# CVEs published 2026-03-09

154 CVEs were published on March 9, 2026: 17 critical, 76 high. Days are UTC.

- [CVE-2026-30927](https://cve.now/CVE-2026-30927.md): Admidio: Event participation IDOR - non-leaders can register other users for events via user\_uuid parameter (CVSS 5.3, admidio · admidio/admidio)
- [CVE-2026-30925](https://cve.now/CVE-2026-30925.md): Parse Server affected by Regular Expression Denial of Service (ReDoS) via \`$regex\` query in LiveQuery (CVSS 8.2, parse-community parse-server · parse-server)
- [CVE-2026-30921](https://cve.now/CVE-2026-30921.md): OneUptime Synthetic Monitor RCE via exposed Playwright browser object (CVSS 10.0, oneuptime · @oneuptime/common)
- [CVE-2026-30920](https://cve.now/CVE-2026-30920.md): OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding (CVSS 8.6, oneuptime · @oneuptime/common)
- [CVE-2026-30919](https://cve.now/CVE-2026-30919.md): facileManager Affected by Stored Cross-Site Scripting (XSS) (CVSS 7.6, facileManager)
- [CVE-2026-30918](https://cve.now/CVE-2026-30918.md): facileManager Affected by Reflected Cross-Site Scripting (XSS) (CVSS 7.6, facileManager)
- [CVE-2026-30917](https://cve.now/CVE-2026-30917.md): Stored XSS on Bucket namespace pages (CVSS 8.8, weirdgloop mediawiki-extensions-Bucket)
- [CVE-2026-30913](https://cve.now/CVE-2026-30913.md): flarum/nickname: Display name injection in notification emails (autolink & markdown) (CVSS 4.6, flarum nicknames · flarum/nicknames)
- [CVE-2026-30887](https://cve.now/CVE-2026-30887.md): OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE (CVSS 10.0, oneuptime · @oneuptime/common)
- [CVE-2026-30885](https://cve.now/CVE-2026-30885.md): WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure (CVSS 5.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-30870](https://cve.now/CVE-2026-30870.md): Some sync filters in PowerSync Service ignored using \`config.edition: 3\` (CVSS 6.5, powersync-ja powersync-service · @powersync service-core +3)
- [CVE-2026-28267](https://cve.now/CVE-2026-28267.md): Multiple i-フィルター products are configured with improper file access permission settings. (CVSS 5.5, Digital Arts i-フィルター · Digital Arts i-FILTER ブラウザー＆クラウド… +4)
- [CVE-2026-30869](https://cve.now/CVE-2026-30869.md): SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage (CVSS 9.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-30862](https://cve.now/CVE-2026-30862.md): Critical Stored XSS & Privilege Escalation in Appsmith (CVSS 9.1, appsmithorg appsmith)
- [CVE-2026-29773](https://cve.now/CVE-2026-29773.md): kubewarden-controller cross-namespace data exfiltration via deprecated host callback binding (CVSS 4.3, kubewarden-controller · github.com/kubewarden/kubewarden-co…)
- [CVE-2026-28513](https://cve.now/CVE-2026-28513.md): Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange (CVSS 8.5, pocket-id · github.com/pocket-id/pocket-id/backend)
- [CVE-2026-28512](https://cve.now/CVE-2026-28512.md): Pocket ID: OAuth redirect\_uri validation bypass via userinfo/host confusion (CVSS 7.1, pocket-id · github.com/pocket-id/pocket-id/backend)
- [CVE-2026-28281](https://cve.now/CVE-2026-28281.md): InstantCMS has Multiple CSRF Vulnerabilities (CVSS 7.1, instantsoft icms2)
- [CVE-2025-11158](https://cve.now/CVE-2025-11158.md): Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization (CVSS 9.1, Hitachi Vantara Pentaho Data Integration and Analytics)
