# CVEs published 2026-03-13

289 CVEs were published on March 13, 2026: 10 critical, 83 high. Days are UTC.

- [CVE-2026-0385](https://cve.now/CVE-2026-0385.md): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (CVSS 5.0, Microsoft Edge for Android)
- [CVE-2026-32732](https://cve.now/CVE-2026-32732.md): XSS in @leanprover/unicode-input-component (CVSS 0.0, leanprover vscode-lean4 · @leanprover/unicode-input-compone…)
- [CVE-2026-32729](https://cve.now/CVE-2026-32729.md): Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on \`/api/auth/verify-totp\` (CVSS 8.1, runtipi)
- [CVE-2026-32724](https://cve.now/CVE-2026-32724.md): PX4 autopilot has a heap Use-After-Free in MavlinkShell::available() via SERIAL\_CONTROL Race Condition (CVSS 5.3, PX4-Autopilot)
- [CVE-2026-3227](https://cve.now/CVE-2026-3227.md): Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N (CVSS 8.5, TP-Link Systems TL-WR802N · TP-Link Systems TL-WR841N +1)
- [CVE-2026-32720](https://cve.now/CVE-2026-32720.md): Improper Access Control in github.com/ctfer-io/monitoring (CVSS 7.1, ctfer-io monitoring · github.com/ctfer-io/monitoring)
- [CVE-2026-32719](https://cve.now/CVE-2026-32719.md): AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import (CVSS 4.2, Mintplex-Labs anything-llm)
- [CVE-2026-32717](https://cve.now/CVE-2026-32717.md): AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys (CVSS 2.7, Mintplex-Labs anything-llm)
- [CVE-2026-32715](https://cve.now/CVE-2026-32715.md): AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences (CVSS 3.8, Mintplex-Labs anything-llm)
- [CVE-2026-32713](https://cve.now/CVE-2026-32713.md): PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors (CVSS 4.3, PX4-Autopilot)
- [CVE-2026-32709](https://cve.now/CVE-2026-32709.md): PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete) (CVSS 5.4, PX4-Autopilot)
- [CVE-2026-32708](https://cve.now/CVE-2026-32708.md): Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot) (CVSS 7.8, PX4-Autopilot)
- [CVE-2026-32707](https://cve.now/CVE-2026-32707.md): PX4 autopilot has a stack buffer overflow in tattu\_can due to unbounded memcpy in frame assembly loop (CVSS 5.2, PX4-Autopilot)
- [CVE-2026-32706](https://cve.now/CVE-2026-32706.md): PX4 autopilot has a global buffer overflow in crsf\_rc via oversized variable-length known packet (CVSS 7.1, PX4-Autopilot)
- [CVE-2026-32705](https://cve.now/CVE-2026-32705.md): PX4 autopilot BST Device Name Length Can Overflow Driver Buffer (CVSS 6.8, PX4-Autopilot)
- [CVE-2026-32616](https://cve.now/CVE-2026-32616.md): Pigeon has a Host Header Injection in email verification flow (CVSS 8.2, kasuganosoras Pigeon)
- [CVE-2026-32704](https://cve.now/CVE-2026-32704.md): SiYuan renderSprig: missing admin check allows any user to read full workspace DB (CVSS 6.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-26133](https://cve.now/CVE-2026-26133.md): M365 Copilot Information Disclosure Vulnerability (CVSS 7.1, Microsoft 365 Copilot for Android · Microsoft 365 Copil… +17)
- [CVE-2026-32702](https://cve.now/CVE-2026-32702.md): Cleanuparr has Username Enumeration via Timing Attack (CVSS 6.9, Cleanuparr)
- [CVE-2026-32640](https://cve.now/CVE-2026-32640.md): (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox. (CVSS 8.7, danthedeckie simpleeval · simpleeval)
- [CVE-2026-32772](https://cve.now/CVE-2026-32772.md): telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW\_ENVIRON SEND USERVAR. (CVSS 3.4, GNU inetutils)
- [CVE-2026-32635](https://cve.now/CVE-2026-32635.md): Angular has XSS in i18n attribute bindings (CVSS 8.6, @angular compiler · @angular core +2)
- [CVE-2026-32630](https://cve.now/CVE-2026-32630.md): file-type affected by ZIP Decompression Bomb DoS via \[Content\_Types\].xml entry (CVSS 5.3, sindresorhus file-type · file-type)
- [CVE-2026-32628](https://cve.now/CVE-2026-32628.md): AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table\_name Parameter (CVSS 7.7, Mintplex-Labs anything-llm)
- [CVE-2026-32627](https://cve.now/CVE-2026-32627.md): cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy (CVSS 8.7, yhirose cpp-httplib)
- [CVE-2025-15060](https://cve.now/CVE-2025-15060.md): claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability (CVSS 9.8, claude-hovercraft)
- [CVE-2026-2491](https://cve.now/CVE-2026-2491.md): Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability (CVSS 6.3, Socomec DIRIS A-40)
- [CVE-2026-2493](https://cve.now/CVE-2026-2493.md): IceWarp collaboration Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, IceWarp)
- [CVE-2026-3084](https://cve.now/CVE-2026-3084.md): GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-2921](https://cve.now/CVE-2026-2921.md): GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-3083](https://cve.now/CVE-2026-3083.md): GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 8.8, GStreamer)
- [CVE-2026-3086](https://cve.now/CVE-2026-3086.md): GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-3085](https://cve.now/CVE-2026-3085.md): GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, GStreamer)
- [CVE-2026-3082](https://cve.now/CVE-2026-3082.md): GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-3081](https://cve.now/CVE-2026-3081.md): GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-2923](https://cve.now/CVE-2026-2923.md): GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-2922](https://cve.now/CVE-2026-2922.md): GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-2920](https://cve.now/CVE-2026-2920.md): GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-3839](https://cve.now/CVE-2026-3839.md): Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability (CVSS 7.3, Unraid)
- [CVE-2026-3838](https://cve.now/CVE-2026-3838.md): Unraid Update Request Path Traversal Remote Code Execution Vulnerability (CVSS 8.8, Unraid)
- [CVE-2026-3562](https://cve.now/CVE-2026-3562.md): Philips Hue Bridge hk\_hap Ed25519 Signature Verification Authentication Bypass Vulnerability (CVSS 6.3, Philips Hue Bridge)
