# CVEs published 2026-03-23

201 CVEs were published on March 23, 2026: 26 critical, 69 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-33290](https://cve.now/CVE-2026-33290.md): WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment\_approved) without… (CVSS 4.3, wp-graphql)
- [CVE-2026-33211](https://cve.now/CVE-2026-33211.md): Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod (CVSS 9.6, tektoncd pipeline · github.com/tektoncd/pipeline)
- [CVE-2026-33286](https://cve.now/CVE-2026-33286.md): Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names (CVSS 9.1, graphiti-api graphiti · graphiti)
- [CVE-2026-33283](https://cve.now/CVE-2026-33283.md): Ella Core panics on malformed ULNASTransport Message without a Request Type (CVSS 6.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33282](https://cve.now/CVE-2026-33282.md): Ella Core panics on malformed NGAP Location Report (CVSS 7.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33281](https://cve.now/CVE-2026-33281.md): Ella Core panics on invalid PDU Session IDs in NGAP messages (CVSS 6.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33252](https://cve.now/CVE-2026-33252.md): MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion (CVSS 7.1, modelcontextprotocol go-sdk · github.com/modelcontextprotoc…)
- [CVE-2026-33241](https://cve.now/CVE-2026-33241.md): Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing (CVSS 8.7, salvo-rs salvo · salvo)
- [CVE-2026-33242](https://cve.now/CVE-2026-33242.md): Salvo has a Path Traversal in salvo-proxy::encode\_url\_path allows API Gateway Bypass (CVSS 7.5, salvo-rs salvo · salvo)
- [CVE-2026-4615](https://cve.now/CVE-2026-4615.md): SourceCodester Online Catering Reservation search.php sql injection (CVSS 6.9, SourceCodester Online Catering Reservation)
- [CVE-2026-4614](https://cve.now/CVE-2026-4614.md): itsourcecode sanitize or validate this input Parameter subjects.php sql injection (CVSS 5.3, itsourcecode sanitize or validate this input)
- [CVE-2026-33250](https://cve.now/CVE-2026-33250.md): Crash when receiving specially-crafted packets (CVSS 7.5, longturn freeciv21)
- [CVE-2026-33202](https://cve.now/CVE-2026-33202.md): Rails Active Storage has possible glob injection in its DiskService (CVSS 6.6, rails activestorage · activestorage)
- [CVE-2026-33195](https://cve.now/CVE-2026-33195.md): Rails Active Storage has possible Path Traversal in DiskService (CVSS 8.0, rails activestorage · activestorage)
- [CVE-2026-33176](https://cve.now/CVE-2026-33176.md): Rails Active Support has a possible DoS vulnerability in its number helpers (CVSS 6.6, rails activesupport · activesupport)
- [CVE-2026-4021](https://cve.now/CVE-2026-4021.md): Contest Gallery \<= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type… (CVSS 8.1, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2026-4056](https://cve.now/CVE-2026-4056.md): User Registration & Membership \<= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation (CVSS 5.4, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-3533](https://cve.now/CVE-2026-3533.md): JupiterX Core \<= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import (CVSS 8.8, artbees Jupiter X Core)
- [CVE-2026-4001](https://cve.now/CVE-2026-4001.md): Woocommerce Custom Product Addons Pro \<= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula (CVSS 9.8, acowebs Woocommerce Custom Product Addons Pro)
- [CVE-2026-33174](https://cve.now/CVE-2026-33174.md): Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests (CVSS 6.6, rails activestorage · activestorage)
- [CVE-2026-33173](https://cve.now/CVE-2026-33173.md): Rails Active Storage has possible content type bypass via metadata in direct uploads (CVSS 5.3, rails activestorage · activestorage)
- [CVE-2026-33170](https://cve.now/CVE-2026-33170.md): Rails Active Support has a possible XSS vulnerability in SafeBuffer#% (CVSS 5.3, rails activesupport · activesupport)
- [CVE-2026-33169](https://cve.now/CVE-2026-33169.md): Rails Active Support has a possible ReDoS vulnerability in number\_to\_delimited (CVSS 6.9, rails activesupport · activesupport)
- [CVE-2026-4613](https://cve.now/CVE-2026-4613.md): SourceCodester E-Commerce Site products.php sql injection (CVSS 6.9, SourceCodester E-Commerce Site)
- [CVE-2026-33168](https://cve.now/CVE-2026-33168.md): Rails has a possible XSS vulnerability in its Action View tag helpers (CVSS 2.3, rails actionview · actionview)