- [CVE-2026-30937](https://cve.now/CVE-2026-30937.md): ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes\_per\_line calculation (CVSS 6.8, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-30936](https://cve.now/CVE-2026-30936.md): ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-30935](https://cve.now/CVE-2026-30935.md): ImageMagick has a heap Buffer Over-Read in BilateralBlurImage (CVSS 4.4, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-30931](https://cve.now/CVE-2026-30931.md): ImageMagick has a heap-based buffer overflow in UHDR encoder (CVSS 6.8, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-30929](https://cve.now/CVE-2026-30929.md): ImageMagick has a stack buffer overflow in MagnifyImage (CVSS 7.7, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-30883](https://cve.now/CVE-2026-30883.md): ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder (CVSS 5.7, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28693](https://cve.now/CVE-2026-28693.md): ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write (CVSS 8.1, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28692](https://cve.now/CVE-2026-28692.md): ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28691](https://cve.now/CVE-2026-28691.md): ImageMagick has an uninitialized pointer dereference in JBIG decoder (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28690](https://cve.now/CVE-2026-28690.md): ImageMagick has a stack write buffer overflow in MNG encoder (CVSS 6.9, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28689](https://cve.now/CVE-2026-28689.md): ImageMagick has a Path Policy TOCTOU symlink race bypass (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28688](https://cve.now/CVE-2026-28688.md): ImageMagick has a heap use-after-free in the MSL encoder (CVSS 4.0, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28687](https://cve.now/CVE-2026-28687.md): ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28686](https://cve.now/CVE-2026-28686.md): ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer (CVSS 6.8, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28494](https://cve.now/CVE-2026-28494.md): ImageMagick affected by stack corruption through long morphology kernel names or arrays (CVSS 7.1, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28493](https://cve.now/CVE-2026-28493.md): ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder (CVSS 6.5, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-28433](https://cve.now/CVE-2026-28433.md): Misskey lacks resource ownership validation (CVSS 2.3, misskey-dev misskey)
- [CVE-2026-28432](https://cve.now/CVE-2026-28432.md): HTTP signature verification can be bypassed (CVSS 7.1, misskey-dev misskey)
- [CVE-2026-28431](https://cve.now/CVE-2026-28431.md): Misskey lacks proper authorization checks and input validation (CVSS 9.2, misskey-dev misskey)
- [CVE-2026-26982](https://cve.now/CVE-2026-26982.md): Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operations (CVSS 6.3, ghostty-org ghostty)
- [CVE-2026-31802](https://cve.now/CVE-2026-31802.md): node-tar Symlink Path Traversal via Drive-Relative Linkpath (CVSS 8.2, isaacs node-tar · tar)
- [CVE-2026-1776](https://cve.now/CVE-2026-1776.md): Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read (CVSS 6.0, owen2345 Camaleon CMS · camaleon\_cms)
- [CVE-2026-30926](https://cve.now/CVE-2026-30926.md): SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content (CVSS 7.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-25960](https://cve.now/CVE-2026-25960.md): SSRF Protection Bypass in vLLM (CVSS 7.1, vllm-project vllm · vllm)
- [CVE-2026-3288](https://cve.now/CVE-2026-3288.md): ingress-nginx rewrite-target nginx configuration injection (CVSS 8.8, Kubernetes ingress-nginx)
- [CVE-2026-31816](https://cve.now/CVE-2026-31816.md): Budibase Universal Auth Bypass via Webhook Query Param Injection (CVSS 9.1, budibase)
- [CVE-2026-30240](https://cve.now/CVE-2026-30240.md): Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets (CVSS 9.6, budibase)
- [CVE-2026-25045](https://cve.now/CVE-2026-25045.md): Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role) (CVSS 8.7, budibase)
