# CVEs published 2026-03-14

7 CVEs were published on March 14, 2026: 1 critical, 1 high. Days are UTC.

- [CVE-2026-4163](https://cve.now/CVE-2026-4163.md): Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection (CVSS 9.3, Wavlink WL-WN579A3)
- [CVE-2026-4179](https://cve.now/CVE-2026-4179.md): stm32: usb: Infinite while loop in Interrupt Handler (CVSS 6.1, zephyrproject-rtos Zephyr)
- [CVE-2026-32774](https://cve.now/CVE-2026-32774.md): Vulnogram - Stored Cross-Site Scripting via Comment Hypertext (CVSS 5.3, Vulnogram)
- [CVE-2026-0849](https://cve.now/CVE-2026-0849.md): crypto: ATAES132A response length allows stack buffer overflow (CVSS 3.8, zephyrproject-rtos Zephyr)
- [CVE-2026-1870](https://cve.now/CVE-2026-1870.md): Thim Kit for Elementor \<= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure (CVSS 5.3, thimpress Thim Kit for Elementor – Pre-built Templates & Wi…)
- [CVE-2025-54920](https://cve.now/CVE-2025-54920.md): Apache Spark: Spark History Server Code Execution Vulnerability (CVSS 8.8, Apache Software Foundation Apache Spark · org.apache.spa… +4)
- [CVE-2026-1948](https://cve.now/CVE-2026-1948.md): NEX-Forms – Ultimate Forms Plugin for WordPress \<= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate\_license (CVSS 4.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.