CVEs published March 7, 2026
109 CVEs were published on March 7, 2026: 6 critical, 34 high.
- Published
- 109
- Critical
- 6
- High
- 34
- Medium
- 62
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 58
Most affected products
- Tencent WeKnora · github.com/Tencent/WeKnora
- 8
- Freedom Factory dGEN1
- 7
- ellite Wallos
- 5
- FlowiseAI Flowise · flowise
- 5
- Anhui Seeker Electronic Technology Co. XikeStor SKS8310-8X
- 4
- gravitl netmaker · github.com/gravitl/netmaker
- 4
- parse-community parse-server · parse-server
- 4
- Tenda FH451
- 3
- xlnt-community xlnt
- 3
- zitadel · github.com/zitadel/zitadel +1
- 3
Critical 6
- CVE-2026-30861WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration ValidationTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-30860WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query ToolTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-30863Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adaptersparse-community parse-server · parse-server
- CVE-2026-30832Soft Serve: SSRF via unvalidated LFS endpoint in repo importcharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2026-29191ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpointzitadel · github.com/zitadel/zitadel +1
- CVE-2026-25070XikeStor SKS8310-8X PingTestSet Command InjectionAnhui Seeker Electronic Technology Co. XikeStor SKS8310-8X
High 34
- CVE-2026-3679Tenda FH451 QuickIndex formQuickIndex stack-based overflowTenda FH451
- CVE-2026-3678Tenda FH451 AdvSetWan sub_3C434 stack-based overflowTenda FH451
- CVE-2026-3677Tenda FH451 setcfm fromSetCfm stack-based overflowTenda FH451
- CVE-2026-30855WeKnora: Broken Access Control in Tenant ManagementTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-30851Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalationcaddyserver caddy · github.com/caddyserver/caddy/v2 +1
- CVE-2026-29196Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keysgravitl netmaker · github.com/gravitl/netmaker
- CVE-2026-29194Netmaker: Insufficient Authorization in Host Token Verificationgravitl netmaker · github.com/gravitl/netmaker
- CVE-2026-30834PinchTab: SSRF with Full Response Exfiltration via Download Handlerpinchtab · github.com/pinchtab/pinchtab +1
- CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpathisaacs node-tar · tar
- CVE-2026-29784Ghost: Incomplete CSRF protections around OTC useTryGhost Ghost · ghost
- CVE-2026-29778pyLoad: Arbitrary File Write via Path Traversal in edit_package()pyload · pyload-ng
- CVE-2026-29779UptimeFlare: Montior config / Credentials in `workerConfig` exposed in client-side JavaScript bundlelyc8503 UptimeFlare
- CVE-2026-29771Netmaker: Denial of Service via Server Shutdown Endpointgravitl netmaker · github.com/gravitl/netmaker
- CVE-2026-29067ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Loginzitadel · github.com/zitadel/zitadel +1
- CVE-2026-29193ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2zitadel · github.com/zitadel/zitadel +1
- CVE-2026-29192ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeoverzitadel · github.com/zitadel/zitadel/v2 +1
- CVE-2026-29186@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Executionbackstage · @backstage/plugin-techdocs-node
- CVE-2026-2219It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data sDebian dpkg
- CVE-2026-1074WP App Bar <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' Parameterryscript WP App Bar
- CVE-2025-14675Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletionmetabox Meta Box · wpmetabox/meta-box
- CVE-2025-8899Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalationvideowhisper Paid Videochat Turnkey Site – HTML5 PPV Live W…
- CVE-2026-30840Wallos: Server-Side Request Forgery (SSRF) in Notification Testersellite Wallos
- CVE-2026-30828Wallos: SSRF via url parameter leading to File Traversalellite Wallos
- CVE-2026-30827express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting (all IPv4 clients share one bucket on dual-stack servers)express-rate-limit
- CVE-2026-30824Flowise: Missing Authentication on NVIDIA NIM EndpointsFlowiseAI Flowise · flowise
- CVE-2026-30823Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO ConfigurationFlowiseAI Flowise · flowise
- CVE-2026-30822Flowise: Mass Assignment in `/api/v1/leads` EndpointFlowiseAI Flowise · flowise
