CVEs published March 9, 2026
154 CVEs were published on March 9, 2026: 17 critical, 76 high.
- Published
- 154
- Critical
- 17
- High
- 76
- Medium
- 59
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 78
Most affected products
- ImageMagick · Magick.NET-Q16-AnyCPU +18
- 16
- MBS UBR-01 Mk II · MBS UBR-02 +1
- 15
- FreeBSD
- 6
- Tenda FH1202
- 5
- Tenda i3
- 5
- budibase
- 4
- SourceCodester Sales and Inventory System
- 4
- Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- 4
- misskey-dev misskey
- 3
- oneuptime · @oneuptime/common
- 3
Critical 17
- CVE-2026-30921OneUptime Synthetic Monitor RCE via exposed Playwright browser objectoneuptime · @oneuptime/common
- CVE-2026-30887OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCEoneuptime · @oneuptime/common
- CVE-2026-30869SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakagesiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-30862Critical Stored XSS & Privilege Escalation in Appsmithappsmithorg appsmith
- CVE-2025-11158Hitachi Vantara Pentaho Data Integration & Analytics - Missing AuthorizationHitachi Vantara Pentaho Data Integration and Analytics
- CVE-2026-28431Misskey lacks proper authorization checks and input validationmisskey-dev misskey
- CVE-2026-31816Budibase Universal Auth Bypass via Webhook Query Param Injectionbudibase
- CVE-2026-30240Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secretsbudibase
- CVE-2026-24713Apache IoTDB: JEXL Expression Injection VulnerabilityApache Software Foundation Apache IoTDB · org.apache.iotdb:…
- CVE-2026-24015Apache IoTDB: Insecure Default Configuration VulnerabilityApache Software Foundation Apache IoTDB · org.apache.iotdb:…
- CVE-2025-41765Unchecked role in wwwupload.cgiMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41764Unchecked role in wwwupdate.cgiMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2026-3823Atop Technologies｜EHG2408 series switch - Stack-based Buffer OverflowAtop Technologies EHG2408 · Atop Technologies EHG2408-2SFP
- CVE-2026-3630Stack-based Buffer Overflow Vulnerability in COMMGR2DeltaWW COMMGR2
- CVE-2025-70039An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1
- CVE-2025-70042An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.
- CVE-2025-70046An issue pertaining to CWE-829: Inclusion of Functionality from Untrusted Control Sphere was discovered in Miazzy oa-front-service master.
High 76
- CVE-2026-30925Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryparse-community parse-server · parse-server
- CVE-2026-30920OneUptime has broken access control in GitHub App installation flow that allows unauthorized project bindingoneuptime · @oneuptime/common
- CVE-2026-30919facileManager Affected by Stored Cross-Site Scripting (XSS)facileManager
- CVE-2026-30918facileManager Affected by Reflected Cross-Site Scripting (XSS)facileManager
- CVE-2026-30917Stored XSS on Bucket namespace pagesweirdgloop mediawiki-extensions-Bucket
- CVE-2026-28513Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchangepocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-28512Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusionpocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-28281InstantCMS has Multiple CSRF Vulnerabilitiesinstantsoft icms2
- CVE-2026-30929ImageMagick has a stack buffer overflow in MagnifyImageImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28693ImageMagick has an integer overflow in DIB coder can result in out of bounds read or writeImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28691ImageMagick has an uninitialized pointer dereference in JBIG decoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28494ImageMagick affected by stack corruption through long morphology kernel names or arraysImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28432HTTP signature verification can be bypassedmisskey-dev misskey
- CVE-2026-31802node-tar Symlink Path Traversal via Drive-Relative Linkpathisaacs node-tar · tar
- CVE-2026-30926SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook contentsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-25960SSRF Protection Bypass in vLLMvllm-project vllm · vllm
- CVE-2026-3288ingress-nginx rewrite-target nginx configuration injectionKubernetes ingress-nginx
- CVE-2026-25045Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)budibase
- CVE-2026-25737Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)budibase
- CVE-2026-25041Budibase has a Command Injection in PostgreSQL Dump Commandbudibase · @budibase/server
- CVE-2025-68402FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]FreshRSS
- CVE-2025-62166FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokensFreshRSS
