# CVEs published 2026-03-04

204 CVEs were published on March 4, 2026: 29 critical, 60 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-2836](https://cve.now/CVE-2026-2836.md): Cache poisoning via insecure-by-default cache key (CVSS 8.4, https://github.com/cloudflare/pingora · pingora-cache)
- [CVE-2026-2835](https://cve.now/CVE-2026-2835.md): HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing (CVSS 9.3, https://github.com/cloudflare/pingora · pingora-core)
- [CVE-2026-22052](https://cve.now/CVE-2026-22052.md): ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. (CVSS 5.3, NETAPP ONTAP)
- [CVE-2026-2833](https://cve.now/CVE-2026-2833.md): HTTP Request Smuggling via Premature Upgrade (CVSS 9.3, https://github.com/cloudflare/pingora · pingora-core)
- [CVE-2025-41257](https://cve.now/CVE-2025-41257.md): Suprema BioStar 2 Insecure Password Change (CVSS 4.8, Suprema BioStar)
- [CVE-2026-2297](https://cve.now/CVE-2026-2297.md): SourcelessFileLoader does not use io.open\_code() (CVSS 5.7, Python Software Foundation CPython)
- [CVE-2026-29085](https://cve.now/CVE-2026-29085.md): Hono: SSE Control Field Injection via CR/LF in writeSSE() (CVSS 6.5, honojs hono · hono)
- [CVE-2026-29045](https://cve.now/CVE-2026-29045.md): Hono: Arbitrary file access via serveStatic vulnerability (CVSS 7.5, honojs hono · hono)
- [CVE-2026-29086](https://cve.now/CVE-2026-29086.md): Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() (CVSS 5.4, honojs hono · hono)
- [CVE-2026-26002](https://cve.now/CVE-2026-26002.md): OnDemand susceptible to malicious input when navigating to a directory. (CVSS 6.3, OSC ondemand)
- [CVE-2026-25750](https://cve.now/CVE-2026-25750.md): LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl (CVSS 8.5, langchain-ai helm)
- [CVE-2026-22040](https://cve.now/CVE-2026-22040.md): NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash (CVSS 5.3, nanomq)
- [CVE-2025-68467](https://cve.now/CVE-2025-68467.md): Dark Reader gives users the ability to request style sheets from local web servers (CVSS 3.4, darkreader)
- [CVE-2026-29000](https://cve.now/CVE-2026-29000.md): pac4j-jwt JwtAuthenticator Authentication Bypass (CVSS 9.3, pac4j-jwt · org.pac4j:pac4j-jwt)
- [CVE-2025-66024](https://cve.now/CVE-2025-66024.md): XWiki Blog Application home page vulnerable to Stored XSS via Post Title (CVSS 8.6, xwiki-contrib application-blog-ui · org.xwiki.contrib.blog:…)
- [CVE-2026-27898](https://cve.now/CVE-2026-27898.md): Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher (CVSS 5.4, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-27803](https://cve.now/CVE-2026-27803.md): Vaultwarden: Collection Management Operations Allowed Without \`manage\` Verification for Manager Role (CVSS 8.3, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-27802](https://cve.now/CVE-2026-27802.md): Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager (CVSS 8.3, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-27801](https://cve.now/CVE-2026-27801.md): Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement (CVSS 6.0, dani-garcia vaultwarden · vaultwarden)
- [CVE-2026-28435](https://cve.now/CVE-2026-28435.md): Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib (CVSS 7.5, yhirose cpp-httplib)
- [CVE-2026-28434](https://cve.now/CVE-2026-28434.md): cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION\_WHAT response header (CVSS 5.3, yhirose cpp-httplib)
- [CVE-2026-28427](https://cve.now/CVE-2026-28427.md): OpenDeck affected by path traversal allows arbitrary file read (CVSS 5.9, nekename OpenDeck)
- [CVE-2026-3545](https://cve.now/CVE-2026-3545.md): Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandb (CVSS 9.6, Google Chrome)
- [CVE-2026-3544](https://cve.now/CVE-2026-3544.md): Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory writ (CVSS 8.8, Google Chrome)
- [CVE-2026-3543](https://cve.now/CVE-2026-3543.md): Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds m (CVSS 8.8, Google Chrome)
- [CVE-2026-3542](https://cve.now/CVE-2026-3542.md): Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memo (CVSS 8.8, Google Chrome)
- [CVE-2026-3541](https://cve.now/CVE-2026-3541.md): Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory re (CVSS 8.8, Google Chrome)
- [CVE-2026-3540](https://cve.now/CVE-2026-3540.md): Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory (CVSS 8.8, Google Chrome)