- [CVE-2026-3561](https://cve.now/CVE-2026-3561.md): Philips Hue Bridge hk\_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Philips Hue Bridge)
- [CVE-2026-3560](https://cve.now/CVE-2026-3560.md): Philips Hue Bridge HomeKit hk\_hap\_pair\_storage\_put Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Philips Hue Bridge)
- [CVE-2026-3559](https://cve.now/CVE-2026-3559.md): Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability (CVSS 8.1, Philips Hue Bridge)
- [CVE-2026-3558](https://cve.now/CVE-2026-3558.md): Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability (CVSS 8.1, Philips Hue Bridge)
- [CVE-2026-3557](https://cve.now/CVE-2026-3557.md): Philips Hue Bridge hap\_pair\_verify\_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Philips Hue Bridge)
- [CVE-2026-3556](https://cve.now/CVE-2026-3556.md): Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Philips Hue Bridge)
- [CVE-2026-3555](https://cve.now/CVE-2026-3555.md): Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Philips Hue Bridge)
- [CVE-2026-32621](https://cve.now/CVE-2026-32621.md): Apollo Federation has prototype pollution via incomplete key sanitization (CVSS 9.9, @apollo federation-internals · @apollo gateway +4)
- [CVE-2026-32626](https://cve.now/CVE-2026-32626.md): AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection (CVSS 9.7, Mintplex-Labs anything-llm)
- [CVE-2026-32614](https://cve.now/CVE-2026-32614.md): Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability (CVSS 7.5, emmansun gmsm · github.com/emmansun/gmsm)
- [CVE-2026-0977](https://cve.now/CVE-2026-0977.md): IBM CICS Transaction Gateway for Multiplatforms Information Disclosure (CVSS 5.1, IBM CICS Transaction Gateway for Multiplatforms)
- [CVE-2026-32617](https://cve.now/CVE-2026-32617.md): AnythingLLM Permissable CORS policy (CVSS 7.1, Mintplex-Labs anything-llm)
- [CVE-2026-32600](https://cve.now/CVE-2026-32600.md): xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption (CVSS 8.2, simplesamlphp xml-security · simplesamlphp/xml-security)
- [CVE-2026-32594](https://cve.now/CVE-2026-32594.md): Parse Server GraphQL WebSocket endpoint bypasses security middleware (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2025-13212](https://cve.now/CVE-2025-13212.md): IBM Aspera Console Denial of Service (CVSS 5.3, IBM Aspera Console)
- [CVE-2025-13459](https://cve.now/CVE-2025-13459.md): IBM Aspera Console Denial of Service (CVSS 2.7, IBM Aspera Console)
- [CVE-2025-13460](https://cve.now/CVE-2025-13460.md): IBM Aspera Console Information Disclosure (CVSS 5.3, IBM Aspera Console)
- [CVE-2026-32314](https://cve.now/CVE-2026-32314.md): Yamux remote Panic via malformed Data frame with SYN set and len = 262145 (CVSS 8.7, libp2p rust-yamux · yamux)
- [CVE-2026-32313](https://cve.now/CVE-2026-32313.md): xmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption (CVSS 8.2, robrichards xmlseclibs · robrichards/xmlseclibs)
- [CVE-2026-31949](https://cve.now/CVE-2026-31949.md): LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos (CVSS 6.5, danny-avila LibreChat)
- [CVE-2026-31944](https://cve.now/CVE-2026-31944.md): LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link (CVSS 7.6, danny-avila LibreChat)
- [CVE-2026-31899](https://cve.now/CVE-2026-31899.md): CairoSVG vulnerable to Exponential DoS via recursive \<use\> element amplification (CVSS 7.5, Kozea CairoSVG · cairosvg)
- [CVE-2025-36368](https://cve.now/CVE-2025-36368.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway SQL Injection (CVSS 6.5, IBM Sterling B2B Integrator)
- [CVE-2026-31886](https://cve.now/CVE-2026-31886.md): Dagu has a Path Traversal via \`dagRunId\` in Inline DAG Execution (CVSS 9.1, dagu-org dagu · github.com/dagu-org/dagu)
- [CVE-2026-31882](https://cve.now/CVE-2026-31882.md): Dagu SSE Authentication Bypass in Basic Auth Mode (CVSS 7.5, dagu-org dagu · dagu)
- [CVE-2023-40693](https://cve.now/CVE-2023-40693.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2026-31864](https://cve.now/CVE-2026-31864.md): JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering (CVSS 6.8, jumpserver)
- [CVE-2026-31814](https://cve.now/CVE-2026-31814.md): Yamux remote Panic via malformed WindowUpdate credit (CVSS 8.7, libp2p rust-yamux · yamux)
- [CVE-2026-31798](https://cve.now/CVE-2026-31798.md): JumpServer Improper Certificate Validation in Custom SMS API Client (CVSS 5.0, jumpserver)
- [CVE-2025-14483](https://cve.now/CVE-2025-14483.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway Information Disclosure (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2026-30961](https://cve.now/CVE-2026-30961.md): Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload (CVSS 4.3, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2025-14504](https://cve.now/CVE-2025-14504.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-30955](https://cve.now/CVE-2026-30955.md): Gokapi vulnerable to DoS in E2E Metadata Parser (CVSS 6.5, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2026-30943](https://cve.now/CVE-2026-30943.md): Gokapi has Privilege Escalation in File Replace (CVSS 4.1, Forceu Gokapi · github.com/forceu/gokapi)
- [CVE-2026-30915](https://cve.now/CVE-2026-30915.md): SFTPGo improperly sanitizes placeholders in group home directories/key prefixes (CVSS 5.3, drakkan sftpgo · github.com/drakkan/sftpgo +1)
- [CVE-2026-30914](https://cve.now/CVE-2026-30914.md): SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy (CVSS 5.3, drakkan sftpgo · github.com/drakkan/sftpgo/v2 +1)
- [CVE-2026-30853](https://cve.now/CVE-2026-30853.md): calibre has a Path Traversal Leading to Arbitrary File Write (CVSS 5.0, kovidgoyal calibre)
- [CVE-2026-0835](https://cve.now/CVE-2026-0835.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7\_2, 6.2.0.0 through 6.2.0.5\_1, 6.2.1.0 through 6.2.1.1\_1, a (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2025-71263](https://cve.now/CVE-2025-71263.md): In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size o (CVSS 7.4, AT&T Bell Labs UNIX)
