# CVEs published 2026-03-06

184 CVEs were published on March 6, 2026: 22 critical, 89 high. Days are UTC.

- [CVE-2026-1981](https://cve.now/CVE-2026-1981.md): Winston AI \<= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion (CVSS 4.3, winstonai HUMN-1 AI Website Scanner & Human Certification b…)
- [CVE-2026-1644](https://cve.now/CVE-2026-1644.md): WP Frontend Profile \<= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection (CVSS 4.3, glowlogix WP Frontend Profile)
- [CVE-2026-2371](https://cve.now/CVE-2026-2371.md): Greenshift \<= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb\_el\_reusable\_load' (CVSS 5.3, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-27142](https://cve.now/CVE-2026-27142.md): URLs in meta content attribute actions are not escaped in html/template (CVSS 6.1, Go standard library html/template · stdlib)
- [CVE-2026-27139](https://cve.now/CVE-2026-27139.md): FileInfo can escape from a Root in os (CVSS 2.5, Go standard library os · stdlib)
- [CVE-2026-25679](https://cve.now/CVE-2026-25679.md): Incorrect parsing of IPv6 host literals in net/url (CVSS 7.5, Go standard library net/url · stdlib)
- [CVE-2026-27138](https://cve.now/CVE-2026-27138.md): Panic in name constraint checking for malformed certificates in crypto/x509 (CVSS 5.9, Go standard library crypto/x509 · stdlib)
- [CVE-2026-27137](https://cve.now/CVE-2026-27137.md): Incorrect enforcement of email constraints in crypto/x509 (CVSS 7.5, Go standard library crypto/x509 · stdlib)
- [CVE-2026-30242](https://cve.now/CVE-2026-30242.md): Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer (CVSS 8.5, makeplane plane · plane)
- [CVE-2026-30244](https://cve.now/CVE-2026-30244.md): Plane: Unauthenticated Workspace Member Information Disclosure (CVSS 7.5, makeplane plane · plane)
- [CVE-2026-30241](https://cve.now/CVE-2026-30241.md): Mercurius: queryDepth limit bypassed for WebSocket subscriptions (CVSS 2.7, mercurius-js mercurius · mercurius)
- [CVE-2026-30238](https://cve.now/CVE-2026-30238.md): Group-Office: Reflected XSS in JavaScript context (CVSS 5.1, Intermesh groupoffice)
- [CVE-2026-30237](https://cve.now/CVE-2026-30237.md): Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) (CVSS 2.1, Intermesh groupoffice)
- [CVE-2026-30231](https://cve.now/CVE-2026-30231.md): Flare: Private File IDOR via raw/direct endpoints (CVSS 6.0, FlintSH Flare)
- [CVE-2026-30230](https://cve.now/CVE-2026-30230.md): Flare: Password‑Protected Thumbnail Bypass (CVSS 8.2, FlintSH Flare)
- [CVE-2026-30227](https://cve.now/CVE-2026-30227.md): MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery (CVSS 6.9, jstedfast MimeKit · MimeKit)
- [CVE-2026-30233](https://cve.now/CVE-2026-30233.md): OliveTin: View permission not being checked when returning dashboards (CVSS 6.5, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-30225](https://cve.now/CVE-2026-30225.md): OliveTin: RestartAction always runs actions as guest (CVSS 5.3, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-30223](https://cve.now/CVE-2026-30223.md): OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes (CVSS 8.8, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-30224](https://cve.now/CVE-2026-30224.md): OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session (CVSS 5.4, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-29795](https://cve.now/CVE-2026-29795.md): stellar-xdr: \`StringM::from\_str\` bypasses max length validation (CVSS 4.0, rs-stellar-xdr · stellar-xdr)