- [CVE-2026-3538](https://cve.now/CVE-2026-3538.md): Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acce (CVSS 8.8, Google Chrome)
- [CVE-2026-3537](https://cve.now/CVE-2026-3537.md): Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap (CVSS 8.8, Google Chrome)
- [CVE-2026-3536](https://cve.now/CVE-2026-3536.md): Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acc (CVSS 8.8, Google Chrome)
- [CVE-2026-20064](https://cve.now/CVE-2026-20064.md): A vulnerability in of Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to cause the device t (CVSS 6.5, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20025](https://cve.now/CVE-2026-20025.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjac (CVSS 6.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20024](https://cve.now/CVE-2026-20024.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjac (CVSS 6.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20023](https://cve.now/CVE-2026-20023.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat De (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20022](https://cve.now/CVE-2026-20022.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adj (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20021](https://cve.now/CVE-2026-20021.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat De (CVSS 4.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20020](https://cve.now/CVE-2026-20020.md): A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adj (CVSS 6.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20016](https://cve.now/CVE-2026-20016.md): A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authent (CVSS 6.0, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-0847](https://cve.now/CVE-2026-0847.md): Path Traversal in nltk/nltk (CVSS 8.6, nltk/nltk · nltk)
- [CVE-2026-3125](https://cve.now/CVE-2026-3125.md): SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass (CVSS 7.7, @opennextjs/cloudflare)
- [CVE-2026-20073](https://cve.now/CVE-2026-20073.md): Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass Vulnerability (CVSS 5.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20102](https://cve.now/CVE-2026-20102.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20070](https://cve.now/CVE-2026-20070.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20069](https://cve.now/CVE-2026-20069.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling Vulnerability (CVSS 4.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20068](https://cve.now/CVE-2026-20068.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20067](https://cve.now/CVE-2026-20067.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20066](https://cve.now/CVE-2026-20066.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Cisco…)
- [CVE-2026-20065](https://cve.now/CVE-2026-20065.md): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Cisco…)
- [CVE-2026-20063](https://cve.now/CVE-2026-20063.md): Cisco Secure FTD Software Authenticated Command Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20058](https://cve.now/CVE-2026-20058.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Cisco…)
- [CVE-2026-20057](https://cve.now/CVE-2026-20057.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20054](https://cve.now/CVE-2026-20054.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Infinite Loop Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20053](https://cve.now/CVE-2026-20053.md): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Heap Overflow Denial of Service Vulnerability (CVSS 5.8, Cisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1)
- [CVE-2026-20052](https://cve.now/CVE-2026-20052.md): Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20050](https://cve.now/CVE-2026-20050.md): Cisco Secure Firewall Threat Defense Decryption Policy Denial of Service Vulnerability (CVSS 6.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20017](https://cve.now/CVE-2026-20017.md): Cisco Secure FTD Software Authenticated Command Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20018](https://cve.now/CVE-2026-20018.md): Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability (CVSS 5.9, Cisco Secure Firewall Management Center · Cisco Secure Fire…)