- [CVE-2026-25737](https://cve.now/CVE-2026-25737.md): Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS) (CVSS 8.9, budibase)
- [CVE-2026-25041](https://cve.now/CVE-2026-25041.md): Budibase has a Command Injection in PostgreSQL Dump Command (CVSS 8.6, budibase · @budibase/server)
- [CVE-2025-68402](https://cve.now/CVE-2025-68402.md): FreshRSS has an authentication bypass due to truncated bcrypt hash \[edge branch\] (CVSS 8.2, FreshRSS)
- [CVE-2025-62166](https://cve.now/CVE-2025-62166.md): FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens (CVSS 7.5, FreshRSS)
- [CVE-2026-0846](https://cve.now/CVE-2026-0846.md): Arbitrary File Read via Absolute Path Input in nltk.util.filestring() (CVSS 8.6, nltk/nltk · nltk)
- [CVE-2026-3638](https://cve.now/CVE-2026-3638.md): Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authent (CVSS 5.9, Devolutions Server)
- [CVE-2026-29023](https://cve.now/CVE-2026-29023.md): Keygraph Shannon Hard-coded Router API Key (CVSS 6.9, KeygraphHQ Shannon)
- [CVE-2025-15568](https://cve.now/CVE-2025-15568.md): Command Injection Vulnerability on TP-Link Archer AXE75 (CVSS 8.5, TP-Link Systems Archer AXE75 v1.6/v1.0)
- [CVE-2024-14027](https://cve.now/CVE-2024-14027.md): xattr: switch to CLASS(fd) (no CVSS, Linux)
- [CVE-2026-3588](https://cve.now/CVE-2026-3588.md): Server-Side Request Forgery (SSRF) in ikea dirigera (CVSS 7.5, ikea dirigera)
- [CVE-2026-25866](https://cve.now/CVE-2026-25866.md): MobaXterm \< 26.1 Notepad++ Unquoted Service Path (CVSS 8.5, Mobatek MobaXterm)
- [CVE-2026-3089](https://cve.now/CVE-2026-3089.md): Actual Sync Server 26.2.1 - Authenticated Path Traversal (CVSS 5.3, Actual Sync Server · @actual-app/sync-server)
- [CVE-2026-2919](https://cve.now/CVE-2026-2919.md): Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect (CVSS 4.3, Mozilla Focus for iOS)
- [CVE-2026-3819](https://cve.now/CVE-2026-3819.md): SourceCodester Resort Reservation System Reservation Management page cross site scripting (CVSS 5.1, SourceCodester Resort Reservation System)
- [CVE-2026-3038](https://cve.now/CVE-2026-3038.md): Local DoS and possible privilege escalation via routing sockets (CVSS 7.5, FreeBSD)
- [CVE-2026-21736](https://cve.now/CVE-2026-21736.md): GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled (CVSS 4.4, Imagination Technologies Graphics DDK)
- [CVE-2026-2261](https://cve.now/CVE-2026-2261.md): blocklistd(8) socket leak (CVSS 7.5, FreeBSD)
- [CVE-2026-3818](https://cve.now/CVE-2026-3818.md): Tiandy Easy7 CMS Windows GetDBData.jsp sql injection (CVSS 6.9, Tiandy Easy7 CMS Windows)
- [CVE-2025-15576](https://cve.now/CVE-2025-15576.md): Jail chroot escape via fd exchange with a different jail (CVSS 7.5, FreeBSD)
- [CVE-2025-15547](https://cve.now/CVE-2025-15547.md): Jail escape by a privileged user via nullfs (CVSS 8.8, FreeBSD)
- [CVE-2025-14769](https://cve.now/CVE-2025-14769.md): ipfw denial of service (CVSS 7.5, FreeBSD)
- [CVE-2026-3817](https://cve.now/CVE-2026-3817.md): SourceCodester Patients Waiting Area Queue Management System patient-search.php improper authorization (CVSS 6.9, SourceCodester Patients Waiting Area Queue Management System)
- [CVE-2025-14558](https://cve.now/CVE-2025-14558.md): Remote code execution via ND6 Router Advertisements (CVSS 7.2, FreeBSD)
- [CVE-2026-3816](https://cve.now/CVE-2026-3816.md): OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input\_zip.read denial of service (CVSS 5.3, OWASP DefectDojo)
- [CVE-2026-25604](https://cve.now/CVE-2026-25604.md): Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass (CVSS 5.4, Apache Software Foundation Apache Airflow Providers Amazon…)
- [CVE-2026-3815](https://cve.now/CVE-2026-3815.md): UTT HiPER 810G formApMail strcpy buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-69219](https://cve.now/CVE-2025-69219.md): Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator (CVSS 8.8, Apache Software Foundation Apache Airflow Providers Http ·…)
