# CVEs published 2026-03-08 81 CVEs were published on March 8, 2026: 2 critical, 14 high. Days are UTC. - [CVE-2026-3789](https://cve.now/CVE-2026-3789.md): Bytedesk SpringAIGiteeRestController SpringAIGiteeRestService.java getModels server-side request forgery (CVSS 5.3, Bytedesk) - [CVE-2026-3788](https://cve.now/CVE-2026-3788.md): Bytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery (CVSS 5.3, Bytedesk) - [CVE-2026-3787](https://cve.now/CVE-2026-3787.md): UltraVNC Windows Service cryptbase.dll uncontrolled search path (CVSS 7.3, UltraVNC) - [CVE-2026-3786](https://cve.now/CVE-2026-3786.md): EasyCMS Request Parameter RbacuserAction.class.php sql injection (CVSS 5.3, EasyCMS) - [CVE-2026-3785](https://cve.now/CVE-2026-3785.md): EasyCMS Request Parameter RbacnodeAction.class.php sql injection (CVSS 5.3, EasyCMS) - [CVE-2026-3771](https://cve.now/CVE-2026-3771.md): SourceCodester/janobe Resort Reservation System accomodation.php sql injection (CVSS 5.3, SourceCodester Resort Reservation System · janobe Resort Re…) - [CVE-2026-3770](https://cve.now/CVE-2026-3770.md): SourceCodester Computer Laboratory Management System cross-site request forgery (CVSS 5.3, SourceCodester Computer Laboratory Management System) - [CVE-2026-3769](https://cve.now/CVE-2026-3769.md): Tenda F453 WrlclientSet stack-based overflow (CVSS 8.7, Tenda F453) - [CVE-2026-3768](https://cve.now/CVE-2026-3768.md): Tenda F453 WrlExtraSet formWrlExtraSet stack-based overflow (CVSS 8.7, Tenda F453) - [CVE-2026-3767](https://cve.now/CVE-2026-3767.md): itsourcecode sanitize or validate this input teacher-attendance.php sql injection (CVSS 5.3, itsourcecode sanitize or validate this input) - [CVE-2026-3766](https://cve.now/CVE-2026-3766.md): SourceCodester Web-based Pharmacy Product Management System edit-profile.php cross site scripting (CVSS 5.1, SourceCodester Web-based Pharmacy Product Management System) - [CVE-2026-3765](https://cve.now/CVE-2026-3765.md): itsourcecode University Management System att\_single\_view.php sql injection (CVSS 6.9, itsourcecode University Management System) - [CVE-2026-3764](https://cve.now/CVE-2026-3764.md): SourceCodester Client Database Management System superadmin\_user\_update.php improper authorization (CVSS 6.9, SourceCodester Client Database Management System) - [CVE-2026-3763](https://cve.now/CVE-2026-3763.md): code-projects Simple Flight Ticket Booking System showhistory.php cross site scripting (CVSS 5.3, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3762](https://cve.now/CVE-2026-3762.md): SourceCodester Client Database Management System Endpoint superadmin\_delete\_manager.php improper authorization (CVSS 6.9, SourceCodester Client Database Management System) - [CVE-2026-3761](https://cve.now/CVE-2026-3761.md): SourceCodester Client Database Management System Endpoint superadmin\_user\_delete.php improper authorization (CVSS 5.3, SourceCodester Client Database Management System) - [CVE-2026-3760](https://cve.now/CVE-2026-3760.md): itsourcecode University Management System view\_result.php sql injection (CVSS 6.9, itsourcecode University Management System) - [CVE-2026-3759](https://cve.now/CVE-2026-3759.md): projectworlds Online Art Gallery Shop adminHome.php sql injection (CVSS 6.9, projectworlds Online Art Gallery Shop) - [CVE-2026-3758](https://cve.now/CVE-2026-3758.md): projectworlds Online Art Gallery Shop adminHome.php sql injection (CVSS 6.9, projectworlds Online Art Gallery Shop) - [CVE-2026-3757](https://cve.now/CVE-2026-3757.md): projectworlds Online Art Gallery Shop pass sql injection (CVSS 6.9, projectworlds Online Art Gallery Shop) - [CVE-2026-3756](https://cve.now/CVE-2026-3756.md): SourceCodester Sales and Inventory System check\_item\_details.