- [CVE-2026-20007](https://cve.now/CVE-2026-20007.md): Cisco Secure Firewall Threat Defense Software Snort Deep Inspection Bypass Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20006](https://cve.now/CVE-2026-20006.md): Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20149](https://cve.now/CVE-2026-20149.md): A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. (CVSS 6.1, Cisco Webex Meetings)
- [CVE-2026-20082](https://cve.now/CVE-2026-20082.md): A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20062](https://cve.now/CVE-2026-20062.md): A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authe (CVSS 7.2, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20049](https://cve.now/CVE-2026-20049.md): A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secu (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20015](https://cve.now/CVE-2026-20015.md): A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, rem (CVSS 5.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20014](https://cve.now/CVE-2026-20014.md): A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remot (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20013](https://cve.now/CVE-2026-20013.md): A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, rem (CVSS 5.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20106](https://cve.now/CVE-2026-20106.md): A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (A (CVSS 5.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20105](https://cve.now/CVE-2026-20105.md): A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Fi (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20103](https://cve.now/CVE-2026-20103.md): A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Fi (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20101](https://cve.now/CVE-2026-20101.md): A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an un (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20100](https://cve.now/CVE-2026-20100.md): A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Softw (CVSS 7.7, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20003](https://cve.now/CVE-2026-20003.md): A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks (CVSS 4.9, Cisco Secure Firewall Management Center)
- [CVE-2026-20002](https://cve.now/CVE-2026-20002.md): A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct (CVSS 8.1, Cisco Secure Firewall Management Center)
- [CVE-2026-20131](https://cve.now/CVE-2026-20131.md): Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability (CVSS 10.0, KEV, Cisco Secure Firewall Management Center)
- [CVE-2026-20039](https://cve.now/CVE-2026-20039.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software SSL VPN Authentication Denial of Service Vulnerability (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20044](https://cve.now/CVE-2026-20044.md): Cisco Secure Firewall Management Center Command Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Management Center)
- [CVE-2026-20079](https://cve.now/CVE-2026-20079.md): Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability (CVSS 10.0, KEV, Cisco Secure Firewall Management Center)
- [CVE-2026-20031](https://cve.now/CVE-2026-20031.md): ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability (CVSS 5.3, Cisco Secure Endpoint)
- [CVE-2019-25507](https://cve.now/CVE-2019-25507.md): Ashop Shopping Cart Software Lastest SQL Injection via index.php (CVSS 8.8, Ashopsoftware Ashop Shopping Cart Software)
- [CVE-2019-25506](https://cve.now/CVE-2019-25506.md): FreeSMS 2.1.2 Authentication Bypass via SQL Injection (CVSS 8.8, FreeSMS)
- [CVE-2019-25505](https://cve.now/CVE-2019-25505.md): Tradebox 5.4 SQL Injection via symbol Parameter (CVSS 7.1, Bdtask Tradebox)
- [CVE-2019-25504](https://cve.now/CVE-2019-25504.md): NCrypted Jobgator Lastest SQL Injection via agents Find-Jobs (CVSS 8.8, NCrypted Jobgator)
- [CVE-2019-25503](https://cve.now/CVE-2019-25503.md): PHPads 2.0 SQL Injection via click.php3 bannerID (CVSS 7.1, Blondish PHPads)
- [CVE-2019-25502](https://cve.now/CVE-2019-25502.md): Simple Job Script Cross-Site Scripting via job\_type\_value Parameter (CVSS 5.1, niteosoft Simple Job Script)
- [CVE-2019-25501](https://cve.now/CVE-2019-25501.md): Simple Job Script SQL Injection via delete\_application\_ajax.php (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2019-25500](https://cve.now/CVE-2019-25500.md): Simple Job Script SQL Injection via register-recruiters endpoint (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2019-25499](https://cve.now/CVE-2019-25499.md): Simple Job Script SQL Injection via get\_job\_applications\_ajax.php (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2019-25498](https://cve.now/CVE-2019-25498.md): Simple Job Script SQL Injection via searched Endpoint (CVSS 8.8, niteosoft Simple Job Script)
