# CVEs published 2026-03-03

135 CVEs were published on March 3, 2026: 23 critical, 49 high. Days are UTC.

- [CVE-2026-28289](https://cve.now/CVE-2026-28289.md): FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution (CVSS 10.0, freescout-help-desk freescout)
- [CVE-2026-27971](https://cve.now/CVE-2026-27971.md): Qwik affected by unauthenticated RCE via server$ Deserialization (CVSS 9.2, QwikDev qwik · @builder.io/qwik)
- [CVE-2026-27932](https://cve.now/CVE-2026-27932.md): joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) (CVSS 7.5, authlib joserfc · joserfc)
- [CVE-2026-27905](https://cve.now/CVE-2026-27905.md): BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction (CVSS 8.6, BentoML)
- [CVE-2026-27622](https://cve.now/CVE-2026-27622.md): OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write (CVSS 8.4, AcademySoftwareFoundation openexr · openexr)
- [CVE-2026-27601](https://cve.now/CVE-2026-27601.md): Underscore.js has unlimited recursion in \_.flatten and \_.isEqual, potential for DoS attack (CVSS 8.2, jashkenas underscore · underscore)
- [CVE-2026-26279](https://cve.now/CVE-2026-26279.md): Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection (CVSS 9.1, Froxlor · froxlor/froxlor)
- [CVE-2026-3266](https://cve.now/CVE-2026-3266.md): Improper access control vulnerability has been discovered in OpenText™ Filr. (CVSS 8.3, OpenText™ Filr)
- [CVE-2026-27981](https://cve.now/CVE-2026-27981.md): HomeBox has an Auth Rate Limit Bypass via IP Spoofing (CVSS 7.4, sysadminsmedia homebox)
- [CVE-2026-27600](https://cve.now/CVE-2026-27600.md): HomeBox affected by Blind SSRF (CVSS 5.0, sysadminsmedia homebox)
- [CVE-2026-26272](https://cve.now/CVE-2026-26272.md): HomeBox affected by Stored XSS via HTML/SVG Attachment Upload (CVSS 4.6, sysadminsmedia homebox)
- [CVE-2026-26266](https://cve.now/CVE-2026-26266.md): AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering (CVSS 9.3, aliasvault)
- [CVE-2026-25590](https://cve.now/CVE-2026-25590.md): GLPI Inventory Plugin has Reflected XSS in task jobs (CVSS 4.5, glpi-project glpi-inventory-plugin)
- [CVE-2026-24898](https://cve.now/CVE-2026-24898.md): OpenEMR has an Unauthenticated MedEx Token Disclosure (CVSS 10.0, openemr)
- [CVE-2026-25146](https://cve.now/CVE-2026-25146.md): OpenEMR's payments gateway\_api\_key secret rendered into client JS code (CVSS 9.6, openemr)
- [CVE-2026-24848](https://cve.now/CVE-2026-24848.md): OpenEMR Arbitrary File Write leading to Remote Code Execution (CVSS 8.7, openemr)
- [CVE-2026-27012](https://cve.now/CVE-2026-27012.md): Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php (CVSS 9.8, devcode-it openstamanager · devcode-it/openstamanager)
- [CVE-2026-24415](https://cve.now/CVE-2026-24415.md): OpenSTAManager affected by reflected XSS in modifica\_iva.php via righe parameter (CVSS 5.1, devcode-it openstamanager · devcode-it/openstamanager)
- [CVE-2026-21866](https://cve.now/CVE-2026-21866.md): Dify - Stored XSS in chat (CVSS 5.1, langgenius dify)
- [CVE-2026-3487](https://cve.now/CVE-2026-3487.md): itsourcecode College Management System class-result.php sql injection (CVSS 5.1, itsourcecode College Management System)
- [CVE-2026-3130](https://cve.now/CVE-2026-3130.md): Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete per (CVSS 9.8, Devolutions Server)
- [CVE-2026-3204](https://cve.now/CVE-2026-3204.md): Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displa (CVSS 9.8, Devolutions Server)
- [CVE-2026-2590](https://cve.now/CVE-2026-2590.md): Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Mana (CVSS 9.8, Devolutions Remote Desktop Manager)
- [CVE-2026-3224](https://cve.now/CVE-2026-3224.md): Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unaut (CVSS 9.8, Devolutions Server)
- [CVE-2026-1775](https://cve.now/CVE-2026-1775.md): Missing Authentication for Critical Function in Labkotec LID-3300IP (CVSS 8.8, Labkotec LID-3300IP)
- [CVE-2026-3486](https://cve.now/CVE-2026-3486.md): itsourcecode College Management System student-fee.php sql injection (CVSS 5.1, itsourcecode College Management System)
- [CVE-2026-3485](https://cve.now/CVE-2026-3485.md): D-Link DIR-868L SSDP Service sub\_1BF84 os command injection (CVSS 9.3, D-Link DIR-868L)