- [CVE-2025-13702](https://cve.now/CVE-2025-13702.md): IBM Sterling Partner Engagement Manager Cross-Site Scripting (CVSS 6.1, IBM Sterling Partner Engagement Manager)
- [CVE-2025-13718](https://cve.now/CVE-2025-13718.md): IBM Sterling Partner Engagement Manager Information Disclosure (CVSS 3.7, IBM Sterling Partner Engagement Manager)
- [CVE-2025-13723](https://cve.now/CVE-2025-13723.md): IBM Sterling Partner Engagement Manager Information Disclosure (CVSS 5.3, IBM Sterling Partner Engagement Manager)
- [CVE-2025-12453](https://cve.now/CVE-2025-12453.md): Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica. (CVSS 5.1, OpenText™ Vertica)
- [CVE-2025-12454](https://cve.now/CVE-2025-12454.md): Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica. (CVSS 5.1, OpenText™ Vertica)
- [CVE-2025-12455](https://cve.now/CVE-2025-12455.md): Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica. (CVSS 5.1, OpenText™ Vertica)
- [CVE-2025-13726](https://cve.now/CVE-2025-13726.md): IBM Sterling Partner Engagement Manager Information Disclosure (CVSS 5.3, IBM Sterling Partner Engagement Manager)
- [CVE-2025-14811](https://cve.now/CVE-2025-14811.md): IBM Sterling Partner Engagement Manager Information Disclosure (CVSS 3.1, IBM Sterling Partner Engagement Manager)
- [CVE-2026-31897](https://cve.now/CVE-2026-31897.md): FreeRDP has an out-of-bounds read in \`freerdp\_bitmap\_decompress\_planar\` (CVSS 0.0, FreeRDP)
- [CVE-2026-31806](https://cve.now/CVE-2026-31806.md): FreeRDP has a Heap Buffer Overflow in nsc\_process\_message() via Unchecked SURFACE\_BITS\_COMMAND Bitmap Dimensions (CVSS 9.3, FreeRDP)
- [CVE-2026-31885](https://cve.now/CVE-2026-31885.md): FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step\_index bounds checks (CVSS 6.5, FreeRDP)
- [CVE-2026-31884](https://cve.now/CVE-2026-31884.md): FreeRDP has a division-by-zero in ADPCM decoders when \`nBlockAlign\` is 0 (CVSS 6.5, FreeRDP)
- [CVE-2026-31883](https://cve.now/CVE-2026-31883.md): FreeRDP has a \`size\_t\` underflow in ADPCM decoder leads to heap-buffer-overflow write (CVSS 6.5, FreeRDP)
- [CVE-2026-29776](https://cve.now/CVE-2026-29776.md): FreeRDP has an Integer Underflow in update\_read\_cache\_bitmap\_order Function of FreeRDP's Core Library (CVSS 3.1, FreeRDP)
- [CVE-2026-29775](https://cve.now/CVE-2026-29775.md): FreeRDP has a heap-buffer-overflow in bitmap\_cache\_put via OOB cacheId (CVSS 5.3, FreeRDP)
- [CVE-2026-29774](https://cve.now/CVE-2026-29774.md): FreeRDP has a heap-buffer-overflow in avc420\_yuv\_to\_rgb via OOB regionRects (CVSS 5.3, FreeRDP)
- [CVE-2026-29079](https://cve.now/CVE-2026-29079.md): Type Confusion in Lexbor Fragment Parser (CVSS 8.2, lexbor)
- [CVE-2026-29078](https://cve.now/CVE-2026-29078.md): Integer Underflow in Lexbor ISO‑2022‑JP Encoder (CVSS 8.2, lexbor)
- [CVE-2026-32746](https://cve.now/CVE-2026-32746.md): telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add\_ (CVSS 9.8, GNU inetutils)
- [CVE-2026-1668](https://cve.now/CVE-2026-1668.md): Input Validation Vulnerability on Multiple Omada Switches (CVSS 7.7, TP-Link Systems SG2008P · TP-Link Systems SX3016F +37)
- [CVE-2026-23940](https://cve.now/CVE-2026-23940.md): Denial of Service via Oversized Package Upload (CVSS 7.1, hexpm)
- [CVE-2026-26954](https://cve.now/CVE-2026-26954.md): SandboxJS has a Sandbox Escape (CVSS 10.0, nyariv SandboxJS · @nyariv/sandboxjs)
- [CVE-2026-32745](https://cve.now/CVE-2026-32745.md): In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings (CVSS 6.3, JetBrains Datalore)
- [CVE-2026-4092](https://cve.now/CVE-2026-4092.md): Arbitrary File Write via Path Traversal in Google clasp leading to RCE (CVSS 8.7, Google Clasp · @google/clasp)
- [CVE-2025-60012](https://cve.now/CVE-2025-60012.md): Apache Livy: Restrict file access (CVSS 6.3, Apache Software Foundation Apache Livy · org.apache.livy:li…)
- [CVE-2025-66249](https://cve.now/CVE-2025-66249.md): Apache Livy: Unauthorized directory access (CVSS 6.3, Apache Software Foundation Apache Livy · org.apache.livy:li…)
- [CVE-2026-0956](https://cve.now/CVE-2026-0956.md): Out-Of-Bounds Read in Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2026-0955](https://cve.now/CVE-2026-0955.md): Out-Of-Bounds Read When Opening a Corrupt File in Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2026-0957](https://cve.now/CVE-2026-0957.md): Out-Of-Bounds Write in Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2026-0954](https://cve.now/CVE-2026-0954.md): Out-Of-Bounds Write When Opening a Corrupt DSB File in Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2026-2673](https://cve.now/CVE-2026-2673.md): OpenSSL TLS 1.3 server may choose unexpected key agreement group (CVSS 6.5, OpenSSL)
- [CVE-2025-13779](https://cve.now/CVE-2025-13779.md): Configuration Data Spill (CVSS 8.3, ABB AWIN GW100 rev.2 · ABB AWIN GW120)
- [CVE-2025-13778](https://cve.now/CVE-2025-13778.md): Device Reboot Control (CVSS 6.5, ABB AWIN GW100 rev.2 · ABB AWIN GW120)
- [CVE-2025-13777](https://cve.now/CVE-2025-13777.md): Authentication Bypass due to Improper Session Validation (CVSS 8.3, ABB AWIN GW100 rev.2 · ABB AWIN GW120)
- [CVE-2026-4111](https://cve.now/CVE-2026-4111.md): Libarchive: infinite loop denial of service in rar5 decompression via archive\_read\_data() in libarchive (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +6)
- [CVE-2026-32543](https://cve.now/CVE-2026-32543.md): WordPress Responsive Blocks plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 5.3, CyberChimps Responsive Blocks)
- [CVE-2026-32487](https://cve.now/CVE-2026-32487.md): WordPress Lawyer Landing Page theme \<= 1.2.7 - Broken Access Control vulnerability (CVSS 5.3, raratheme Lawyer Landing Page)