- [CVE-2026-20008](https://cve.now/CVE-2026-20008.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Lua Code Injection Vulnerability (CVSS 6.0, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20009](https://cve.now/CVE-2026-20009.md): Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability (CVSS 5.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-26949](https://cve.now/CVE-2026-26949.md): Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Incorrect Authorization vulnerability. (CVSS 5.5, Dell Device Management Agent)
- [CVE-2026-20001](https://cve.now/CVE-2026-20001.md): Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities (CVSS 6.5, Cisco Secure Firewall Management Center)
- [CVE-2026-20005](https://cve.now/CVE-2026-20005.md): Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software · Ci… +1)
- [CVE-2026-22760](https://cve.now/CVE-2026-22760.md): Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability. (CVSS 3.3, Dell Device Management Agent)
- [CVE-2026-29069](https://cve.now/CVE-2026-29069.md): Craft has an unauthenticated activation email trigger with potential user enumeration (CVSS 6.9, craftcms cms · craftcms/cms)
- [CVE-2026-28784](https://cve.now/CVE-2026-28784.md): Craft is affected by potential authenticated Remote Code Execution via Twig SSTI (CVSS 8.6, craftcms cms · craftcms/cms)
- [CVE-2026-28783](https://cve.now/CVE-2026-28783.md): Craft has a Twig Function Blocklist Bypass (CVSS 9.4, craftcms cms · craftcms/cms)
- [CVE-2026-28782](https://cve.now/CVE-2026-28782.md): Craft has a Permission Bypass and IDOR in Duplicate Entry Action (CVSS 5.3, craftcms cms · craftcms/cms)
- [CVE-2026-28781](https://cve.now/CVE-2026-28781.md): Craft Affected by Entries Authorship Spoofing via Mass Assignment (CVSS 7.1, craftcms cms · craftcms/cms)
- [CVE-2026-28697](https://cve.now/CVE-2026-28697.md): Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates (CVSS 9.4, craftcms cms · craftcms/cms)
- [CVE-2026-28696](https://cve.now/CVE-2026-28696.md): Craft affected by IDOR via GraphQL @parseRefs (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-3520](https://cve.now/CVE-2026-3520.md): Multer vulnerable to Denial of Service via uncontrolled recursion (CVSS 8.7, expressjs multer · multer)
- [CVE-2026-28695](https://cve.now/CVE-2026-28695.md): Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget (CVSS 7.5, craftcms cms · craftcms/cms)
- [CVE-2025-15558](https://cve.now/CVE-2025-15558.md): Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.0, Docker CLI · Docker Compose +4)
- [CVE-2026-23812](https://cve.now/CVE-2026-23812.md): Security Boundary Bypass via Routing Node Impersonation (CVSS 4.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23811](https://cve.now/CVE-2026-23811.md): Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation (CVSS 4.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23810](https://cve.now/CVE-2026-23810.md): Cross-BSSID GTK Re-encryption and Traffic Injection (CVSS 4.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23809](https://cve.now/CVE-2026-23809.md): MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection (CVSS 5.4, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23808](https://cve.now/CVE-2026-23808.md): Client Isolation Bypass via GTK Manipulation (CVSS 5.4, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-23601](https://cve.now/CVE-2026-23601.md): Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise (CVSS 5.4, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…)
- [CVE-2026-22285](https://cve.now/CVE-2026-22285.md): Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. (CVSS 4.4, Dell Device Management Agent)
- [CVE-2025-59787](https://cve.now/CVE-2025-59787.md): HTTP 5XX Internal Server Errors (CVSS 5.3, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-59786](https://cve.now/CVE-2025-59786.md): Cookies are not Invalidated upon Logout and Password Change (CVSS 6.0, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-59785](https://cve.now/CVE-2025-59785.md): API - Insufficient Input Validation (CVSS 5.3, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-59784](https://cve.now/CVE-2025-59784.md): Log Pollution - Control Characters Not Escaped (CVSS 6.9, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-12801](https://cve.now/CVE-2025-12801.md): Nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1)
