# CVEs published 2026-03-15

69 CVEs were published on March 15, 2026: 9 critical, 18 high. Days are UTC.

- [CVE-2026-4198](https://cve.now/CVE-2026-4198.md): hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection (CVSS 4.8, hypermodel-labs mcp-server-auto-commit)
- [CVE-2026-4197](https://cve.now/CVE-2026-4197.md): D-Link DNS-1550-04 download\_mgr.cgi RSS\_Item\_List command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2026-4196](https://cve.now/CVE-2026-4196.md): D-Link DNS-1550-04 remote\_backup.cgi cgi\_set\_rsync\_server command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2026-4195](https://cve.now/CVE-2026-4195.md): D-Link DNS-1550-04 wizard\_mgr.cgi command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2026-4194](https://cve.now/CVE-2026-4194.md): D-Link DNS-1550-04 system\_mgr.cgi cgi\_set\_wto access control (CVSS 6.9, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2026-4193](https://cve.now/CVE-2026-4193.md): D-Link DIR-823G goahead UpdateClientInfo access control (CVSS 6.9, D-Link DIR-823G)
- [CVE-2026-4192](https://cve.now/CVE-2026-4192.md): AvinashBole quip-mcp-server index.ts setupToolHandlers command injection (CVSS 5.3, AvinashBole quip-mcp-server)
- [CVE-2026-4191](https://cve.now/CVE-2026-4191.md): JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload (CVSS 6.9, JawherKl node-api-postgres)
- [CVE-2026-4190](https://cve.now/CVE-2026-4190.md): JawherKl node-api-postgres user.js User.getAll sql injection (CVSS 6.9, JawherKl node-api-postgres)
- [CVE-2026-4189](https://cve.now/CVE-2026-4189.md): phpipam Section edit-result.php sql injection (CVSS 5.1, phpipam)
- [CVE-2026-4188](https://cve.now/CVE-2026-4188.md): D-Link DIR-619L boa formSchedule stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2026-4187](https://cve.now/CVE-2026-4187.md): Tiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authentication (CVSS 6.9, Tiandy Easy7 Integrated Management Platform)
- [CVE-2026-4186](https://cve.now/CVE-2026-4186.md): UEditor JSONP Callback controller.php cross site scripting (CVSS 5.1, UEditor)
- [CVE-2015-20120](https://cve.now/CVE-2015-20120.md): RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection (CVSS 8.8, Next Click Ventures RealtyScript)
- [CVE-2017-20220](https://cve.now/CVE-2017-20220.md): Serviio PRO 1.8 Unauthenticated Password Change via REST API (CVSS 8.7, Serviio PRO)
- [CVE-2017-20219](https://cve.now/CVE-2017-20219.md): Serviio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowser (CVSS 5.1, Serviio PRO)
- [CVE-2017-20218](https://cve.now/CVE-2017-20218.md): Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path (CVSS 8.5, Serviio PRO)
- [CVE-2017-20217](https://cve.now/CVE-2017-20217.md): Serviio PRO 1.8 REST API Information Disclosure (CVSS 8.7, Serviio PRO)
- [CVE-2016-20036](https://cve.now/CVE-2016-20036.md): Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities (CVSS 5.1, Wowza Media Systems, LLC. Wowza Streaming Engine)
- [CVE-2016-20035](https://cve.now/CVE-2016-20035.md): Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint (CVSS 6.9, Wowza Media Systems, LLC. Wowza Streaming Engine)
- [CVE-2016-20034](https://cve.now/CVE-2016-20034.md): Wowza Streaming Engine 4.5.0 Privilege Escalation via user edit (CVSS 8.7, Wowza Media Systems, LLC. Wowza Streaming Engine)
- [CVE-2016-20033](https://cve.now/CVE-2016-20033.md): Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm\_x64.exe (CVSS 8.5, Wowza Media Systems, LLC. Wowza Streaming Engine)
- [CVE-2015-20121](https://cve.now/CVE-2015-20121.md): RealtyScript 4.0.2 SQL Injection via u\_id and agent Parameters (CVSS 8.8, Next Click Ventures RealtyScripts)