- CVE-2026-30821Flowise: Arbitrary File Upload via MIME SpoofingFlowiseAI Flowise · flowise
- CVE-2026-30820Flowise Authorization Bypass via Spoofed x-request-from HeaderFlowiseAI Flowise · flowise
- CVE-2026-3352Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Settingshahadul878 Easy PHP Settings
- CVE-2026-2020JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attributeskatox JS Archive List
- CVE-2025-14353ZIP Code Based Content Protection <= 1.0.2 - Unauthenticated SQL Injection via 'zipcode' Parameterpresstigers ZIP Code Based Content Protection
- CVE-2026-25072XikeStor SKS8310-8X Predictable Session IdentifiersAnhui Seeker Electronic Technology Co. XikeStor SKS8310-8X
- CVE-2026-25071XikeStor SKS8310-8X switch_config.src Missing AuthenticationAnhui Seeker Electronic Technology Co. XikeStor SKS8310-8X
Medium, low and unrated 69
- CVE-2026-3683bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgerybufanyun HotGo
- CVE-2026-3682welovemedia FFmate ffmpeg.go Execute argument injectionwelovemedia FFmate
- CVE-2026-3681welovemedia FFmate webhook.go fireWebhook server-side request forgerywelovemedia FFmate
- CVE-2026-3680RyuzakiShinji biome-mcp-server biome-mcp-server.ts command injectionRyuzakiShinji biome-mcp-server
- CVE-2026-3675Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppReceiver improper authorizationFreedom Factory dGEN1
- CVE-2026-3674Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorizationFreedom Factory dGEN1
- CVE-2026-3672JeecgBoot getDictItems isExistSqlInjectKeyword sql injectionJeecgBoot
- CVE-2026-3671Freedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorizationFreedom Factory dGEN1
- CVE-2026-3670Freedom Factory dGEN1 com.dgen.alarm improper authorizationFreedom Factory dGEN1
- CVE-2026-3669Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorizationFreedom Factory dGEN1
- CVE-2026-2671Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmissionMendi Neurofeedback Headset
- CVE-2026-30859WeKnora: Broken Access Control - Cross-Tenant Data ExposureTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-30858WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal ResourcesTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-30857WeKnora: Unauthorized Cross‑Tenant Knowledge Base CloningTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-30856WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt InjectionTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-30852Caddy: vars_regexp double-expands user input, leaking env vars and filescaddyserver caddy · github.com/caddyserver/caddy/v2 +1
- CVE-2026-30854Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabledparse-community parse-server · parse-server
- CVE-2026-30850Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationparse-community parse-server · parse-server
- CVE-2026-30848Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directoryparse-community parse-server · parse-server
- CVE-2026-29195Netmaker: Privilege Escalation from Admin to Super-Admin via User Updategravitl netmaker · github.com/gravitl/netmaker
- CVE-2026-29076cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsingyhirose cpp-httplib
- CVE-2026-3668Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access controlFreedom Factory dGEN1
- CVE-2026-30838league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag namesthephpleague commonmark · league/commonmark
- CVE-2026-29787mcp-memory-service: System Information Disclosure via Health Endpointdoobidoo mcp-memory-service · mcp-memory-service
- CVE-2026-3667Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorizationFreedom Factory dGEN1
- CVE-2026-3665xlnt-community xlnt XLSX File xlsx_consumer.cpp read_office_document null pointer dereferencexlnt-community xlnt
- CVE-2026-29781Sliver: Authenticated Nil-Pointer Dereference in HandlersBishopFox sliver · github.com/bishopfox/sliver
- CVE-2026-29780eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File WriteGOVCERT-LU eml_parser · eml-parser
- CVE-2026-29190Karapace: Path Traversal in Backup ReaderAiven-Open karapace
- CVE-2026-29184@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypassbackstage · @backstage/plugin-scaffolder-backend
- CVE-2026-29185@backstage/integration: Potential reading of SCM URLs using built in tokenbackstage · @backstage/integration