- [CVE-2026-33167](https://cve.now/CVE-2026-33167.md): Rails has a possible XSS vulnerability in its Action Pack debug exceptions (CVSS 1.3, rails actionpack · actionpack)
- [CVE-2026-33046](https://cve.now/CVE-2026-33046.md): Indico discloses local files resulting in Remote Code Execution through LaTeX injection (CVSS 7.7, indico)
- [CVE-2026-3225](https://cve.now/CVE-2026-3225.md): LearnPress \<= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion (CVSS 4.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-4306](https://cve.now/CVE-2026-4306.md): WP Job Portal \<= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter (CVSS 7.5, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2026-2412](https://cve.now/CVE-2026-2412.md): Quiz and Survey Master (QSM) \<= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged\_question' Parameter (CVSS 6.5, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2026-4066](https://cve.now/CVE-2026-4066.md): Smart Custom Fields \<= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post… (CVSS 4.3, inc2734 Smart Custom Fields)
- [CVE-2026-4612](https://cve.now/CVE-2026-4612.md): itsourcecode Free Hotel Reservation System Parameter index.php sql injection (CVSS 6.9, itsourcecode Free Hotel Reservation System)
- [CVE-2026-4681](https://cve.now/CVE-2026-4681.md): Critical Remote Code Execution vulnerability reported in Windchill (CVSS 9.3, PTC Windchill PDMLink · PTC FlexPLM)
- [CVE-2026-33634](https://cve.now/CVE-2026-33634.md): Trivy ecosystem supply chain briefly compromised (CVSS 9.4, KEV, aquasecurity setup-trivy · aquasecurity trivy-action +6)
- [CVE-2026-32300](https://cve.now/CVE-2026-32300.md): Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information (CVSS 8.1, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-32299](https://cve.now/CVE-2026-32299.md): Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature (CVSS 7.5, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-32279](https://cve.now/CVE-2026-32279.md): Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin (CVSS 6.8, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-32913](https://cve.now/CVE-2026-32913.md): OpenClaw \< 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects (CVSS 8.8, OpenClaw)
- [CVE-2026-27646](https://cve.now/CVE-2026-27646.md): OpenClaw \< 2026.3.7 - Sandbox Escape via /acp spawn Command (CVSS 5.8, OpenClaw)
- [CVE-2026-27183](https://cve.now/CVE-2026-27183.md): OpenClaw \< 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch (CVSS 2.1, OpenClaw)
- [CVE-2026-32278](https://cve.now/CVE-2026-32278.md): Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin (CVSS 8.2, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-1940](https://cve.now/CVE-2026-1940.md): Gstreamer: incomplete fix of cve-2026-1940 (CVSS 5.1, Red Hat Enterprise Linux)
- [CVE-2026-32277](https://cve.now/CVE-2026-32277.md): Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View (CVSS 8.7, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-4611](https://cve.now/CVE-2026-4611.md): TOTOLINK X6000R shttpd setLanCfg privilege escalation (CVSS 8.6, TOTOLINK X6000R)
- [CVE-2026-32276](https://cve.now/CVE-2026-32276.md): Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin (CVSS 8.8, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-29111](https://cve.now/CVE-2026-29111.md): systemd: Local unprivileged user can trigger an assert (CVSS 5.5, systemd)
- [CVE-2025-60949](https://cve.now/CVE-2025-60949.md): Census CSWeb leaked configuration files (CVSS 9.3, Census CSWeb)
- [CVE-2025-60948](https://cve.now/CVE-2025-60948.md): Census CSWeb stored XSS (CVSS 4.6, Census CSWeb)
- [CVE-2025-60947](https://cve.now/CVE-2025-60947.md): Census CSWeb arbitrary file upload (CVSS 8.8, Census CSWeb)
- [CVE-2025-60946](https://cve.now/CVE-2025-60946.md): Census CSWeb path traversal (CVSS 8.8, Census CSWeb)
- [CVE-2026-23882](https://cve.now/CVE-2026-23882.md): Blinko: Admin RCE - MCP Server Command Injection (CVSS 8.6, blinkospace blinko)
- [CVE-2026-23485](https://cve.now/CVE-2026-23485.md): Blinko: Unauthorized Path Traversal File Enumeration - music-metadata (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23488](https://cve.now/CVE-2026-23488.md): Blinko: multiple interfaces in the comment feature allow unauthorized access (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23487](https://cve.now/CVE-2026-23487.md): Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token (CVSS 6.0, blinkospace blinko)