- [CVE-2026-32486](https://cve.now/CVE-2026-32486.md): WordPress Travel Booking theme \<= 1.3.9 - Broken Access Control vulnerability (CVSS 5.3, wptravelengine Travel Booking)
- [CVE-2026-32462](https://cve.now/CVE-2026-32462.md): WordPress Master Addons for Elementor plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Liton Arefin Master Addons for Elementor)
- [CVE-2026-32461](https://cve.now/CVE-2026-32461.md): WordPress Really Simple SSL plugin \<= 9.5.7 - Broken Access Control vulnerability (CVSS 4.3, Really Simple Plugins Really Simple SSL)
- [CVE-2026-32460](https://cve.now/CVE-2026-32460.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.5.36 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themefic Ultimate Addons for Contact Form)
- [CVE-2026-32459](https://cve.now/CVE-2026-32459.md): WordPress UpsellWP plugin \<= 2.2.4 - SQL Injection vulnerability (CVSS 7.6, flycart UpsellWP)
- [CVE-2026-32458](https://cve.now/CVE-2026-32458.md): WordPress WOLF plugin \<= 1.0.8.7 - SQL Injection vulnerability (CVSS 7.6, RealMag777 WOLF)
- [CVE-2026-32457](https://cve.now/CVE-2026-32457.md): WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin \<= 1.6.18 - Broken Access Control vulnerability (CVSS 5.3, Wombat Plugins Advanced Product Fields (Product Addons) for…)
- [CVE-2026-32456](https://cve.now/CVE-2026-32456.md): WordPress Admin Menu Editor plugin \<= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Janis Elsts Admin Menu Editor)
- [CVE-2026-32455](https://cve.now/CVE-2026-32455.md): WordPress MDTF plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RealMag777 MDTF)
- [CVE-2026-32454](https://cve.now/CVE-2026-32454.md): WordPress Avada Core plugin \< 5.15.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeFusion Avada Core)
- [CVE-2026-32453](https://cve.now/CVE-2026-32453.md): WordPress Avada Core plugin \< 5.15.0 - Broken Access Control vulnerability (CVSS 5.3, ThemeFusion Avada Core)
- [CVE-2026-32452](https://cve.now/CVE-2026-32452.md): WordPress Fusion Builder plugin \< 3.15.0 - Broken Access Control vulnerability (CVSS 5.3, ThemeFusion Fusion Builder)
- [CVE-2026-32451](https://cve.now/CVE-2026-32451.md): WordPress Fusion Builder plugin \< 3.15.0 - Broken Access Control vulnerability (CVSS 6.5, ThemeFusion Fusion Builder)
- [CVE-2026-32450](https://cve.now/CVE-2026-32450.md): WordPress Active Products Tables for WooCommerce plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RealMag777 Active Products Tables for WooCommerce)
- [CVE-2026-32449](https://cve.now/CVE-2026-32449.md): WordPress Themify Event Post plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themifyme Themify Event Post)
- [CVE-2026-32448](https://cve.now/CVE-2026-32448.md): WordPress Podlove Podcast Publisher plugin \<= 4.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eric Teubert Podlove Podcast Publisher)
- [CVE-2026-32447](https://cve.now/CVE-2026-32447.md): WordPress Atarim plugin \<= 4.3.2 - Broken Access Control vulnerability (CVSS 4.3, Vito Peleg Atarim)
- [CVE-2026-32446](https://cve.now/CVE-2026-32446.md): WordPress Contact Form by WPForms plugin \<= 1.9.9.3 - Broken Access Control vulnerability (CVSS 4.3, Syed Balkhi Contact Form by WPForms)
- [CVE-2026-32445](https://cve.now/CVE-2026-32445.md): WordPress Elementor Website Builder plugin \<= 3.35.5 - Broken Access Control vulnerability (CVSS 2.7, Elementor Website Builder)
- [CVE-2026-32443](https://cve.now/CVE-2026-32443.md): WordPress Product Feed PRO for WooCommerce plugin \<= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Josh Kohlbach Product Feed PRO for WooCommerce)
- [CVE-2026-32442](https://cve.now/CVE-2026-32442.md): WordPress e2pdf plugin \<= 1.28.15 - Broken Access Control vulnerability (CVSS 5.0, e2pdf)
- [CVE-2026-32440](https://cve.now/CVE-2026-32440.md): WordPress WP Food plugin \< 2.7.1 - Broken Access Control vulnerability (CVSS 5.3, Ex-Themes WP Food)
- [CVE-2026-32439](https://cve.now/CVE-2026-32439.md): WordPress BigHearts theme \<= 3.1.14 - Broken Access Control vulnerability (CVSS 5.3, WebGeniusLab BigHearts)
- [CVE-2026-32438](https://cve.now/CVE-2026-32438.md): WordPress VW School Education theme \<= 1.4.6 - Broken Access Control vulnerability (CVSS 5.3, vowelweb VW School Education)
- [CVE-2026-32437](https://cve.now/CVE-2026-32437.md): WordPress VW Portfolio theme \<= 1.3.3 - Broken Access Control vulnerability (CVSS 5.3, vowelweb VW Portfolio)
- [CVE-2026-32436](https://cve.now/CVE-2026-32436.md): WordPress VW Photography theme \<= 1.3.8 - Broken Access Control vulnerability (CVSS 5.3, vowelweb VW Photography)
- [CVE-2026-32435](https://cve.now/CVE-2026-32435.md): WordPress VW Pet Shop theme \<= 1.4.7 - Broken Access Control vulnerability (CVSS 5.3, vowelweb VW Pet Shop)
- [CVE-2026-32434](https://cve.now/CVE-2026-32434.md): WordPress VW Fitness theme \<= 4.3.4 - Broken Access Control vulnerability (CVSS 5.3, vowelweb VW Fitness)
- [CVE-2026-32433](https://cve.now/CVE-2026-32433.md): WordPress CP Contact Form with Paypal plugin \<= 1.3.61 - SQL Injection vulnerability (CVSS 8.5, codepeople CP Contact Form with Paypal)
- [CVE-2026-32432](https://cve.now/CVE-2026-32432.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.42 - Broken Access Control vulnerability (CVSS 5.3, codepeople WP Time Slots Booking Form)
- [CVE-2026-32431](https://cve.now/CVE-2026-32431.md): WordPress Astra Bulk Edit plugin \<= 1.2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Astra Bulk Edit)
- [CVE-2026-32430](https://cve.now/CVE-2026-32430.md): WordPress PowerPack Addons for Elementor plugin \<= 2.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, IdeaBox Creations PowerPack Addons for Elementor)
- [CVE-2026-32429](https://cve.now/CVE-2026-32429.md): WordPress Magical Addons For Elementor plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor Alam Magical Addons For Elementor)
- [CVE-2026-32428](https://cve.now/CVE-2026-32428.md): WordPress Popup Like box plugin \<= 3.7.7 - Broken Access Control vulnerability (CVSS 5.3, Ays Pro Popup Like box)