- CVE-2026-0846Arbitrary File Read via Absolute Path Input in nltk.util.filestring()nltk/nltk · nltk
- CVE-2025-15568Command Injection Vulnerability on TP-Link Archer AXE75TP-Link Systems Archer AXE75 v1.6/v1.0
- CVE-2026-3588Server-Side Request Forgery (SSRF) in ikea dirigeraikea dirigera
- CVE-2026-25866MobaXterm < 26.1 Notepad++ Unquoted Service PathMobatek MobaXterm
- CVE-2026-3038Local DoS and possible privilege escalation via routing socketsFreeBSD
- CVE-2026-2261blocklistd(8) socket leakFreeBSD
- CVE-2025-15576Jail chroot escape via fd exchange with a different jailFreeBSD
- CVE-2025-15547Jail escape by a privileged user via nullfsFreeBSD
- CVE-2025-14769ipfw denial of serviceFreeBSD
- CVE-2025-14558Remote code execution via ND6 Router AdvertisementsFreeBSD
- CVE-2026-3815UTT HiPER 810G formApMail strcpy buffer overflowUTT HiPER
- CVE-2025-69219Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorApache Software Foundation Apache Airflow Providers Http ·…
- CVE-2026-3814UTT HiPER 810G getOneApConfTempEntry strcpy buffer overflowUTT HiPER
- CVE-2025-40639SQL injection in EventobotEventobot
- CVE-2025-69279In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-69278In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T7300/T8100/T9100/T8200/…
- CVE-2025-61616In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61615In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61614In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T7300/T8100/T9100/T8200/…
- CVE-2025-61613In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61612In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T7300/T8100/T9100/T8200/…
- CVE-2025-61611In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. UDX710
- CVE-2026-3811Tenda FH1202 P2pListFilter fromP2pListFilter stack-based overflowTenda FH1202
- CVE-2025-41772wwwupdate.cgi Session token in URLMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41767Signature bypass on update uploadMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41766Stack buffer overflow on parsing web requestMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41761Privilege escalation possibleMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41758Arbitrary Write with wwwupload.cgiMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41757Arbitrary Write with ubr-restoreMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41756Arbitrary Write with ubr-editfileMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2026-3810Tenda FH1202 DhcpListClient fromDhcpListClient stack-based overflowTenda FH1202
- CVE-2026-3809Tenda FH1202 NatSaticSetting fromNatStaticSetting stack-based overflowTenda FH1202
- CVE-2026-3808Tenda FH1202 webtypelibrary formWebTypeLibrary stack-based overflowTenda FH1202
- CVE-2026-3807Tenda FH1202 AdvSetWrlsafeset formWrlsafeset stack-based overflowTenda FH1202
- CVE-2026-3804Tenda i3 WifiMacFilterSet formWifiMacFilterSet stack-based overflowTenda i3
- CVE-2026-3803Tenda i3 WifiMacFilterGet formWifiMacFilterGet stack-based overflowTenda i3
- CVE-2026-30896The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs).Qsee Client
- CVE-2026-3802Tenda i3 exeCommand formexeCommand stack-based overflowTenda i3
- CVE-2026-3801Tenda i3 setAutoPing formSetAutoPing stack-based overflowTenda i3
- CVE-2026-3822Taipower｜Taipower APP(Android) - Improper Certificate ValidationTaipower APP
- CVE-2026-3799Tenda i3 setcfm formSetCfm stack-based overflowTenda i3
- CVE-2026-3631Buffer Over-read DoS Vulnerability in COMMGR2DeltaWW COMMGR2
- CVE-2025-70028An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') was discovered in Sunbird-Ed S
- CVE-2025-70030An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
- CVE-2025-70031An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
- CVE-2025-70034An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in mscdex ssh2 v1.17.0.
- CVE-2025-70038An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in linagora Twake v2023.Q1.1223.
- CVE-2025-70047An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in Nexusoft NexusInterface v3.2.0-beta.2.
- CVE-2025-70048An issue pertaining to CWE-319: Cleartext Transmission of Sensitive Information was discovered in Nexusoft NexusInterface v3.2.0-beta.2.
- CVE-2025-70059An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial
- CVE-2025-70238Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard52.
- CVE-2025-70243Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard534.
- CVE-2025-70250Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formdumpeasysetup.
- CVE-2026-30140An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn.
