# CVEs published 2026-03-07

109 CVEs were published on March 7, 2026: 6 critical, 34 high. Days are UTC.

- [CVE-2026-3683](https://cve.now/CVE-2026-3683.md): bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery (CVSS 5.3, bufanyun HotGo)
- [CVE-2026-3682](https://cve.now/CVE-2026-3682.md): welovemedia FFmate ffmpeg.go Execute argument injection (CVSS 5.3, welovemedia FFmate)
- [CVE-2026-3681](https://cve.now/CVE-2026-3681.md): welovemedia FFmate webhook.go fireWebhook server-side request forgery (CVSS 5.3, welovemedia FFmate)
- [CVE-2026-3680](https://cve.now/CVE-2026-3680.md): RyuzakiShinji biome-mcp-server biome-mcp-server.ts command injection (CVSS 5.3, RyuzakiShinji biome-mcp-server)
- [CVE-2026-3679](https://cve.now/CVE-2026-3679.md): Tenda FH451 QuickIndex formQuickIndex stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2026-3678](https://cve.now/CVE-2026-3678.md): Tenda FH451 AdvSetWan sub\_3C434 stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2026-3677](https://cve.now/CVE-2026-3677.md): Tenda FH451 setcfm fromSetCfm stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2026-3675](https://cve.now/CVE-2026-3675.md): Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppReceiver improper authorization (CVSS 4.8, Freedom Factory dGEN1)
- [CVE-2026-3674](https://cve.now/CVE-2026-3674.md): Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorization (CVSS 4.8, Freedom Factory dGEN1)
- [CVE-2026-3672](https://cve.now/CVE-2026-3672.md): JeecgBoot getDictItems isExistSqlInjectKeyword sql injection (CVSS 5.3, JeecgBoot)
- [CVE-2026-3671](https://cve.now/CVE-2026-3671.md): Freedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorization (CVSS 4.8, Freedom Factory dGEN1)
- [CVE-2026-3670](https://cve.now/CVE-2026-3670.md): Freedom Factory dGEN1 com.dgen.alarm improper authorization (CVSS 4.8, Freedom Factory dGEN1)
- [CVE-2026-3669](https://cve.now/CVE-2026-3669.md): Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorization (CVSS 4.8, Freedom Factory dGEN1)
- [CVE-2026-2671](https://cve.now/CVE-2026-2671.md): Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission (CVSS 2.3, Mendi Neurofeedback Headset)
- [CVE-2026-30861](https://cve.now/CVE-2026-30861.md): WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation (CVSS 10.0, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-30860](https://cve.now/CVE-2026-30860.md): WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool (CVSS 10.0, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-30859](https://cve.now/CVE-2026-30859.md): WeKnora: Broken Access Control - Cross-Tenant Data Exposure (CVSS 5.3, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-30858](https://cve.now/CVE-2026-30858.md): WeKnora: DNS Rebinding Vulnerability in web\_fetch Tool Allows SSRF to Internal Resources (CVSS 6.5, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-30857](https://cve.now/CVE-2026-30857.md): WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning (CVSS 5.3, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-30856](https://cve.now/CVE-2026-30856.md): WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection (CVSS 5.9, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-30855](https://cve.now/CVE-2026-30855.md): WeKnora: Broken Access Control in Tenant Management (CVSS 8.8, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-30851](https://cve.now/CVE-2026-30851.md): Caddy forward\_auth copy\_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation (CVSS 8.1, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2026-30852](https://cve.now/CVE-2026-30852.md): Caddy: vars\_regexp double-expands user input, leaking env vars and files (CVSS 5.5, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2026-30854](https://cve.now/CVE-2026-30854.md): Parse Server: GraphQL \`\_\_type\` introspection bypass via inline fragments when public introspection is disabled (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-30850](https://cve.now/CVE-2026-30850.md): Parse Server: File metadata endpoint bypasses \`beforeFind\` / \`afterFind\` trigger authorization (CVSS 6.3, parse-community parse-server · parse-server)