- [CVE-2026-32427](https://cve.now/CVE-2026-32427.md): WordPress VW Education Lite plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 5.3, vowelweb VW Education Lite)
- [CVE-2026-32426](https://cve.now/CVE-2026-32426.md): WordPress Medilazar Core plugin \< 1.4.7 - Local File Inclusion vulnerability (CVSS 7.5, themelexus Medilazar Core)
- [CVE-2026-32425](https://cve.now/CVE-2026-32425.md): WordPress Payment Gateway Pix For GiveWP plugin \<= 2.2.3 - Broken Access Control vulnerability (CVSS 5.3, linknacional Payment Gateway Pix For GiveWP)
- [CVE-2026-32424](https://cve.now/CVE-2026-32424.md): WordPress Sprout Clients plugin \<= 3.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BoldGrid Sprout Clients)
- [CVE-2026-32423](https://cve.now/CVE-2026-32423.md): WordPress Admin and Site Enhancements (ASE) plugin \<= 8.4.0 - Broken Access Control vulnerability (CVSS 5.4, Bowo Admin and Site Enhancements)
- [CVE-2026-32422](https://cve.now/CVE-2026-32422.md): WordPress WP EasyCart plugin \<= 5.8.13 - SQL Injection vulnerability (CVSS 8.5, levelfourdevelopment WP EasyCart)
- [CVE-2026-32421](https://cve.now/CVE-2026-32421.md): WordPress Post Timeline plugin \<= 2.4.1 - Broken Access Control vulnerability (CVSS 5.3, Agile Logix Post Timeline)
- [CVE-2026-32420](https://cve.now/CVE-2026-32420.md): WordPress GamiPress plugin \<= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Ruben Garcia GamiPress)
- [CVE-2026-32419](https://cve.now/CVE-2026-32419.md): WordPress List category posts plugin \<= 0.93.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Fernando Briano List category posts)
- [CVE-2026-32418](https://cve.now/CVE-2026-32418.md): WordPress Meow Gallery plugin \<= 5.4.4 - SQL Injection vulnerability (CVSS 7.6, Jordy Meow Meow Gallery)
- [CVE-2026-32417](https://cve.now/CVE-2026-32417.md): WordPress Pochipp plugin \< 1.18.9 - Broken Access Control vulnerability (CVSS 5.4, wppochipp Pochipp)
- [CVE-2026-32416](https://cve.now/CVE-2026-32416.md): WordPress PDF Poster plugin \<= 2.4.0 - Broken Access Control vulnerability (CVSS 5.4, bPlugins PDF Poster)
- [CVE-2026-32415](https://cve.now/CVE-2026-32415.md): WordPress Squeeze plugin \<= 1.7.7 - Directory Traversal vulnerability (CVSS 5.0, Bogdan Bendziukov Squeeze)
- [CVE-2026-32414](https://cve.now/CVE-2026-32414.md): WordPress Advanced Woo Labels plugin \<= 2.36 - Remote Code Execution (RCE) vulnerability (CVSS 7.2, ILLID Advanced Woo Labels)
- [CVE-2026-32413](https://cve.now/CVE-2026-32413.md): WordPress Permalink Manager Lite plugin \< 2.5.3 - Broken Access Control vulnerability (CVSS 5.3, Maciej Bis Permalink Manager Lite)
- [CVE-2026-32412](https://cve.now/CVE-2026-32412.md): WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin \<= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Gift Up! Gift Up Gift Cards for WordPress and WooCommerce)
- [CVE-2026-32411](https://cve.now/CVE-2026-32411.md): WordPress Embed Calendly plugin \<= 4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Simpma Embed Calendly)
- [CVE-2026-32410](https://cve.now/CVE-2026-32410.md): WordPress WBW Currency Switcher for WooCommerce plugin \<= 2.2.5 - Broken Access Control vulnerability (CVSS 5.3, WBW Plugins WBW Currency Switcher for WooCommerce)
- [CVE-2026-32409](https://cve.now/CVE-2026-32409.md): WordPress Forminator plugin \<= 1.50.2 - Broken Access Control vulnerability (CVSS 5.3, WPMU DEV - Your All-in-One WordPress Platform Forminator)
- [CVE-2026-32408](https://cve.now/CVE-2026-32408.md): WordPress Brizy plugin \<= 2.7.23 - Broken Access Control vulnerability (CVSS 4.3, themefusecom Brizy)
- [CVE-2026-32407](https://cve.now/CVE-2026-32407.md): WordPress WPC Smart Wishlist for WooCommerce plugin \<= 5.0.8 - Broken Access Control vulnerability (CVSS 4.3, WPClever WPC Smart Wishlist for WooCommerce)
- [CVE-2026-32406](https://cve.now/CVE-2026-32406.md): WordPress WPC Product Bundles for WooCommerce plugin \<= 8.4.5 - Broken Access Control vulnerability (CVSS 4.3, WPClever WPC Product Bundles for WooCommerce)
- [CVE-2026-32405](https://cve.now/CVE-2026-32405.md): WordPress WoodMart theme \<= 8.3.9 - Sensitive Data Exposure vulnerability (CVSS 5.3, xtemos WoodMart)
- [CVE-2026-32404](https://cve.now/CVE-2026-32404.md): WordPress Studio99 WP Monitor plugin \<= 1.0.3 - Broken Access Control vulnerability (CVSS 5.3, Studio99 WP Monitor)
- [CVE-2026-32403](https://cve.now/CVE-2026-32403.md): WordPress Toocheke Companion plugin \<= 1.194 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Toocheke Companion)
- [CVE-2026-32402](https://cve.now/CVE-2026-32402.md): WordPress Image Slider by Ays plugin \<= 2.7.1 - Broken Access Control vulnerability (CVSS 5.3, Ays Pro Image Slider by Ays)
- [CVE-2026-32401](https://cve.now/CVE-2026-32401.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.9 - Local File Inclusion vulnerability (CVSS 7.2, BoldGrid Client Invoicing by Sprout Invoices)
- [CVE-2026-32400](https://cve.now/CVE-2026-32400.md): WordPress Boldman theme \<= 7.7 - Local File Inclusion vulnerability (CVSS 7.5, ThemetechMount Boldman)
- [CVE-2026-32399](https://cve.now/CVE-2026-32399.md): WordPress Media LIbrary Assistant plugin \<= 3.32 - SQL Injection vulnerability (CVSS 8.5, David Lingren Media LIbrary Assistant)
- [CVE-2026-32398](https://cve.now/CVE-2026-32398.md): WordPress TeraWallet – For WooCommerce plugin \<= 1.5.15 - Race Condition vulnerability (CVSS 6.5, Subrata Mal TeraWallet – For WooCommerce)
- [CVE-2026-32397](https://cve.now/CVE-2026-32397.md): WordPress Filter & Grids plugin \<= 3.5.1 - Broken Access Control vulnerability (CVSS 5.3, YMC Filter & Grids)
- [CVE-2026-32396](https://cve.now/CVE-2026-32396.md): WordPress Team plugin \<= 5.0.13 - Broken Access Control vulnerability (CVSS 5.3, RadiusTheme Team)
- [CVE-2026-32395](https://cve.now/CVE-2026-32395.md): WordPress Xpro Addons For Beaver Builder – Lite plugin \<= 1.5.6 - Broken Access Control vulnerability (CVSS 5.3, Xpro Addons For Beaver Builder – Lite)
