CVEs published March 16, 2026
191 CVEs were published on March 16, 2026: 12 critical, 49 high.
- Published
- 191
- Critical
- 12
- High
- 49
- Medium
- 113
- Low
- 17
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 70
Most affected products
- D-Link DNS-120 · D-Link DNR-202L +18
- 11
- Mattermost · github.com/mattermost/mattermost-server +3
- 11
- Raytha
- 11
- HCL AION
- 10
- OpenHarmony
- 7
- Samsung Mobile Smart Switch
- 7
- chamilo-lms
- 5
- Samsung Mobile Devices
- 5
- Wakyma application web
- 5
- craftcms cms · craftcms/cms
- 4
Critical 12
- CVE-2026-4177YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitterTODDR YAML::Syck
- CVE-2026-28430Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.phpchamilo-lms
- CVE-2026-27962Authlib JWS JWK Header Injection: Signature Verification Bypassauthlib
- CVE-2026-4254Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflowTenda AC8
- CVE-2026-23489Fields GLPI plugin vulnerable to RCE in dropdown generationpluginsGLPI fields
- CVE-2026-4252Tenda AC8 IPv6 check_is_ipv6 ip address for authenticationTenda AC8
- CVE-2025-62319Boolean-Based SQL Injection in Multiple Unica ComponentsHCL Unica
- CVE-2017-20224Telesquare SKT LTE Router SDT-CS3B1 WebDAV Arbitrary File UploadTelesquare SDT-CS3B1
- CVE-2017-20223Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object ReferenceTelesquare SDT-CS3B1
- CVE-2025-69808An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cau
- CVE-2025-69809A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling a
- CVE-2025-69902A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary com
High 49
- CVE-2026-29522ZwickRoell Test Data Management < 3.0.8 Path Traversal LFIZwickRoell GmbH & Co. KG Test Data Management
- CVE-2026-30881Chamilo LMS: SQL Injection in the statistics AJAX endpointchamilo-lms
- CVE-2026-30875Chamilo LMS: Authenticated RCE via H5P Importchamilo-lms
- CVE-2026-32267Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()craftcms cms · craftcms/cms
- CVE-2026-32264Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllercraftcms cms · craftcms/cms
- CVE-2026-32263Craft CMS vulnerable to behavior injection RCE via EntryTypesControllercraftcms cms · craftcms/cms
- CVE-2026-32261RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugincraftcms webhooks · craftcms/webhooks
- CVE-2025-69196FastMCP OAuth Proxy token reuse across MCP serversjlowin fastmcp · fastmcp
- CVE-2026-4269Improper S3 ownership verification in Bedrock AgentCore Starter ToolkitAWS Bedrock AgentCore Starter Toolkit · bedrock-agentcore-s…
- CVE-2026-28498Authlib: Fail-Open Cryptographic Verification in OIDC Hash Bindingauthlib
- CVE-2026-28490Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracleauthlib
- CVE-2026-23862Dell ThinOS 10 versions prior to ThinOS 2602_10.0573, contain an Improper Neutralization of Special Elements used in a Command ('Command InjDell ThinOS
- CVE-2026-4276LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.LibreChat RAG API
- CVE-2026-25369WordPress Flexmls® IDX plugin <= 3.15.9 - Reflected Cross Site Scripting (XSS) vulnerabilityFlexmls® IDX
- CVE-2025-10685HTTP POST with specific higher content length leads into heap corruptionSofting smartLink SW-PN · Softing smartLink SW-HT
- CVE-2026-24458DoS attack via login attempts with multi-megabyte passwordsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-69240Header Poisoning in Raytha CMSRaytha
- CVE-2025-15540Authenticated RCE in Raytha CMSRaytha
- CVE-2026-3476Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026Dassault Systèmes SOLIDWORKS Desktop
- CVE-2026-2476MS Teams plugin sensitive config values not properly masked in support packetsMattermost · github.com/mattermost/mattermost-plugin-msteams
- CVE-2026-3022Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application webWakyma application web
- CVE-2026-3021Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application webWakyma application web
- CVE-2026-3020Identity based authorization bypass vulnerability (IDOR) in the Wakyma application webWakyma application web
- CVE-2026-3110Multiple vulnerabilities on the Educativa CampusEducativa Campus
- CVE-2025-11500Credentials exposure in tinycontrol devicestinycontrol Lan Kontroler · tinycontrol LK3.9 +2
- CVE-2025-15587Credentials exposure in tinycontrol devicestinycontrol Lan Kontroler · tinycontrol LK3.9 +2
- CVE-2026-4227LB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflowLB-LINK BL-WR9000
- CVE-2026-4226LB-LINK BL-WR9000 get_virtual_cfg sub_44E8D0 stack-based overflowLB-LINK BL-WR9000
- CVE-2026-4255DLL Injection Privilege Escalationthermalright TR-VISION HOME
- CVE-2026-25083GROWI OpenAI thread/message API endpoints do not perform authorization.GROWI
- CVE-2026-32775libexif through 0.6.25 has a flaw in decoding MakerNotes.libexif project libexif
