CVEs published March 11, 2026
337 CVEs were published on March 11, 2026: 35 critical, 108 high. 1 is now in CISA KEV.
- Published
- 337
- Critical
- 35
- High
- 108
- Medium
- 172
- Low
- 22
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 184
Most affected products
- Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- 33
- Google Chrome
- 29
- Adobe Commerce · Adobe Magento Open Source
- 19
- GitLab
- 14
- parse-community parse-server · parse-server
- 9
- openemr
- 8
- Hewlett Packard Enterprise (HPE) AOS-CX
- 5
- opf openproject
- 5
- Splunk Enterprise · Splunk Cloud Platform
- 5
- Cisco IOS XR Software
- 4
Critical 35
- CVE-2026-3916Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape vGoogle Chrome
- CVE-2026-32136AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication BypassAdguardTeam AdGuardHome · github.com/AdguardTeam/AdGuardHome
- CVE-2026-27591Winter: Privilege escalation by authenticated backend userswintercms winter · winter/wn-backend-module
- CVE-2026-32096Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/snsuseplunk plunk
- CVE-2026-31976xygeni-action v5 tag poisoned with C2 backdoorxygeni-action
- CVE-2026-27478Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonationunitycatalog · io.unitycatalog:unitycatalog-server
- CVE-2026-31957Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deploymentshimmelblau-idm himmelblau
- CVE-2026-31896WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.phpLabRedesCefetRJ WeGIA
- CVE-2026-31877Frappe SQL Injection due to improper field sanitizationfrappe
- CVE-2019-25487SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmdSapido RB-1732
- CVE-2019-25471FileThingie 2.5.7 Arbitrary File Upload via ft2.phpFileThingie
- CVE-2019-25468NetGain EM Plus 10.1.68 Remote Code Execution via script_test.jspNetGain Systems NetGain EM Plus
- CVE-2018-25159Epross AVCON6 OGNL Remote Code Execution via login.actionEpross AVCON6 systems management platform
- CVE-2026-31874Taskosaur Improper Role Assignment via Parameter Manipulation in User RegistrationTaskosaur
- CVE-2026-31871Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLparse-community parse-server · parse-server
- CVE-2026-31862Cloud CLI has Command Injection via Multiple Parameterssiteboon claudecodeui · @siteboon/claudecodeui
- CVE-2026-31856Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQLparse-community parse-server · parse-server
- CVE-2026-31852Jellyfin Possible Organization/Secret Compromise from dangerous CI implementationjellyfin code-quality.yml
- CVE-2026-31840Parse Server has a SQL injection via dot-notation field name in PostgreSQLparse-community parse-server · parse-server
- CVE-2026-28229Argo Workflows has unauthorized access to Argo Workflows Templateargoproj argo-workflows · github.com/argoproj/argo-workf… +3
- CVE-2026-27897Vociferous Unauthenticated Remote Path Traversal (RCE via CSRF)WanderingAstronomer Vociferous
- CVE-2026-30903External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to coZoom Communications Zoom Workplace
- CVE-2026-3826WellChoose｜IFTOP - Local File InclusionWellChoose IFTOP
- CVE-2026-2631Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege EscalationDatalogics Ecommerce Delivery
- CVE-2026-27842Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device Micro Research MR-GM5L-S1 · Micro Research MR-GM5A-L1
- CVE-2026-24448Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access.Micro Research MR-GM5L-S1 · Micro Research MR-GM5A-L1
- CVE-2026-29515MiCode FileExplorer SwiFTP Server Authentication BypassMiCode FileExplorer
- CVE-2026-23813Authentication Bypass in Web Interface allows Unauthenticated Admin Password ResetHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2023-27573netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef01234netbox-community netbox-docker
- CVE-2025-66956Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute
- CVE-2025-67038Lantronix EDS5000, G520, and X300 OS Command InjectionLantronix EDS5000 series · Lantronix G520 series +3
- CVE-2025-67039Lantronix EDS3000PS Authentication Bypass Using an Alternate Path or ChannelLantronix EDS3000PS series
- CVE-2025-70024An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0
- CVE-2025-70041An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.