- [CVE-2026-29791](https://cve.now/CVE-2026-29791.md): Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion (CVSS 4.9, agentgateway · github.com/agentgateway/agentgateway)
- [CVE-2026-29790](https://cve.now/CVE-2026-29790.md): dbt-common: commonprefix() doesn't protect against path traversal (CVSS 2.0, dbt-labs dbt-common · dbt-common)
- [CVE-2026-29789](https://cve.now/CVE-2026-29789.md): Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification (CVSS 10.0, vitodeploy vito)
- [CVE-2026-29788](https://cve.now/CVE-2026-29788.md): TSPortal: Anyone can forge self-deletion requests of any user (CVSS 8.4, miraheze TSPortal · miraheze/ts-portal)
- [CVE-2026-30835](https://cve.now/CVE-2026-30835.md): Parse Server: Malformed \`$regex\` query leaks database error details in API response (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-30229](https://cve.now/CVE-2026-30229.md): Parse Server: Endpoint \`/loginAs\` allows \`readOnlyMasterKey\` to gain full read and write access as any user (CVSS 8.5, parse-community parse-server · parse-server)
- [CVE-2026-30228](https://cve.now/CVE-2026-30228.md): Parse Server: File creation and deletion bypasses \`readOnlyMasterKey\` write restriction (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-29182](https://cve.now/CVE-2026-29182.md): Parse Server: Cloud Hooks and Cloud Jobs bypass \`readOnlyMasterKey\` write restriction (CVSS 8.6, parse-community parse-server · parse-server)
- [CVE-2026-30847](https://cve.now/CVE-2026-30847.md): Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens (CVSS 9.3, Wekan)
- [CVE-2026-30846](https://cve.now/CVE-2026-30846.md): Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication (CVSS 8.7, Wekan)
- [CVE-2026-30845](https://cve.now/CVE-2026-30845.md): Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication (CVSS 6.9, Wekan)
- [CVE-2026-30844](https://cve.now/CVE-2026-30844.md): Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading (CVSS 9.3, Wekan)
- [CVE-2026-30843](https://cve.now/CVE-2026-30843.md): Wekan has Cross-Board IDOR in Custom Fields Update Endpoints (CVSS 9.3, Wekan)
- [CVE-2026-29063](https://cve.now/CVE-2026-29063.md): Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable (CVSS 8.7, immutable-js · immutable)
- [CVE-2026-29178](https://cve.now/CVE-2026-29178.md): Lemmy: Unauthenticated SSRF via file\_type query parameter injection in image endpoint (CVSS 7.7, LemmyNet lemmy · lemmy\_routes)
- [CVE-2026-29110](https://cve.now/CVE-2026-29110.md): Cryptomator: Leaking of cleartext paths into log file in non-debug mode (CVSS 2.2, cryptomator)
- [CVE-2026-3419](https://cve.now/CVE-2026-3419.md): Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation (CVSS 5.3, fastify)
- [CVE-2026-29091](https://cve.now/CVE-2026-29091.md): Locutus: Remote Code Execution (RCE) in locutus call\_user\_func\_array due to Code Injection (CVSS 8.1, locutusjs locutus · locutus)
- [CVE-2026-30833](https://cve.now/CVE-2026-30833.md): Rocket.Chat: NoSQL injection in the EE ddp-streamer-service (CVSS 6.9, RocketChat Rocket.Chat)
- [CVE-2026-30831](https://cve.now/CVE-2026-30831.md): Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer (CVSS 8.0, RocketChat Rocket.Chat)
- [CVE-2026-28514](https://cve.now/CVE-2026-28514.md): Rocket.Chat: Users can login with any password via the EE ddp-streamer-service (CVSS 9.3, RocketChat Rocket.Chat)
- [CVE-2026-29089](https://cve.now/CVE-2026-29089.md): TimescaleDB uses untrusted search path during extension upgrade (CVSS 8.8, timescaledb)