- [CVE-2025-59783](https://cve.now/CVE-2025-59783.md): OS Command Injection over API (CVSS 8.8, 2N Telekomunikace a.s. 2N Access Commander)
- [CVE-2025-62879](https://cve.now/CVE-2025-62879.md): Rancher Backup Operator pod's logs leak S3 tokens (CVSS 6.8, SUSE Rancher · github.com/rancher/backup-restore-operator)
- [CVE-2026-23238](https://cve.now/CVE-2026-23238.md): romfs: check sb\_set\_blocksize() return value (no CVSS, Linux)
- [CVE-2026-23237](https://cve.now/CVE-2026-23237.md): platform/x86: classmate-laptop: Add missing NULL pointer checks (no CVSS, Linux)
- [CVE-2026-23236](https://cve.now/CVE-2026-23236.md): fbdev: smscufx: properly copy ioctl memory to kernelspace (CVSS 7.3, Linux)
- [CVE-2026-23235](https://cve.now/CVE-2026-23235.md): f2fs: fix out-of-bounds access in sysfs attribute read/write (no CVSS, Linux)
- [CVE-2026-23234](https://cve.now/CVE-2026-23234.md): f2fs: fix to avoid UAF in f2fs\_write\_end\_io() (no CVSS, Linux)
- [CVE-2026-23233](https://cve.now/CVE-2026-23233.md): f2fs: fix to avoid mapping wrong physical block for swapfile (no CVSS, Linux)
- [CVE-2026-23232](https://cve.now/CVE-2026-23232.md): Revert "f2fs: block cache/dio write during f2fs\_enable\_checkpoint()" (no CVSS, Linux)
- [CVE-2025-71238](https://cve.now/CVE-2025-71238.md): scsi: qla2xxx: Fix bsg\_done() causing double free (no CVSS, Linux)
- [CVE-2025-40896](https://cve.now/CVE-2025-40896.md): Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0 (CVSS 6.3, Nozomi Networks Arc)
- [CVE-2025-40895](https://cve.now/CVE-2025-40895.md): HTML injection in Sensor Map in CMC before 25.6.0 (CVSS 2.0, Nozomi Networks CMC)
- [CVE-2025-40894](https://cve.now/CVE-2025-40894.md): HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0 (CVSS 2.1, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-3103](https://cve.now/CVE-2026-3103.md): Deletion of passwords via RestApi (CVSS 5.3, Checkmk)
- [CVE-2026-25907](https://cve.now/CVE-2026-25907.md): Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2026-23231](https://cve.now/CVE-2026-23231.md): netfilter: nf\_tables: fix use-after-free in nf\_tables\_addchain() (CVSS 7.8, Linux)
- [CVE-2026-21422](https://cve.now/CVE-2026-21422.md): Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability. (CVSS 3.4, Dell PowerScale OneFS)
- [CVE-2026-21424](https://cve.now/CVE-2026-21424.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-21421](https://cve.now/CVE-2026-21421.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-21426](https://cve.now/CVE-2026-21426.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-21423](https://cve.now/CVE-2026-21423.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerab (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-22270](https://cve.now/CVE-2026-22270.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulne (CVSS 6.7, Dell PowerScale OneFS,)
- [CVE-2026-21425](https://cve.now/CVE-2026-21425.md): Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulnera (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-24732](https://cve.now/CVE-2026-24732.md): Improper permission checks in Extension:NSFileRepo (CVSS 6.6, Hallo Welt! BlueSpice)
- [CVE-2026-3058](https://cve.now/CVE-2026-3058.md): Seraphinite Accelerator \<= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, seraphinitesoft Seraphinite Accelerator)
- [CVE-2026-3056](https://cve.now/CVE-2026-3056.md): Seraphinite Accelerator \<= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearing (CVSS 4.3, seraphinitesoft Seraphinite Accelerator)
- [CVE-2026-1674](https://cve.now/CVE-2026-1674.md): Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder \<= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save\_gutena\_forms\_schema() (CVSS 6.5, saadiqbal Gutena Forms – Contact Form, Survey Form, Feedbac…)
- [CVE-2026-2355](https://cve.now/CVE-2026-2355.md): My Calendar – Accessible Event Manager \<= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, joedolson My Calendar – Accessible Event Manager)
- [CVE-2026-1706](https://cve.now/CVE-2026-1706.md): All-in-One Video Gallery \<= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter (CVSS 6.1, plugins360 All-in-One Video Gallery)