- [CVE-2026-3814](https://cve.now/CVE-2026-3814.md): UTT HiPER 810G getOneApConfTempEntry strcpy buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2026-3813](https://cve.now/CVE-2026-3813.md): opencc JFlow WF\_CCForm.java Calculate injection (CVSS 5.3, opencc JFlow)
- [CVE-2025-40639](https://cve.now/CVE-2025-40639.md): SQL injection in Eventobot (CVSS 8.7, Eventobot)
- [CVE-2025-40638](https://cve.now/CVE-2025-40638.md): Reflected Cross-Site Scripting (XSS) in Eventobot (CVSS 5.1, Eventobot)
- [CVE-2025-69279](https://cve.now/CVE-2025-69279.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-69278](https://cve.now/CVE-2025-69278.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T7300/T8100/T9100/T8200/…)
- [CVE-2025-61616](https://cve.now/CVE-2025-61616.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61615](https://cve.now/CVE-2025-61615.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61614](https://cve.now/CVE-2025-61614.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T7300/T8100/T9100/T8200/…)
- [CVE-2025-61613](https://cve.now/CVE-2025-61613.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61612](https://cve.now/CVE-2025-61612.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T7300/T8100/T9100/T8200/…)
- [CVE-2025-61611](https://cve.now/CVE-2025-61611.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. UDX710)
- [CVE-2026-3812](https://cve.now/CVE-2026-3812.md): itsourcecode Payroll Management System manage\_employee\_allowances.php cross site scripting (CVSS 5.3, itsourcecode Payroll Management System)
- [CVE-2026-24713](https://cve.now/CVE-2026-24713.md): Apache IoTDB: JEXL Expression Injection Vulnerability (CVSS 9.8, Apache Software Foundation Apache IoTDB · org.apache.iotdb:…)
- [CVE-2026-24015](https://cve.now/CVE-2026-24015.md): Apache IoTDB: Insecure Default Configuration Vulnerability (CVSS 9.8, Apache Software Foundation Apache IoTDB · org.apache.iotdb:…)
- [CVE-2026-3811](https://cve.now/CVE-2026-3811.md): Tenda FH1202 P2pListFilter fromP2pListFilter stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2025-41772](https://cve.now/CVE-2025-41772.md): wwwupdate.cgi Session token in URL (CVSS 7.5, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41767](https://cve.now/CVE-2025-41767.md): Signature bypass on update upload (CVSS 7.2, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41766](https://cve.now/CVE-2025-41766.md): Stack buffer overflow on parsing web request (CVSS 8.8, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41765](https://cve.now/CVE-2025-41765.md): Unchecked role in wwwupload.cgi (CVSS 9.1, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41764](https://cve.now/CVE-2025-41764.md): Unchecked role in wwwupdate.cgi (CVSS 9.1, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41763](https://cve.now/CVE-2025-41763.md): Unchecked role in wwwdnload.cgi (CVSS 6.5, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41762](https://cve.now/CVE-2025-41762.md): Secret leak with wwwdnload.cgi (CVSS 6.2, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41761](https://cve.now/CVE-2025-41761.md): Privilege escalation possible (CVSS 7.8, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41760](https://cve.now/CVE-2025-41760.md): Pass filter with Empty Table (CVSS 4.9, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41759](https://cve.now/CVE-2025-41759.md): Use of wildcard (“\*” or “all”) in Block list (CVSS 4.9, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41758](https://cve.now/CVE-2025-41758.md): Arbitrary Write with wwwupload.cgi (CVSS 8.8, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41757](https://cve.now/CVE-2025-41757.md): Arbitrary Write with ubr-restore (CVSS 8.8, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41756](https://cve.now/CVE-2025-41756.md): Arbitrary Write with ubr-editfile (CVSS 8.1, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41755](https://cve.now/CVE-2025-41755.md): Arbitrary Read with ubr-logread (CVSS 6.5, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2025-41754](https://cve.now/CVE-2025-41754.md): Arbitrary Read with ubr-editfile (CVSS 6.5, MBS UBR-01 Mk II · MBS UBR-02 +1)
