.now/CVE-2026-32062.md): OpenClaw 2026.2.21-2 \< 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream (CVSS 8.7, openclaw · @openclaw/voice-call)
- [CVE-2026-32061](https://cve.now/CVE-2026-32061.md): OpenClaw \< 2026.2.17 - Arbitrary File Read via $include Directive Path Traversal (CVSS 6.7, openclaw)
- [CVE-2026-32060](https://cve.now/CVE-2026-32060.md): OpenClaw \< 2026.2.14 - Path Traversal in apply\_patch via Crafted Paths (CVSS 8.7, openclaw)
- [CVE-2026-32059](https://cve.now/CVE-2026-32059.md): OpenClaw 2026.2.22-2 \< 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins (CVSS 8.7, openclaw)
- [CVE-2026-3496](https://cve.now/CVE-2026-3496.md): JetBooking \<= 4.0.3 - Unauthenticated SQL Injection via 'check\_in\_date' Parameter (CVSS 7.5, Crocoblock JetBooking)
- [CVE-2026-3904](https://cve.now/CVE-2026-3904.md): Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under h (CVSS 6.2, The GNU C Library glibc)
- [CVE-2026-3944](https://cve.now/CVE-2026-3944.md): itsourcecode University Management System att\_add.php sql injection (CVSS 6.9, itsourcecode University Management System)
- [CVE-2026-3943](https://cve.now/CVE-2026-3943.md): H3C ACG1000-AK230 aaa\_portal\_auth\_local\_submit command injection (CVSS 6.9, H3C ACG1000-AK230)
- [CVE-2026-3178](https://cve.now/CVE-2026-3178.md): Name Directory \<= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name\_directory\_name' (CVSS 7.2, jeroenpeters1986 Name Directory)
- [CVE-2026-3805](https://cve.now/CVE-2026-3805.md): use after free in SMB connection reuse (CVSS 7.5, curl)
- [CVE-2026-3784](https://cve.now/CVE-2026-3784.md): wrong proxy connection reuse with credentials (CVSS 6.5, curl)
- [CVE-2026-3783](https://cve.now/CVE-2026-3783.md): token leak with redirect and netrc (CVSS 5.3, curl)
- [CVE-2026-1965](https://cve.now/CVE-2026-1965.md): bad reuse of HTTP Negotiate connection (CVSS 6.5, curl)
- [CVE-2026-3231](https://cve.now/CVE-2026-3231.md): Checkout Field Editor (Checkout Manager) for WooCommerce \<= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom… (CVSS 7.2, themehigh Checkout Field Editor (Checkout Manager) for WooC…)
- [CVE-2026-3906](https://cve.now/CVE-2026-3906.md): WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API (CVSS 4.3, WordPress Foundation WordPress)
- [CVE-2026-3492](https://cve.now/CVE-2026-3492.md): Gravity Forms \<= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title (CVSS 6.4, Gravity Forms)
- [CVE-2026-1992](https://cve.now/CVE-2026-1992.md): ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation (CVSS 8.8, smub ExactMetrics – Google Analytics Dashboard for WordPress)
- [CVE-2026-1993](https://cve.now/CVE-2026-1993.md): ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update (CVSS 8.8, smub ExactMetrics – Google Analytics Dashboard for WordPress)
- [CVE-2026-1454](https://cve.now/CVE-2026-1454.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 2.0.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, themehunk Lead Form Builder & Contact Form)
- [CVE-2024-14026](https://cve.now/CVE-2024-14026.md): QTS, QuTS hero (CVSS 2.0, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-14025](https://cve.now/CVE-2024-14025.md): Video Station (CVSS 0.1, QNAP Systems Video Station)
- [CVE-2024-14024](https://cve.now/CVE-2024-14024.md): Video Station (CVSS 0.1, QNAP Systems Video Station)
- [CVE-2026-2917](https://cve.now/CVE-2026-2917.md): Happy Addons for Elementor \<= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post\_id'… (CVSS 5.4, thehappymonster Happy Addons for Elementor)
- [CVE-2026-3903](https://cve.now/CVE-2026-3903.md): Modular Connector \<= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth (CVSS 4.3, modulards Modular DS: Monitor, update, and backup multiple…)
- [CVE-2026-1708](https://cve.now/CVE-2026-1708.md): Appointment Booking Calendar \<= 1.6.9.27 - Unauthenticated SQL Injection via 'append\_where\_sql' Parameter (CVSS 7.5, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2026-2918](https://cve.now/CVE-2026-2918.md): Happy Addons for Elementor \<= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via… (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2026-3534](https://cve.now/CVE-2026-3534.md): Astra \<= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (CVSS 6.4, brainstormforce Astra)
