CVEs published March 12, 2026
194 CVEs were published on March 12, 2026: 25 critical, 96 high. 2 are now in CISA KEV.
- Published
- 194
- Critical
- 25
- High
- 96
- Medium
- 68
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 96
Most affected products
- Jettweb Hazir Haber Sitesi Scripti
- 11
- Tenda W3
- 7
- Veeam Backup and Replication
- 7
- undici
- 6
- Trane Tracer SC · Trane Tracer SC+ +1
- 5
- Inoutscripts Inout EasyRooms Ultimate Edition
- 4
- Xooscripts XooGallery
- 4
- @tinacms cli · @tinacms/cli
- 3
- dataease
- 3
- oneuptime
- 3
Critical 25
- CVE-2026-32306OneUptime ClickHouse SQL Injection via Aggregate Query Parametersoneuptime
- CVE-2026-32304Locutus: RCE via unsanitized input in create_function()locutusjs locutus · locutus
- CVE-2026-32301Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URLcentrifugal centrifugo · github.com/centrifugal/centrifu… +4
- CVE-2026-3611Honeywell IQ4x BMS Controller Missing authentication for critical functionHoneywell IQ4E · Honeywell IQ412 +5
- CVE-2026-32251Tolgee has an XXE Injection in Translation Importtolgee-platform
- CVE-2026-32248Parse Server: Account takeover via operator injection in authentication data identifierparse-community parse-server · parse-server
- CVE-2026-32242Parse Server OAuth2 adapter shares mutable state across providers via singleton instanceparse-community parse-server · parse-server
- CVE-2026-32140Dataease: Redshift JDBC RCE Bypassdataease
- CVE-2026-32137DataEase SQL Injection Vulnerabilitydataease
- CVE-2026-28252Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeTrane Tracer SC · Trane Tracer SC+ +1
- CVE-2026-28792Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS@tinacms cli · @tinacms/cli
- CVE-2026-21708A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.Veeam Backup and Replication
- CVE-2026-21669A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.Veeam Backup and Replication
- CVE-2026-21671A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availabilitVeeam Software Appliance
- CVE-2026-21666A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.Veeam Backup and Replication
- CVE-2026-21667A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.Veeam Backup and Replication
- CVE-2026-28384Authenticated RCE via unsanitized compression_algorithmCanonical lxd
- CVE-2026-3060CVE-2026-3060SGLang
- CVE-2026-3059CVE-2026-3059SGLang
- CVE-2026-25818HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha
- CVE-2026-25823HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha
- CVE-2026-26791GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_ser
- CVE-2026-26792GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_u
- CVE-2026-26793GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function.
- CVE-2026-26795GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log fun
High 96
- CVE-2026-32597PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)jpadilla pyjwt · pyjwt
- CVE-2026-32319Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payloadellanetworks core · github.com/ellanetworks/core
- CVE-2026-3910Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-3909Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a cGoogle Chrome
- CVE-2026-32308OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")oneuptime
- CVE-2026-32302OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy modeopenclaw
- CVE-2026-25076Anchore Enterprise GraphQL Reports API SQL injectionAnchore Enterprise
- CVE-2026-2229undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validationundici
- CVE-2026-1528undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientundici
- CVE-2026-1526undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompressionundici
- CVE-2026-32274Black: Arbitrary file writes from unsanitized user input in cache file namepsf black · black
- CVE-2026-32260Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)denoland deno · deno
- CVE-2026-32247Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filtersgetzep graphiti · graphiti-core