- [CVE-2026-3810](https://cve.now/CVE-2026-3810.md): Tenda FH1202 DhcpListClient fromDhcpListClient stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2026-3809](https://cve.now/CVE-2026-3809.md): Tenda FH1202 NatSaticSetting fromNatStaticSetting stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2026-3808](https://cve.now/CVE-2026-3808.md): Tenda FH1202 webtypelibrary formWebTypeLibrary stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2026-3807](https://cve.now/CVE-2026-3807.md): Tenda FH1202 AdvSetWrlsafeset formWrlsafeset stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2026-3823](https://cve.now/CVE-2026-3823.md): Atop Technologies｜EHG2408 series switch - Stack-based Buffer Overflow (CVSS 9.3, Atop Technologies EHG2408 · Atop Technologies EHG2408-2SFP)
- [CVE-2026-3806](https://cve.now/CVE-2026-3806.md): SourceCodester/janobe Resort Reservation System room\_rates.php sql injection (CVSS 5.3, SourceCodester Resort Reservation System · janobe Resort Re…)
- [CVE-2026-3804](https://cve.now/CVE-2026-3804.md): Tenda i3 WifiMacFilterSet formWifiMacFilterSet stack-based overflow (CVSS 8.7, Tenda i3)
- [CVE-2026-3803](https://cve.now/CVE-2026-3803.md): Tenda i3 WifiMacFilterGet formWifiMacFilterGet stack-based overflow (CVSS 8.7, Tenda i3)
- [CVE-2026-30896](https://cve.now/CVE-2026-30896.md): The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs). (CVSS 7.8, Qsee Client)
- [CVE-2026-3802](https://cve.now/CVE-2026-3802.md): Tenda i3 exeCommand formexeCommand stack-based overflow (CVSS 8.7, Tenda i3)
- [CVE-2026-3801](https://cve.now/CVE-2026-3801.md): Tenda i3 setAutoPing formSetAutoPing stack-based overflow (CVSS 8.7, Tenda i3)
- [CVE-2026-3822](https://cve.now/CVE-2026-3822.md): Taipower｜Taipower APP(Android) - Improper Certificate Validation (CVSS 8.3, Taipower APP)
- [CVE-2026-3800](https://cve.now/CVE-2026-3800.md): SourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted upload (CVSS 5.3, SourceCodester Resort Reservation System · janobe Resort Re…)
- [CVE-2026-3799](https://cve.now/CVE-2026-3799.md): Tenda i3 setcfm formSetCfm stack-based overflow (CVSS 8.7, Tenda i3)
- [CVE-2026-3798](https://cve.now/CVE-2026-3798.md): Comfast CF-AC100 Request Path mbox-config sub\_44AC14 command injection (CVSS 5.1, Comfast CF-AC100)
- [CVE-2026-3631](https://cve.now/CVE-2026-3631.md): Buffer Over-read DoS Vulnerability in COMMGR2 (CVSS 7.5, DeltaWW COMMGR2)
- [CVE-2026-3630](https://cve.now/CVE-2026-3630.md): Stack-based Buffer Overflow Vulnerability in COMMGR2 (CVSS 9.8, DeltaWW COMMGR2)
- [CVE-2026-3797](https://cve.now/CVE-2026-3797.md): Tiandy Video Surveillance System 视频监控平台 CLS\_REST\_File.java uploadFile unrestricted upload (CVSS 5.3, Tiandy Video Surveillance System 视频监控平台)
- [CVE-2026-3796](https://cve.now/CVE-2026-3796.md): Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO\_Imp.sys ZwTerminateProcess access control (CVSS 4.8, Qi-ANXIN QAX Virus Removal)
- [CVE-2026-3795](https://cve.now/CVE-2026-3795.md): doramart DoraCMS v1.js createFileBypath path traversal (CVSS 5.3, doramart DoraCMS)
- [CVE-2026-3794](https://cve.now/CVE-2026-3794.md): doramart DoraCMS Email API send improper authentication (CVSS 6.9, doramart DoraCMS)