- [CVE-2026-23486](https://cve.now/CVE-2026-23486.md): Blinko: Unauthorized User Information Leak (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23480](https://cve.now/CVE-2026-23480.md): Blinko: Low Privilege User Privilege Escalation - upsertUser Endpoint (CVSS 5.3, blinkospace blinko)
- [CVE-2026-23481](https://cve.now/CVE-2026-23481.md): Blinko: Authenticated Arbitrary File Write - saveAdditionalDevFile (CVSS 5.3, blinkospace blinko)
- [CVE-2026-23484](https://cve.now/CVE-2026-23484.md): Blinko: Authenticated Arbitrary File Write - saveDevPlugin (CVSS 5.3, blinkospace blinko)
- [CVE-2026-23483](https://cve.now/CVE-2026-23483.md): Blinko: Unauthorized Arbitrary File Read - /plugins (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23482](https://cve.now/CVE-2026-23482.md): Blinko: Unauthorized Arbitrary File Read - /api/file/temp (CVSS 8.2, blinkospace blinko)
- [CVE-2026-3055](https://cve.now/CVE-2026-3055.md): Insufficient input validation leading to memory overread (CVSS 9.3, KEV, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-4597](https://cve.now/CVE-2026-4597.md): 648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection (CVSS 5.3, 648540858 wvp-GB28181-pro)
- [CVE-2026-4368](https://cve.now/CVE-2026-4368.md): Race Condition leading to User Session Mixup (CVSS 7.7, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-2298](https://cve.now/CVE-2026-2298.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement… (CVSS 9.4, Salesforce Marketing Cloud Engagement)
- [CVE-2026-32879](https://cve.now/CVE-2026-32879.md): New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure (CVSS 4.9, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-4596](https://cve.now/CVE-2026-4596.md): projectworlds Lawyer Management System lawyers.php cross site scripting (CVSS 5.1, projectworlds Lawyer Management System)
- [CVE-2026-30886](https://cve.now/CVE-2026-30886.md): New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check (CVSS 6.5, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-33548](https://cve.now/CVE-2026-33548.md): MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline (CVSS 8.6, mantisbt · mantisbt/mantisbt)
- [CVE-2026-33517](https://cve.now/CVE-2026-33517.md): MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation (CVSS 8.6, mantisbt · mantisbt/mantisbt)
- [CVE-2026-30849](https://cve.now/CVE-2026-30849.md): MantisBT SOAP API has an authentication bypass vulnerability on MySQL (CVSS 9.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-32852](https://cve.now/CVE-2026-32852.md): MailEnable \< 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter (CVSS 5.1, MailEnable)
- [CVE-2026-32851](https://cve.now/CVE-2026-32851.md): MailEnable \< 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter (CVSS 5.1, MailEnable)
- [CVE-2026-32850](https://cve.now/CVE-2026-32850.md): MailEnable \< 10.55 Reflected XSS via ManageShares.aspx SelectedIndex Parameter (CVSS 5.1, MailEnable)
- [CVE-2026-27131](https://cve.now/CVE-2026-27131.md): Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground (CVSS 5.5, putyourlightson craft-sprig · putyourlightson/craft-sprig)
- [CVE-2026-26209](https://cve.now/CVE-2026-26209.md): cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads (CVSS 7.5, agronholm cbor2 · cbor2)
- [CVE-2026-33723](https://cve.now/CVE-2026-33723.md): AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user\_id Parameter in subscribe.php (CVSS 7.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33719](https://cve.now/CVE-2026-33719.md): AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php (CVSS 8.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33717](https://cve.now/CVE-2026-33717.md): AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33716](https://cve.now/CVE-2026-33716.md): AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php (CVSS 9.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33690](https://cve.now/CVE-2026-33690.md): AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33688](https://cve.now/CVE-2026-33688.md): AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33685](https://cve.now/CVE-2026-33685.md): AVideo Allows Unauthenticated Access to AD\_Server reports.json.php that Exposes Ad Campaign Analytics and User Data (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-0898](https://cve.now/CVE-2026-0898.md): An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google… (CVSS 9.0, Pegasystems Pega Robot Studio)