- [CVE-2026-29087](https://cve.now/CVE-2026-29087.md): @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware (CVSS 7.5, honojs node-server · @hono/node-server)
- [CVE-2026-29783](https://cve.now/CVE-2026-29783.md): GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution (CVSS 7.5, github copilot-cli · @github/copilot)
- [CVE-2026-29082](https://cve.now/CVE-2026-29082.md): Kestra: Stored Cross-Site Scripting in Markdown File Preview (CVSS 7.3, kestra-io kestra)
- [CVE-2026-29075](https://cve.now/CVE-2026-29075.md): Mesa: Checking out of untrusted code in \`benchmarks.yml\` workflow may lead to code execution in privileged runner (CVSS 8.3, mesa)
- [CVE-2025-15602](https://cve.now/CVE-2025-15602.md): Snipe-IT \< 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation (CVSS 8.7, Grokability Snipe-IT · snipe/snipe-it)
- [CVE-2026-29064](https://cve.now/CVE-2026-29064.md): Zarf: Symlink targets in archives are not validated against destination directory (CVSS 8.2, zarf-dev zarf · github.com/zarf-dev/zarf/src/pkg/archive +1)
- [CVE-2026-26017](https://cve.now/CVE-2026-26017.md): CoreDNS ACL Bypass (CVSS 7.7, coredns · github.com/coredns/coredns)
- [CVE-2026-26018](https://cve.now/CVE-2026-26018.md): CoreDNS Loop Detection Denial of Service Vulnerability (CVSS 7.5, coredns · github.com/coredns/coredns)
- [CVE-2026-27027](https://cve.now/CVE-2026-27027.md): Everon api.everon.io Insufficiently Protected Credentials (CVSS 6.5, api.everon.io)
- [CVE-2026-20748](https://cve.now/CVE-2026-20748.md): Everon api.everon.io Insufficient Session Expiration (CVSS 7.3, api.everon.io)
- [CVE-2026-24696](https://cve.now/CVE-2026-24696.md): Everon api.everon.io Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, api.everon.io)
- [CVE-2026-26288](https://cve.now/CVE-2026-26288.md): Everon api.everon.io Missing Authentication for Critical Function (CVSS 9.4, api.everon.io)
- [CVE-2026-27777](https://cve.now/CVE-2026-27777.md): Mobiliti e-mobi.hu Insufficiently Protected Credentials (CVSS 6.5, Mobiliti e-mobi.hu)
- [CVE-2026-27764](https://cve.now/CVE-2026-27764.md): Mobiliti e-mobi.hu Insufficient Session Expiration (CVSS 7.3, Mobiliti e-mobi.hu)
- [CVE-2026-20882](https://cve.now/CVE-2026-20882.md): Mobiliti e-mobi.hu Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, Mobiliti e-mobi.hu)
- [CVE-2026-2754](https://cve.now/CVE-2026-2754.md): Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. (CVSS 7.5, Navtor NavBox)
- [CVE-2026-2753](https://cve.now/CVE-2026-2753.md): An Absolute Path Traversal vulnerability exists in Navtor NavBox. (CVSS 7.5, Navtor NavBox)
- [CVE-2026-2752](https://cve.now/CVE-2026-2752.md): Navtor NavBox allows information disclosure via the /api/ais-data endpoint. (CVSS 5.3, Navtor NavBox)
- [CVE-2026-26051](https://cve.now/CVE-2026-26051.md): Mobiliti e-mobi.hu Missing Authentication for Critical Function (CVSS 9.4, Mobiliti e-mobi.hu)
- [CVE-2018-25200](https://cve.now/CVE-2018-25200.md): OOP CMS BLOG 1.0 Cross-Site Request Forgery via addUser.php (CVSS 6.9, Zsoft OOP CMS BLOG)
- [CVE-2018-25199](https://cve.now/CVE-2018-25199.md): OOP CMS BLOG 1.0 SQL Injection via search parameter (CVSS 8.8, Zsoft OOP CMS BLOG)
- [CVE-2018-25198](https://cve.now/CVE-2018-25198.md): eToolz 3.4.8.0 Denial of Service via Buffer Overflow (CVSS 6.9, Gaijin eToolz)
- [CVE-2018-25197](https://cve.now/CVE-2018-25197.md): PlayJoom 0.10.1 SQL Injection via catid Parameter (CVSS 8.8, PlayJoom)
- [CVE-2018-25196](https://cve.now/CVE-2018-25196.md): ServerZilla 1.0 SQL Injection via email Parameter (CVSS 8.8, ServerZilla)