- CVE-2026-31386OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.LiteSpeed Technologies OpenLiteSpeed · LiteSpeed Technologi…
- CVE-2026-21005Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilegeSamsung Mobile Smart Switch
- CVE-2026-4214D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-21000Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.Samsung Mobile Galaxy Store
- CVE-2026-20999Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.Samsung Mobile Smart Switch
- CVE-2026-20998Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.Samsung Mobile Smart Switch
- CVE-2026-20996Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgradeSamsung Mobile Smart Switch
- CVE-2026-20990Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrarSamsung Mobile Devices
- CVE-2026-4213D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4212D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4211D-Link DNS-1550-04 local_backup_mgr.cgi Local_Backup_Info stack-based overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2017-20222Telesquare SKT LTE Router SDT-CS3B1 Unauthenticated Remote RebootTelesquare SDT-CS3B1
- CVE-2025-50881The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.
- CVE-2025-66687Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files
- CVE-2025-69768SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php component
- CVE-2025-69783A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g
- CVE-2025-69784A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injec
- CVE-2026-30405An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attributegithub.com/osrg/gobgp/v4 · github.com/osrg/gobgp +1
Medium, low and unrated 130
- CVE-2026-4287Tiandy Easy7 Integrated Management Platform Endpoint queryResources sql injectionTiandy Easy7 Integrated Management Platform
- CVE-2026-4285taoofagi easegen-admin Pdf2MdUtil.java recognizeMarkdown path traversaltaoofagi easegen-admin
- CVE-2026-4284taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgerytaoofagi easegen-admin
- CVE-2026-21991A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.Oracle Linux
- CVE-2026-1629Permalink Preview Information Disclosure After Permission RevocationMattermost
- CVE-2026-26230Team Admin Privilege Escalation to Demote Members to GuestMattermost
- CVE-2026-2454DoS in Calls plugin via malformed msgpack in websocket request.Mattermost
- CVE-2026-26304Permission Bypass in Playbook Run CreationMattermost · github.com/mattermost/mattermost-plugin-playbo…
- CVE-2026-30882Chamilo LMS: Reflected XSS in the session category listing pagechamilo-lms
- CVE-2026-30876Chamilo LMS: User enumeration vulnerability via responsechamilo-lms
- CVE-2026-29516Buffalo TeraStation TS5400R Excessive File Permissions Information DisclosureBuffalo TeraStation NAS TS5400R
- CVE-2026-32262Craft CMS has a Path Traversal Vulnerability in AssetsControllercraftcms cms · craftcms/cms
- CVE-2026-4224Stack overflow parsing XML with deeply nested DTD content modelsPython Software Foundation CPython
- CVE-2026-3644Incomplete control character validation in http.cookiesPython Software Foundation CPython
- CVE-2026-4253Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injectionTenda AC8
- CVE-2026-29510Hereta ETH-IMC408M Stored XSS via Device NameShenzhen Hereta Technology Co. Hereta ETH-IMC408M
- CVE-2026-29513Hereta ETH-IMC408M Stored XSS via Device LocationShenzhen Hereta Technology Co. Hereta ETH-IMC408M
- CVE-2026-29520Hereta ETH-IMC408M Reflected XSS via ping_ipaddr ParameterShenzhen Hereta Technology Co. Hereta ETH-IMC408M
- CVE-2026-29521Hereta ETH-IMC408M CSRF via Configuration SetupShenzhen Hereta Technology Co. Hereta ETH-IMC408M
- CVE-2026-4270AWS API MCP File Access Restriction BypassAWS API MCP Server · awslabs-aws-api-mcp-server
- CVE-2026-4251CityData CityChat ai.citydata.citychat credentials.json credentials storageCityData CityChat
- CVE-2026-4250Albert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storageAlbert Sağlık Hizmetleri ve Ticaret Albert Health
- CVE-2026-32587WordPress WP EasyPay plugin <= 4.2.11 - Broken Access Control vulnerabilitySaad Iqbal WP EasyPay
- CVE-2026-32583WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerabilityWebnus Modern Events Calendar
- CVE-2026-4243La Nacion App app.lanacion.activity BuildConfig.java credentials storageLa Nacion App
- CVE-2026-24692Guest users can bypass read permissions via search APIMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-22545Password Change Bypass via Auth Switch EndpointMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-2455SSRF bypass via IPv4-mapped IPv6 literalsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-21386Private channel enumeration via /mute slash commandMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-2274Stored Cross Site Scripting in Forcepoint Web SecurityForcepoint Web Security