- [CVE-2026-33683](https://cve.now/CVE-2026-33683.md): AVideo vulnerable to Stored XSS via html\_entity\_decode() Reversing xss\_esc() Sanitization in Channel About Field (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33681](https://cve.now/CVE-2026-33681.md): AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name (CVSS 7.2, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33651](https://cve.now/CVE-2026-33651.md): AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live\_schedule\_id in Scheduler\_commands::getAllActiveOrToRepeat() (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4595](https://cve.now/CVE-2026-4595.md): code-projects Exam Form Submission update\_s6.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2025-15606](https://cve.now/CVE-2025-15606.md): Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N (CVSS 7.1, TP-Link Systems TD-W8961N)
- [CVE-2026-25075](https://cve.now/CVE-2026-25075.md): strongSwan 4.5.0 \< 6.0.5 EAP-TTLS AVP Parsing Integer Underflow (CVSS 8.7, strongSwan)
- [CVE-2026-33650](https://cve.now/CVE-2026-33650.md): AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion (CVSS 7.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33649](https://cve.now/CVE-2026-33649.md): AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33648](https://cve.now/CVE-2026-33648.md): AVideo Vulnerable to OS Command Injection via Unsanitized \`users\_id\` and \`liveTransmitionHistory\_id\` in Restreamer Log File Path (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33647](https://cve.now/CVE-2026-33647.md): AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33513](https://cve.now/CVE-2026-33513.md): AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) (CVSS 8.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33512](https://cve.now/CVE-2026-33512.md): AVideo has an unauthenticated decrypt oracle leaking any ciphertext (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2025-15605](https://cve.now/CVE-2025-15605.md): Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.5, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2025-15519](https://cve.now/CVE-2025-15519.md): Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.5, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2025-15518](https://cve.now/CVE-2025-15518.md): Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.5, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2025-15517](https://cve.now/CVE-2025-15517.md): Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.6, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2026-4594](https://cve.now/CVE-2026-4594.md): erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injection (CVSS 6.9, erupts erupt)
- [CVE-2026-4593](https://cve.now/CVE-2026-4593.md): erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injection (CVSS 5.3, erupts erupt)
- [CVE-2026-33507](https://cve.now/CVE-2026-33507.md): AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33502](https://cve.now/CVE-2026-33502.md): AVideo has Unauthenticated SSRF via plugin/Live/test.php (CVSS 9.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33501](https://cve.now/CVE-2026-33501.md): AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33500](https://cve.now/CVE-2026-33500.md): AVideo Vulnerable to Stored XSS via Markdown \`javascript:\` URI Bypasses ParsedownSafeWithLinks Sanitization (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33499](https://cve.now/CVE-2026-33499.md): AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php (CVSS 6.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4592](https://cve.now/CVE-2026-4592.md): kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication (CVSS 6.3, kalcaddle kodbox)
- [CVE-2026-33493](https://cve.now/CVE-2026-33493.md): AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter (CVSS 7.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-32845](https://cve.now/CVE-2026-32845.md): jkuhlmann / cgltf \<= 1.15 Sparse Accessor Validation Integer Overflow (CVSS 6.9, jkuhlmann cgltf)
- [CVE-2026-33492](https://cve.now/CVE-2026-33492.md): AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration (CVSS 7.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33488](https://cve.now/CVE-2026-33488.md): AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin (CVSS 7.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4591](https://cve.now/CVE-2026-4591.md): kalcaddle kodbox fileThumb Endpoint app.php checkBin os command injection (CVSS 5.1, kalcaddle kodbox)