- [CVE-2018-25194](https://cve.now/CVE-2018-25194.md): Nominas 0.27 SQL Injection via username Parameter (CVSS 8.8, Arixolab Nominas)
- [CVE-2018-25193](https://cve.now/CVE-2018-25193.md): Mongoose Web Server 6.9 Denial of Service via Socket Connection (CVSS 8.7, Cesanta Mongoose Web Server)
- [CVE-2018-25192](https://cve.now/CVE-2018-25192.md): GPS Tracking System 2.12 SQL Injection via username Parameter (CVSS 8.8, Sourceforge GPS Tracking System)
- [CVE-2018-25191](https://cve.now/CVE-2018-25191.md): Facturation System 1.0 SQL Injection via editar\_producto.php (CVSS 7.1, Obedalvarado Facturation System)
- [CVE-2018-25190](https://cve.now/CVE-2018-25190.md): Easyndexer 1.0 Cross-Site Request Forgery via createuser.php (CVSS 6.9, Sourceforge Easyndexer)
- [CVE-2018-25189](https://cve.now/CVE-2018-25189.md): Data Center Audit 2.6.2 SQL Injection via username Parameter (CVSS 8.8, Sourceforge Data Center Audit)
- [CVE-2018-25188](https://cve.now/CVE-2018-25188.md): Webiness Inventory 2.3 SQL Injection via WsModelGrid.php (CVSS 8.8, Github Webiness Inventory)
- [CVE-2018-25187](https://cve.now/CVE-2018-25187.md): Tina4 Stack 1.0.3 SQL Injection and Database File Download (CVSS 8.8, Tina4 Stack)
- [CVE-2018-25186](https://cve.now/CVE-2018-25186.md): Tina4 Stack 1.0.3 Cross-Site Request Forgery via profile (CVSS 6.9, Tina4 Stack)
- [CVE-2018-25184](https://cve.now/CVE-2018-25184.md): Surreal ToDo 0.6.1.2 Local File Inclusion via index.php (CVSS 6.9, Getsurreal Surreal ToDo)
- [CVE-2018-25182](https://cve.now/CVE-2018-25182.md): Silurus Classifieds Script 2.0 SQL Injection via wcategory.php (CVSS 8.8, Snowhall Silurus Classifieds Script)
- [CVE-2018-25181](https://cve.now/CVE-2018-25181.md): Musicco 2.0.0 Arbitrary Directory Download via Path Traversal (CVSS 8.7, Musicco)
- [CVE-2018-25180](https://cve.now/CVE-2018-25180.md): Maitra 1.7.2 SQL Injection and Database File Download (CVSS 7.1, Salzertechnologies Maitra)
- [CVE-2018-25179](https://cve.now/CVE-2018-25179.md): Gumbo CMS 0.99 SQL Injection via settings endpoint (CVSS 8.8, Gumbo-Cms Gumbo CMS)
- [CVE-2018-25178](https://cve.now/CVE-2018-25178.md): Easyndexer 1.0 Arbitrary File Download via showtif.php (CVSS 8.7, Sourceforge Easyndexer)
- [CVE-2018-25177](https://cve.now/CVE-2018-25177.md): Data Center Audit 2.6.2 Cross-Site Request Forgery via dca\_resetpw.php (CVSS 6.9, Sourceforge Data Center Audit)
- [CVE-2018-25176](https://cve.now/CVE-2018-25176.md): Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload (CVSS 8.8, Demo Alive Parish)
- [CVE-2018-25175](https://cve.now/CVE-2018-25175.md): Alienor Web Libre 2.0 SQL Injection via index.php (CVSS 8.8, Alienor Web Libre)
- [CVE-2018-25174](https://cve.now/CVE-2018-25174.md): ABC ERP 0.6.4 Cross-Site Request Forgery via \_configurar\_perfil.php (CVSS 6.9, Abc-Erp ABC ERP)
- [CVE-2018-25173](https://cve.now/CVE-2018-25173.md): Rmedia SMS 1.0 SQL Injection via editgrp.php (CVSS 8.8, Rmedia SMS)
- [CVE-2018-25172](https://cve.now/CVE-2018-25172.md): Pedidos 1.0 SQL Injection via load\_proveedores.php (CVSS 8.8, Obedalvarado Pedidos)
- [CVE-2018-25171](https://cve.now/CVE-2018-25171.md): EdTv 2 SQL Injection via id Parameter (CVSS 8.8, EdTv)
- [CVE-2018-25170](https://cve.now/CVE-2018-25170.md): DoceboLMS 1.2 SQL Injection via lesson.php (CVSS 8.8, Spaghettilearning DoceboLMS)
- [CVE-2018-25169](https://cve.now/CVE-2018-25169.md): AMPPS 2.7 Denial of Service via Malformed Socket Connection (CVSS 8.7, AMPPS)