- [CVE-2026-3826](https://cve.now/CVE-2026-3826.md): WellChoose｜IFTOP - Local File Inclusion (CVSS 9.3, WellChoose IFTOP)
- [CVE-2026-3825](https://cve.now/CVE-2026-3825.md): WellChoose｜IFTOP - Reflected Cross-site Scripting (CVSS 5.1, WellChoose IFTOP)
- [CVE-2026-31844](https://cve.now/CVE-2026-31844.md): Authenticated SQL Injection in Koha displayby parameter of suggestion.pl (CVSS 8.7, Koha Community Koha)
- [CVE-2026-3824](https://cve.now/CVE-2026-3824.md): WellChoose｜IFTOP - Open redirect (CVSS 5.1, WellChoose IFTOP)
- [CVE-2026-2631](https://cve.now/CVE-2026-2631.md): Datalogics Ecommerce Delivery \< 2.6.60 - Unauthenticated Privilege Escalation (CVSS 9.8, Datalogics Ecommerce Delivery)
- [CVE-2026-2626](https://cve.now/CVE-2026-2626.md): Divi Booster \< 5.0.2 - Unauthenticated PHP Object Injection (CVSS 8.1, divi-booster)
- [CVE-2026-2466](https://cve.now/CVE-2026-2466.md): DukaPress \<= 3.2.4 - Reflected XSS (CVSS 7.1, DukaPress)
- [CVE-2026-1867](https://cve.now/CVE-2026-1867.md): WP Front User Submit \< 5.0.6 - Unauthenticated Sensitive Information Exposure (CVSS 5.9, Guest posting / Frontend Posting / Front Editor)
- [CVE-2026-1753](https://cve.now/CVE-2026-1753.md): Gutena Forms \< 1.6.1 - Contributor+ Arbitrary Limited Options Update (CVSS 6.8, Gutena Forms)
- [CVE-2026-3911](https://cve.now/CVE-2026-3911.md): Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint (CVSS 2.7, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-2707](https://cve.now/CVE-2026-2707.md): weForms \<= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API (CVSS 6.4, boldgrid weForms – Easy Drag & Drop Contact Form Builder Fo…)
- [CVE-2026-3222](https://cve.now/CVE-2026-3222.md): WP Maps \<= 4.9.1 - Unauthenticated SQL Injection via 'location\_id' Parameter (CVSS 7.5, flippercode WP Maps – Store Locator,Google Maps,OpenStreetM…)
- [CVE-2026-2358](https://cve.now/CVE-2026-2358.md): WP ULike \<= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute (CVSS 6.4, alimir WP ULike – Like & Dislike Buttons for Engagement and…)
- [CVE-2026-27842](https://cve.now/CVE-2026-27842.md): Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the… (CVSS 9.8, Micro Research MR-GM5L-S1 · Micro Research MR-GM5A-L1)
- [CVE-2026-24448](https://cve.now/CVE-2026-24448.md): Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access. (CVSS 9.8, Micro Research MR-GM5L-S1 · Micro Research MR-GM5A-L1)
- [CVE-2026-20892](https://cve.now/CVE-2026-20892.md): Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute… (CVSS 7.2, Micro Research MR-GM5L-S1 · Micro Research MR-GM5A-L1)
- [CVE-2026-3884](https://cve.now/CVE-2026-3884.md): Versions of the package spin.js before 3.0.0 are vulnerable to Cross-site Scripting (XSS) via the spin() function that allows a creation… (CVSS 5.1, spin.js)
- [CVE-2025-13067](https://cve.now/CVE-2025-13067.md): Royal Addons for Elementor \<= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass (CVSS 8.8, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-2413](https://cve.now/CVE-2026-2413.md): Ally – Web Accessibility & Usability \<= 4.0.3 - Unauthenticated SQL Injection via URL Path (CVSS 7.5, elemntor Ally – Web Accessibility & Usability)
- [CVE-2026-29515](https://cve.now/CVE-2026-29515.md): MiCode FileExplorer SwiFTP Server Authentication Bypass (CVSS 9.3, MiCode FileExplorer)
- [CVE-2026-23817](https://cve.now/CVE-2026-23817.md): Unauthenticated Open Redirect allows URL Manipulation in Web Interface (CVSS 6.5, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2026-23816](https://cve.now/CVE-2026-23816.md): Authenticated Command Injection found in admin AOS-CX CLI command (CVSS 7.2, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2026-23815](https://cve.now/CVE-2026-23815.md): Authenticated Command Injection found in AOS-CX Administrative CLI Command (CVSS 7.2, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2026-23814](https://cve.now/CVE-2026-23814.md): Authenticated Command Injection found in AOS-CX CLI Command (CVSS 8.8, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2026-23813](https://cve.now/CVE-2026-23813.md): Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2026-3453](https://cve.now/CVE-2026-3453.md): ProfilePress \<= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration (CVSS 8.1, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-21291](https://cve.now/CVE-2026-21291.