- CVE-2026-30741A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Si
High 108
- CVE-2026-3936Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruptioGoogle Chrome
- CVE-2026-3931Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a Google Chrome
- CVE-2026-3926Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafGoogle Chrome
- CVE-2026-3924use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-3923Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-3922Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2026-3921Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2026-3920Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruptioGoogle Chrome
- CVE-2026-3919Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2026-3918Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2026-3917Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2026-3915Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via Google Chrome
- CVE-2026-3914Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-3913Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2026-321332FAuth has Blind SSRF in image parameter allows internal network access and moreBubka 2FAuth
- CVE-2026-32132ZITADEL: Reactivation of Expired Passkey Registration Codeszitadel
- CVE-2026-32131ZITADEL Cross-Tenant Information Disclosure in Management APIzitadel
- CVE-2026-32130ZITADEL SCIM Authentication Bypass via URL Encodingzitadel
- CVE-2026-32117grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)ekacnet grafanacubism-panel
- CVE-2026-32127SQL Injection Vulnerability in ajax graphs library (OpenEMR)openemr
- CVE-2026-32126OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plansopenemr
- CVE-2026-32123OpenEMR: Therapy Group Sensitivity ACL No Longer Enforcedopenemr
- CVE-2026-32121OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modalopenemr
- CVE-2026-32110SiYuan has a Full-Read SSRF via /api/network/forwardProxysiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-0940A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modLenovo ThinkPad T14 Gen 5 BIOS · Lenovo ThinkPad P14s Ge… +6
- CVE-2026-2368An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptinLenovo FileZ
- CVE-2026-32102OliveTin Unauthorized Action Output Disclosure via EventStreamOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-32101StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check@studiocms s3-storage · @studiocms/s3-storage
- CVE-2026-32097PingPong has improper access control in thread file endpoints allows access outside intended scopecomppolicylab pingpong
- CVE-2026-31979himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccachehimmelblau-idm himmelblau
- CVE-2026-27703RIOT has an Out-of-Bounds Write in nanoCoAP HandlerRIOT-OS RIOT
- CVE-2026-31958Tornado has a DoS due to too many multipart partstornadoweb tornado · tornado
- CVE-2026-31900Black's vulnerable version parsing leads to RCE in GitHub Actionpsf black · black
- CVE-2026-31895WeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.phpLabRedesCefetRJ WeGIA
- CVE-2026-31889Shopware has a potential take over of app credentialsshopware core · shopware platform +2
- CVE-2026-31887Shopware unauthenticated data extraction possible through store-api.order endpointshopware core · shopware platform +2
- CVE-2026-31881Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset windowruntipi
- CVE-2019-25486Varient 1.6.1 SQL Injection via user_id ParameterVarient SQL Inj.
- CVE-2019-25483Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k Restricted Shell EscapeComtrend AR-5310
- CVE-2019-25480ARMBot Unrestricted File Upload via upload.phpARMBot
- CVE-2019-25478GetGo Download Manager 6.2.2.3300 Buffer Overflow DoSGetgosoft GetGo Download Manager
- CVE-2019-25472IntelBras Telefone IP TIP200/200 LITE Arbitrary File Read via dumpConfigFileIntelbras Telefone IP TIP
- CVE-2019-25470eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadFormeWON
- CVE-2019-25467Verypdf docPrint Pro 8.0 Local SEH Buffer OverflowVerypdf docPrint Pro
- CVE-2019-25466Easy File Sharing Web Server 7.2 Local SEH OverflowSharing-File Easy File Sharing Web Server
- CVE-2019-25465Hisilicon HiIpcam V100R003 Information Disclosure via Directory TraversalHisilicon HiIpcam
- CVE-2026-31875Parse Server MFA recovery codes not consumed after useparse-community parse-server · parse-server
- CVE-2026-31872Parse Server has a protected fields bypass via dot-notation in query and sortparse-community parse-server · parse-server
- CVE-2026-31870cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Headeryhirose cpp-httplib
- CVE-2026-31866Allocation of Resources Without Limits or Throttling in flagdopen-feature flagd · github.com/open-feature/flagd/flagd
- CVE-2026-31858CraftCMS's `ElementSearchController` Affected by Blind SQL Injectioncraftcms cms · craftcms/cms
- CVE-2026-31857CraftCMS has an RCE vulnerability via relational conditionals in the control panelcraftcms cms · craftcms/cms
- CVE-2026-31975Cloud CLI WebSocket shell injectionsiteboon claudecodeui · @siteboon/claude-code-ui
- CVE-2026-31861Shell Command Injection in Git Routes [CloudCLI UI]siteboon claudecodeui · @siteboon/claude-code-ui
- CVE-2026-31854Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypasscursor
- CVE-2026-31839Striae has a hash validation utility vulnerabilitystriae-org striae · @striae-org/striae
- CVE-2026-20046Cisco IOS XR Software CLI Privilege Escalation VulnerabilityCisco IOS XR Software
- CVE-2026-20074Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2026-20040Cisco IOS XR Software CLI Privilege Escalation VulnerabilityCisco IOS XR Software
