CVEs published March 4, 2026
204 CVEs were published on March 4, 2026: 29 critical, 60 high. 2 are now in CISA KEV.
- Published
- 204
- Critical
- 29
- High
- 60
- Medium
- 102
- Low
- 6
- Unrated
- 7
- Now in CISA KEV
- 2
- Fix available
- 74
Most affected products
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- 24
- Google Chrome
- 9
- Linux
- 9
- Cisco Secure Firewall Threat Defense (FTD) Software
- 8
- craftcms cms · craftcms/cms
- 8
- SEPPmail Secure Email Gateway
- 8
- Dell PowerScale OneFS
- 7
- Cisco Secure Firewall Management Center
- 6
- Concrete CMS · concrete5/concrete5
- 6
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- 6
Critical 29
- CVE-2026-2835HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsinghttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-2833HTTP Request Smuggling via Premature Upgradehttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-29000pac4j-jwt JwtAuthenticator Authentication Bypasspac4j-jwt · org.pac4j:pac4j-jwt
- CVE-2026-3545Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbGoogle Chrome
- CVE-2026-20131Cisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-28783Craft has a Twig Function Blocklist Bypasscraftcms cms · craftcms/cms
- CVE-2026-28697Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templatescraftcms cms · craftcms/cms
- CVE-2026-27441PDF Password CMDiSEPPmail Secure Email Gateway
- CVE-2026-27446Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationApache Software Foundation Apache Artemis · Apache Softw… +2
- CVE-2026-27442zip_attachments Path TraversalSEPPmail Secure Email Gateway
- CVE-2026-29120Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite ReceiverInternational Datacasting IDC SFX2100 SuperFlex Satellite R…
- CVE-2026-28777Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) SFX2100 Satelli…
- CVE-2026-28775Unauthenticated RCE via SNMP Default Writable Community StringInternational Datacasting Corporation (IDC) SFX2100 Series…
- CVE-2026-28774Authenticated OS Command Injection via Traceroute Utility leads to Root RCEInternational Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28773Authenticated OS Command Injection via Ping Utility Leading to RCE as RootInternational Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2025-46108D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup.
- CVE-2025-66678An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu
- CVE-2025-66944SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query param
- CVE-2025-69969A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebb
- CVE-2025-70218Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component.
- CVE-2025-70219Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot.
- CVE-2025-70220Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4.
- CVE-2025-70221Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.
- CVE-2025-70222Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.
- CVE-2025-70223Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork.
- CVE-2025-70225Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component
- CVE-2025-70226Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard.
- CVE-2026-26478A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a speci
High 60
- CVE-2026-2836Cache poisoning via insecure-by-default cache keyhttps://github.com/cloudflare/pingora · pingora-cache
- CVE-2026-29045Hono: Arbitrary file access via serveStatic vulnerabilityhonojs hono · hono
- CVE-2026-25750LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrllangchain-ai helm
- CVE-2025-66024XWiki Blog Application home page vulnerable to Stored XSS via Post Titlexwiki-contrib application-blog-ui · org.xwiki.contrib.blog:…
- CVE-2026-27803Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Roledani-garcia vaultwarden · vaultwarden
- CVE-2026-27802Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Managerdani-garcia vaultwarden · vaultwarden
- CVE-2026-28435Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplibyhirose cpp-httplib
- CVE-2026-3544Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory writGoogle Chrome
- CVE-2026-3543Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds mGoogle Chrome
- CVE-2026-3542Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memoGoogle Chrome
- CVE-2026-3541Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory reGoogle Chrome
- CVE-2026-3540Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory Google Chrome
- CVE-2026-3538Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acceGoogle Chrome
- CVE-2026-3537Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap Google Chrome
- CVE-2026-3536Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory accGoogle Chrome
- CVE-2026-0847Path Traversal in nltk/nltknltk/nltk · nltk
- CVE-2026-3125SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass@opennextjs/cloudflare
- CVE-2026-20082A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software couldCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20062A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an autheCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20049A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco SecuCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20014A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remotCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20105A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure FiCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20103A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure FiCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20101A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20100A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20002A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct Cisco Secure Firewall Management Center
- CVE-2026-20039Cisco Adaptive Security Appliance and Firepower Threat Defense Software SSL VPN Authentication Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2019-25507Ashop Shopping Cart Software Lastest SQL Injection via index.phpAshopsoftware Ashop Shopping Cart Software
- CVE-2019-25506FreeSMS 2.1.2 Authentication Bypass via SQL InjectionFreeSMS
- CVE-2019-25505Tradebox 5.4 SQL Injection via symbol ParameterBdtask Tradebox
- CVE-2019-25504NCrypted Jobgator Lastest SQL Injection via agents Find-JobsNCrypted Jobgator
- CVE-2019-25503PHPads 2.0 SQL Injection via click.php3 bannerIDBlondish PHPads
- CVE-2019-25501Simple Job Script SQL Injection via delete_application_ajax.phpniteosoft Simple Job Script
- CVE-2019-25500Simple Job Script SQL Injection via register-recruiters endpointniteosoft Simple Job Script
- CVE-2019-25499Simple Job Script SQL Injection via get_job_applications_ajax.phpniteosoft Simple Job Script
- CVE-2019-25498Simple Job Script SQL Injection via searched Endpointniteosoft Simple Job Script