- [CVE-2026-25906](https://cve.now/CVE-2026-25906.md): Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. (CVSS 7.3, Dell Optimizer)
- [CVE-2025-13686](https://cve.now/CVE-2025-13686.md): DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment (CVSS 6.3, IBM DataStage on Cloud Pak for Data)
- [CVE-2025-13687](https://cve.now/CVE-2025-13687.md): DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment (CVSS 6.3, IBM DataStage on Cloud Pak for Data)
- [CVE-2025-13688](https://cve.now/CVE-2025-13688.md): DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment (CVSS 6.3, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-24502](https://cve.now/CVE-2026-24502.md): Dell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search Path Element vulnerability. (CVSS 8.8, Dell Command | Intel vPro Out of Band)
- [CVE-2025-14456](https://cve.now/CVE-2025-14456.md): IBM MQ Appliance uses weaker than expected cryptographic algorithms (CVSS 5.9, IBM MQ Appliance)
- [CVE-2025-14480](https://cve.now/CVE-2025-14480.md): IBM Aspera faspio Gateway 1.3.7 has addressed a vulnerability affected by weak cryptographic algorithms (CVSS 5.1, IBM Aspera faspio Gateway)
- [CVE-2026-1567](https://cve.now/CVE-2026-1567.md): IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability (CVSS 7.1, IBM InfoSphere Information Server)
- [CVE-2026-1713](https://cve.now/CVE-2026-1713.md): IBM MQ is affected by an authority vulnerablility (CVSS 5.5, IBM MQ)
- [CVE-2026-0869](https://cve.now/CVE-2026-0869.md): Application User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0 (CVSS 8.3, Brocade ASCG)
- [CVE-2025-13490](https://cve.now/CVE-2025-13490.md): IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality (CVSS 5.9, IBM App Connect Operator · IBM App Connect EnterpriseCertif…)
- [CVE-2025-13616](https://cve.now/CVE-2025-13616.md): DataStage on Cloud Pak for Data is vulnerable to sensitive information leak due to HTTP response (CVSS 6.5, IBM DataStage on Cloud Pak for Data)
- [CVE-2025-13734](https://cve.now/CVE-2025-13734.md): IBM Engineering Requirements Management DOORS Next could allow an authenticated user to access and modify data beyond authorized permissions (CVSS 5.4, IBM Engineering Requirements Management DOORS Next)
- [CVE-2026-29022](https://cve.now/CVE-2026-29022.md): mackron / dr\_libs dr\_wav.h Heap Buffer Overflow via WAV File (CVSS 6.8, mackron dr\_libs dr\_wav.h)
- [CVE-2025-14604](https://cve.now/CVE-2025-14604.md): The following vulnerabilities, which may affect IBM Storage Scale when a directory has a specific ACL composition and could lead to improper execute permissions, have been remediated in Storage Scale versions 5.2.3.6 and 6.0.0.2 (CVSS 6.6, IBM Storage Scale)
- [CVE-2025-14923](https://cve.now/CVE-2025-14923.md): IBM WebSphere Application Server Liberty could provide weaker than expected security (CVSS 4.7, IBM WebSphere Application Server - Liberty)
- [CVE-2025-36363](https://cve.now/CVE-2025-36363.md): IBM DevOps Plan is vulnerable to Excessive Authentication Attempts (CVSS 5.9, IBM DevOps Plan)
- [CVE-2025-36364](https://cve.now/CVE-2025-36364.md): IBM DevOps Plan REST APIs are vulnerable to exposure of sensitive data through request query parameters. (CVSS 6.2, IBM DevOps Plan)
- [CVE-2026-1265](https://cve.now/CVE-2026-1265.md): IBM InfoSphere Information Server is vulnerable due to sensitive information written to a log file (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2026-2606](https://cve.now/CVE-2026-2606.md): IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read (CVSS 6.5, IBM webMethods API Gateway)
- [CVE-2026-3484](https://cve.now/CVE-2026-3484.md): PhialsBasement nmap-mcp-server Nmap CLI index.ts child\_process.exec command injection (CVSS 5.3, PhialsBasement nmap-mcp-server · mcp-nmap-server)
- [CVE-2026-2915](https://cve.now/CVE-2026-2915.md): HP System Event Utility – Denial of Service (CVSS 5.2, HP System Event Utility)
- [CVE-2026-3494](https://cve.now/CVE-2026-3494.md): MariaDB Server Audit Plugin Comment Handling Bypass (CVSS 4.3, MariaDB Foundation MariaDB Server · Amazon Aurora MySQL +5)