- [CVE-2026-30848](https://cve.now/CVE-2026-30848.md): Parse Server: \`PagesRouter\` path traversal allows reading files outside configured pages directory (CVSS 6.3, parse-community parse-server · parse-server)
- [CVE-2026-30863](https://cve.now/CVE-2026-30863.md): Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters (CVSS 9.3, parse-community parse-server · parse-server)
- [CVE-2026-29196](https://cve.now/CVE-2026-29196.md): Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys (CVSS 8.7, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2026-29195](https://cve.now/CVE-2026-29195.md): Netmaker: Privilege Escalation from Admin to Super-Admin via User Update (CVSS 6.9, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2026-29194](https://cve.now/CVE-2026-29194.md): Netmaker: Insufficient Authorization in Host Token Verification (CVSS 8.6, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2026-29076](https://cve.now/CVE-2026-29076.md): cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing (CVSS 5.9, yhirose cpp-httplib)
- [CVE-2026-3668](https://cve.now/CVE-2026-3668.md): Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control (CVSS 2.3, Freedom Factory dGEN1)
- [CVE-2026-30838](https://cve.now/CVE-2026-30838.md): league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names (CVSS 5.1, thephpleague commonmark · league/commonmark)
- [CVE-2026-30832](https://cve.now/CVE-2026-30832.md): Soft Serve: SSRF via unvalidated LFS endpoint in repo import (CVSS 9.1, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2026-30834](https://cve.now/CVE-2026-30834.md): PinchTab: SSRF with Full Response Exfiltration via Download Handler (CVSS 7.5, pinchtab · github.com/pinchtab/pinchtab +1)
- [CVE-2026-29787](https://cve.now/CVE-2026-29787.md): mcp-memory-service: System Information Disclosure via Health Endpoint (CVSS 5.3, doobidoo mcp-memory-service · mcp-memory-service)
- [CVE-2026-29786](https://cve.now/CVE-2026-29786.md): node-tar: Hardlink Path Traversal via Drive-Relative Linkpath (CVSS 8.2, isaacs node-tar · tar)
- [CVE-2026-3667](https://cve.now/CVE-2026-3667.md): Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorization (CVSS 4.8, Freedom Factory dGEN1)
- [CVE-2026-3665](https://cve.now/CVE-2026-3665.md): xlnt-community xlnt XLSX File xlsx\_consumer.cpp read\_office\_document null pointer dereference (CVSS 4.8, xlnt-community xlnt)
- [CVE-2026-29784](https://cve.now/CVE-2026-29784.md): Ghost: Incomplete CSRF protections around OTC use (CVSS 7.5, TryGhost Ghost · ghost)
- [CVE-2026-29778](https://cve.now/CVE-2026-29778.md): pyLoad: Arbitrary File Write via Path Traversal in edit\_package() (CVSS 7.1, pyload · pyload-ng)
- [CVE-2026-29781](https://cve.now/CVE-2026-29781.md): Sliver: Authenticated Nil-Pointer Dereference in Handlers (CVSS 2.1, BishopFox sliver · github.com/bishopfox/sliver)
- [CVE-2026-29780](https://cve.now/CVE-2026-29780.md): eml\_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write (CVSS 5.5, GOVCERT-LU eml\_parser · eml-parser)
- [CVE-2026-29779](https://cve.now/CVE-2026-29779.md): UptimeFlare: Montior config / Credentials in \`workerConfig\` exposed in client-side JavaScript bundle (CVSS 7.5, lyc8503 UptimeFlare)