- CVE-2026-20163Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-13929Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-14513Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2026-1069Uncontrolled Recursion in GitLabGitLab
- CVE-2026-1090Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-31892WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Modeargoproj argo-workflows · github.com/argoproj/argo-workf… +3
- CVE-2025-12690Local Privilege Escalation in NGFW EngineForcepoint NGFW Engine
- CVE-2026-22248GLPI affected by Remote Code Execution via malicious uploadglpi-project glpi
- CVE-2026-21888MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer()nanomq
- CVE-2026-3013Path Traversal in Coppermine Photo GalleryCoppermine Photo Gallery
- CVE-2026-30902Zoom Clients for Windows - Improper Privilege ManagementZoom Communications Zoom Workplace
- CVE-2026-30901Zoom Rooms for Windows - Improper Input ValidationZoom Communications Zoom Rooms
- CVE-2026-30900Zoom Workplace Clients for Windows - Improper CheckZoom Communications Zoom Workplace
- CVE-2026-32062OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Streamopenclaw · @openclaw/voice-call
- CVE-2026-32060OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Pathsopenclaw
- CVE-2026-32059OpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBinsopenclaw
- CVE-2026-3496JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' ParameterCrocoblock JetBooking
- CVE-2026-3178Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'jeroenpeters1986 Name Directory
- CVE-2026-3805use after free in SMB connection reusecurl
- CVE-2026-3231Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Fieldthemehigh Checkout Field Editor (Checkout Manager) for WooC…
- CVE-2026-1992ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installationsmub ExactMetrics – Google Analytics Dashboard for WordPress
- CVE-2026-1993ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Updatesmub ExactMetrics – Google Analytics Dashboard for WordPress
- CVE-2026-1454Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scriptingthemehunk Lead Form Builder & Contact Form
- CVE-2026-1708Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parametercroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2026-31844Authenticated SQL Injection in Koha displayby parameter of suggestion.plKoha Community Koha
- CVE-2026-2626Divi Booster < 5.0.2 - Unauthenticated PHP Object Injectiondivi-booster
- CVE-2026-2466DukaPress <= 3.2.4 - Reflected XSSDukaPress
- CVE-2026-3222WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameterflippercode WP Maps – Store Locator,Google Maps,OpenStreetM…
- CVE-2026-20892Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbiMicro Research MR-GM5L-S1 · Micro Research MR-GM5A-L1
- CVE-2025-13067Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypasswproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-2413Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Pathelemntor Ally – Web Accessibility & Usability
- CVE-2026-23816Authenticated Command Injection found in admin AOS-CX CLI commandHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2026-23815Authenticated Command Injection found in AOS-CX Administrative CLI CommandHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2026-23814Authenticated Command Injection found in AOS-CX CLI CommandHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2026-3453ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expirationproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-21284Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21309Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21290Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21289Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21361Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21311Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2025-67034Lantronix EDS5000, G520, and X300 OS Command InjectionLantronix EDS5000 series · Lantronix G520 series +1
- CVE-2025-67035Lantronix EDS5000 OS Command InjectionLantronix EDS5000 series
- CVE-2025-67036Lantronix EDS5000, G520, and X300 OS Command InjectionLantronix EDS5000 series · Lantronix G520 series +1
- CVE-2025-67037Lantronix EDS5000, G520, and X300 OS Command InjectionLantronix EDS5000 series · Lantronix G520 series +1
- CVE-2025-67041Lantronix EDS3000PS OS Command InjectionLantronix EDS3000PS series
- CVE-2025-67298An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
- CVE-2025-68623In Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace an executable file during the installation
- CVE-2025-70027An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
Medium, low and unrated 194
- CVE-2026-3965whyour qinglong API express.ts protection mechanismwhyour qinglong · @whyour/qinglong
- CVE-2026-2808Consul vulnerable to arbitrary file reads through the vault kubernetes authentication providerHashiCorp Consul · github.com/hashicorp/consul
- CVE-2026-3964OpenAkita Chat API Endpoint shell.py run os command injectionOpenAkita
- CVE-2026-3963perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded keyperfree go-fastdfs-web
- CVE-2026-31988yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parserthejoshwolfe yauzl · yauzl
- CVE-2026-3962Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scriptingJcharis Machine-Learning-Web-Apps
- CVE-2026-3942Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2026-3941Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictiGoogle Chrome