- CVE-2026-32246Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpointsteveiliop56 tinyauth · github.com/steveiliop56/tinyauth
- CVE-2026-32138NEXULEAN API Key LeakStalin-143 website
- CVE-2026-32232ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlinkqhkm zeptoclaw · zeptoclaw
- CVE-2026-32231ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload dataqhkm zeptoclaw · zeptoclaw
- CVE-2026-32141flatted: Unbounded recursion DoS in parse() revive phaseWebReflection flatted · flatted
- CVE-2026-32129Poseidon V1 variable-length input collision via implicit zero-paddingstellar rs-soroban-poseidon · soroban-poseidon
- CVE-2026-32116Magic Wormhole: "wormhole receive" allows arbitrary local file overwritemagic-wormhole
- CVE-2026-28255Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeTrane Tracer SC · Trane Tracer SC+ +1
- CVE-2026-28253Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeTrane Tracer SC · Trane Tracer SC+ +1
- CVE-2026-3841Command Injection Vulnerability in Telnet CLI on TP-Link TL-MR6400TP-Link Systems TL-MR6400
- CVE-2026-21887OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion FeatureOpenCTI-Platform opencti · pycti
- CVE-2026-28791Path Traversal in Media Upload Handle in Tinatinacms
- CVE-2026-28793Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS@tinacms cli · @tinacms/cli
- CVE-2026-28356ReDoS in multipart 1.3.0 - `parse_options_header()`defnull multipart · multipart
- CVE-2026-27940llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fixggml-org llama.cpp
- CVE-2026-25529Postal has HTML injection / XSS in message viewpostalserver postal
- CVE-2026-21672A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.Veeam Backup and Replication
- CVE-2019-25543Netartmedia Real Estate Portal 5.0 SQL Injection via index.phpNetartmedia Real Estate Portal
- CVE-2019-25542Netartmedia Real Estate Portal 5.0 SQL Injection via index.phpNetartmedia Real Estate Portal
- CVE-2019-25541Netartmedia PHP Mall 4.1 Multiple SQL InjectionNetartmedia PHP Mall
- CVE-2019-25540Netartmedia PHP Mall 4.1 Multiple SQL InjectionNetartmedia PHP Mall
- CVE-2019-25539202CMS v10 beta SQL Injection via register.phpSourceforge 202CMS
- CVE-2019-25538202CMS v10 beta SQL Injection via log_user ParameterSourceforge 202CMS
- CVE-2019-25537Netartmedia Event Portal 2.0 SQL Injection via loginaction.phpNetartmedia Event Portal
- CVE-2019-25536Netartmedia PHP Real Estate Agency 4.0 SQL Injection via features parameterNetartmedia PHP Real Estate Agency
- CVE-2019-25535Netartmedia PHP Dating Site SQL Injection via loginaction.phpNetartmedia Php Dating Site
- CVE-2019-25534Netartmedia PHP Car Dealer SQL Injection via features parameterNetartmedia PHP Car Dealer
- CVE-2019-25533Netartmedia PHP Business Directory 4.2 SQL Injection via loginaction.phpPhpbusinessdirectory Netartmedia PHP Business Directory
- CVE-2019-25532Netartmedia Jobs Portal 6.1 SQL Injection via loginaction.phpNetartmedia Jobs Portal
- CVE-2019-25531Netartmedia Deals Portal Lastest SQL Injection via loginaction.phpNetartmedia Deals Portal
- CVE-2019-25530uHotelBooking System Lastest SQL Injection via system_page ParameterHotel-Booking-Script uHotelBooking System
- CVE-2019-25529Placeto CMS Alpha rv.4 SQL Injection via page ParameterSourceforge Placeto CMS
- CVE-2019-25528Inout EasyRooms Ultimate Edition v1.0 SQL Injection via searchInoutscripts Inout EasyRooms Ultimate Edition
- CVE-2019-25527Inout EasyRooms Ultimate Edition v1.0 SQL Injection via searchdetailedInoutscripts Inout EasyRooms Ultimate Edition
- CVE-2019-25526Inout EasyRooms Ultimate Edition v1.0 SQL Injection via searchInoutscripts Inout EasyRooms Ultimate Edition
- CVE-2019-25525Inout EasyRooms Ultimate Edition v1.0 SQL Injection via searchInoutscripts Inout EasyRooms Ultimate Edition
- CVE-2019-25524XooGallery Lastest Latest SQL Injection via results.phpXooscripts XooGallery
- CVE-2019-25523XooGallery Lastest Latest SQL Injection via cat.phpXooscripts XooGallery
- CVE-2019-25522XooGallery Lastest Latest Multiple SQL Injections via photo.phpXooscripts XooGallery