- [CVE-2026-29190](https://cve.now/CVE-2026-29190.md): Karapace: Path Traversal in Backup Reader (CVSS 4.1, Aiven-Open karapace)
- [CVE-2026-29771](https://cve.now/CVE-2026-29771.md): Netmaker: Denial of Service via Server Shutdown Endpoint (CVSS 8.7, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2026-29067](https://cve.now/CVE-2026-29067.md): ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login (CVSS 8.1, zitadel · github.com/zitadel/zitadel +1)
- [CVE-2026-29193](https://cve.now/CVE-2026-29193.md): ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 (CVSS 8.2, zitadel · github.com/zitadel/zitadel +1)
- [CVE-2026-29192](https://cve.now/CVE-2026-29192.md): ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover (CVSS 7.7, zitadel · github.com/zitadel/zitadel/v2 +1)
- [CVE-2026-29191](https://cve.now/CVE-2026-29191.md): ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint (CVSS 9.3, zitadel · github.com/zitadel/zitadel +1)
- [CVE-2026-29186](https://cve.now/CVE-2026-29186.md): @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution (CVSS 7.7, backstage · @backstage/plugin-techdocs-node)
- [CVE-2026-29184](https://cve.now/CVE-2026-29184.md): @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass (CVSS 2.0, backstage · @backstage/plugin-scaffolder-backend)
- [CVE-2026-29185](https://cve.now/CVE-2026-29185.md): @backstage/integration: Potential reading of SCM URLs using built in token (CVSS 2.7, backstage · @backstage/integration)
- [CVE-2026-3664](https://cve.now/CVE-2026-3664.md): xlnt-community xlnt Encrypted XLSX File compound\_document.cpp read\_directory out-of-bounds (CVSS 4.8, xlnt-community xlnt)
- [CVE-2026-3663](https://cve.now/CVE-2026-3663.md): xlnt-community xlnt XLSX File compound\_document.cpp xsgetn out-of-bounds (CVSS 4.8, xlnt-community xlnt)
- [CVE-2026-3662](https://cve.now/CVE-2026-3662.md): Wavlink WL-NU516U1 adm.cgi usb\_p910 command injection (CVSS 5.1, Wavlink WL-NU516U1)
- [CVE-2026-3661](https://cve.now/CVE-2026-3661.md): Wavlink WL-NU516U1 adm.cgi ota\_new\_upgrade command injection (CVSS 5.1, Wavlink WL-NU516U1)
- [CVE-2026-24308](https://cve.now/CVE-2026-24308.md): Apache ZooKeeper: Sensitive information disclosure in client configuration handling (CVSS 6.5, Apache Software Foundation Apache ZooKeeper · org.apache.zo…)
- [CVE-2026-24281](https://cve.now/CVE-2026-24281.md): Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager (CVSS 5.9, Apache Software Foundation Apache ZooKeeper · org.apache.zo…)
- [CVE-2026-2219](https://cve.now/CVE-2026-2219.md): It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data s (CVSS 7.5, Debian dpkg)
- [CVE-2026-1087](https://cve.now/CVE-2026-1087.md): The Guardian News Feed \<= 1.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, openplatform The Guardian News Feed)
- [CVE-2026-1086](https://cve.now/CVE-2026-1086.md): Font Pairing Preview For Landing Pages \<= 1.3 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, wpsolutions Font Pairing Preview For Landing Pages)
- [CVE-2026-1085](https://cve.now/CVE-2026-1085.md): True Ranker \<= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection (CVSS 4.3, optimizza True Ranker)
- [CVE-2026-1825](https://cve.now/CVE-2026-1825.md): Show YouTube video \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, minor Show YouTube video)
- [CVE-2026-1824](https://cve.now/CVE-2026-1824.md): Infomaniak Connect for OpenID \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, leopoldinfomaniak Infomaniak Connect for OpenID)
- [CVE-2026-1823](https://cve.now/CVE-2026-1823.md): Consensus Embed \<= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute (CVSS 6.4, consensusintegrations Consensus Embed)