- [CVE-2026-4404](https://cve.now/CVE-2026-4404.md): Use of hard coded credentials in GoHarbor Harbor (CVSS 9.4, Harbor · github.com/goharbor/harbor)
- [CVE-2026-4590](https://cve.now/CVE-2026-4590.md): kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery (CVSS 2.3, kalcaddle kodbox)
- [CVE-2026-33485](https://cve.now/CVE-2026-33485.md): AVideo has an Unauthenticated Blind SQL Injection in RTMP on\_publish Callback via Stream Name Parameter (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33483](https://cve.now/CVE-2026-33483.md): AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33482](https://cve.now/CVE-2026-33482.md): AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33480](https://cve.now/CVE-2026-33480.md): AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy (CVSS 8.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33479](https://cve.now/CVE-2026-33479.md): AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33478](https://cve.now/CVE-2026-33478.md): AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection (CVSS 10.0, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33354](https://cve.now/CVE-2026-33354.md): AVideo has an authenticated arbitrary local file read via \`chunkFile\` path injection in \`aVideoEncoder.json.php\` (CVSS 7.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33352](https://cve.now/CVE-2026-33352.md): AVideo has an Unauthenticated SQL Injection via \`doNotShowCats\` Parameter (Backslash Escape Bypass) (CVSS 9.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-3635](https://cve.now/CVE-2026-3635.md): Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive… (CVSS 6.1, fastify)
- [CVE-2026-33351](https://cve.now/CVE-2026-33351.md): AVideo has Unauthenticated SSRF via \`webSiteRootURL\` Parameter in saveDVR.json.php, Chaining to Verification Bypass (CVSS 9.1, WWBN AVideo · wwbn/avideo)
- [CVE-2019-25625](https://cve.now/CVE-2019-25625.md): Blob Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Blob Studio)
- [CVE-2019-25624](https://cve.now/CVE-2019-25624.md): Liquid Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Liquid Studio)
- [CVE-2019-25623](https://cve.now/CVE-2019-25623.md): Luminance Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Luminance Studio)
- [CVE-2019-25622](https://cve.now/CVE-2019-25622.md): Paint Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Paint Studio)
- [CVE-2019-25621](https://cve.now/CVE-2019-25621.md): Pixel Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Pixel Studio)
- [CVE-2019-25620](https://cve.now/CVE-2019-25620.md): Tree Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Tree Studio)
- [CVE-2026-33297](https://cve.now/CVE-2026-33297.md): AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php (CVSS 5.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4647](https://cve.now/CVE-2026-4647.md): Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library (CVSS 6.1, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-4589](https://cve.now/CVE-2026-4589.md): kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery (CVSS 5.3, kalcaddle kodbox)
- [CVE-2025-41008](https://cve.now/CVE-2025-41008.md): SQL Injection in Sinturno (CVSS 9.3, Sinturno)
- [CVE-2026-4588](https://cve.now/CVE-2026-4588.md): kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key (CVSS 6.3, kalcaddle kodbox)
- [CVE-2026-4587](https://cve.now/CVE-2026-4587.md): HybridAuth SSL Curl.php certificate validation (CVSS 6.3, HybridAuth · hybridauth/hybridauth)
- [CVE-2026-1958](https://cve.now/CVE-2026-1958.md): Hard-coded passwords in KlinikaXP (CVSS 8.7, BRI KlinikaXP Insertino · BRI KlinikaXP)
- [CVE-2026-31851](https://cve.now/CVE-2026-31851.md): Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks (CVSS 7.7, Nexxt Solutions Nebula 300+)
- [CVE-2026-31850](https://cve.now/CVE-2026-31850.md): Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+ (CVSS 6.8, Nexxt Solutions Nebula 300+)
- [CVE-2026-31849](https://cve.now/CVE-2026-31849.md): Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+ (CVSS 7.2, Nexxt Solutions Nebula 300+)
- [CVE-2026-31848](https://cve.now/CVE-2026-31848.md): Reversible ecos\_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+ (CVSS 8.7, Nexxt Solutions Nebula 300+)
- [CVE-2026-4586](https://cve.now/CVE-2026-4586.md): CodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload (CVSS 5.3, CodePhiliaX Chat2DB)
- [CVE-2025-41007](https://cve.now/CVE-2025-41007.md): SQL Injection in Cuantis (CVSS 9.3, Cuantis)