- CVE-2026-28784Craft is affected by potential authenticated Remote Code Execution via Twig SSTIcraftcms cms · craftcms/cms
- CVE-2026-28781Craft Affected by Entries Authorship Spoofing via Mass Assignmentcraftcms cms · craftcms/cms
- CVE-2026-28696Craft affected by IDOR via GraphQL @parseRefscraftcms cms · craftcms/cms
- CVE-2026-3520Multer vulnerable to Denial of Service via uncontrolled recursionexpressjs multer · multer
- CVE-2026-28695Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetcraftcms cms · craftcms/cms
- CVE-2025-15558Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityDocker CLI · Docker Compose +4
- CVE-2025-59783OS Command Injection over API2N Telekomunikace a.s. 2N Access Commander
- CVE-2026-23236fbdev: smscufx: properly copy ioctl memory to kernelspaceLinux
- CVE-2026-23231netfilter: nf_tables: fix use-after-free in nf_tables_addchain()Linux
- CVE-2023-7337JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookierabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2026-2748S/MIME Certificate Subject WhitespaceSEPPmail Secure Email Gateway
- CVE-2026-27444Header Email Address ParsingSEPPmail Secure Email Gateway
- CVE-2026-27443S/MIME Decryption Tag Sanitization BypassSEPPmail Secure Email Gateway
- CVE-2026-3094File Parsing Out-Of-Bounds Write in CNCSoft-G2deltaww CNCSoft-G2
- CVE-2026-29119Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) SFX2100 Series…
- CVE-2026-28778Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100International Datacasting Corporation (IDC) IDC SFX2100 Sup…
- CVE-2026-28776Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) IDC SFX2100 Sup…
- CVE-2026-2025Mail Mint < 1.19.5 - Unauthenticated Emails DisclosureMail Mint
- CVE-2026-3452Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.Concrete CMS · concrete5/concrete5
- CVE-2026-1273PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpointswpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- CVE-2026-1945WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parametersiqonicdesign WPBookit
- CVE-2025-70341Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.
- CVE-2026-26514An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e.
- CVE-2026-26673An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via
Medium, low and unrated 115
- CVE-2026-22052ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability.NETAPP ONTAP
- CVE-2025-41257Suprema BioStar 2 Insecure Password ChangeSuprema BioStar
- CVE-2026-2297SourcelessFileLoader does not use io.open_code()Python Software Foundation CPython
- CVE-2026-29085Hono: SSE Control Field Injection via CR/LF in writeSSE()honojs hono · hono
- CVE-2026-29086Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()honojs hono · hono
- CVE-2026-26002OnDemand susceptible to malicious input when navigating to a directory.OSC ondemand
- CVE-2026-22040NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crashnanomq
- CVE-2025-68467Dark Reader gives users the ability to request style sheets from local web serversdarkreader
- CVE-2026-27898Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipherdani-garcia vaultwarden · vaultwarden
- CVE-2026-27801Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcementdani-garcia vaultwarden · vaultwarden
- CVE-2026-28434cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response headeryhirose cpp-httplib
- CVE-2026-28427OpenDeck affected by path traversal allows arbitrary file readnekename OpenDeck
- CVE-2026-20064A vulnerability in of Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to cause the device tCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20025A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20024A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20023A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DeCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20022A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20021A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DeCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20020A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20016A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authentCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20073Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20102Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20070Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Cross-Site Scripting VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20069Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20068Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20067Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20066Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-20065Multiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-20063Cisco Secure FTD Software Authenticated Command Injection VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20058Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-20057Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20054Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Infinite Loop Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20053Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Heap Overflow Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2026-20052Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20050Cisco Secure Firewall Threat Defense Decryption Policy Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20017Cisco Secure FTD Software Authenticated Command Injection VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20018Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal VulnerabilityCisco Secure Firewall Management Center · Cisco Secure Fire…
- CVE-2026-20007Cisco Secure Firewall Threat Defense Software Snort Deep Inspection Bypass VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20006Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service VulnerabilityCisco Secure Firewall Threat Defense (FTD) Software
- CVE-2026-20149A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.Cisco Webex Meetings
- CVE-2026-20015A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20013A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20106A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (ACisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20003A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks Cisco Secure Firewall Management Center
- CVE-2026-20044Cisco Secure Firewall Management Center Command Injection VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-20031ClamAV CSS Image Parsing Error Handling Denial of Service VulnerabilityCisco Secure Endpoint
- CVE-2019-25502Simple Job Script Cross-Site Scripting via job_type_value Parameterniteosoft Simple Job Script
- CVE-2026-20008Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Lua Code Injection VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-20009Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-26949Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Incorrect Authorization vulnerability.Dell Device Management Agent