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21293](https://cve.now/CVE-2026-21293.md): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 5.5, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21282](https://cve.now/CVE-2026-21282.md): Adobe Commerce | Improper Input Validation (CWE-20) (CVSS 5.3, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21286](https://cve.now/CVE-2026-21286.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.3, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21294](https://cve.now/CVE-2026-21294.md): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 5.5, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21284](https://cve.now/CVE-2026-21284.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21297](https://cve.now/CVE-2026-21297.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21359](https://cve.now/CVE-2026-21359.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.7, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21309](https://cve.now/CVE-2026-21309.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.5, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21292](https://cve.now/CVE-2026-21292.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21310](https://cve.now/CVE-2026-21310.md): Adobe Commerce | Improper Input Validation (CWE-20) (CVSS 5.3, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21285](https://cve.now/CVE-2026-21285.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21290](https://cve.now/CVE-2026-21290.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21289](https://cve.now/CVE-2026-21289.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.5, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21361](https://cve.now/CVE-2026-21361.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21360](https://cve.now/CVE-2026-21360.md): Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 6.8, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21296](https://cve.now/CVE-2026-21296.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21311](https://cve.now/CVE-2026-21311.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.0, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-21295](https://cve.now/CVE-2026-21295.md): Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (CVSS 3.1, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2025-12473](https://cve.now/CVE-2025-12473.md): RTMKit \<= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter (CVSS 6.1, rometheme RTMKit)
- [CVE-2026-2324](https://cve.now/CVE-2026-2324.md): LatePoint – Calendar Booking Plugin for Appointments and Events \<= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to… (CVSS 6.1, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-1781](https://cve.now/CVE-2026-1781.md): MC4WP: Mailchimp for WordPress \<= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion (CVSS 6.5, dvankooten MC4WP: Mailchimp for WordPress)
- [CVE-2026-27241](https://cve.now/CVE-2026-27241.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27255](https://cve.now/CVE-2026-27255.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27244](https://cve.now/CVE-2026-27244.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27251](https://cve.now/CVE-2026-27251.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27223](https://cve.now/CVE-2026-27223.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27262](https://cve.now/CVE-2026-27262.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27232](https://cve.now/CVE-2026-27232.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27249](https://cve.now/CVE-2026-27249.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27247](https://cve.now/CVE-2026-27247.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27242](https://cve.now/CVE-2026-27242.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27252](https://cve.now/CVE-2026-27252.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27235](https://cve.now/CVE-2026-27235.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27225](https://cve.now/CVE-2026-27225.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27256](https://cve.now/CVE-2026-27256.