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System) - [CVE-2026-3755](https://cve.now/CVE-2026-3755.md): SourceCodester Sales and Inventory System POST check\_customer\_details.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System) - [CVE-2026-3754](https://cve.now/CVE-2026-3754.md): SourceCodester Sales and Inventory System add\_stock.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System) - [CVE-2026-3753](https://cve.now/CVE-2026-3753.md): SourceCodester Sales and Inventory System add\_sales\_print.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System) - [CVE-2026-3752](https://cve.now/CVE-2026-3752.md): SourceCodester Employee Task Management System GET Parameter daily-task-report.php sql injection (CVSS 5.1, SourceCodester Employee Task Management System) - [CVE-2026-3751](https://cve.now/CVE-2026-3751.md): SourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injection (CVSS 5.1, SourceCodester Employee Task Management System) - [CVE-2026-3750](https://cve.now/CVE-2026-3750.md): ContiNew Admin Storage Management S3ClientFactory.java URI.create server-side request forgery (CVSS 5.1, ContiNew Admin) - [CVE-2026-3749](https://cve.now/CVE-2026-3749.md): Bytedesk SVG File UploadRestService.java handleFileUpload unrestricted upload (CVSS 5.3, Bytedesk) - [CVE-2026-3748](https://cve.now/CVE-2026-3748.md): Bytedesk SVG File UploadRestController.java uploadFile unrestricted upload (CVSS 5.3, Bytedesk) - [CVE-2026-3747](https://cve.now/CVE-2026-3747.md): itsourcecode University Management System add\_result.php sql injection (CVSS 6.9, itsourcecode University Management System) - [CVE-2026-3746](https://cve.now/CVE-2026-3746.md): SourceCodester Simple Responsive Tourism Website Login Login.php sql injection (CVSS 6.9, SourceCodester Simple Responsive Tourism Website) - [CVE-2026-3745](https://cve.now/CVE-2026-3745.md): code-projects Student Web Portal profile.php sql injection (CVSS 5.3, code-projects Student Web Portal) - [CVE-2026-3744](https://cve.now/CVE-2026-3744.md): code-projects Student Web Portal signup.php valreg\_passwdation sql injection (CVSS 6.9, code-projects Student Web Portal) - [CVE-2026-3743](https://cve.now/CVE-2026-3743.md): YiFang CMS D\_singlePageGroup.php update cross site scripting (CVSS 5.1, YiFang CMS) - [CVE-2026-3742](https://cve.now/CVE-2026-3742.md): YiFang CMS D\_singlePage.php update cross site scripting (CVSS 5.1, YiFang CMS) - [CVE-2026-3741](https://cve.now/CVE-2026-3741.md): YiFang CMS D\_friendLink.php update cross site scripting (CVSS 5.1, YiFang CMS) - [CVE-2026-3740](https://cve.now/CVE-2026-3740.md): itsourcecode University Management System admin\_search\_student.php sql injection (CVSS 6.9, itsourcecode University Management System) - [CVE-2026-3739](https://cve.now/CVE-2026-3739.md): suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication (CVSS 5.3, suitenumerique messages) - [CVE-2026-3738](https://cve.now/CVE-2026-3738.md): SourceCodester Pet Grooming Management Software Financial Report improper authorization (CVSS 5.3, SourceCodester Pet Grooming Management Software) - [CVE-2026-3737](https://cve.now/CVE-2026-3737.md): SourceCodester