- [CVE-2018-25168](https://cve.now/CVE-2018-25168.md): Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin (CVSS 5.3, Precurio Intranet Portal)
- [CVE-2018-25167](https://cve.now/CVE-2018-25167.md): Net-Billetterie 2.9 SQL Injection via login.inc.php (CVSS 8.8, Net-Billetterie Billetterie)
- [CVE-2018-25166](https://cve.now/CVE-2018-25166.md): Meneame English Pligg 5.8 SQL Injection via search Parameter (CVSS 8.8, Sourceforge Meneame English Pligg)
- [CVE-2018-25165](https://cve.now/CVE-2018-25165.md): Galaxy Forces MMORPG 0.5.8 SQL Injection via ads.php (CVSS 7.1, Galaxy Forces MMORPG)
- [CVE-2018-25164](https://cve.now/CVE-2018-25164.md): EverSync 0.5 Arbitrary File Download via files Directory (CVSS 8.7, Phpmassmail EverSync)
- [CVE-2018-25163](https://cve.now/CVE-2018-25163.md): BitZoom 1.0 SQL Injection via rollno Parameter (CVSS 8.8, BitZoom)
- [CVE-2018-25162](https://cve.now/CVE-2018-25162.md): 2-Plan Team 1.0.4 Arbitrary File Upload via managefile.php (CVSS 7.1, 2-Plan Plan Team)
- [CVE-2018-25161](https://cve.now/CVE-2018-25161.md): Warranty Tracking System 11.06.3 SQL Injection via SearchCustomer.php (CVSS 8.8, Warrantytrack Warranty Tracking System)
- [CVE-2026-28080](https://cve.now/CVE-2026-28080.md): WordPress Rank Math SEO PRO plugin \<= 3.0.95 - Broken Access Control vulnerability (CVSS 4.3, Rank Math SEO PRO)
- [CVE-2026-28106](https://cve.now/CVE-2026-28106.md): WordPress B2BKing Premium plugin \< 5.4.20 - Open Redirection vulnerability (CVSS 4.7, Kings Plugins B2BKing Premium)
- [CVE-2024-35644](https://cve.now/CVE-2024-35644.md): WordPress Preferred Languages plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pascal Birchler Preferred Languages)
- [CVE-2026-1468](https://cve.now/CVE-2026-1468.md): Cross-Site Request Forgery in QuickCMS (CVSS 5.1, OpenSolution QuickCMS)
- [CVE-2026-3589](https://cve.now/CVE-2026-3589.md): WooCommerce \< 10.5.3 - Arbitrary Admin User Creation via CSRF (CVSS 7.5, Automattic WooCommerce)
- [CVE-2026-23925](https://cve.now/CVE-2026-23925.md): Unauthorized host creation via configuration.import API by low-privilege user with write permissions (CVSS 5.1, Zabbix)
- [CVE-2026-2331](https://cve.now/CVE-2026-2331.md): CVE-2026-2331 (CVSS 9.8, SICK AG SICK Lector85x · SICK AG SICK Lector83x)
- [CVE-2026-2330](https://cve.now/CVE-2026-2330.md): CVE-2026-2330 (CVSS 9.4, SICK AG SICK Lector85x · SICK AG SICK Lector83x)
- [CVE-2026-29074](https://cve.now/CVE-2026-29074.md): SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) (CVSS 7.5, svgo)
- [CVE-2026-2830](https://cve.now/CVE-2026-2830.md): WP All Import \<= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' (CVSS 6.1, wpallimport WP All Import – Drag & Drop Import for CSV, XML…)
- [CVE-2026-29183](https://cve.now/CVE-2026-29183.md): SiYuan: Unauthenticated reflected SVG XSS in \`/api/icon/getDynamicIcon\` (\`type=8\`) enables arbitrary JavaScript execution (CVSS 9.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-29073](https://cve.now/CVE-2026-29073.md): SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access (CVSS 5.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-29062](https://cve.now/CVE-2026-29062.md): jackson-core: Nesting Depth Constraint Bypass in \`UTF8DataInputJsonParser\` potentially allowing Resource Exhaustion (CVSS 8.7, FasterXML jackson-core · tools.jackson.core:jackson-core)
- [CVE-2026-29059](https://cve.now/CVE-2026-29059.md): Windmill: SUPERADMIN\_SECRET (rarely used) can be accessed publicly (CVSS 6.9, windmill-labs windmill)