- CVE-2026-3940Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictiGoogle Chrome
- CVE-2026-3939Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions vGoogle Chrome
- CVE-2026-3938Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-3937Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via aGoogle Chrome
- CVE-2026-3935Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a craftGoogle Chrome
- CVE-2026-3934Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin poliGoogle Chrome
- CVE-2026-3932Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation resGoogle Chrome
- CVE-2026-3930Unsafe navigation in Navigation in Google Chrome on iOS prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions vGoogle Chrome
- CVE-2025-62328HCL Nomad server on Domino is affected by a missing default frame-ancestors directiveHCLSoftware Nomad server on Domino
- CVE-2026-3929Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin daGoogle Chrome
- CVE-2026-3928Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2026-3927Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2026-3925Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofingGoogle Chrome
- CVE-2026-3961zyddnys manga-image-translator Translate Endpoints request_extraction.py to_pil_image server-side request forgeryzyddnys manga-image-translator
- CVE-2026-39590xKoda WireMCP Tshark CLI index.js server.tool os command injection0xKoda WireMCP
- CVE-2026-3958Woahai321 ListSync JSON api_server.py requests.post server-side request forgeryWoahai321 ListSync
- CVE-2026-32128FastGPT Python Sandbox Bypass of File-Write Restrictionlabring FastGPT
- CVE-2026-3957xierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injectionxierongwkhd weimai-wetapp
- CVE-2026-32125OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labelsopenemr
- CVE-2026-32124OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)openemr
- CVE-2026-32122OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2)openemr
- CVE-2026-32118OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation textopenemr
- CVE-2026-32112ha-mcp has XSS via Unescaped HTML in OAuth Consent Formhomeassistant-ai ha-mcp · ha-mcp
- CVE-2026-32111ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oraclehomeassistant-ai ha-mcp · ha-mcp
- CVE-2026-3956xierongwkhd weimai-wetapp Admin_AdminUserController.java getAdmins sql injectionxierongwkhd weimai-wetapp
- CVE-2026-3955elecV2P jsfile Endpoint wbjs.js runJSFile code injectionelecV2P
- CVE-2026-2640During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticatedLenovo PC Manager
- CVE-2026-1717An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allLenovo Vantage · Lenovo Baiying
- CVE-2026-1716An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow aLenovo Vantage · Lenovo Baiying
- CVE-2026-1715An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow aLenovo Vantage · Lenovo Baiying
- CVE-2026-1653A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenLenovo Smart Connect
- CVE-2026-1652A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local autheLenovo Smart Connect
- CVE-2026-1068An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptinLenovo FileZ
- CVE-2026-0520A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticLenovo FileZ
- CVE-2026-32109Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`9001 copyparty · copyparty
- CVE-2026-32108Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access9001 copyparty · copyparty
- CVE-2026-32104StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settingswithstudiocms studiocms · studiocms
- CVE-2026-32106StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accountswithstudiocms studiocms · studiocms
- CVE-2026-32103StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generationwithstudiocms studiocms · studiocms
- CVE-2026-3954OpenBMB XAgent workspace.py workspace path traversalOpenBMB XAgent
- CVE-2026-32234Parse Server has a SQL injection via query field name when using PostgreSQLparse-community parse-server · parse-server
- CVE-2026-32098Parse Server has a protected fields bypass via LiveQuery subscription WHERE clauseparse-community parse-server · parse-server
- CVE-2026-32095Plunk has Stored Cross-Site Scripting (XSS) via SVG File Uploaduseplunk plunk
- CVE-2026-32094Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dashericcornelissen shescape · shescape
- CVE-2026-31974Blind SSRF on OpenProject instance via webhooksopf openproject
- CVE-2026-31961Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsinganchore quill · github.com/anchore/quill
- CVE-2026-3951LockerProject Locker Error Response registry.js authIsAwesome cross site scriptingLockerProject Locker
- CVE-2026-31960DoS in Quill via unbounded read of HTTP response body during notarizationanchore quill · github.com/anchore/quill
- CVE-2026-31959SSRF in Quill via unvalidated URL from Apple notarization log retrievalanchore quill · github.com/anchore/quill
- CVE-2026-31954Emlog asynchronous media file deletion missing CSRF protectionemlog
- CVE-2026-31901Parse Server has user enumeration via email verification endpointparse-community parse-server · parse-server
- CVE-2026-31894WeGIA affected by arbitrary file read via symlink in backup restoreLabRedesCefetRJ WeGIA
- CVE-2026-3950strukturag libheif stsz/stts track.cc load out-of-boundsstrukturag libheif
- CVE-2026-24510Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerability.Dell Alienware Command Center
- CVE-2026-24508Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Certificate Validation vulnerability.Dell Alienware Command Center
