CVEs published March 15, 2026
69 CVEs were published on March 15, 2026: 9 critical, 18 high.
- Published
- 69
- Critical
- 9
- High
- 18
- Medium
- 42
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Next Click Ventures RealtyScript
- 6
- ZKTeco ZKBioSecurity
- 6
- D-Link DIR-816
- 5
- arduino-TuyaOpen
- 4
- D-Link DNS-120 · D-Link DNR-202L +18
- 4
- Serviio PRO
- 4
- Wowza Media Systems, LLC. Wowza Streaming Engine
- 4
- JawherKl node-api-postgres
- 2
- Next Click Ventuers RealtyScript
- 2
- Qool CMS
- 2
Critical 9
- CVE-2026-4184D-Link DIR-816 goahead form2Wl5BasicSetup.cgi stack-based overflowD-Link DIR-816
- CVE-2026-4183D-Link DIR-816 goahead form2WlanBasicSetup.cgi stack-based overflowD-Link DIR-816
- CVE-2026-4182D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflowD-Link DIR-816
- CVE-2026-4181D-Link DIR-816 goahead form2RepeaterStep2.cgi stack-based overflowD-Link DIR-816
- CVE-2016-20030ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActionZKTeco ZKBioSecurity
- CVE-2016-20026ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code ExecutionZKTeco ZKBioSecurity
- CVE-2016-20024ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege EscalationZKTeco ZKTime.Net
- CVE-2026-4170Topsec TopACM HTTP Request nmc_sync.php os command injectionTopsec TopACM
- CVE-2026-4164Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injectionWavlink WL-WN578W2
High 18
- CVE-2026-4188D-Link DIR-619L boa formSchedule stack-based overflowD-Link DIR-619L
- CVE-2015-20120RealtyScript 4.0.2 Multiple Time-based Blind SQL InjectionNext Click Ventures RealtyScript
- CVE-2017-20220Serviio PRO 1.8 Unauthenticated Password Change via REST APIServiio PRO
- CVE-2017-20218Serviio PRO 1.8 Local Privilege Escalation via Unquoted PathServiio PRO
- CVE-2017-20217Serviio PRO 1.8 REST API Information DisclosureServiio PRO
- CVE-2016-20034Wowza Streaming Engine 4.5.0 Privilege Escalation via user editWowza Media Systems, LLC. Wowza Streaming Engine
- CVE-2016-20033Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exeWowza Media Systems, LLC. Wowza Streaming Engine
- CVE-2015-20121RealtyScript 4.0.2 SQL Injection via u_id and agent ParametersNext Click Ventures RealtyScripts
- CVE-2013-20006Qool CMS Multiple Persistent Cross-Site Scripting VulnerabilitiesQool CMS
- CVE-2026-28522arduino-TuyaOpen WiFiUDP Null Pointer Dereference Denial of Servicearduino-TuyaOpen
- CVE-2026-28519arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Executionarduino-TuyaOpen
- CVE-2026-28521arduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosurearduino-TuyaOpen
- CVE-2026-28520arduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Executionarduino-TuyaOpen
- CVE-2016-20025ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure PermissionsZKTeco ZKAccess Professional
- CVE-2025-14287Command Injection in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-4172TRENDnet TEW-632BRP HTTP POST Request ping_response.cgi stack-based overflowTRENDnet TEW-632BRP
- CVE-2026-4167Belkin F9K1122 formReboot stack-based overflowBelkin F9K1122
- CVE-2026-1947NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_idwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
Medium, low and unrated 42
- CVE-2026-4198hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injectionhypermodel-labs mcp-server-auto-commit
- CVE-2026-4197D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4196D-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4195D-Link DNS-1550-04 wizard_mgr.cgi command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4194D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access controlD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4193D-Link DIR-823G goahead UpdateClientInfo access controlD-Link DIR-823G
- CVE-2026-4192AvinashBole quip-mcp-server index.ts setupToolHandlers command injectionAvinashBole quip-mcp-server
- CVE-2026-4191JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted uploadJawherKl node-api-postgres
- CVE-2026-4190JawherKl node-api-postgres user.js User.getAll sql injectionJawherKl node-api-postgres
- CVE-2026-4189phpipam Section edit-result.php sql injectionphpipam
- CVE-2026-4187Tiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authenticationTiandy Easy7 Integrated Management Platform
- CVE-2026-4186UEditor JSONP Callback controller.php cross site scriptingUEditor
- CVE-2017-20219Serviio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowserServiio PRO
- CVE-2016-20036Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting VulnerabilitiesWowza Media Systems, LLC. Wowza Streaming Engine
- CVE-2016-20035Wowza Streaming Engine 4.5.0 CSRF via user edit endpointWowza Media Systems, LLC. Wowza Streaming Engine
- CVE-2015-20119RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.phpNext Click Ventures RealtyScript
- CVE-2015-20118RealtyScript 4.0.2 Stored Cross-Site Scripting via location_name ParameterNext Click Ventures RealtyScript
- CVE-2015-20117RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User CreationNext Click Ventures RealtyScript
- CVE-2015-20116RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload FilenameNext Click Ventures RealtyScript
- CVE-2015-20115RealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload ParameterNext Click Ventures RealtyScript
- CVE-2015-20114RealtyScript 4.0.2 Cross-Site Scripting via Multiple ParametersNext Click Ventuers RealtyScript
- CVE-2015-20113RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting VulnerabilitiesNext Click Ventuers RealtyScript
- CVE-2013-20005Qool CMS 2.0 RC2 Cross-Site Request Forgery via adduserQool CMS
- CVE-2026-4185GPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflowGPAC
- CVE-2016-20032ZKTeco ZKAccess Security System 5.3.1 Stored XSSZKTeco ZKAccess Security System
- CVE-2016-20031ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jspZKTeco ZKBioSecurity
- CVE-2016-20029ZKTeco ZKBioSecurity 3.0 File Path Manipulation VulnerabilityZKTeco ZKBioSecurity
- CVE-2016-20028ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery SuperadminZKTeco ZKBioSecurity
- CVE-2016-20027ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS VulnerabilitiesZKTeco ZKBioSecurity
- CVE-2026-4180D-Link DIR-816 goahead redirect.asp access controlD-Link DIR-816
- CVE-2026-4175Aureus ERP Chatter Message content-text-entry.blade.php cross site scriptingAureus ERP · aureuserp/aureuserp
- CVE-2026-4174Radare2 Mach-O File mach0.c walk_exports_trie resource consumptionRadare2
- CVE-2026-4173CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injectionCodePhiliaX Chat2DB
- CVE-2026-4171CodeGenieApp serverless-express API Endpoint TodoList.ts authorizationCodeGenieApp serverless-express
- CVE-2026-4169Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scriptingTecnick TCExam
- CVE-2026-4168Tecnick TCExam Group tce_edit_group.php cross site scriptingTecnick TCExam
- CVE-2026-4166Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scriptingWavlink WL-NU516U1
- CVE-2026-4165Worksuite HR, CRM and Project Management create cross site scriptingWorksuite HR, CRM and Project Management
- CVE-2026-2233User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameterwedevs User Frontend: AI Powered Frontend Posting, User Dir…
- CVE-2026-1883Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletionwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2026-3441Binutils: gnu binutils: information disclosure via specially crafted xcoff object fileRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-3442Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linkerRed Hat Hardened Images · Red Hat Enterprise Linux +1