- CVE-2025-52642HCL AION is affected by an internal filesystem paths disloser vulnerabilityHCL AION
- CVE-2025-52646HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.HCL AION
- CVE-2025-52645HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.HCL AION
- CVE-2025-52649HCL AION is affected by a vulnerability where certain identifiers may be predictable in natureHCL AION
- CVE-2026-4242BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storageBabyChakra Pregnancy & Parenting App
- CVE-2025-52644HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged.HCL AION
- CVE-2025-52643HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environmentHCL AION
- CVE-2025-52636HCL AION is affected by a improper handling of uploads files SizeHCL AION
- CVE-2026-4241itsourcecode College Management System time-table.php sql injectionitsourcecode College Management System
- CVE-2026-4240Open5GS CCA smf_s6b_sta_cb denial of serviceOpen5GS
- CVE-2025-10461Global file reads caused by improper URL checks in webserverSofting smartLink SW-HT · Softing smartLink SW-PN
- CVE-2026-4239Lagom WHMCS Template Datatables prototype pollutionLagom WHMCS Template
- CVE-2026-25780Memory Exhaustion via Malformed DOC File UploadMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-52648HCL AION is affected by a vulnerability where offering images are not digitally signed.HCL AION
- CVE-2025-52638Multiple security vulnerabilities affect HCL AIONHCL AION
- CVE-2026-4238itsourcecode College Management System courses.php sql injectionitsourcecode College Management System
- CVE-2025-52637Multiple security vulnerabilities affect HCL AIONHCL AION
- CVE-2026-4265Guest user can upload files without permission across teamsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-25783Denial of service via malformed User-Agent header in getBrowserVersionMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-4237itsourcecode Free Hotel Reservation System index.php sql injectionitsourcecode Free Hotel Reservation System
- CVE-2026-2462Admin RCE via Malicious Plugin Upload on CI Test InstancesMattermost
- CVE-2026-2578Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read PostsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-69246Lack of bruteforce protection in Raytha CMSRaytha
- CVE-2025-69245Reflected XSS in Raytha CMSRaytha
- CVE-2025-69243User enumeration in Raytha CMSRaytha
- CVE-2025-69242Reflected XSS in Raytha CMSRaytha
- CVE-2025-69241Stored XSS in Raytha CMSRaytha
- CVE-2025-69239Server-Site Request Forgery in Raytha CMSRaytha
- CVE-2025-69238Cross-Site Request Forgery in Raytha CMSRaytha
- CVE-2025-69237Stored XSS in Raytha CMSRaytha
- CVE-2025-69236Stored XSS in Raytha CMSRaytha
- CVE-2026-26246Memory Exhaustion via Malformed PSD File UploadMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-4236itsourcecode Online Enrollment System index.php sql injectionitsourcecode Online Enrollment System
- CVE-2026-2458Unauthorized channel enumeration in private teams after member removalMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-2457WebSocket Message Spoofing via Permalink Embed ManipulationMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-2461Missing authorization check allows unauthorized modification of other users' comments on a boardMattermost · github.com/mattermost/mattermost-plugin-boards
- CVE-2026-2463Unauthorized access to invite ID during team creationMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-2456Denial of Service via Unbounded Memory Allocation in Integration ActionsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-4235itsourcecode Online Enrollment System login.php sql injectionitsourcecode Online Enrollment System
- CVE-2025-15554Admin Passwords Cached by Browsers in Truesec LAPSWebUITruesec LAPSWebUI
- CVE-2025-15553Insecure Logout Functionality in Truesec LAPSWebUITruesec LAPSWebUI
- CVE-2025-15552Long Session Lifetime in Truesec LAPSWebUITruesec LAPSWebUI
- CVE-2026-4234SSCMS DDL SitesAddController.Submit.cs sql injectionSSCMS
- CVE-2026-3024Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma application webWakyma application web
- CVE-2026-3023Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application webWakyma application web
- CVE-2026-4233ThingsGateway download path traversalThingsGateway
- CVE-2026-3111Multiple vulnerabilities on the Educativa CampusEducativa Campus
- CVE-2026-4232Tiandy Integrated Management Platform getAuthorityByUserId sql injectionTiandy Integrated Management Platform
- CVE-2026-4231vanna-ai vanna Endpoint __init__.py run_sql server-side request forgeryvanna-ai vanna
- CVE-2026-4230vanna-ai vanna Endpoint __init__.py update_sql sql injectionvanna-ai vanna