Pet Grooming Management Software User Creation add\_user.php improper authorization (CVSS 5.3, SourceCodester Pet Grooming Management Software) - [CVE-2026-3736](https://cve.now/CVE-2026-3736.md): code-projects Simple Flight Ticket Booking System SearchResultRoundtrip.php sql injection (CVSS 6.9, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3735](https://cve.now/CVE-2026-3735.md): code-projects Simple Flight Ticket Booking System SearchResultOneway.php sql injection (CVSS 6.9, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3734](https://cve.now/CVE-2026-3734.md): SourceCodester Client Database Management System Endpoint fetch\_manager\_details.php improper authorization (CVSS 6.9, SourceCodester Client Database Management System) - [CVE-2026-3733](https://cve.now/CVE-2026-3733.md): xuxueli xxl-job JobInfoController.java server-side request forgery (CVSS 5.3, xuxueli xxl-job) - [CVE-2026-3732](https://cve.now/CVE-2026-3732.md): Tenda F453 exeCommand strcpy stack-based overflow (CVSS 8.7, Tenda F453) - [CVE-2026-3731](https://cve.now/CVE-2026-3731.md): libssh SFTP Extension Name sftp.c sftp\_extensions\_get\_data out-of-bounds (CVSS 6.9, libssh) - [CVE-2026-3730](https://cve.now/CVE-2026-3730.md): itsourcecode Free Hotel Reservation System index.php sql injection (CVSS 6.9, itsourcecode Free Hotel Reservation System) - [CVE-2026-3729](https://cve.now/CVE-2026-3729.md): Tenda F453 PPTPDClient fromPptpUserAdd stack-based overflow (CVSS 8.7, Tenda F453) - [CVE-2026-3728](https://cve.now/CVE-2026-3728.md): Tenda F453 setcfm fromSetCfm stack-based overflow (CVSS 8.7, Tenda F453) - [CVE-2026-3727](https://cve.now/CVE-2026-3727.md): Tenda F453 QuickIndex sub\_3C6C0 stack-based overflow (CVSS 8.7, Tenda F453) - [CVE-2026-3726](https://cve.now/CVE-2026-3726.md): Tenda F453 webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow (CVSS 8.7, Tenda F453) - [CVE-2026-3725](https://cve.now/CVE-2026-3725.md): 1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine (CVSS 5.3, 1024-lab SmartAdmin · lab1024 SmartAdmin) - [CVE-2026-3724](https://cve.now/CVE-2026-3724.md): SourceCodester Patients Waiting Area Queue Management System checkin.php improper authorization (CVSS 5.3, SourceCodester Patients Waiting Area Queue Management System) - [CVE-2026-3723](https://cve.now/CVE-2026-3723.md): code-projects Simple Flight Ticket Booking System Admindelete.php sql injection (CVSS 6.9, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3721](https://cve.now/CVE-2026-3721.md): 1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting (CVSS 5.1, 1024-lab SmartAdmin · lab1024 SmartAdmin) - [CVE-2026-3720](https://cve.now/CVE-2026-3720.md): 1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting (CVSS 5.1, 1024-lab SmartAdmin · lab1024 SmartAdmin) - [CVE-2026-3719](https://cve.now/CVE-2026-3719.md): Tsinghua Unigroup Electronic Archives System downLoad path traversal (CVSS 6.9, Tsinghua Unigroup Electronic Archives System) - [CVE-2026-3716](https://cve.now/CVE-2026-3716.md): Wavlink WL-WN579X3-C adm.cgi sub\_401AD4 cross site scripting (CVSS 4.8, Wavlink WL-WN579X3-C) - [CVE-2026-3715](https://cve.now/CVE-2026-3715.md): Wavlink WL-WN579X3-C firewall.cgi sub\_40139C stack-based overflow (CVSS 8.7, Wavlink WL-WN579X3-C) - [CVE-2026-3714](https://cve.now/CVE-2026-3714.md): OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine (CVSS 