- CVE-2026-3664xlnt-community xlnt Encrypted XLSX File compound_document.cpp read_directory out-of-boundsxlnt-community xlnt
- CVE-2026-3663xlnt-community xlnt XLSX File compound_document.cpp xsgetn out-of-boundsxlnt-community xlnt
- CVE-2026-3662Wavlink WL-NU516U1 adm.cgi usb_p910 command injectionWavlink WL-NU516U1
- CVE-2026-3661Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injectionWavlink WL-NU516U1
- CVE-2026-24308Apache ZooKeeper: Sensitive information disclosure in client configuration handlingApache Software Foundation Apache ZooKeeper · org.apache.zo…
- CVE-2026-24281Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerApache Software Foundation Apache ZooKeeper · org.apache.zo…
- CVE-2026-1087The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Updateopenplatform The Guardian News Feed
- CVE-2026-1086Font Pairing Preview For Landing Pages <= 1.3 - Cross-Site Request Forgery to Settings Updatewpsolutions Font Pairing Preview For Landing Pages
- CVE-2026-1085True Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnectionoptimizza True Ranker
- CVE-2026-1825Show YouTube video <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributeminor Show YouTube video
- CVE-2026-1824Infomaniak Connect for OpenID <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesleopoldinfomaniak Infomaniak Connect for OpenID
- CVE-2026-1823Consensus Embed <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attributeconsensusintegrations Consensus Embed
- CVE-2026-1073Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Updatethemepul Purchase Button For Affiliate Link
- CVE-2026-1820Media Library Alt Text Editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_id' Shortcode Attributebrainvireinfo Media Library Alt Text Editor
- CVE-2026-1574MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedgamoni MyQtip – easy qTip2
- CVE-2026-1805DA Media GigList <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'list_title' Shortcode Attributedamedialimited DA Media GigList
- CVE-2026-1569Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcodenabeghe Wueen
- CVE-2026-2433RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessagerebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…
- CVE-2026-1071Carta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingscartaonline Carta Online
- CVE-2026-2420LotekMedia Popup Form <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsLotekMedia Popup Form
- CVE-2026-27796Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)homarr-labs homarr
- CVE-2026-27797Homarr: Unauthenticated SSRF in rssFeed.tshomarr-labs homarr
- CVE-2026-30830Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tagkepano defuddle · defuddle
- CVE-2026-30829Checkmate: Unauthenticated Access to Unpublished Status Pagebluewave-labs Checkmate
- CVE-2026-30842Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatarsellite Wallos
- CVE-2026-30841Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.phpellite Wallos
- CVE-2026-30839Wallos: SSRF via webhook test endpointellite Wallos
- CVE-2026-30825hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Tokenhoppscotch
- CVE-2026-30247WeKnora: SSRF via RedirectionTencent WeKnora · github.com/Tencent/WeKnora
- CVE-2026-2431CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameterscreativemindssolutions CM Custom Reports – Flexible reporti…
- CVE-2026-2722Stock Ticker <= 3.26.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Templateurkekg Stock Ticker
- CVE-2026-2721MailArchiver <= 4.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settingspierrelannoy MailArchiver
- CVE-2026-1650MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field DeletionMDJM Event Management
- CVE-2026-2429Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Fieldjackdewey Community Events
- CVE-2026-2494ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denialmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-2488ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletionmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-1902Hammas Calendar <= 1.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attributeinnovaatik Hammas Calendar
- CVE-2026-25073XikeStor SKS8310-8X Stored XSS via System NameAnhui Seeker Electronic Technology Co. XikeStor SKS8310-8X