- [CVE-2026-32394](https://cve.now/CVE-2026-32394.md): WordPress PublishPress Capabilities plugin \<= 2.31.0 - Broken Access Control vulnerability (CVSS 4.3, PublishPress Capabilities)
- [CVE-2026-32393](https://cve.now/CVE-2026-32393.md): WordPress Greenly Theme Addons plugin \< 8.2 - Local File Inclusion vulnerability (CVSS 7.5, Creatives\_Planet Greenly Theme Addons)
- [CVE-2026-32392](https://cve.now/CVE-2026-32392.md): WordPress Greenly theme \<= 8.1 - Local File Inclusion vulnerability (CVSS 7.5, Creatives\_Planet Greenly)
- [CVE-2026-32391](https://cve.now/CVE-2026-32391.md): WordPress SmartFix theme \< 1.2.4 - Broken Access Control vulnerability (CVSS 5.4, linethemes SmartFix)
- [CVE-2026-32390](https://cve.now/CVE-2026-32390.md): WordPress Nanosoft theme \< 1.3.2 - Broken Access Control vulnerability (CVSS 5.4, linethemes Nanosoft)
- [CVE-2026-32388](https://cve.now/CVE-2026-32388.md): WordPress GLB theme \<= 1.2.2 - Broken Access Control vulnerability (CVSS 5.4, linethemes GLB)
- [CVE-2026-32387](https://cve.now/CVE-2026-32387.md): WordPress Checkout for PayPal plugin \<= 1.0.46 - Broken Access Control vulnerability (CVSS 5.3, Noor Alam Checkout for PayPal)
- [CVE-2026-32386](https://cve.now/CVE-2026-32386.md): WordPress Envo Extra plugin \<= 1.9.13 - Broken Access Control vulnerability (CVSS 4.3, EnvoThemes Envo Extra)
- [CVE-2026-32385](https://cve.now/CVE-2026-32385.md): WordPress RegistrationMagic plugin \<= 6.0.7.6 - Broken Access Control vulnerability (CVSS 5.4, Metagauss RegistrationMagic)
- [CVE-2026-32384](https://cve.now/CVE-2026-32384.md): WordPress WpBookingly plugin \<= 1.2.9 - Local File Inclusion vulnerability (CVSS 7.5, magepeopleteam WpBookingly)
- [CVE-2026-32383](https://cve.now/CVE-2026-32383.md): WordPress Ridhi theme \<= 1.1.2 - Broken Access Control vulnerability (CVSS 5.3, raratheme Ridhi)
- [CVE-2026-32382](https://cve.now/CVE-2026-32382.md): WordPress Digital Download theme \<= 1.1.4 - Broken Access Control vulnerability (CVSS 5.3, raratheme Digital Download)
- [CVE-2026-32381](https://cve.now/CVE-2026-32381.md): WordPress App Landing Page theme \<= 1.2.2 - Broken Access Control vulnerability (CVSS 5.3, raratheme App Landing Page)
- [CVE-2026-32380](https://cve.now/CVE-2026-32380.md): WordPress Numinous theme \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.3, raratheme Numinous)
- [CVE-2026-32379](https://cve.now/CVE-2026-32379.md): WordPress Rara Academic theme \<= 1.2.2 - Broken Access Control vulnerability (CVSS 5.3, raratheme Rara Academic)
- [CVE-2026-32378](https://cve.now/CVE-2026-32378.md): WordPress Book Landing Page theme \<= 1.2.7 - Broken Access Control vulnerability (CVSS 5.3, raratheme Book Landing Page)
- [CVE-2026-32377](https://cve.now/CVE-2026-32377.md): WordPress Pranayama Yoga theme \<= 1.2.2 - Broken Access Control vulnerability (CVSS 5.3, raratheme Pranayama Yoga)
- [CVE-2026-32376](https://cve.now/CVE-2026-32376.md): WordPress Kalon theme \<= 1.2.9 - Broken Access Control vulnerability (CVSS 5.3, raratheme Kalon)
- [CVE-2026-32375](https://cve.now/CVE-2026-32375.md): WordPress Travel Diaries theme \<= 1.2.4 - Broken Access Control vulnerability (CVSS 5.3, raratheme Travel Diaries)
- [CVE-2026-32374](https://cve.now/CVE-2026-32374.md): WordPress The Minimal theme \<= 1.2.9 - Broken Access Control vulnerability (CVSS 5.3, raratheme The Minimal)
- [CVE-2026-32373](https://cve.now/CVE-2026-32373.md): WordPress SMS Alert Order Notifications plugin \<= 3.9.0 - Broken Access Control vulnerability (CVSS 5.4, Cozy Vision SMS Alert Order Notifications)
- [CVE-2026-32372](https://cve.now/CVE-2026-32372.md): WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin \<= 3.2.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, RadiusTheme ShopBuilder – Elementor WooCommerce Builder Add…)
- [CVE-2026-32371](https://cve.now/CVE-2026-32371.md): WordPress Elegant Pink theme \<= 1.3.3 - Broken Access Control vulnerability (CVSS 5.3, raratheme Elegant Pink)
- [CVE-2026-32370](https://cve.now/CVE-2026-32370.md): WordPress Influencer theme \<= 1.1.7 - Broken Access Control vulnerability (CVSS 5.3, raratheme Influencer)
- [CVE-2026-32369](https://cve.now/CVE-2026-32369.md): WordPress Medilink-Core plugin \< 2.0.7 - Local File Inclusion vulnerability (CVSS 7.5, RadiusTheme Medilink-Core)
- [CVE-2026-32368](https://cve.now/CVE-2026-32368.md): WordPress Geo to Lat plugin \<= 1.0.19 - SQL Injection vulnerability (CVSS 8.5, delphiknight Geo to Lat)
- [CVE-2026-32367](https://cve.now/CVE-2026-32367.md): WordPress Modal Dialog plugin \<= 3.5.16 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Yannick Lefebvre Modal Dialog)
- [CVE-2026-32366](https://cve.now/CVE-2026-32366.md): WordPress Collapsing Categories plugin \<= 3.0.9 - SQL Injection vulnerability (CVSS 8.5, robfelty Collapsing Categories)
- [CVE-2026-32365](https://cve.now/CVE-2026-32365.md): WordPress Collapsing Archives plugin \<= 3.0.7 - SQL Injection vulnerability (CVSS 8.5, robfelty Collapsing Archives)
- [CVE-2026-32364](https://cve.now/CVE-2026-32364.md): WordPress Turbo Manager plugin \< 4.0.8 - Local File Inclusion vulnerability (CVSS 7.5, redqteam Turbo Manager)
- [CVE-2026-32363](https://cve.now/CVE-2026-32363.md): WordPress WPLifeCycle plugin \<= 3.3.1 - Broken Access Control vulnerability (CVSS 5.3, Funlus Oy WPLifeCycle)
- [CVE-2026-32362](https://cve.now/CVE-2026-32362.md): WordPress WP Sessions Time Monitoring Full Automatic plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 5.3, activity-log.com WP Sessions Time Monitoring Full Automatic)
- [CVE-2026-32361](https://cve.now/CVE-2026-32361.md): WordPress Editorial Calendar plugin \<= 3.9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Marketing Fire Editorial Calendar)