5.1, OpenCart) - [CVE-2026-3713](https://cve.now/CVE-2026-3713.md): pnggroup libpng pnm2png pnm2png.c do\_pnm2png heap-based overflow (CVSS 4.8, pnggroup libpng) - [CVE-2026-3711](https://cve.now/CVE-2026-3711.md): code-projects Simple Flight Ticket Booking System Adminupdate.php sql injection (CVSS 5.1, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3710](https://cve.now/CVE-2026-3710.md): code-projects Simple Flight Ticket Booking System Adminadd.php sql injection (CVSS 5.1, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3709](https://cve.now/CVE-2026-3709.md): code-projects Simple Flight Ticket Booking System register.php sql injection (CVSS 6.9, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3708](https://cve.now/CVE-2026-3708.md): code-projects Simple Flight Ticket Booking System login.php sql injection (CVSS 6.9, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3707](https://cve.now/CVE-2026-3707.md): MrNanko webp4j gif\_decoder.c DecodeGifFromMemory integer overflow (CVSS 4.8, MrNanko webp4j) - [CVE-2026-3706](https://cve.now/CVE-2026-3706.md): mkj Dropbear S Range Check curve25519.c unpackneg signature verification (CVSS 6.3, mkj Dropbear) - [CVE-2026-3705](https://cve.now/CVE-2026-3705.md): code-projects Simple Flight Ticket Booking System Adminsearch.php sql injection (CVSS 6.9, code-projects Simple Flight Ticket Booking System) - [CVE-2026-3703](https://cve.now/CVE-2026-3703.md): Wavlink NU516U1 login.cgi sub\_401A10 out-of-bounds write (CVSS 9.3, Wavlink NU516U1) - [CVE-2026-3702](https://cve.now/CVE-2026-3702.md): SourceCodester Loan Management System index.php cross site scripting (CVSS 5.3, SourceCodester Loan Management System) - [CVE-2026-3701](https://cve.now/CVE-2026-3701.md): H3C Magic B1 aspForm Edit\_BasicSSID\_5G buffer overflow (CVSS 8.7, H3C Magic B1) - [CVE-2026-3704](https://cve.now/CVE-2026-3704.md): Wavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub\_405B2C command injection (CVSS 5.1, Wavlink NU516U1) - [CVE-2026-3700](https://cve.now/CVE-2026-3700.md): UTT HiPER 810G formConfigDnsFilterGlobal strcpy buffer overflow (CVSS 8.7, UTT HiPER) - [CVE-2026-3699](https://cve.now/CVE-2026-3699.md): UTT HiPER 810G formRemoteControl strcpy buffer overflow (CVSS 8.7, UTT HiPER) - [CVE-2026-3698](https://cve.now/CVE-2026-3698.md): UTT HiPER 810G NTP strcpy buffer overflow (CVSS 8.7, UTT HiPER) - [CVE-2026-3697](https://cve.now/CVE-2026-3697.md): Planet ICG-2510 Language Package Configuration httpd sub\_40C8E4 stack-based overflow (CVSS 5.3, Planet ICG-2510) - [CVE-2026-30910](https://cve.now/CVE-2026-30910.md): Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows (CVSS 7.5, IAMB Crypt::Sodium::XS) - [CVE-2026-30909](https://cve.now/CVE-2026-30909.md): Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows (CVSS 9.8, TIMLEGGE Crypt::NaCl::Sodium) - [CVE-2026-3696](https://cve.now/CVE-2026-3696.md): Totolink N300RH CGI cstecgi.cgi setWiFiWpsConfig os command injection (CVSS 6.9, Totolink N300RH) - [CVE-2026-3695](https://cve.now/CVE-2026-3695.md): SourceCodester Modern Image Gallery App delete.php path traversal (CVSS 6.9, SourceCodester Modern Image Gallery App) - [CVE-2026-3693](https://cve.now/CVE-2026-3693.md): Shy2593666979 AgentChat User Endpoint user.py update\_user\_info resource injection (CVSS 6.9, Shy2593666979 AgentChat) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2026-03-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.