- [CVE-2026-31847](https://cve.now/CVE-2026-31847.md): Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+ (CVSS 8.5, Nexxt Solutions Nebula 300+)
- [CVE-2026-31846](https://cve.now/CVE-2026-31846.md): Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+ (CVSS 7.1, Nexxt Solutions Nebula 300+ / Tenda F3 V2.0 Firmware)
- [CVE-2026-32969](https://cve.now/CVE-2026-32969.md): Pre-Auth Blind SQLi in userinfo Endpoint (CVSS 7.5, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-32968](https://cve.now/CVE-2026-32968.md): Unauthenticated RCE in com\_mb24sysapi (CVSS 9.8, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-4585](https://cve.now/CVE-2026-4585.md): Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection (CVSS 9.3, Tiandy Easy7 Integrated Management Platform)
- [CVE-2026-4584](https://cve.now/CVE-2026-4584.md): Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission (CVSS 2.3, Shenzhen HCC Technology MPOS M6 PLUS)
- [CVE-2026-4633](https://cve.now/CVE-2026-4633.md): Keycloak: keycloak: user enumeration via differential error messages (CVSS 3.7, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-4583](https://cve.now/CVE-2026-4583.md): Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay (CVSS 2.3, Shenzhen HCC Technology MPOS M6 PLUS)
- [CVE-2026-28809](https://cve.now/CVE-2026-28809.md): XXE in esaml SAML library allows local file read and potential SSRF (CVSS 6.3, dropbox esaml · arekinath esaml +3)
- [CVE-2026-4582](https://cve.now/CVE-2026-4582.md): Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication (CVSS 2.3, Shenzhen HCC Technology MPOS M6 PLUS)
- [CVE-2026-4581](https://cve.now/CVE-2026-4581.md): code-projects Simple Laundry System Parameters checklogin.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4580](https://cve.now/CVE-2026-4580.md): code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4628](https://cve.now/CVE-2026-4628.md): Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control (CVSS 4.3, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-3587](https://cve.now/CVE-2026-3587.md): Hidden CLI Function Allows Root Access (CVSS 10.0, WAGO Lean Managed Switch 852-1812 · WAGO Lean Managed S… +14)
- [CVE-2026-4579](https://cve.now/CVE-2026-4579.md): code-projects Simple Laundry System Parameters viewdetail.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4578](https://cve.now/CVE-2026-4578.md): code-projects Exam Form Submission update\_s3.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2026-23555](https://cve.now/CVE-2026-23555.md): Xenstored DoS by unprivileged domain (CVSS 7.1, Xen)
- [CVE-2026-23554](https://cve.now/CVE-2026-23554.md): Use after free of paging structures in EPT (CVSS 7.8, Xen)
- [CVE-2025-13997](https://cve.now/CVE-2025-13997.md): King Addons for Elementor \<= 51.1.49 - Unauthenticated API Keys Disclosure (CVSS 5.3, kingaddons King Addons for Elementor – 80+ Elementor Widget…)
- [CVE-2025-6229](https://cve.now/CVE-2025-6229.md): Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) \<=… (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2026-4577](https://cve.now/CVE-2026-4577.md): code-projects Exam Form Submission update\_s4.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2026-1969](https://cve.now/CVE-2026-1969.md): ThemeREX Addons \< 2.38.5 - Unauthenticated Arbitrary File Upload (CVSS 5.3, trx\_addons)
- [CVE-2026-4576](https://cve.now/CVE-2026-4576.md): code-projects Exam Form Submission update\_s5.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2026-4575](https://cve.now/CVE-2026-4575.md): code-projects Exam Form Submission update\_s2.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2025-10734](https://cve.now/CVE-2025-10734.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.12 - Unauthenticated… (CVSS 5.3, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2025-10679](https://cve.now/CVE-2025-10679.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.12 - Unauthenticated… (CVSS 7.3, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2025-10731](https://cve.now/CVE-2025-10731.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.12 - Unauthenticated… (CVSS 5.3, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2026-4574](https://cve.now/CVE-2026-4574.md): SourceCodester Simple E-learning System User Profile Update sql injection (CVSS 5.3, SourceCodester Simple E-learning System)
