# CVEs published 2026-03-01

20 CVEs were published on March 1, 2026: 0 critical, 6 high. Days are UTC.

- [CVE-2026-3400](https://cve.now/CVE-2026-3400.md): Tenda AC15 TextEditingConversion stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2026-3399](https://cve.now/CVE-2026-3399.md): Tenda F453 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-3398](https://cve.now/CVE-2026-3398.md): Tenda F453 httpd AdvSetWan fromAdvSetWan buffer overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-3395](https://cve.now/CVE-2026-3395.md): MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection (CVSS 6.9, MaxSite CMS)
- [CVE-2026-3394](https://cve.now/CVE-2026-3394.md): jarikomppa soloud WAV File soloud\_wav.cpp loadwav memory corruption (CVSS 4.8, jarikomppa soloud)
- [CVE-2026-3393](https://cve.now/CVE-2026-3393.md): jarikomppa soloud Audio File soloud\_wav.cpp loadflac heap-based overflow (CVSS 4.8, jarikomppa soloud)
- [CVE-2026-3392](https://cve.now/CVE-2026-3392.md): FascinatedBox lily lily\_emitter.c eval\_tree null pointer dereference (CVSS 4.8, FascinatedBox lily)
- [CVE-2026-3391](https://cve.now/CVE-2026-3391.md): FascinatedBox lily lily\_emitter.c clear\_storages out-of-bounds (CVSS 4.8, FascinatedBox lily)
- [CVE-2026-3390](https://cve.now/CVE-2026-3390.md): FascinatedBox lily Error Reporting lily\_build\_error.c patch\_line\_end out-of-bounds (CVSS 4.8, FascinatedBox lily)
- [CVE-2026-3389](https://cve.now/CVE-2026-3389.md): Squirrel sqstdrex.cpp sqstd\_rex\_newnode null pointer dereference (CVSS 4.8, Squirrel)
- [CVE-2026-3388](https://cve.now/CVE-2026-3388.md): Squirrel sqcompiler.cpp UnaryOP recursion (CVSS 4.8, Squirrel)
- [CVE-2026-3387](https://cve.now/CVE-2026-3387.md): wren-lang wren wren\_compiler.c getByteCountForArguments null pointer dereference (CVSS 4.8, wren-lang wren)
- [CVE-2026-3386](https://cve.now/CVE-2026-3386.md): wren-lang wren wren\_compiler.c emitOp out-of-bounds (CVSS 4.8, wren-lang wren)
- [CVE-2026-3385](https://cve.now/CVE-2026-3385.md): wren-lang wren wren\_compiler.c resolveLocal recursion (CVSS 4.8, wren-lang wren)
- [CVE-2026-3384](https://cve.now/CVE-2026-3384.md): ChaiScript chaiscript\_eval.hpp Function\_Push\_Pop recursion (CVSS 4.8, ChaiScript)
- [CVE-2026-3383](https://cve.now/CVE-2026-3383.md): ChaiScript boxed\_number.hpp go divide by zero (CVSS 4.8, ChaiScript)
- [CVE-2026-3382](https://cve.now/CVE-2026-3382.md): ChaiScript boxed\_number.hpp get\_as memory corruption (CVSS 4.8, ChaiScript)
- [CVE-2026-3380](https://cve.now/CVE-2026-3380.md): Tenda F453 L7Im frmL7ImForm buffer overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-3379](https://cve.now/CVE-2026-3379.md): Tenda F453 SetIpBind fromSetIpBind buffer overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-3378](https://cve.now/CVE-2026-3378.md): Tenda F453 qossetting fromqossetting buffer overflow (CVSS 8.7, Tenda F453)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.