- CVE-2026-20001Cisco Secure Firewall Management Center Software SQL Injection VulnerabilitiesCisco Secure Firewall Management Center
- CVE-2026-20005Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attackerCisco Secure Firewall Threat Defense (FTD) Software · Ci… +1
- CVE-2026-22760Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability.Dell Device Management Agent
- CVE-2026-29069Craft has an unauthenticated activation email trigger with potential user enumerationcraftcms cms · craftcms/cms
- CVE-2026-28782Craft has a Permission Bypass and IDOR in Duplicate Entry Actioncraftcms cms · craftcms/cms
- CVE-2026-23812Security Boundary Bypass via Routing Node ImpersonationHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23811Unauthorized Bi-Directional Traffic Interception via L2/L3 ManipulationHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23810Cross-BSSID GTK Re-encryption and Traffic InjectionHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23809MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic RedirectionHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23808Client Isolation Bypass via GTK ManipulationHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23601Frame Injection via Shared GTK Allows Traffic Spoofing and Client CompromiseHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-22285Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability.Dell Device Management Agent
- CVE-2025-59787HTTP 5XX Internal Server Errors2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-59786Cookies are not Invalidated upon Logout and Password Change2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-59785API - Insufficient Input Validation2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-59784Log Pollution - Control Characters Not Escaped2N Telekomunikace a.s. 2N Access Commander
- CVE-2025-12801Nfs-utils: rpc.mountd in the nfs-utils privilege escalationRed Hat Enterprise Linux · Red Hat OpenShift Container P… +1
- CVE-2025-62879Rancher Backup Operator pod's logs leak S3 tokensSUSE Rancher · github.com/rancher/backup-restore-operator
- CVE-2026-23238romfs: check sb_set_blocksize() return valueLinux
- CVE-2026-23237platform/x86: classmate-laptop: Add missing NULL pointer checksLinux
- CVE-2026-23235f2fs: fix out-of-bounds access in sysfs attribute read/writeLinux
- CVE-2026-23234f2fs: fix to avoid UAF in f2fs_write_end_io()Linux
- CVE-2026-23233f2fs: fix to avoid mapping wrong physical block for swapfileLinux
- CVE-2026-23232Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"Linux
- CVE-2025-71238scsi: qla2xxx: Fix bsg_done() causing double freeLinux
- CVE-2025-40896Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0Nozomi Networks Arc
- CVE-2025-40895HTML injection in Sensor Map in CMC before 25.6.0Nozomi Networks CMC
- CVE-2025-40894HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-3103Deletion of passwords via RestApiCheckmk
- CVE-2026-25907Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability.Dell PowerScale OneFS
- CVE-2026-21422Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability.Dell PowerScale OneFS
- CVE-2026-21424Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges Dell PowerScale OneFS
- CVE-2026-21421Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges Dell PowerScale OneFS
- CVE-2026-21426Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges Dell PowerScale OneFS
- CVE-2026-21423Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerabDell PowerScale OneFS
- CVE-2026-22270Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulneDell PowerScale OneFS,
- CVE-2026-21425Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulneraDell PowerScale OneFS
- CVE-2026-24732Improper permission checks in Extension:NSFileRepoHallo Welt! BlueSpice
- CVE-2026-3058Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actorseraphinitesoft Seraphinite Accelerator
- CVE-2026-3056Seraphinite Accelerator <= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearingseraphinitesoft Seraphinite Accelerator
- CVE-2026-1674Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()saadiqbal Gutena Forms – Contact Form, Survey Form, Feedbac…
- CVE-2026-2355My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesjoedolson My Calendar – Accessible Event Manager
- CVE-2026-1706All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameterplugins360 All-in-One Video Gallery
- CVE-2026-3439A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewallSonicWall SonicOS
- CVE-2026-27445PGP Signature ReflectionSEPPmail Secure Email Gateway
- CVE-2026-2747PGP Mixed Plaintext and Encrypted ContentSEPPmail Secure Email Gateway
- CVE-2025-66168Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validatedApache Software Foundation Apache ActiveMQ · org.apache.… +2
- CVE-2026-2746Missing PGP Signature TagSEPPmail Secure Email Gateway
- CVE-2026-1236Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST APIsmub Envira Gallery – Image Photo Gallery, Albums, Video Ga…
- CVE-2026-28772Reflected XSS in IDC_Logging Index endpointInternational Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28771Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101International Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28770XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101International Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-28769LFI in /IDC_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 101International Datacasting Corporation (IDC) SFX Series Supe…
- CVE-2026-2732Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replaceshortpixel Enable Media Replace
- CVE-2026-2363WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attributecbutlerjr WP-Members Membership Plugin
- CVE-2026-2994Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist GroupConcrete CMS · concrete5/concrete5
- CVE-2026-3240Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy formConcrete CMS · concrete5/concrete5
- CVE-2026-3241Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.Concrete CMS · concrete5/concrete5
- CVE-2026-3242Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language blockConcrete CMS · concrete5/concrete5
- CVE-2026-3244Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page NamesConcrete CMS · concrete5/concrete5
- CVE-2026-1651Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parametericegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2026-2292Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Fieldbandido Morkva UA Shipping
- CVE-2026-1980WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposureiqonicdesign WPBookit
- CVE-2026-2289Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' FieldTaskbuilder – Project Management & Task Management Tool Wit…
- CVE-2025-70342erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json.