- [CVE-2026-3437](https://cve.now/CVE-2026-3437.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Portwell Engineering Toolkits (CVSS 9.3, Portwell Engineering Toolkits)
- [CVE-2026-0540](https://cve.now/CVE-2026-0540.md): DOMPurify XSS via Missing Rawtext Elements in SAFE\_FOR\_XML (CVSS 5.3, cure53 DOMPurify · dompurify)
- [CVE-2025-15599](https://cve.now/CVE-2025-15599.md): DOMPurify XSS via Textarea Rawtext Bypass in SAFE\_FOR\_XML (CVSS 5.1, cure53 DOMPurify · dompurify)
- [CVE-2026-3136](https://cve.now/CVE-2026-3136.md): Google Cloud Build Comment Control Bypass (CVSS 8.6, Google Cloud Cloud Build)
- [CVE-2026-3465](https://cve.now/CVE-2026-3465.md): Tuya App/SDK JSON Data Point denial of service (CVSS 2.3, Tuya App · Tuya SDK)
- [CVE-2026-28518](https://cve.now/CVE-2026-28518.md): OpenViking .ovpack Import ZIP Slip Path Traversal (CVSS 8.4, Volcengine OpenViking · openviking)
- [CVE-2025-64736](https://cve.now/CVE-2025-64736.md): An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afb (CVSS 6.1, The Biosig Project libbiosig)
- [CVE-2026-22891](https://cve.now/CVE-2026-22891.md): A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Br (CVSS 9.8, The Biosig Project libbiosig)
- [CVE-2026-20777](https://cve.now/CVE-2026-20777.md): A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master (CVSS 8.1, The Biosig Project libbiosig)
- [CVE-2026-25674](https://cve.now/CVE-2026-25674.md): Potential incorrect permissions on newly created file system objects (CVSS 3.7, djangoproject Django · django)
- [CVE-2026-25673](https://cve.now/CVE-2026-25673.md): Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows (CVSS 7.5, djangoproject Django · django)
- [CVE-2026-2637](https://cve.now/CVE-2026-2637.md): iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. (CVSS 8.5, iBoysoft NTFS)
- [CVE-2026-3344](https://cve.now/CVE-2026-3344.md): WatchGuard Firebox System Integrity Check Bypass (CVSS 6.9, WatchGuard Fireware OS)
- [CVE-2026-3343](https://cve.now/CVE-2026-3343.md): WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI (CVSS 5.1, WatchGuard Fireware OS)
- [CVE-2026-3342](https://cve.now/CVE-2026-3342.md): WatchGuard Firebox Out of Bounds Write Vulnerability (CVSS 8.6, WatchGuard Fireware OS)
- [CVE-2026-3351](https://cve.now/CVE-2026-3351.md): Authorization Bypass in LXD GET /1.0/certificates Endpoint (CVSS 2.1, Canonical lxd · github.com/canonical/lxd)
- [CVE-2026-3463](https://cve.now/CVE-2026-3463.md): xlnt-community xlnt Compound Document binary.hpp append heap-based overflow (CVSS 4.8, xlnt-community xlnt)
- [CVE-2025-59060](https://cve.now/CVE-2025-59060.md): Apache Ranger: Hostname verification bypass in NiFiRegistryClient (CVSS 5.3, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2025-59059](https://cve.now/CVE-2025-59059.md): Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator (CVSS 9.8, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2025-15598](https://cve.now/CVE-2025-15598.md): Dataease SQLBot JWT Token auth.py validateEmbedded signature verification (CVSS 6.3, Dataease SQLBot)
- [CVE-2026-2568](https://cve.now/CVE-2026-2568.md): WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \<= 1.1.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, crmperks WP Zendesk for Contact Form 7, WPForms, Elementor,…)
- [CVE-2026-22886](https://cve.now/CVE-2026-22886.md): OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. (CVSS 9.8, Eclipse Foundation Eclipse OpenMQ)
- [CVE-2026-1876](https://cve.now/CVE-2026-1876.md): Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series Ethernet module (CVSS 8.7, Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet…)
- [CVE-2026-1875](https://cve.now/CVE-2026-1875.md): Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module (CVSS 8.7, Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP…)
- [CVE-2026-1874](https://cve.now/CVE-2026-1874.md): Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module (CVSS 8.7, Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet…)
- [CVE-2025-12345](https://cve.now/CVE-2025-12345.md): LLM-Claw Agent Deployment initiate.c agent\_deploy\_init buffer overflow (CVSS 8.7, LLM-Claw)
- [CVE-2025-15595](https://cve.now/CVE-2025-15595.md): Privilege escalation via dll hijacking in Inno Setup (CVSS 5.7, mlsoft Inno Setup)