- [CVE-2026-4573](https://cve.now/CVE-2026-4573.md): SourceCodester Simple E-learning System HTTP GET Parameter delete\_post.php sql injection (CVSS 5.3, SourceCodester Simple E-learning System)
- [CVE-2026-4603](https://cve.now/CVE-2026-4603.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in… (CVSS 5.1, jsrsasign)
- [CVE-2026-4601](https://cve.now/CVE-2026-4601.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash… (CVSS 9.4, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4599](https://cve.now/CVE-2026-4599.md): Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the… (CVSS 9.3, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4598](https://cve.now/CVE-2026-4598.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the… (CVSS 8.7, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4602](https://cve.now/CVE-2026-4602.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative… (CVSS 8.7, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4600](https://cve.now/CVE-2026-4600.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA… (CVSS 9.1, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2025-10736](https://cve.now/CVE-2025-10736.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.10 - Incorrect… (CVSS 6.5, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2026-4572](https://cve.now/CVE-2026-4572.md): SourceCodester Sales and Inventory System HTTP POST Request view\_product.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4571](https://cve.now/CVE-2026-4571.md): SourceCodester Sales and Inventory System HTTP POST Request view\_payments.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4570](https://cve.now/CVE-2026-4570.md): SourceCodester Sales and Inventory System HTTP POST Request view\_customers.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4569](https://cve.now/CVE-2026-4569.md): SourceCodester Sales and Inventory System HTTP POST Request view\_category.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4568](https://cve.now/CVE-2026-4568.md): SourceCodester Sales and Inventory System HTTP GET Request update\_supplier.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4567](https://cve.now/CVE-2026-4567.md): Tenda A15 UploadCfg stack-based overflow (CVSS 9.3, Tenda A15)
- [CVE-2026-4566](https://cve.now/CVE-2026-4566.md): Belkin F9K1122 formWISP5G stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2026-4606](https://cve.now/CVE-2026-4606.md): GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege (CVSS 10.0, GeoVision GV-Edge Recording Manager)
- [CVE-2026-4565](https://cve.now/CVE-2026-4565.md): Tenda AC21 SetNetControlList formSetQosBand buffer overflow (CVSS 8.7, Tenda AC21)
- [CVE-2024-46878](https://cve.now/CVE-2024-46878.md): A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. (CVSS 5.4)
- [CVE-2024-46879](https://cve.now/CVE-2024-46879.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin\_system.php in Tiki version 21.2. (CVSS 5.4)
- [CVE-2024-51222](https://cve.now/CVE-2024-51222.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0… (CVSS 4.8)
- [CVE-2024-51223](https://cve.now/CVE-2024-51223.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0… (CVSS 4.8)
- [CVE-2024-51224](https://cve.now/CVE-2024-51224.md): Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management… (CVSS 4.8)
- [CVE-2024-51225](https://cve.now/CVE-2024-51225.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System… (CVSS 4.8)
- [CVE-2024-51226](https://cve.now/CVE-2024-51226.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management… (CVSS 6.1)
- [CVE-2025-52204](https://cve.now/CVE-2025-52204.md): A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter (CVSS 6.1)
- [CVE-2026-24516](https://cve.now/CVE-2026-24516.md): A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. (CVSS 8.8, github.com/digitalocean/droplet-agent)
- [CVE-2026-26828](https://cve.now/CVE-2026-26828.md): A NULL pointer dereference in the daap\_reply\_playlists function (src/httpd\_daap.c) of owntone-server commit 3d1652d allows attackers to… (CVSS 7.5)
- [CVE-2026-26829](https://cve.now/CVE-2026-26829.md): A NULL pointer dereference in the safe\_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a… (CVSS 7.5)
- [CVE-2026-30006](https://cve.now/CVE-2026-30006.md): XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file. (CVSS 6.2)
- [CVE-2026-30007](https://cve.now/CVE-2026-30007.md): XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file (CVSS 6.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-03-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.