- CVE-2026-31888Shopware has user enumeration via distinct error codes on Store API login endpointshopware core · shopware platform +2
- CVE-2026-24509Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability.Dell Alienware Command Center
- CVE-2026-31879Frappe Workspace modification and stored XSS due to improper resource ownership checksfrappe
- CVE-2026-3949strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-boundsstrukturag libheif
- CVE-2026-31878Frappe: Possible SSRF by any authenticated userfrappe
- CVE-2019-25485R 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR BypassR-Project R
- CVE-2019-25484WinMPG iPod Convert 3.0 Register Field Buffer Overflow DoSWinMPG iPod Convert
- CVE-2019-25477RAR Password Recovery 1.80 Denial of Service Buffer OverflowTop-Password RAR Password Recovery
- CVE-2019-25476Outlook Password Recovery 2.10 Denial of Service Buffer OverflowTop-Password Outlook Password Recovery Denial of Service Ex…
- CVE-2019-25475SQL Server Password Changer 1.90 Denial of Service Buffer OverflowTop-Password SQL Server Password Changer Denial of Service…
- CVE-2019-25474Easy MP3 Downloader 4.7.8.8 Denial of Service Buffer OverflowEasy MP3 Downloader Denial of Service
- CVE-2019-25469Folder Lock 7.7.9 Denial of Service via Serial Number FieldNewsoftwares Folder Lock
- CVE-2019-25464InputMapper 1.6.10 Local Denial of Service via Username FieldDSD Consulting Services LLC. InputMapper
- CVE-2019-25463SpotIE Internet Explorer Password Recovery 2.9.5 Key Field DoSNsauditor SpotIE Internet Explorer Password Recovery
- CVE-2026-31876Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (`tweetToEmbed`)streetwriters notesnook
- CVE-2026-0231Cortex XDR Broker VM: Sensitive Information Disclosure VulnerabilityPalo Alto Networks Cortex XDR Broker VM
- CVE-2026-0230Cortex XDR Agent: Local Administrator can disable the agent on macOSPalo Alto Networks Cortex XDR Agent
- CVE-2026-31868Parse Server has Stored XSS via file upload of HTML-renderable file typesparse-community parse-server · parse-server
- CVE-2026-31867Craft Commerce has a Potential IDOR in Commerce cartscraftcms commerce · craftcms/commerce
- CVE-2026-30226devalue has prototype pollution in devalue.parse and devalue.unflattensveltejs devalue · devalue
- CVE-2026-31863Improper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heartanyproto anytype-heart · anyproto anytype-cli +3
- CVE-2026-31859Craft has Reflective XSS via incomplete return URL sanitizationcraftcms cms · craftcms/cms
- CVE-2026-31853ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-31813Supabase Auth has insecure Apple and Azure authentication with ID tokenssupabase auth
- CVE-2026-30868Cross-Site Request Forgery (CSRF) in opnsense/coreopnsense core
- CVE-2026-20118Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2026-20117Multiple Cisco Contact Center Products Cross-Site Scripting VulnerabilitiesCisco Unified Contact Center Express
- CVE-2026-20116Multiple Cisco Contact Center Products Cross-Site Scripting VulnerabilitiesCisco Unified Contact Center Express
- CVE-2026-1471Caching of authentication contextNeo4j Enterprise edition
- CVE-2026-30239OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgetsopf openproject
- CVE-2026-30236OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rateopf openproject
- CVE-2026-20162Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-20166Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-20164Sensitive Information Disclosure through Improper Access Control in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-20165Sensitive Information Disclosure in MongoClient logging channel in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-3429Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest apiRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2026-1524Auth misconfiguration when multiple providers enabledneo4j Enterprise Edition
- CVE-2025-12555Incorrect Authorization in GitLabGitLab
- CVE-2026-30235Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobberingopf openproject
- CVE-2025-12576Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-12697Improper Encoding or Escaping of Output in GitLabGitLab
- CVE-2025-12704Missing Authorization in GitLabGitLab
- CVE-2025-13690Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-0602Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2026-1230Use of Incorrectly-Resolved Name or Reference in GitLabGitLab
- CVE-2026-1663Missing Authorization in GitLabGitLab
- CVE-2026-30234OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)opf openproject
- CVE-2026-29777Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match valuestraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-28803Open Forms possible to view submission details of other people than intendedopen-formulieren open-forms
- CVE-2026-1497Incorrect privilege assignment in composite databasesneo4j Enterprise Edition
- CVE-2026-1732Improper Removal of Sensitive Information Before Storage or Transfer in GitLabGitLab
- CVE-2026-3848Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLabGitLab
- CVE-2026-32229In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabledJetBrains Hub
- CVE-2026-3946PHPEMS index.php cross site scriptingPHPEMS
- CVE-2026-32063OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generationopenclaw
- CVE-2026-32061OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversalopenclaw
- CVE-2026-3904Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under hThe GNU C Library glibc