- [CVE-2015-20119](https://cve.now/CVE-2015-20119.md): RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php (CVSS 5.1, Next Click Ventures RealtyScript)
- [CVE-2015-20118](https://cve.now/CVE-2015-20118.md): RealtyScript 4.0.2 Stored Cross-Site Scripting via location\_name Parameter (CVSS 5.1, Next Click Ventures RealtyScript)
- [CVE-2015-20117](https://cve.now/CVE-2015-20117.md): RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation (CVSS 6.9, Next Click Ventures RealtyScript)
- [CVE-2015-20116](https://cve.now/CVE-2015-20116.md): RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename (CVSS 5.1, Next Click Ventures RealtyScript)
- [CVE-2015-20115](https://cve.now/CVE-2015-20115.md): RealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload Parameter (CVSS 5.1, Next Click Ventures RealtyScript)
- [CVE-2015-20114](https://cve.now/CVE-2015-20114.md): RealtyScript 4.0.2 Cross-Site Scripting via Multiple Parameters (CVSS 5.1, Next Click Ventuers RealtyScript)
- [CVE-2015-20113](https://cve.now/CVE-2015-20113.md): RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities (CVSS 6.9, Next Click Ventuers RealtyScript)
- [CVE-2013-20006](https://cve.now/CVE-2013-20006.md): Qool CMS Multiple Persistent Cross-Site Scripting Vulnerabilities (CVSS 8.7, Qool CMS)
- [CVE-2013-20005](https://cve.now/CVE-2013-20005.md): Qool CMS 2.0 RC2 Cross-Site Request Forgery via adduser (CVSS 6.9, Qool CMS)
- [CVE-2026-4185](https://cve.now/CVE-2026-4185.md): GPAC MP4Box swf\_parse.c swf\_def\_bits\_jpeg stack-based overflow (CVSS 5.3, GPAC)
- [CVE-2026-4184](https://cve.now/CVE-2026-4184.md): D-Link DIR-816 goahead form2Wl5BasicSetup.cgi stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2026-4183](https://cve.now/CVE-2026-4183.md): D-Link DIR-816 goahead form2WlanBasicSetup.cgi stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2026-4182](https://cve.now/CVE-2026-4182.md): D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2026-4181](https://cve.now/CVE-2026-4181.md): D-Link DIR-816 goahead form2RepeaterStep2.cgi stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2026-28522](https://cve.now/CVE-2026-28522.md): arduino-TuyaOpen WiFiUDP Null Pointer Dereference Denial of Service (CVSS 7.1, arduino-TuyaOpen)
- [CVE-2026-28519](https://cve.now/CVE-2026-28519.md): arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution (CVSS 8.7, arduino-TuyaOpen)
- [CVE-2026-28521](https://cve.now/CVE-2026-28521.md): arduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosure (CVSS 7.0, arduino-TuyaOpen)
- [CVE-2026-28520](https://cve.now/CVE-2026-28520.md): arduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Execution (CVSS 8.6, arduino-TuyaOpen)
- [CVE-2016-20032](https://cve.now/CVE-2016-20032.md): ZKTeco ZKAccess Security System 5.3.1 Stored XSS (CVSS 5.1, ZKTeco ZKAccess Security System)
- [CVE-2016-20031](https://cve.now/CVE-2016-20031.md): ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp (CVSS 6.8, ZKTeco ZKBioSecurity)
- [CVE-2016-20030](https://cve.now/CVE-2016-20030.md): ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction (CVSS 9.3, ZKTeco ZKBioSecurity)
- [CVE-2016-20029](https://cve.now/CVE-2016-20029.md): ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability (CVSS 6.9, ZKTeco ZKBioSecurity)
- [CVE-2016-20028](https://cve.now/CVE-2016-20028.md): ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin (CVSS 5.3, ZKTeco ZKBioSecurity)
- [CVE-2016-20027](https://cve.now/CVE-2016-20027.md): ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities (CVSS 5.1, ZKTeco ZKBioSecurity)