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27237](https://cve.now/CVE-2026-27237.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27265](https://cve.now/CVE-2026-27265.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27233](https://cve.now/CVE-2026-27233.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27236](https://cve.now/CVE-2026-27236.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27240](https://cve.now/CVE-2026-27240.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27239](https://cve.now/CVE-2026-27239.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27234](https://cve.now/CVE-2026-27234.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27231](https://cve.now/CVE-2026-27231.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27230](https://cve.now/CVE-2026-27230.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27229](https://cve.now/CVE-2026-27229.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27266](https://cve.now/CVE-2026-27266.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27254](https://cve.now/CVE-2026-27254.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27228](https://cve.now/CVE-2026-27228.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27248](https://cve.now/CVE-2026-27248.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27257](https://cve.now/CVE-2026-27257.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27226](https://cve.now/CVE-2026-27226.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27253](https://cve.now/CVE-2026-27253.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27224](https://cve.now/CVE-2026-27224.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-27250](https://cve.now/CVE-2026-27250.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2023-27573](https://cve.now/CVE-2023-27573.md): netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and… (CVSS 9.0, netbox-community netbox-docker)
- [CVE-2025-66956](https://cve.now/CVE-2025-66956.md): Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and… (CVSS 9.9)
- [CVE-2025-67034](https://cve.now/CVE-2025-67034.md): Lantronix EDS5000, G520, and X300 OS Command Injection (CVSS 7.2, Lantronix EDS5000 series · Lantronix G520 series +1)
- [CVE-2025-67035](https://cve.now/CVE-2025-67035.md): Lantronix EDS5000 OS Command Injection (CVSS 7.2, Lantronix EDS5000 series)
- [CVE-2025-67036](https://cve.now/CVE-2025-67036.md): Lantronix EDS5000, G520, and X300 OS Command Injection (CVSS 7.2, Lantronix EDS5000 series · Lantronix G520 series +1)
- [CVE-2025-67037](https://cve.now/CVE-2025-67037.md): Lantronix EDS5000, G520, and X300 OS Command Injection (CVSS 7.2, Lantronix EDS5000 series · Lantronix G520 series +1)
- [CVE-2025-67038](https://cve.now/CVE-2025-67038.md): Lantronix EDS5000, G520, and X300 OS Command Injection (CVSS 9.8, KEV, Lantronix EDS5000 series · Lantronix G520 series +3)
- [CVE-2025-67039](https://cve.now/CVE-2025-67039.md): Lantronix EDS3000PS Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Lantronix EDS3000PS series)
- [CVE-2025-67041](https://cve.now/CVE-2025-67041.md): Lantronix EDS3000PS OS Command Injection (CVSS 7.2, Lantronix EDS3000PS series)
- [CVE-2025-67298](https://cve.now/CVE-2025-67298.md): An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile (CVSS 8.1)
- [CVE-2025-68623](https://cve.now/CVE-2025-68623.md): In Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace an executable file during the… (CVSS 8.8)
- [CVE-2025-70024](https://cve.now/CVE-2025-70024.md): An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata… (CVSS 9.8)
- [CVE-2025-70027](https://cve.now/CVE-2025-70027.md): An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. (CVSS 7.5)
- [CVE-2025-70041](https://cve.now/CVE-2025-70041.md): An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master. (CVSS 9.8)
- [CVE-2025-70082](https://cve.now/CVE-2025-70082.md): Lantronix EDS3000PS Unverified Password Change (CVSS 2.7, Lantronix EDS3000PS series)
- [CVE-2025-70330](https://cve.now/CVE-2025-70330.md): Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files. (CVSS 3.3)
- [CVE-2026-30741](https://cve.now/CVE-2026-30741.md): A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a… (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-03-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.