- [CVE-2026-32360](https://cve.now/CVE-2026-32360.md): WordPress Rich Showcase for Google Reviews plugin \<= 6.9.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, richplugins Rich Showcase for Google Reviews)
- [CVE-2026-32359](https://cve.now/CVE-2026-32359.md): WordPress Icon List Block plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Icon List Block)
- [CVE-2026-32358](https://cve.now/CVE-2026-32358.md): WordPress Booking Calendar plugin \<= 10.14.15 - SQL Injection vulnerability (CVSS 7.6, wpdevelop Booking Calendar)
- [CVE-2026-32357](https://cve.now/CVE-2026-32357.md): WordPress Simple Blog Card plugin \<= 2.37 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Katsushi Kawamori Simple Blog Card)
- [CVE-2026-32356](https://cve.now/CVE-2026-32356.md): WordPress Robo Gallery plugin \<= 5.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, robosoft Robo Gallery)
- [CVE-2026-32355](https://cve.now/CVE-2026-32355.md): WordPress JetEngine plugin \< 3.8.4.1 - Deserialization of untrusted data vulnerability (CVSS 8.8, Crocoblock JetEngine)
- [CVE-2026-32354](https://cve.now/CVE-2026-32354.md): WordPress WpEvently plugin \< 5.1.9 - Sensitive Data Exposure vulnerability (CVSS 5.3, magepeopleteam WpEvently)
- [CVE-2026-32353](https://cve.now/CVE-2026-32353.md): WordPress MailerPress plugin \<= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, MailerPress Team MailerPress)
- [CVE-2026-32352](https://cve.now/CVE-2026-32352.md): WordPress Elementor Website Builder plugin \<= 3.35.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Elementor Website Builder)
- [CVE-2026-32351](https://cve.now/CVE-2026-32351.md): WordPress PowerPress Podcasting plugin \<= 11.15.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, blubrry PowerPress Podcasting)
- [CVE-2026-32350](https://cve.now/CVE-2026-32350.md): WordPress Chocolate House theme \<= 1.1.5 - Broken Access Control vulnerability (CVSS 5.3, wpradiant Chocolate House)
- [CVE-2026-32349](https://cve.now/CVE-2026-32349.md): WordPress Embed PDF Viewer plugin \<= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Andy Fragen Embed PDF Viewer)
- [CVE-2026-32348](https://cve.now/CVE-2026-32348.md): WordPress MAS Videos plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.3, MadrasThemes MAS Videos)
- [CVE-2026-32347](https://cve.now/CVE-2026-32347.md): WordPress Restaurant and Cafe theme \<= 1.2.5 - Broken Access Control vulnerability (CVSS 5.3, raratheme Restaurant and Cafe)
- [CVE-2026-32346](https://cve.now/CVE-2026-32346.md): WordPress Travel Agency theme \<= 1.5.5 - Broken Access Control vulnerability (CVSS 5.3, raratheme Travel Agency)
- [CVE-2026-32345](https://cve.now/CVE-2026-32345.md): WordPress Perfect Portfolio theme \<= 1.2.4 - Broken Access Control vulnerability (CVSS 5.3, raratheme Perfect Portfolio)
- [CVE-2026-32344](https://cve.now/CVE-2026-32344.md): WordPress Corpiva theme \<= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, desertthemes Corpiva)
- [CVE-2026-32343](https://cve.now/CVE-2026-32343.md): WordPress Easy Table of Contents plugin \<= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Magazine3 Easy Table of Contents)
- [CVE-2026-32342](https://cve.now/CVE-2026-32342.md): WordPress Quiz Maker plugin \<= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ays Pro Quiz Maker)
- [CVE-2026-32341](https://cve.now/CVE-2026-32341.md): WordPress Benevolent theme \<= 1.3.9 - Broken Access Control vulnerability (CVSS 5.3, raratheme Benevolent)
- [CVE-2026-32340](https://cve.now/CVE-2026-32340.md): WordPress Business One Page theme \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.3, raratheme Business One Page)
- [CVE-2026-32339](https://cve.now/CVE-2026-32339.md): WordPress Bakes And Cakes theme \<= 1.2.9 - Broken Access Control vulnerability (CVSS 5.3, raratheme Bakes And Cakes)
- [CVE-2026-32338](https://cve.now/CVE-2026-32338.md): WordPress Construction Landing Page theme \<= 1.4.1 - Broken Access Control vulnerability (CVSS 5.3, raratheme Construction Landing Page)
- [CVE-2026-32337](https://cve.now/CVE-2026-32337.md): WordPress Preschool and Kindergarten theme \<= 1.2.5 - Broken Access Control vulnerability (CVSS 5.3, raratheme Preschool and Kindergarten)
- [CVE-2026-32336](https://cve.now/CVE-2026-32336.md): WordPress Rara Business theme \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.3, raratheme Rara Business)
- [CVE-2026-32335](https://cve.now/CVE-2026-32335.md): WordPress The Conference theme \<= 1.2.5 - Broken Access Control vulnerability (CVSS 5.3, raratheme The Conference)
- [CVE-2026-32334](https://cve.now/CVE-2026-32334.md): WordPress JobScout theme \<= 1.1.7 - Broken Access Control vulnerability (CVSS 5.3, raratheme JobScout)
- [CVE-2026-32332](https://cve.now/CVE-2026-32332.md): WordPress Easy Form plugin \<= 2.7.9 - Broken Access Control vulnerability (CVSS 5.3, Ays Pro Easy Form)
- [CVE-2026-32331](https://cve.now/CVE-2026-32331.md): WordPress Textmetrics plugin \<= 3.6.4 - Broken Access Control vulnerability (CVSS 5.4, Israpil Textmetrics)
- [CVE-2026-32330](https://cve.now/CVE-2026-32330.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Photo Gallery by 10Web)
- [CVE-2026-32329](https://cve.now/CVE-2026-32329.md): WordPress Advanced Related Posts plugin \<= 1.9.1 - Broken Access Control vulnerability (CVSS 5.3, Ays Pro Advanced Related Posts)
- [CVE-2026-32328](https://cve.now/CVE-2026-32328.md): WordPress Lemmony theme \< 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, shufflehound Lemmony)
- [CVE-2026-31922](https://cve.now/CVE-2026-31922.md): WordPress Fox LMS plugin \<= 1.0.6.3 - SQL Injection vulnerability (CVSS 8.5, Ays Pro Fox LMS)
- [CVE-2026-31919](https://cve.now/CVE-2026-31919.md): WordPress Advanced Coupons for WooCommerce Coupons plugin \<= 4.7.1 - Broken Access Control vulnerability (CVSS 4.3, Josh Kohlbach Advanced Coupons for WooCommerce Coupons)
- [CVE-2026-31918](https://cve.now/CVE-2026-31918.md): WordPress immonex Kickstart plugin \<= 1.13.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, immonex Kickstart)