Medium, low and unrated 61
- CVE-2026-30927Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameteradmidio · admidio/admidio
- CVE-2026-30913flarum/nickname: Display name injection in notification emails (autolink & markdown)flarum nicknames · flarum/nicknames
- CVE-2026-30885WWBN AVideo - Unauthenticated IDOR - Playlist Information DisclosureWWBN AVideo · wwbn/avideo
- CVE-2026-30870Some sync filters in PowerSync Service ignored using `config.edition: 3`powersync-ja powersync-service · @powersync service-core +3
- CVE-2026-28267Multiple i-フィルター products are configured with improper file access permission settings.Digital Arts i-フィルター · Digital Arts i-FILTER ブラウザー＆クラウド… +4
- CVE-2026-29773kubewarden-controller cross-namespace data exfiltration via deprecated host callback bindingkubewarden-controller · github.com/kubewarden/kubewarden-co…
- CVE-2026-30937ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculationImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-30936ImageMagick has a heap Buffer Overflow in WaveletDenoiseImageImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-30935ImageMagick has a heap Buffer Over-Read in BilateralBlurImageImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-30931ImageMagick has a heap-based buffer overflow in UHDR encoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-30883ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28692ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28690ImageMagick has a stack write buffer overflow in MNG encoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28689ImageMagick has a Path Policy TOCTOU symlink race bypassImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28688ImageMagick has a heap use-after-free in the MSL encoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28687ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28686ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output bufferImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28493ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-28433Misskey lacks resource ownership validationmisskey-dev misskey
- CVE-2026-26982Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operationsghostty-org ghostty
- CVE-2026-1776Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Readowen2345 Camaleon CMS · camaleon_cms
- CVE-2026-3638Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authentDevolutions Server
- CVE-2026-29023Keygraph Shannon Hard-coded Router API KeyKeygraphHQ Shannon
- CVE-2024-14027xattr: switch to CLASS(fd)Linux
- CVE-2026-3089Actual Sync Server 26.2.1 - Authenticated Path TraversalActual Sync Server · @actual-app/sync-server
- CVE-2026-2919Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirectMozilla Focus for iOS
- CVE-2026-3819SourceCodester Resort Reservation System Reservation Management page cross site scriptingSourceCodester Resort Reservation System
- CVE-2026-21736GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabledImagination Technologies Graphics DDK
- CVE-2026-3818Tiandy Easy7 CMS Windows GetDBData.jsp sql injectionTiandy Easy7 CMS Windows
- CVE-2026-3817SourceCodester Patients Waiting Area Queue Management System patient-search.php improper authorizationSourceCodester Patients Waiting Area Queue Management System
- CVE-2026-3816OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of serviceOWASP DefectDojo
- CVE-2026-25604Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication BypassApache Software Foundation Apache Airflow Providers Amazon…
- CVE-2026-3813opencc JFlow WF_CCForm.java Calculate injectionopencc JFlow
- CVE-2025-40638Reflected Cross-Site Scripting (XSS) in EventobotEventobot
- CVE-2026-3812itsourcecode Payroll Management System manage_employee_allowances.php cross site scriptingitsourcecode Payroll Management System
- CVE-2025-41763Unchecked role in wwwdnload.cgiMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41762Secret leak with wwwdnload.cgiMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41760Pass filter with Empty TableMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41759Use of wildcard (“*” or “all”) in Block listMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41755Arbitrary Read with ubr-logreadMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2025-41754Arbitrary Read with ubr-editfileMBS UBR-01 Mk II · MBS UBR-02 +1
- CVE-2026-3806SourceCodester/janobe Resort Reservation System room_rates.php sql injectionSourceCodester Resort Reservation System · janobe Resort Re…
- CVE-2026-3800SourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted uploadSourceCodester Resort Reservation System · janobe Resort Re…
- CVE-2026-3798Comfast CF-AC100 Request Path mbox-config sub_44AC14 command injectionComfast CF-AC100
- CVE-2026-3797Tiandy Video Surveillance System 视频监控平台 CLS_REST_File.java uploadFile unrestricted uploadTiandy Video Surveillance System 视频监控平台
- CVE-2026-3796Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access controlQi-ANXIN QAX Virus Removal
- CVE-2026-3795doramart DoraCMS v1.js createFileBypath path traversaldoramart DoraCMS
- CVE-2026-3794doramart DoraCMS Email API send improper authenticationdoramart DoraCMS
- CVE-2026-3793SourceCodester Sales and Inventory System GET Parameter sales_invoice1.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-3792SourceCodester Sales and Inventory System GET Parameter purchase_invoice.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-3791SourceCodester Sales and Inventory System Search dashboard.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-3790SourceCodester Sales and Inventory System POST Parameter check_supplier_details.php sql injectionSourceCodester Sales and Inventory System
- CVE-2025-69647GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists d
- CVE-2025-69648GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rng
- CVE-2025-70032An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
- CVE-2025-70033An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.
- CVE-2025-70037An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in linagora Twake v2023.Q1.1223.
- CVE-2025-70040An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2.
- CVE-2025-70050An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackerslesspass
- CVE-2025-70060An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.
- CVE-2025-70973ScadaBR 1.12.4 is vulnerable to Session Fixation.