- [CVE-2026-29058](https://cve.now/CVE-2026-29058.md): AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php (CVSS 9.8, WWBN AVideo-Encoder · wwbn/avideo)
- [CVE-2026-29049](https://cve.now/CVE-2026-29049.md): melange: unbounded HTTP download in \`melange update-cache\` can exhaust disk in CI (CVSS 4.3, chainguard-dev melange · chainguard.dev/melange)
- [CVE-2026-29048](https://cve.now/CVE-2026-29048.md): HumHub: XSS in Button component (CVSS 6.9, humhub)
- [CVE-2026-29042](https://cve.now/CVE-2026-29042.md): Nuclio Shell Runtime Command Injection Leading to Privilege Escalation (CVSS 8.9, nuclio · github.com/nuclio/nuclio)
- [CVE-2026-29065](https://cve.now/CVE-2026-29065.md): changedetection.io: Zip Slip vulnerability in the backup restore functionality (CVSS 8.8, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2026-29039](https://cve.now/CVE-2026-29039.md): changedetection.io: XPath - Arbitrary File Read via unparsed-text() (CVSS 8.8, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2026-29038](https://cve.now/CVE-2026-29038.md): changedetection.io: Reflected XSS in RSS Tag Error Response (CVSS 6.1, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2026-28804](https://cve.now/CVE-2026-28804.md): pypdf: Inefficient decoding of ASCIIHexDecode streams (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-28802](https://cve.now/CVE-2026-28802.md): Authlib: Setting \`alg: none\` and a blank signature appears to bypass signature verification (CVSS 7.7, authlib)
- [CVE-2026-28801](https://cve.now/CVE-2026-28801.md): Natro Macro: Code Injection through Pattern/Path files (CVSS 6.6, NatroTeam NatroMacro)
- [CVE-2026-28800](https://cve.now/CVE-2026-28800.md): Natro Macro: Malicious actions allowed through Discord RC Commands by any user (CVSS 6.4, NatroTeam NatroMacro)
- [CVE-2026-28438](https://cve.now/CVE-2026-28438.md): CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements (CVSS 6.9, cocoindex-io cocoindex · cocoindex)
- [CVE-2026-28799](https://cve.now/CVE-2026-28799.md): PJSIP: Heap use-after-free in PJSIP presence subscription termination handler (CVSS 8.7, pjsip pjproject)
- [CVE-2026-29068](https://cve.now/CVE-2026-29068.md): PJSIP: Stack buffer overflow in Opus codec parser (CVSS 8.7, pjsip pjproject)
- [CVE-2026-28795](https://cve.now/CVE-2026-28795.md): OpenChatBI: Critical Path Traversal Vulnerability in save\_report Tool of OpenChatBI (CVSS 8.7, zhongyu09 openchatbi · openchatbi)
- [CVE-2026-2446](https://cve.now/CVE-2026-2446.md): Powerpack for LearnDash \< 1.3.0 - Unauthenticated Arbitrary Option Update (CVSS 9.8, PowerPack for LearnDash)
- [CVE-2026-1128](https://cve.now/CVE-2026-1128.md): WP eCommerce \<= 3.15.1 - Coupon Deletion via CSRF (CVSS 4.3, WP eCommerce)
- [CVE-2026-28794](https://cve.now/CVE-2026-28794.md): oRPC: Prototype Pollution in \`@orpc/client\` via \`StandardRPCJsonSerializer\` Deserialization (CVSS 9.3, middleapi orpc · @orpc/client)
- [CVE-2026-28428](https://cve.now/CVE-2026-28428.md): Talishar: Authentication Bypass via Empty authKey Parameter Allows Unauthenticated Game Actions (CVSS 5.3, Talishar)
- [CVE-2026-28429](https://cve.now/CVE-2026-28429.md): Talishar: Critical Path Traversal in gameName Parameter (CVSS 7.5, Talishar)
- [CVE-2026-28787](https://cve.now/CVE-2026-28787.md): OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay (CVSS 8.2, oneuptime · @oneuptime/common)
- [CVE-2026-28685](https://cve.now/CVE-2026-28685.md): Kimai: API invoice endpoint missing customer-level access control (IDOR) (CVSS 6.5, kimai · kimai/kimai)