- [CVE-2023-7337](https://cve.now/CVE-2023-7337.md): JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie (CVSS 7.5, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2026-3439](https://cve.now/CVE-2026-3439.md): A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall (CVSS 4.9, SonicWall SonicOS)
- [CVE-2026-27441](https://cve.now/CVE-2026-27441.md): PDF Password CMDi (CVSS 9.5, SEPPmail Secure Email Gateway)
- [CVE-2026-2748](https://cve.now/CVE-2026-2748.md): S/MIME Certificate Subject Whitespace (CVSS 7.8, SEPPmail Secure Email Gateway)
- [CVE-2026-27446](https://cve.now/CVE-2026-27446.md): Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation (CVSS 9.3, Apache Software Foundation Apache Artemis · Apache Softw… +2)
- [CVE-2026-27442](https://cve.now/CVE-2026-27442.md): zip\_attachments Path Traversal (CVSS 9.3, SEPPmail Secure Email Gateway)
- [CVE-2026-27445](https://cve.now/CVE-2026-27445.md): PGP Signature Reflection (CVSS 6.9, SEPPmail Secure Email Gateway)
- [CVE-2026-27444](https://cve.now/CVE-2026-27444.md): Header Email Address Parsing (CVSS 7.8, SEPPmail Secure Email Gateway)
- [CVE-2026-2747](https://cve.now/CVE-2026-2747.md): PGP Mixed Plaintext and Encrypted Content (CVSS 6.9, SEPPmail Secure Email Gateway)
- [CVE-2026-27443](https://cve.now/CVE-2026-27443.md): S/MIME Decryption Tag Sanitization Bypass (CVSS 8.2, SEPPmail Secure Email Gateway)
- [CVE-2025-66168](https://cve.now/CVE-2025-66168.md): Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated (CVSS 5.4, Apache Software Foundation Apache ActiveMQ · org.apache.… +2)
- [CVE-2026-2746](https://cve.now/CVE-2026-2746.md): Missing PGP Signature Tag (CVSS 6.9, SEPPmail Secure Email Gateway)
- [CVE-2026-3094](https://cve.now/CVE-2026-3094.md): File Parsing Out-Of-Bounds Write in CNCSoft-G2 (CVSS 7.8, deltaww CNCSoft-G2)
- [CVE-2026-1236](https://cve.now/CVE-2026-1236.md): Envira Gallery for WordPress \<= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified\_gallery\_theme' Parameter via REST API (CVSS 6.4, smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…)
- [CVE-2026-29120](https://cve.now/CVE-2026-29120.md): Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver (CVSS 9.2, International Datacasting IDC SFX2100 SuperFlex Satellite R…)
- [CVE-2026-29119](https://cve.now/CVE-2026-29119.md): Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver (CVSS 8.8, International Datacasting Corporation (IDC) SFX2100 Series…)
- [CVE-2026-28778](https://cve.now/CVE-2026-28778.md): Hardcoded FTP Credentials and LPE(via Insecure Permissions) for \`xd\` Local Account on IDC SFX2100 (CVSS 7.9, International Datacasting Corporation (IDC) IDC SFX2100 Sup…)
- [CVE-2026-28777](https://cve.now/CVE-2026-28777.md): Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver (CVSS 9.2, International Datacasting Corporation (IDC) SFX2100 Satelli…)
- [CVE-2026-28776](https://cve.now/CVE-2026-28776.md): Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver (CVSS 7.8, International Datacasting Corporation (IDC) IDC SFX2100 Sup…)
- [CVE-2026-28775](https://cve.now/CVE-2026-28775.md): Unauthenticated RCE via SNMP Default Writable Community String (CVSS 10.0, International Datacasting Corporation (IDC) SFX2100 Series…)
- [CVE-2026-28774](https://cve.now/CVE-2026-28774.md): Authenticated OS Command Injection via Traceroute Utility leads to Root RCE (CVSS 9.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28773](https://cve.now/CVE-2026-28773.md): Authenticated OS Command Injection via Ping Utility Leading to RCE as Root (CVSS 9.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28772](https://cve.now/CVE-2026-28772.md): Reflected XSS in IDC\_Logging Index endpoint (CVSS 5.1, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28771](https://cve.now/CVE-2026-28771.md): Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101 (CVSS 5.1, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28770](https://cve.now/CVE-2026-28770.md): XML injection In /IDC\_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101 (CVSS 5.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-28769](https://cve.now/CVE-2026-28769.md): LFI in /IDC\_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 101 (CVSS 5.3, International Datacasting Corporation (IDC) SFX Series Supe…)