- CVE-2019-25521XooGallery Lastest Latest SQL Injection via gal.php gal_idXooscripts XooGallery
- CVE-2019-25520Jettweb PHP Hazir Haber Sitesi Scripti V1 Authentication BypassJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25519Jettweb PHP Hazir Haber Sitesi Scripti V1 SQL InjectionJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25518Jettweb PHP Hazir Haber Sitesi Scripti V1 SQL Injection via arama.phpJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25517Jettweb PHP Hazir Haber Sitesi Scripti V1 SQL Injection via haberarsiv.phpJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25516Jettweb PHP Hazir Haber Sitesi Scripti V1 SQL Injection via gallery.phpJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25515Jettweb PHP Hazir Haber Sitesi Scripti V3 Authentication BypassJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25514Jettweb PHP Hazir Haber Sitesi Scripti V3 SQL InjectionJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25513Jettweb PHP Hazir Haber Sitesi Scripti V3 SQL Injection via datagetir.phpJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25512Jettweb PHP Hazir Haber Sitesi Scripti V3 SQL InjectionJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25511Jettweb PHP Hazir Haber Sitesi Scripti V3 SQL InjectionJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25510Jettweb PHP Hazir Haber Sitesi Scripti V2 Authentication BypassJettweb Hazir Haber Sitesi Scripti
- CVE-2019-25509XooDigital Lastest Latest SQL Injection via results.phpXooscripts XooDigital
- CVE-2019-25508Jettweb Php Hazir Ilan Sitesi Scripti V2 SQL Injection via katgetir.phpJettweb Hazir Ilan Sitesi Scripti
- CVE-2019-25488Jettweb Hazir Rent A Car Scripti V4 SQL Injection via adminJettweb Rent A Car Scripti
- CVE-2019-25482Jettweb PHP Hazir Rent A Car Sitesi Scripti V2 SQL InjectionJettweb Hazir Rent A Car Sitesi Scripti
- CVE-2019-25481iScripts ReserveLogic Lastest SQL Injection via search endpointiScripts ReserveLogic
- CVE-2019-25479Inout RealEstate Lastest SQL Injection via agentlistdetailsInoutscripts Inout RealEstate
- CVE-2019-25473Clinic Pro SQL Injection via monthly_expense_overview month ParameterSoftwebinternational Clinic Pro
- CVE-2026-4043Tenda i12 wifiSSIDget formwrlSSIDget stack-based overflowTenda i12
- CVE-2026-21668A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.Veeam Backup and Replication
- CVE-2026-21670A vulnerability allowing a low-privileged user to extract saved SSH credentials.Veeam Backup and Replication
- CVE-2026-4042Tenda i12 WifiMacFilterGet formWifiMacFilterGet stack-based overflowTenda i12
- CVE-2026-4041Tenda i12 exeCommand vos_strcpy stack-based overflowTenda i12
- CVE-2026-2514Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web applicationProgress Software Flowmon ADS
- CVE-2026-2513Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web applicationProgress Software Flowmon ADS
- CVE-2026-3989CVE-2026-3989SGLang
- CVE-2026-4008Tenda W3 POST Parameter wifiSSIDset stack-based overflowTenda W3
- CVE-2026-4007Tenda W3 POST Parameter wifiSSIDget stack-based overflowTenda W3
- CVE-2026-3978D-Link DIR-513 formEasySetupWizard3 stack-based overflowD-Link DIR-513
- CVE-2026-3976Tenda W3 POST Parameter WifiMacFilterSet formWifiMacFilterSet stack-based overflowTenda W3
- CVE-2026-3975Tenda W3 POST Parameter WifiMacFilterGet formWifiMacFilterGet stack-based overflowTenda W3
- CVE-2026-3657My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Actionpremio My Sticky Bar – Floating Notification Bar & Sticky H…
- CVE-2026-3974Tenda W3 HTTP exeCommand formexeCommand stack-based overflowTenda W3
- CVE-2026-3973Tenda W3 POST Parameter setAutoPing formSetAutoPing stack-based overflowTenda W3
- CVE-2026-3972Tenda W3 HTTP setcfm formSetCfm stack-based overflowTenda W3
- CVE-2026-3971Tenda i3 wifiSSIDset formwrlSSIDset stack-based overflowTenda i3
- CVE-2026-3970Tenda i3 wifiSSIDget formwrlSSIDget stack-based overflowTenda i3
- CVE-2023-43010The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple Safari +1
- CVE-2025-70245Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.