- [CVE-2026-31917](https://cve.now/CVE-2026-31917.md): WordPress WP ERP plugin \<= 1.16.10 - SQL Injection vulnerability (CVSS 8.5, weDevs WP ERP)
- [CVE-2026-31916](https://cve.now/CVE-2026-31916.md): WordPress Latest Post Shortcode plugin \<= 14.2.1 - Broken Access Control vulnerability (CVSS 5.3, Iulia Cazan Latest Post Shortcode)
- [CVE-2026-31915](https://cve.now/CVE-2026-31915.md): WordPress Flatsome theme \<= 3.19.6 - Broken Access Control vulnerability (CVSS 5.3, UX-themes Flatsome)
- [CVE-2026-2859](https://cve.now/CVE-2026-2859.md): Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint (CVSS 6.3, Checkmk)
- [CVE-2026-24097](https://cve.now/CVE-2026-24097.md): Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint (CVSS 5.3, Checkmk)
- [CVE-2026-4063](https://cve.now/CVE-2026-4063.md): Social Icons Widget & Block \<= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation (CVSS 4.3, wpzoom Social Icons Widget & Block – Social Media Icons & S…)
- [CVE-2026-23941](https://cve.now/CVE-2026-23941.md): Request smuggling via first-wins Content-Length parsing in inets httpd (CVSS 7.0, Erlang OTP)
- [CVE-2026-23943](https://cve.now/CVE-2026-23943.md): Pre-auth SSH DoS via unbounded zlib inflate (CVSS 6.9, Erlang OTP)
- [CVE-2026-23942](https://cve.now/CVE-2026-23942.md): SFTP root escape via component-agnostic prefix check in ssh\_sftpd (CVSS 5.3, Erlang OTP)
- [CVE-2026-4105](https://cve.now/CVE-2026-4105.md): Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method (CVSS 6.7, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-3999](https://cve.now/CVE-2026-3999.md): Broken access control vulnerability affecting ID Server (CVSS 8.8, Pointsharp ID Server)
- [CVE-2026-3986](https://cve.now/CVE-2026-3986.md): Calculated Fields Form \<= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings (CVSS 6.4, codepeople Calculated Fields Form)
- [CVE-2026-2888](https://cve.now/CVE-2026-2888.md): Formidable Forms \<= 6.28 - Unauthenticated Payment Amount Manipulation via 'item\_meta' Parameter (CVSS 5.3, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2026-2879](https://cve.now/CVE-2026-2879.md): GetGenie \<= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion (CVSS 5.4, roxnor GetGenie – AI Content Writer with Keyword Research &…)
- [CVE-2026-2257](https://cve.now/CVE-2026-2257.md): GetGenie \<= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API (CVSS 6.4, roxnor GetGenie – AI Content Writer with Keyword Research &…)
- [CVE-2026-3873](https://cve.now/CVE-2026-3873.md): Legacy built-in user account (CVSS 7.2, syslink software AG Avantra)
- [CVE-2026-2890](https://cve.now/CVE-2026-2890.md): Formidable Forms \<= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse (CVSS 7.5, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2026-1704](https://cve.now/CVE-2026-1704.md): Appointment Booking Calendar \<= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure (CVSS 4.3, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2026-3045](https://cve.now/CVE-2026-3045.md): Appointment Booking Calendar \<= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint (CVSS 7.5, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2026-3891](https://cve.now/CVE-2026-3891.md): Pix for WooCommerce \<= 1.5.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, linknacional Pix for WooCommerce)
- [CVE-2025-15515](https://cve.now/CVE-2025-15515.md): The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability. (CVSS 6.9, vivo Easyshare)
- [CVE-2025-57849](https://cve.now/CVE-2025-57849.md): Fuse: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4, Red Hat Fuse)
- [CVE-2025-8766](https://cve.now/CVE-2025-8766.md): Noobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container (CVSS 6.4, Red Hat Openshift Data Foundation)
- [CVE-2026-22216](https://cve.now/CVE-2026-22216.md): wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass (CVSS 6.9, gVectors wpDiscuz)
- [CVE-2026-22215](https://cve.now/CVE-2026-22215.md): wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage (CVSS 5.3, gVectors wpDiscuz)
- [CVE-2026-22210](https://cve.now/CVE-2026-22210.md): wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs (CVSS 2.1, gVectors wpDiscuz)
- [CVE-2026-22209](https://cve.now/CVE-2026-22209.md): wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag (CVSS 5.1, gVectors wpDiscuz)
- [CVE-2026-22204](https://cve.now/CVE-2026-22204.md): wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp\_mail() Recipient (CVSS 6.3, gVectors wpDiscuz)
- [CVE-2026-22203](https://cve.now/CVE-2026-22203.md): wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext (CVSS 6.9, gVectors wpDiscuz)
- [CVE-2026-22202](https://cve.now/CVE-2026-22202.md): wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email (CVSS 6.1, gVectors wpDiscuz)
- [CVE-2026-22201](https://cve.now/CVE-2026-22201.md): wpDiscuz before 7.6.47 - IP Address Spoofing in getIP() (CVSS 6.9, gVectors wpDiscuz)
- [CVE-2026-22199](https://cve.now/CVE-2026-22199.md): Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi (CVSS 8.7, Voltronic Power SNMP Web Pro)
- [CVE-2026-22193](https://cve.now/CVE-2026-22193.md): wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions() (CVSS 9.2, gVectors wpDiscuz)
- [CVE-2026-22192](https://cve.now/CVE-2026-22192.md): Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage (CVSS 8.8, Voltronic Power SNMP Web Pro)
- [CVE-2026-22191](https://cve.now/CVE-2026-22191.md): Beghelli Sicuro24 SicuroWeb AngularJS Template Injection (CVSS 5.1, Beghelli SicuroWeb)
- [CVE-2026-22183](https://cve.now/CVE-2026-22183.md): wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview (CVSS 5.3, gVectors wpDiscuz)
- [CVE-2026-22182](https://cve.now/CVE-2026-22182.md): wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType (CVSS 8.7, gVectors wpDiscuz)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.