- [CVE-2026-3455](https://cve.now/CVE-2026-3455.md): Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improp (CVSS 5.1, mailparser)
- [CVE-2026-3449](https://cve.now/CVE-2026-3449.md): Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSigna (CVSS 4.8, @tootallnate/once)
- [CVE-2026-1492](https://cve.now/CVE-2026-1492.md): User Registration & Membership \<= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration (CVSS 9.8, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-20801](https://cve.now/CVE-2026-20801.md): Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integr (CVSS 5.6, Gallagher NxWitness VMS and Hanwha VMS Integrations)
- [CVE-2026-20757](https://cve.now/CVE-2026-20757.md): Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service i (CVSS 2.5, Gallagher Command Centre Server)
- [CVE-2025-47147](https://cve.now/CVE-2025-47147.md): Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with acc (CVSS 5.7, Gallagher Command Centre Mobile Client)
- [CVE-2026-1487](https://cve.now/CVE-2026-1487.md): LatePoint \<= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import (CVSS 6.5, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-2448](https://cve.now/CVE-2026-2448.md): Page Builder by SiteOrigin \<= 2.33.5 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, gpriday Page Builder by SiteOrigin)
- [CVE-2026-2269](https://cve.now/CVE-2026-2269.md): Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin \<= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload (CVSS 7.2, uncannyowl Uncanny Automator – Easy Automation, Integration…)
- [CVE-2026-2628](https://cve.now/CVE-2026-2628.md): All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login \<= 2.2.5 - Authentication Bypass (CVSS 9.8, cyberlord92 All-in-One Microsoft 365 & Entra ID / Azure AD…)
- [CVE-2026-0754](https://cve.now/CVE-2026-0754.md): SIP Service Providers – Possible Impersonation of Poly Voice Device (CVSS 8.2, HP VVX · HP Edge E +1)
- [CVE-2021-35483](https://cve.now/CVE-2021-35483.md): The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload J (CVSS 4.1)
- [CVE-2021-35484](https://cve.now/CVE-2021-35484.md): Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on (CVSS 8.2)
- [CVE-2021-35485](https://cve.now/CVE-2021-35485.md): The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload s (CVSS 8.0)
- [CVE-2021-35486](https://cve.now/CVE-2021-35486.md): A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import an (CVSS 8.1)
- [CVE-2023-31044](https://cve.now/CVE-2023-31044.md): An issue was discovered in Nokia Impact before Mobile 23\_FP1. (CVSS 2.0)
- [CVE-2024-55019](https://cve.now/CVE-2024-55019.md): Incorrect access control in the component download\_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenti (CVSS 6.5)
- [CVE-2024-55020](https://cve.now/CVE-2024-55020.md): A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows att (CVSS 9.8)
- [CVE-2024-55021](https://cve.now/CVE-2024-55021.md): Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. (CVSS 7.5)
- [CVE-2024-55022](https://cve.now/CVE-2024-55022.md): Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Nam (CVSS 8.8)
- [CVE-2024-55023](https://cve.now/CVE-2024-55023.md): Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access (CVSS 5.3)
- [CVE-2024-55024](https://cve.now/CVE-2024-55024.md): An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthoriz (CVSS 8.8)
- [CVE-2024-55025](https://cve.now/CVE-2024-55025.md): Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access t (CVSS 6.5)
- [CVE-2024-55026](https://cve.now/CVE-2024-55026.md): An issue in the reset\_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrar (CVSS 8.8)
- [CVE-2024-55027](https://cve.now/CVE-2024-55027.md): Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac\_temp.db. (CVSS 7.5)
- [CVE-2025-52365](https://cve.now/CVE-2025-52365.md): A command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository allows remote attackers to execute arbitrary sy (CVSS 7.8)
- [CVE-2025-57622](https://cve.now/CVE-2025-57622.md): An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(reque (CVSS 9.8)