- CVE-2025-70873An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obsqlite
- CVE-2026-25817HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha
- CVE-2026-25819HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 al
- CVE-2026-26794GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function.
Medium, low and unrated 73
- CVE-2026-32612Statamic: privilege escalation via stored cross-site scriptingstatamic cms · statamic/cms
- CVE-2026-32322soroban-sdk: `Fr` scalar field equality comparison bypasses modular reductionstellar rs-soroban-sdk · soroban-sdk
- CVE-2026-32320Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstringsellanetworks core · github.com/ellanetworks/core
- CVE-2026-32598OneUptime: Password Reset Token Logged at INFO Leveloneuptime
- CVE-2026-1527undici is vulnerable to CRLF Injection via upgrade optionundici
- CVE-2026-2581undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoSundici
- CVE-2026-1525undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')undici
- CVE-2026-32269Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpointparse-community parse-server · parse-server
- CVE-2026-32259ImageMagick has a possible stack buffer overflow in sixel encoderImageMagick
- CVE-2026-32240Cap'n Proto: Integer overflow in KJ-HTTP chunk sizecapnproto
- CVE-2026-32239Cap'n Proto has an integer overflow in KJ-HTTPcapnproto
- CVE-2026-32249NFA regex engine NULL pointer dereference affects Vim < 9.2.0137vim
- CVE-2026-2376Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interfacemirror registry for Red Hat OpenShift · Red Hat Quay
- CVE-2026-32245Tinyauth's OIDC authorization codes are not bound to client on token exchangesteveiliop56 tinyauth · github.com/steveiliop56/tinyauth
- CVE-2026-32237@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint@backstage plugin-scaffolder-backend · @backstage/plugin-sc…
- CVE-2026-32236@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch@backstage plugin-auth-backend · @backstage/plugin-auth-bac…
- CVE-2026-32235@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass@backstage plugin-auth-backend · @backstage/plugin-auth-bac…
- CVE-2026-3497Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.Ubuntu openssh
- CVE-2026-32142shopware/commercial: `/api/_info/config` route exposes information about licensesshopware commercial
- CVE-2025-13913Inductive Automation Ignition Software Deserialization of Untrusted DataInductive Automation Ignition Software
- CVE-2026-32230Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pagelouislam uptime-kuma · uptime-kuma
- CVE-2026-32100swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixesswag platform-security
- CVE-2025-13462tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handlingPython Software Foundation CPython
- CVE-2026-32139Dataease: Unfiltered active SVG content leads to Stored XSSdataease
- CVE-2026-31890Inspektor Gadget: Tracing Denial of Service via Event Floodinginspektor-gadget
- CVE-2026-28256Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeTrane Tracer SC · Trane Tracer SC+ +1
- CVE-2026-28254Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeTrane Tracer SC · Trane Tracer SC+ +1
- CVE-2026-31873Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivityunjs unhead · unhead
- CVE-2026-31860Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol checkunjs unhead · unhead
- CVE-2026-31841Raw exposure of database statements in Hyperterse MCP search toolhyperterse
- CVE-2026-29066Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI@tinacms cli · @tinacms/cli
- CVE-2026-24125Path Traversal in @tinacms/graphql@tinacms graphql · @tinacms/graphql
- CVE-2026-4045projectsend Auth.php response discrepancyprojectsend
- CVE-2026-4044projectsend Delete import-orphans.php realpath path traversalprojectsend
- CVE-2026-3099Libsoup: libsoup: authentication bypass via digest authentication replay attackRed Hat Enterprise Linux
- CVE-2026-0809Weak KSeF token encoding in Streamsoft PrestiżStreamsoft Prestiż