- [CVE-2026-2732](https://cve.now/CVE-2026-2732.md): Enable Media Replace \<= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace (CVSS 5.4, shortpixel Enable Media Replace)
- [CVE-2026-2363](https://cve.now/CVE-2026-2363.md): WP-Members Membership Plugin \<= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order\_by' Shortcode Attribute (CVSS 6.5, cbutlerjr WP-Members Membership Plugin)
- [CVE-2026-2025](https://cve.now/CVE-2026-2025.md): Mail Mint \< 1.19.5 - Unauthenticated Emails Disclosure (CVSS 7.5, Mail Mint)
- [CVE-2026-2994](https://cve.now/CVE-2026-2994.md): Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3240](https://cve.now/CVE-2026-3240.md): Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3241](https://cve.now/CVE-2026-3241.md): Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block. (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3242](https://cve.now/CVE-2026-3242.md): Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3244](https://cve.now/CVE-2026-3244.md): Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2026-3452](https://cve.now/CVE-2026-3452.md): Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block. (CVSS 8.9, Concrete CMS · concrete5/concrete5)
- [CVE-2026-1651](https://cve.now/CVE-2026-1651.md): Email Subscribers & Newsletters \<= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow\_ids' Parameter (CVSS 6.5, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2026-2292](https://cve.now/CVE-2026-2292.md): Morkva UA Shipping \<= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field (CVSS 4.4, bandido Morkva UA Shipping)
- [CVE-2026-1273](https://cve.now/CVE-2026-1273.md): PostX \<= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints (CVSS 7.2, wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…)
- [CVE-2026-1980](https://cve.now/CVE-2026-1980.md): WPBookit \<= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure (CVSS 5.3, iqonicdesign WPBookit)
- [CVE-2026-2289](https://cve.now/CVE-2026-2289.md): Taskbuilder \<= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field (CVSS 4.4, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2026-1945](https://cve.now/CVE-2026-1945.md): WPBookit \<= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb\_user\_name' and 'wpb\_user\_email' Parameters (CVSS 7.2, iqonicdesign WPBookit)
- [CVE-2025-46108](https://cve.now/CVE-2025-46108.md): D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup. (CVSS 9.8)
- [CVE-2025-66678](https://cve.now/CVE-2025-66678.md): An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu (CVSS 9.8)
- [CVE-2025-66944](https://cve.now/CVE-2025-66944.md): SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query param (CVSS 9.8)
- [CVE-2025-69969](https://cve.now/CVE-2025-69969.md): A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebb (CVSS 9.6)
- [CVE-2025-70218](https://cve.now/CVE-2025-70218.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component. (CVSS 9.8)
- [CVE-2025-70219](https://cve.now/CVE-2025-70219.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot. (CVSS 9.8)
- [CVE-2025-70220](https://cve.now/CVE-2025-70220.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN\_wizard4. (CVSS 9.8)
- [CVE-2025-70221](https://cve.now/CVE-2025-70221.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin. (CVSS 9.8)
- [CVE-2025-70222](https://cve.now/CVE-2025-70222.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode. (CVSS 9.8)
- [CVE-2025-70223](https://cve.now/CVE-2025-70223.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork. (CVSS 9.8)
- [CVE-2025-70225](https://cve.now/CVE-2025-70225.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component (CVSS 9.8)
- [CVE-2025-70226](https://cve.now/CVE-2025-70226.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard. (CVSS 9.8)
- [CVE-2025-70341](https://cve.now/CVE-2025-70341.md): Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files. (CVSS 7.8)
- [CVE-2025-70342](https://cve.now/CVE-2025-70342.md): erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. (CVSS 6.6)
- [CVE-2026-26478](https://cve.now/CVE-2026-26478.md): A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a speci (CVSS 9.8)
- [CVE-2026-26514](https://cve.now/CVE-2026-26514.md): An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. (CVSS 7.5)
- [CVE-2026-26673](https://cve.now/CVE-2026-26673.md): An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.