- [CVE-2026-1074](https://cve.now/CVE-2026-1074.md): WP App Bar \<= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' Parameter (CVSS 7.2, ryscript WP App Bar)
- [CVE-2026-1073](https://cve.now/CVE-2026-1073.md): Purchase Button For Affiliate Link \<= 1.0.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, themepul Purchase Button For Affiliate Link)
- [CVE-2026-1820](https://cve.now/CVE-2026-1820.md): Media Library Alt Text Editor \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post\_id' Shortcode Attribute (CVSS 6.4, brainvireinfo Media Library Alt Text Editor)
- [CVE-2026-1574](https://cve.now/CVE-2026-1574.md): MyQtip – easy qTip2 \<= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, dgamoni MyQtip – easy qTip2)
- [CVE-2026-1805](https://cve.now/CVE-2026-1805.md): DA Media GigList \<= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'list\_title' Shortcode Attribute (CVSS 6.4, damedialimited DA Media GigList)
- [CVE-2026-1569](https://cve.now/CVE-2026-1569.md): Wueen \<= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode (CVSS 6.4, nabeghe Wueen)
- [CVE-2026-2433](https://cve.now/CVE-2026-2433.md): RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging \<= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage (CVSS 6.1, rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…)
- [CVE-2026-1071](https://cve.now/CVE-2026-1071.md): Carta Online \<= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, cartaonline Carta Online)
- [CVE-2026-2420](https://cve.now/CVE-2026-2420.md): LotekMedia Popup Form \<= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, LotekMedia Popup Form)
- [CVE-2025-14675](https://cve.now/CVE-2025-14675.md): Meta Box \<= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion (CVSS 7.2, metabox Meta Box · wpmetabox/meta-box)
- [CVE-2026-27796](https://cve.now/CVE-2026-27796.md): Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) (CVSS 5.3, homarr-labs homarr)
- [CVE-2026-27797](https://cve.now/CVE-2026-27797.md): Homarr: Unauthenticated SSRF in rssFeed.ts (CVSS 5.3, homarr-labs homarr)
- [CVE-2026-30830](https://cve.now/CVE-2026-30830.md): Defuddle: XSS via unescaped string interpolation in \_findContentBySchemaText image tag (CVSS 2.1, kepano defuddle · defuddle)
- [CVE-2025-8899](https://cve.now/CVE-2025-8899.md): Paid Videochat Turnkey Site – HTML5 PPV Live Webcams \<= 7.3.20 - Authenticated (Author+) Privilege Escalation (CVSS 8.8, videowhisper Paid Videochat Turnkey Site – HTML5 PPV Live W…)
- [CVE-2026-30829](https://cve.now/CVE-2026-30829.md): Checkmate: Unauthenticated Access to Unpublished Status Page (CVSS 5.3, bluewave-labs Checkmate)
- [CVE-2026-30842](https://cve.now/CVE-2026-30842.md): Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars (CVSS 4.3, ellite Wallos)
- [CVE-2026-30841](https://cve.now/CVE-2026-30841.md): Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php (CVSS 6.9, ellite Wallos)
- [CVE-2026-30840](https://cve.now/CVE-2026-30840.md): Wallos: Server-Side Request Forgery (SSRF) in Notification Testers (CVSS 8.8, ellite Wallos)
- [CVE-2026-30839](https://cve.now/CVE-2026-30839.md): Wallos: SSRF via webhook test endpoint (CVSS 5.3, ellite Wallos)
- [CVE-2026-30828](https://cve.now/CVE-2026-30828.md): Wallos: SSRF via url parameter leading to File Traversal (CVSS 8.7, ellite Wallos)
- [CVE-2026-30827](https://cve.now/CVE-2026-30827.md): express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting (all IPv4 clients share one bucket on dual-stack servers) (CVSS 7.5, express-rate-limit)