- [CVE-2026-29084](https://cve.now/CVE-2026-29084.md): Gokapi: CSRF in Login Endpoint (CVSS 4.6, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2026-29061](https://cve.now/CVE-2026-29061.md): Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion (CVSS 5.4, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2026-29060](https://cve.now/CVE-2026-29060.md): Gokapi: Privilege escalation with auth token (CVSS 5.0, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2026-28683](https://cve.now/CVE-2026-28683.md): Gokapi: Stored XSS in SVG Hotlinks (CVSS 8.7, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2026-28682](https://cve.now/CVE-2026-28682.md): Gokapi: Data Leak in Upload Status Stream (CVSS 6.4, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2026-28681](https://cve.now/CVE-2026-28681.md): IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links (CVSS 8.1, irrdnet irrd · irrd)
- [CVE-2026-28679](https://cve.now/CVE-2026-28679.md): HomeGallery: Path Traversal (Arbitrary File Read) (CVSS 8.6, xemle home-gallery)
- [CVE-2026-28785](https://cve.now/CVE-2026-28785.md): Ghostfolio: Time-Based Blind SQL Injection in Manual Asset Import (CVSS 9.3, ghostfolio)
- [CVE-2026-28680](https://cve.now/CVE-2026-28680.md): Ghostfolio: Full-Read SSRF in Manual Asset Import (CVSS 9.3, ghostfolio)
- [CVE-2026-28677](https://cve.now/CVE-2026-28677.md): OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access (CVSS 8.2, OpenSift)
- [CVE-2026-28676](https://cve.now/CVE-2026-28676.md): OpenSift: Insufficient path containment checks in storage helpers could allow path traversal-style file operations (CVSS 8.8, OpenSift)
- [CVE-2026-28675](https://cve.now/CVE-2026-28675.md): OpenSift: Sensitive implementation details exposed via raw exception messages and token-returning endpoints (CVSS 5.3, OpenSift)
- [CVE-2026-28509](https://cve.now/CVE-2026-28509.md): LangBot has a Cross Site Scripting(XSS) Vulnerability (CVSS 6.3, langbot-app LangBot)
- [CVE-2026-28508](https://cve.now/CVE-2026-28508.md): Idno: Unauthenticated SSRF via URL Unfurl Endpoint (CVSS 9.2, idno · idno/known)
- [CVE-2026-28507](https://cve.now/CVE-2026-28507.md): Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal (CVSS 8.6, idno · idno/known)
- [CVE-2026-27605](https://cve.now/CVE-2026-27605.md): Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API (CVSS 6.3, chartbrew)
- [CVE-2026-27603](https://cve.now/CVE-2026-27603.md): Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project\_id/chart/:chart\_id/filter missing verifyToken + checkPermissions (CVSS 8.7, chartbrew)
- [CVE-2026-27005](https://cve.now/CVE-2026-27005.md): Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) (CVSS 8.8, chartbrew)
- [CVE-2026-25888](https://cve.now/CVE-2026-25888.md): Chartbrew: Remote Code Execution (RCE) via Vulnerable API (CVSS 8.8, chartbrew)
- [CVE-2026-25887](https://cve.now/CVE-2026-25887.md): Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query (CVSS 7.2, chartbrew)
- [CVE-2026-25877](https://cve.now/CVE-2026-25877.md): Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations (CVSS 6.5, chartbrew)
- [CVE-2026-29041](https://cve.now/CVE-2026-29041.md): Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload (CVSS 8.8, chamilo-lms)
- [CVE-2025-59544](https://cve.now/CVE-2025-59544.md): Chamilo: Unauthorized access to update category of any user (CVSS 6.9, chamilo-lms)
- [CVE-2025-59543](https://cve.now/CVE-2025-59543.md): Chamilo: Account Takeover via Stored XSS in Course Description (CVSS 9.1, chamilo-lms)