- [CVE-2025-62814](https://cve.now/CVE-2025-62814.md): An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, and 2400. (CVSS 7.5)
- [CVE-2025-62815](https://cve.now/CVE-2025-62815.md): An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580, and 2500. (CVSS 5.5)
- [CVE-2025-62816](https://cve.now/CVE-2025-62816.md): An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. (CVSS 5.5)
- [CVE-2025-62817](https://cve.now/CVE-2025-62817.md): An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. (CVSS 7.5)
- [CVE-2025-63909](https://cve.now/CVE-2025-63909.md): Incorrect access control in the component /opt/SRLtzm/bin/TapeDumper of Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows (CVSS 7.2)
- [CVE-2025-63910](https://cve.now/CVE-2025-63910.md): An authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers with (CVSS 7.2)
- [CVE-2025-63911](https://cve.now/CVE-2025-63911.md): Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability. (CVSS 7.2)
- [CVE-2025-63912](https://cve.now/CVE-2025-63912.md): Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allow (CVSS 5.5)
- [CVE-2025-66363](https://cve.now/CVE-2025-66363.md): An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. (CVSS 7.5)
- [CVE-2025-66680](https://cve.now/CVE-2025-66680.md): An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files v (CVSS 7.1)
- [CVE-2025-66945](https://cve.now/CVE-2025-66945.md): A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. (CVSS 9.1)
- [CVE-2025-67840](https://cve.now/CVE-2025-67840.md): Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM\_ (CVSS 7.2)
- [CVE-2025-69765](https://cve.now/CVE-2025-69765.md): Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formGetIptv function and the list parameter, which can cause memory corruption (CVSS 7.5)
- [CVE-2025-70234](https://cve.now/CVE-2025-70234.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS. (CVSS 7.5)
- [CVE-2025-70236](https://cve.now/CVE-2025-70236.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter. (CVSS 5.3)
- [CVE-2025-70237](https://cve.now/CVE-2025-70237.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr. (CVSS 7.5)
- [CVE-2025-70239](https://cve.now/CVE-2025-70239.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN\_Wizard55. (CVSS 7.5)
- [CVE-2025-70240](https://cve.now/CVE-2025-70240.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN\_Wizard51. (CVSS 7.5)
- [CVE-2025-70241](https://cve.now/CVE-2025-70241.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType\_Wizard5. (CVSS 7.5)
- [CVE-2025-70821](https://cve.now/CVE-2025-70821.md): renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component (CVSS 9.8)
- [CVE-2026-24103](https://cve.now/CVE-2026-24103.md): A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18\_multi. (CVSS 9.8)
- [CVE-2026-26883](https://cve.now/CVE-2026-26883.md): Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete\_appointment. (CVSS 2.7)
- [CVE-2026-26884](https://cve.now/CVE-2026-26884.md): Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/view\_appointment.php. (CVSS 2.7)
- [CVE-2026-26885](https://cve.now/CVE-2026-26885.md): Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /classes/Master.php?f=delete\_service. (CVSS 2.7)
- [CVE-2026-26886](https://cve.now/CVE-2026-26886.md): Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /admin/services/manage\_service.php. (CVSS 2.7)
- [CVE-2026-26887](https://cve.now/CVE-2026-26887.md): Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage\_supplier.php. (CVSS 2.7)
- [CVE-2026-26888](https://cve.now/CVE-2026-26888.md): Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage\_stock.php. (CVSS 2.7)
- [CVE-2026-26889](https://cve.now/CVE-2026-26889.md): Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage\_category.php. (CVSS 2.7)
- [CVE-2026-26890](https://cve.now/CVE-2026-26890.md): Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage\_product.php. (CVSS 2.7)
- [CVE-2026-26891](https://cve.now/CVE-2026-26891.md): Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage\_parcel\_type.php. (CVSS 2.7)
- [CVE-2026-26892](https://cve.now/CVE-2026-26892.md): Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage\_carrier.php. (CVSS 2.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.