- CVE-2026-2987Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'specialk Simple Ajax Chat – Add a Fast, Secure Chat Box
- CVE-2026-4040OpenClaw File Existence tools.exec.safeBins information exposureOpenClaw
- CVE-2026-4039OpenClaw Skill Env applySkillConfigenvOverrides code injectionOpenClaw
- CVE-2026-2366Keycloak: keycloak: information disclosure via authorization bypass in admin apiRed Hat build of Keycloak · @keycloak/keycloak-admin-cli… +1
- CVE-2026-3234Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injectionRed Hat Enterprise Linux · Red Hat JBoss Core Services
- CVE-2026-4016GPAC SVG Parser load_svg.c svgin_process out-of-bounds writeGPAC
- CVE-2026-4015GPAC TeXML File load_text.c txtin_process_texml stack-based overflowGPAC
- CVE-2026-4014itsourcecode Cafe Reservation System Registration signup.php sql injectionitsourcecode Cafe Reservation System
- CVE-2026-4013SourceCodester Web-based Pharmacy Product Management System add_admin.php improper authorizationSourceCodester Web-based Pharmacy Product Management System
- CVE-2026-4012rxi fe fe.c read_ out-of-boundsrxi fe
- CVE-2026-4010ThakeeNathees pocketlang pkByteBufferAddString memory corruptionThakeeNathees pocketlang
- CVE-2026-4009jarikomppa soloud WAV File dr_wav.h drwav_read_pcm_frames_s16__msadpcm out-of-boundsjarikomppa soloud
- CVE-2026-3994rui314 mold Object File input-files.cc initialize_sections heap-based overflowrui314 mold
- CVE-2026-3993itsourcecode Payroll Management System manage_employee_deductions.php cross site scriptingitsourcecode Payroll Management System
- CVE-2026-2687Reading progressbar < 1.3.1 - Admin+ Stored XSSReading progressbar
- CVE-2025-15473Timetics < 1.0.52 - Unauthenticated Payment/Booking Status UpdateTimetics
- CVE-2026-3992CodeGenieApp serverless-express Users Endpoint dynamodb.ts injectionCodeGenieApp serverless-express
- CVE-2026-3990CesiumGS CesiumJS standalone.html cross site scriptingCesiumGS CesiumJS
- CVE-2026-3984Campcodes Division Regional Athletic Meet Game Result Matrix System save_up_athlete.php cross site scriptingCampcodes Division Regional Athletic Meet Game Result Matri…
- CVE-2026-3983Campcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scriptingCampcodes Division Regional Athletic Meet Game Result Matri…
- CVE-2026-3982itsourcecode University Management System view_result.php cross site scriptingitsourcecode University Management System
- CVE-2026-3981itsourcecode Online Doctor Appointment System doctor_action.php sql injectionitsourcecode Online Doctor Appointment System
- CVE-2026-3980itsourcecode Online Doctor Appointment System patient_action.php sql injectionitsourcecode Online Doctor Appointment System
- CVE-2026-3979quickjs-ng quickjs quickjs.c js_iterator_concat_return use after freequickjs-ng quickjs
- CVE-2026-3977projectsend AJAX Endpoints authorizationprojectsend
- CVE-2026-3226LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggeringthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2025-15038An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver.ASUS Business System Control Interface
- CVE-2026-1878An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SASUS Driver
- CVE-2025-15037An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver.ASUS Business System Control Interface
- CVE-2025-59388Hyper Data ProtectorQNAP Systems Hyper Data Protector
- CVE-2026-1182Improper Removal of Sensitive Information Before Storage or Transfer in GitLabGitLab
- CVE-2026-3969FeMiner wms Basic Organizational Structure depart_add_bg.php sql injectionFeMiner wms
- CVE-2026-3968AutohomeCorp frostmourne Oracle Nashorn JavaScript ExpressionRule.java scriptEngine.eval code injectionAutohomeCorp frostmourne
- CVE-2026-3967Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserializationAlfresco Activiti
- CVE-2026-3966648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgery648540858 wvp-GB28181-pro
- CVE-2025-61154Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Servi
- CVE-2025-66955Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access file