- [CVE-2025-59542](https://cve.now/CVE-2025-59542.md): Chamilo: Account Takeover via Stored XSS in Course Learning Paths (CVSS 9.1, chamilo-lms)
- [CVE-2025-59541](https://cve.now/CVE-2025-59541.md): Chamilo: CSRF Vulnerability in Project Deletion (CVSS 8.1, chamilo-lms)
- [CVE-2025-59540](https://cve.now/CVE-2025-59540.md): Chamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback (CVSS 6.4, chamilo-lms)
- [CVE-2025-55289](https://cve.now/CVE-2025-55289.md): Chamilo: Stored Cross Site Scripting in Skills Argumentation (CVSS 8.8, chamilo-lms)
- [CVE-2026-28501](https://cve.now/CVE-2026-28501.md): WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php (CVSS 9.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-28502](https://cve.now/CVE-2026-28502.md): WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction (CVSS 9.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-29093](https://cve.now/CVE-2026-29093.md): WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-29046](https://cve.now/CVE-2026-29046.md): TinyWeb: HTTP Header Control Character Injection into CGI Environment (CVSS 9.2, maximmasiutin TinyWeb)
- [CVE-2026-28497](https://cve.now/CVE-2026-28497.md): TinyWeb: Integer Overflow in \`\_Val\` (HTTP Request Smuggling) (CVSS 9.3, maximmasiutin TinyWeb)
- [CVE-2026-25962](https://cve.now/CVE-2026-25962.md): MarkUs: Zip bomb in config upload enables DoS (CVSS 6.5, MarkUsProject Markus)
- [CVE-2026-27807](https://cve.now/CVE-2026-27807.md): MarkUs: YAML alias (‘billion laughs’) DoS in config upload (CVSS 4.9, MarkUsProject Markus)
- [CVE-2026-3616](https://cve.now/CVE-2026-3616.md): DefaultFuction Jeson Customer Relationship Management System edit.php sql injection (CVSS 5.3, DefaultFuction Jeson Customer Relationship Management System)
- [CVE-2026-3613](https://cve.now/CVE-2026-3613.md): Wavlink WL-NU516U1 login.cgi sub\_401A0C stack-based overflow (CVSS 8.6, Wavlink WL-NU516U1)
- [CVE-2026-3612](https://cve.now/CVE-2026-3612.md): Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub\_405AF4 command injection (CVSS 8.6, Wavlink WL-NU516U1)
- [CVE-2026-3610](https://cve.now/CVE-2026-3610.md): HSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting (CVSS 5.3, HSC Cybersecurity Mailinspector)
- [CVE-2025-69644](https://cve.now/CVE-2025-69644.md): An issue was discovered in Binutils before 2.46. (CVSS 5.0)
- [CVE-2025-69645](https://cve.now/CVE-2025-69645.md): Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. (CVSS 5.5)
- [CVE-2025-69646](https://cve.now/CVE-2025-69646.md): Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug\_rnglists data. (CVSS 5.5)
- [CVE-2025-69649](https://cve.now/CVE-2025-69649.md): GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header (CVSS 5.5)
- [CVE-2025-69650](https://cve.now/CVE-2025-69650.md): GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. (CVSS 7.5)
- [CVE-2025-69651](https://cve.now/CVE-2025-69651.md): GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malf (CVSS 5.5)
- [CVE-2025-69652](https://cve.now/CVE-2025-69652.md): GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed (CVSS 6.2)
- [CVE-2025-69653](https://cve.now/CVE-2025-69653.md): A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70 (CVSS 6.5)
- [CVE-2025-69654](https://cve.now/CVE-2025-69654.md): A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-1 (CVSS 7.5)
- [CVE-2025-70363](https://cve.now/CVE-2025-70363.md): Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.