- CVE-2026-4229vanna-ai vanna bigquery_vector.py remove_training_data sql injectionvanna-ai vanna · vanna
- CVE-2026-4228LB-LINK BL-WR9000 set_wifi sub_458754 command injectionLB-LINK BL-WR9000
- CVE-2026-4225CMS Made Simple User Management listusers.php cross site scriptingCMS Made Simple
- CVE-2025-6969ability_ability_runtime an improper input validation vulnerabilityOpenHarmony
- CVE-2025-26474communication_ipc an improper input validation vulnerabilityOpenHarmony
- CVE-2025-52458arkcompiler_ets_runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-41432arkcompiler_ets_runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-25277arkcompiler_ets_runtime has a type confusion vulnerabilityOpenHarmony
- CVE-2025-12736multimedia_audio_standard has an insecure storage of sensitive information vulnerabilityOpenHarmony
- CVE-2026-0639liteos_a has a missing release of memory vulnerabilityOpenHarmony
- CVE-2026-32778libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.libexpat project libexpat
- CVE-2026-4223itsourcecode Payroll Management System manage_employee.php sql injectionitsourcecode Payroll Management System
- CVE-2026-32777libexpat before 2.7.5 allows an infinite loop while parsing DTD content.libexpat project libexpat
- CVE-2026-32776libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.libexpat project libexpat
- CVE-2026-4222SSCMS download PathUtils.RemoveParentPath path traversalSSCMS
- CVE-2026-4221Tiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted uploadTiandy Easy7 Integrated Management Platform
- CVE-2025-71264Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).Mumble
- CVE-2026-4220Technologies Integrated Management Platform SetWebpagePic.jsp unrestricted uploadTechnologies Integrated Management Platform
- CVE-2026-4219INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentialsINDEX Conferences & Exhibitions Organization YWF BPOF APGCS…
- CVE-2026-4218myAEDES App aedes.me.beta EngageBayUtils.java information disclosuremyAEDES App
- CVE-2026-4217XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storageXREAL Nebula App
- CVE-2026-4216i-SENS SmartLog App air.SmartLog.android hard-coded credentialsi-SENS SmartLog App
- CVE-2026-21004Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.Samsung Mobile Smart Switch
- CVE-2026-4215FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgeryFlowCI flow-core-x
- CVE-2026-21002Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary applicSamsung Mobile Galaxy Store
- CVE-2026-21001Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.Samsung Mobile Galaxy Store
- CVE-2026-20997Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass auSamsung Mobile Smart Switch
- CVE-2026-20995Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a speSamsung Mobile Smart Switch
- CVE-2026-20994URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.Samsung Mobile Samsung Account
- CVE-2026-20993Improper export of android application components in Samsung Assistant prior to version 9.3.10.7 allows local attacker to access saved inforSamsung Mobile Samsung Assistant
- CVE-2026-20992Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage ofSamsung Mobile Devices
- CVE-2026-20991Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.Samsung Mobile Devices
- CVE-2026-20989Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom foSamsung Mobile Devices
- CVE-2026-20988Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary Samsung Mobile Devices
- CVE-2026-4210D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4209D-Link DNS-1550-04 account_mgr.cgi cgi_chg_admin_pw command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4207D-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4206D-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4205D-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2017-20221Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command ExecutionTelesquare SDT-CS3B1
- CVE-2026-4204D-Link DNS-1550-04 gui_mgr.cgi cgi_mycloud_auto_downlaod command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4203D-Link DNS-1550-04 network_mgr.cgi cgi_dhcpd command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-4201glowxq glowxq-oj SysFileController.java upload unrestricted uploadglowxq-oj
- CVE-2026-4200glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgeryglowxq-oj
- CVE-2026-4199bazinga012 mcp_code_executor index.ts installDependencies command injectionbazinga012 mcp_code_executor
- CVE-2025-57543Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms.
- CVE-2025-65734An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13,
- CVE-2025-68971In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be as
- CVE-2025-69693Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c).
- CVE-2025-69727An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8.