- [CVE-2026-3793](https://cve.now/CVE-2026-3793.md): SourceCodester Sales and Inventory System GET Parameter sales\_invoice1.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-3792](https://cve.now/CVE-2026-3792.md): SourceCodester Sales and Inventory System GET Parameter purchase\_invoice.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-3791](https://cve.now/CVE-2026-3791.md): SourceCodester Sales and Inventory System Search dashboard.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-3790](https://cve.now/CVE-2026-3790.md): SourceCodester Sales and Inventory System POST Parameter check\_supplier\_details.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2025-69647](https://cve.now/CVE-2025-69647.md): GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists d (CVSS 6.2)
- [CVE-2025-69648](https://cve.now/CVE-2025-69648.md): GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug\_rng (CVSS 6.2)
- [CVE-2025-70028](https://cve.now/CVE-2025-70028.md): An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') was discovered in Sunbird-Ed S (CVSS 7.5)
- [CVE-2025-70030](https://cve.now/CVE-2025-70030.md): An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. (CVSS 7.5)
- [CVE-2025-70031](https://cve.now/CVE-2025-70031.md): An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. (CVSS 8.8)
- [CVE-2025-70032](https://cve.now/CVE-2025-70032.md): An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. (CVSS 6.1)
- [CVE-2025-70033](https://cve.now/CVE-2025-70033.md): An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1. (CVSS 5.4)
- [CVE-2025-70034](https://cve.now/CVE-2025-70034.md): An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in mscdex ssh2 v1.17.0. (CVSS 7.5)
- [CVE-2025-70037](https://cve.now/CVE-2025-70037.md): An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in linagora Twake v2023.Q1.1223. (CVSS 6.1)
- [CVE-2025-70038](https://cve.now/CVE-2025-70038.md): An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in linagora Twake v2023.Q1.1223. (CVSS 8.8)
- [CVE-2025-70039](https://cve.now/CVE-2025-70039.md): An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1 (CVSS 9.8)
- [CVE-2025-70040](https://cve.now/CVE-2025-70040.md): An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2. (CVSS 5.3)
- [CVE-2025-70042](https://cve.now/CVE-2025-70042.md): An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master. (CVSS 9.8)
- [CVE-2025-70046](https://cve.now/CVE-2025-70046.md): An issue pertaining to CWE-829: Inclusion of Functionality from Untrusted Control Sphere was discovered in Miazzy oa-front-service master. (CVSS 9.8)
- [CVE-2025-70047](https://cve.now/CVE-2025-70047.md): An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in Nexusoft NexusInterface v3.2.0-beta.2. (CVSS 7.5)
- [CVE-2025-70048](https://cve.now/CVE-2025-70048.md): An issue pertaining to CWE-319: Cleartext Transmission of Sensitive Information was discovered in Nexusoft NexusInterface v3.2.0-beta.2. (CVSS 7.5)
- [CVE-2025-70050](https://cve.now/CVE-2025-70050.md): An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers (CVSS 6.5, lesspass)
- [CVE-2025-70059](https://cve.now/CVE-2025-70059.md): An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial (CVSS 7.5)
- [CVE-2025-70060](https://cve.now/CVE-2025-70060.md): An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0. (CVSS 5.4)
- [CVE-2025-70238](https://cve.now/CVE-2025-70238.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN\_Wizard52. (CVSS 7.5)
- [CVE-2025-70243](https://cve.now/CVE-2025-70243.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN\_Wizard534. (CVSS 7.5)
- [CVE-2025-70250](https://cve.now/CVE-2025-70250.md): Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formdumpeasysetup. (CVSS 7.5)
- [CVE-2025-70973](https://cve.now/CVE-2025-70973.md): ScadaBR 1.12.4 is vulnerable to Session Fixation. (CVSS 4.8)
- [CVE-2026-30140](https://cve.now/CVE-2026-30140.md): An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26\_cn. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.