- [CVE-2026-30825](https://cve.now/CVE-2026-30825.md): hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token (CVSS 0.0, hoppscotch)
- [CVE-2026-30824](https://cve.now/CVE-2026-30824.md): Flowise: Missing Authentication on NVIDIA NIM Endpoints (CVSS 7.7, FlowiseAI Flowise · flowise)
- [CVE-2026-30823](https://cve.now/CVE-2026-30823.md): Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration (CVSS 8.8, FlowiseAI Flowise · flowise)
- [CVE-2026-30822](https://cve.now/CVE-2026-30822.md): Flowise: Mass Assignment in \`/api/v1/leads\` Endpoint (CVSS 7.7, FlowiseAI Flowise · flowise)
- [CVE-2026-30821](https://cve.now/CVE-2026-30821.md): Flowise: Arbitrary File Upload via MIME Spoofing (CVSS 8.2, FlowiseAI Flowise · flowise)
- [CVE-2026-30820](https://cve.now/CVE-2026-30820.md): Flowise Authorization Bypass via Spoofed x-request-from Header (CVSS 8.7, FlowiseAI Flowise · flowise)
- [CVE-2026-30247](https://cve.now/CVE-2026-30247.md): WeKnora: SSRF via Redirection (CVSS 5.9, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-3352](https://cve.now/CVE-2026-3352.md): Easy PHP Settings \<= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp\_memory\_limit' Setting (CVSS 7.2, shahadul878 Easy PHP Settings)
- [CVE-2026-2431](https://cve.now/CVE-2026-2431.md): CM Custom Reports \<= 1.2.7 - Reflected Cross-Site Scripting via 'date\_from' and 'date\_to' Parameters (CVSS 6.1, creativemindssolutions CM Custom Reports – Flexible reporti…)
- [CVE-2026-2722](https://cve.now/CVE-2026-2722.md): Stock Ticker \<= 3.26.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Template (CVSS 4.8, urkekg Stock Ticker)
- [CVE-2026-2721](https://cve.now/CVE-2026-2721.md): MailArchiver \<= 4.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings (CVSS 4.8, pierrelannoy MailArchiver)
- [CVE-2026-1650](https://cve.now/CVE-2026-1650.md): MDJM Event Management \<= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion (CVSS 5.3, MDJM Event Management)
- [CVE-2026-2429](https://cve.now/CVE-2026-2429.md): Community Events \<= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce\_venue\_name' CSV Field (CVSS 4.9, jackdewey Community Events)
- [CVE-2026-2020](https://cve.now/CVE-2026-2020.md): JS Archive List \<= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute (CVSS 7.5, skatox JS Archive List)
- [CVE-2025-14353](https://cve.now/CVE-2025-14353.md): ZIP Code Based Content Protection \<= 1.0.2 - Unauthenticated SQL Injection via 'zipcode' Parameter (CVSS 7.5, presstigers ZIP Code Based Content Protection)
- [CVE-2026-2494](https://cve.now/CVE-2026-2494.md): ProfileGrid \<= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2026-2488](https://cve.now/CVE-2026-2488.md): ProfileGrid \<= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2026-1902](https://cve.now/CVE-2026-1902.md): Hammas Calendar \<= 1.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute (CVSS 6.4, innovaatik Hammas Calendar)
- [CVE-2026-25073](https://cve.now/CVE-2026-25073.md): XikeStor SKS8310-8X Stored XSS via System Name (CVSS 5.1, Anhui Seeker Electronic Technology Co. XikeStor SKS8310-8X)
- [CVE-2026-25072](https://cve.now/CVE-2026-25072.md): XikeStor SKS8310-8X Predictable Session Identifiers (CVSS 8.6, Anhui Seeker Electronic Technology Co. XikeStor SKS8310-8X)
- [CVE-2026-25071](https://cve.now/CVE-2026-25071.md): XikeStor SKS8310-8X switch\_config.src Missing Authentication (CVSS 8.7, Anhui Seeker Electronic Technology Co. XikeStor SKS8310-8X)
- [CVE-2026-25070](https://cve.now/CVE-2026-25070.md): XikeStor SKS8310-8X PingTestSet Command Injection (CVSS 9.3, Anhui Seeker Electronic Technology Co. XikeStor SKS8310-8X)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.