- [CVE-2016-20026](https://cve.now/CVE-2016-20026.md): ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution (CVSS 9.3, ZKTeco ZKBioSecurity)
- [CVE-2016-20025](https://cve.now/CVE-2016-20025.md): ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions (CVSS 8.7, ZKTeco ZKAccess Professional)
- [CVE-2016-20024](https://cve.now/CVE-2016-20024.md): ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation (CVSS 9.3, ZKTeco ZKTime.Net)
- [CVE-2026-4180](https://cve.now/CVE-2026-4180.md): D-Link DIR-816 goahead redirect.asp access control (CVSS 6.9, D-Link DIR-816)
- [CVE-2026-4175](https://cve.now/CVE-2026-4175.md): Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting (CVSS 5.1, Aureus ERP · aureuserp/aureuserp)
- [CVE-2026-4174](https://cve.now/CVE-2026-4174.md): Radare2 Mach-O File mach0.c walk\_exports\_trie resource consumption (CVSS 4.8, Radare2)
- [CVE-2025-14287](https://cve.now/CVE-2025-14287.md): Command Injection in mlflow/mlflow (CVSS 7.5, mlflow/mlflow · mlflow)
- [CVE-2026-4173](https://cve.now/CVE-2026-4173.md): CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection (CVSS 5.3, CodePhiliaX Chat2DB)
- [CVE-2026-4172](https://cve.now/CVE-2026-4172.md): TRENDnet TEW-632BRP HTTP POST Request ping\_response.cgi stack-based overflow (CVSS 8.6, TRENDnet TEW-632BRP)
- [CVE-2026-4171](https://cve.now/CVE-2026-4171.md): CodeGenieApp serverless-express API Endpoint TodoList.ts authorization (CVSS 5.3, CodeGenieApp serverless-express)
- [CVE-2026-4170](https://cve.now/CVE-2026-4170.md): Topsec TopACM HTTP Request nmc\_sync.php os command injection (CVSS 9.3, Topsec TopACM)
- [CVE-2026-4169](https://cve.now/CVE-2026-4169.md): Tecnick TCExam XML Export tce\_xml\_users.php F\_xml\_export\_users cross site scripting (CVSS 4.8, Tecnick TCExam)
- [CVE-2026-4168](https://cve.now/CVE-2026-4168.md): Tecnick TCExam Group tce\_edit\_group.php cross site scripting (CVSS 4.8, Tecnick TCExam)
- [CVE-2026-4167](https://cve.now/CVE-2026-4167.md): Belkin F9K1122 formReboot stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2026-4166](https://cve.now/CVE-2026-4166.md): Wavlink WL-NU516U1 login.cgi sub\_404F68 cross site scripting (CVSS 5.1, Wavlink WL-NU516U1)
- [CVE-2026-4165](https://cve.now/CVE-2026-4165.md): Worksuite HR, CRM and Project Management create cross site scripting (CVSS 4.8, Worksuite HR, CRM and Project Management)
- [CVE-2026-4164](https://cve.now/CVE-2026-4164.md): Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection (CVSS 9.3, Wavlink WL-WN578W2)
- [CVE-2026-2233](https://cve.now/CVE-2026-2233.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post\_id' Parameter (CVSS 5.3, wedevs User Frontend: AI Powered Frontend Posting, User Dir…)
- [CVE-2026-1947](https://cve.now/CVE-2026-1947.md): NEX-Forms – Ultimate Forms Plugin for WordPress \<= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf\_set\_entry\_update\_id (CVSS 7.5, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-1883](https://cve.now/CVE-2026-1883.md): Wicked Folders \<= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion (CVSS 4.3, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2026-3441](https://cve.now/CVE-2026-3441.md): Binutils: gnu binutils: information disclosure via specially crafted xcoff object file (CVSS 6.1, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-3442](https://cve.now/CVE-2026-3442.md): Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker (CVSS 6.1, Red Hat Hardened Images · Red Hat Enterprise Linux +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.