- CVE-2026-3944itsourcecode University Management System att_add.php sql injectionitsourcecode University Management System
- CVE-2026-3943H3C ACG1000-AK230 aaa_portal_auth_local_submit command injectionH3C ACG1000-AK230
- CVE-2026-3784wrong proxy connection reuse with credentialscurl
- CVE-2026-3783token leak with redirect and netrccurl
- CVE-2026-1965bad reuse of HTTP Negotiate connectioncurl
- CVE-2026-3906WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST APIWordPress Foundation WordPress
- CVE-2026-3492Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form TitleGravity Forms
- CVE-2024-14026QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-14025Video StationQNAP Systems Video Station
- CVE-2024-14024Video StationQNAP Systems Video Station
- CVE-2026-2917Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameterthehappymonster Happy Addons for Elementor
- CVE-2026-3903Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauthmodulards Modular DS: Monitor, update, and backup multiple…
- CVE-2026-2918Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditionsthehappymonster Happy Addons for Elementor
- CVE-2026-3534Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Metabrainstormforce Astra
- CVE-2026-3825WellChoose｜IFTOP - Reflected Cross-site ScriptingWellChoose IFTOP
- CVE-2026-3824WellChoose｜IFTOP - Open redirectWellChoose IFTOP
- CVE-2026-1867WP Front User Submit < 5.0.6 - Unauthenticated Sensitive Information ExposureGuest posting / Frontend Posting / Front Editor
- CVE-2026-1753Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options UpdateGutena Forms
- CVE-2026-3911Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpointRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-2707weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST APIboldgrid weForms – Easy Drag & Drop Contact Form Builder Fo…
- CVE-2026-2358WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributealimir WP ULike – Like & Dislike Buttons for Engagement and…
- CVE-2026-3884Versions of the package spin.js before 3.0.0 are vulnerable to Cross-site Scripting (XSS) via the spin() function that allows a creation of spin.js
- CVE-2026-23817Unauthenticated Open Redirect allows URL Manipulation in Web InterfaceHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2026-21291Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21293Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21282Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21286Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21294Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21297Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21359Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21292Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21310Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21285Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21360Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21296Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-21295Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)Adobe Commerce · Adobe Magento Open Source
- CVE-2025-12473RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameterrometheme RTMKit
- CVE-2026-2324LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site ScriptingLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-1781MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletiondvankooten MC4WP: Mailchimp for WordPress
- CVE-2026-27241Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27255Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27244Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27251Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27223Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27262Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27232Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27249Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27247Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27242Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27252Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27235Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27225Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27256Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27237Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27265Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27233Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27236Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27240Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27239Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27234Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27231Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27230Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27229Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27266Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27254Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27228Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27248Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27257Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27226Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27253Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27224Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-27250Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2025-70082Lantronix EDS3000PS Unverified Password ChangeLantronix EDS3000PS series
- CVE-2025-70330Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files.