# CVEs published 2026-03-18

191 CVEs were published on March 18, 2026: 15 critical, 83 high. Days are UTC.

- [CVE-2026-32743](https://cve.now/CVE-2026-32743.md): PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handling (CVSS 6.5, PX4-Autopilot)
- [CVE-2026-32255](https://cve.now/CVE-2026-32255.md): Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint (CVSS 8.6, kanbn kan)
- [CVE-2026-32805](https://cve.now/CVE-2026-32805.md): Romeo is vulnerable to Archive Slip due to missing checks in sanitization (CVSS 8.3, ctfer-io romeo · github.com/ctfer-io/romeo/webserver)
- [CVE-2026-32737](https://cve.now/CVE-2026-32737.md): Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace (CVSS 7.9, ctfer-io romeo · github.com/ctfer-io/romeo/environment/depl…)
- [CVE-2026-32735](https://cve.now/CVE-2026-32735.md): Unpacking Arbitrary Mustache Template Files via \`maven-dependency-plugin\` (CVSS 2.3, io.github.chrimle:openapi-to-java-records-mustache-template…)
- [CVE-2025-15031](https://cve.now/CVE-2025-15031.md): Path Traversal Vulnerability in mlflow/mlflow (CVSS 8.1, mlflow/mlflow · mlflow)
- [CVE-2026-32736](https://cve.now/CVE-2026-32736.md): Hytale Modding Wiki has Insecure Direct Object Reference / GDPR PII Exposure (CVSS 4.3, HytaleModding wiki)
- [CVE-2026-32731](https://cve.now/CVE-2026-32731.md): ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction (CVSS 10.0, apostrophecms import-export · @apostrophecms/import-export)
- [CVE-2026-32730](https://cve.now/CVE-2026-32730.md): ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware (CVSS 8.1, apostrophecms apostrophe · apostrophe)
- [CVE-2026-33163](https://cve.now/CVE-2026-33163.md): Parse Server leaks protected fields via LiveQuery afterEvent trigger (CVSS 8.2, parse-community parse-server · parse-server)
- [CVE-2026-33042](https://cve.now/CVE-2026-33042.md): Parse Server affected by empty authData bypassing credential requirement on signup (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-32944](https://cve.now/CVE-2026-32944.md): Parse Server crash via deeply nested query condition operators (CVSS 8.7, parse-community parse-server · parse-server)
- [CVE-2026-32943](https://cve.now/CVE-2026-32943.md): Parse Server has a password reset token single-use bypass via concurrent requests (CVSS 2.3, parse-community parse-server · parse-server)
- [CVE-2026-4407](https://cve.now/CVE-2026-4407.md): Out-of-bounds array write in Xpdf 4.06 due to missing validation (CVSS 2.1, Xpdf)
- [CVE-2026-32886](https://cve.now/CVE-2026-32886.md): Parse Server's Cloud function dispatch crashes server via prototype chain traversal (CVSS 8.2, parse-community parse-server · parse-server)
- [CVE-2026-32878](https://cve.now/CVE-2026-32878.md): Parse Server vulnerable to schema poisoning via prototype pollution in deep copy (CVSS 5.3, parse-community parse-server · parse-server)
- [CVE-2026-32770](https://cve.now/CVE-2026-32770.md): Parse Server: LiveQuery subscription with invalid regular expression crashes server (CVSS 5.9, parse-community parse-server · parse-server)
- [CVE-2026-32742](https://cve.now/CVE-2026-32742.md): Parse Server session creation endpoint allows overwriting server-generated session fields (CVSS 4.3, parse-community parse-server · parse-server)
- [CVE-2026-32728](https://cve.now/CVE-2026-32728.md): Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries (CVSS 8.3, parse-community parse-server · parse-server)
- [CVE-2026-32723](https://cve.now/CVE-2026-32723.md): SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) (CVSS 4.8, nyariv SandboxJS · @nyariv/sandboxjs)
- [CVE-2026-32722](https://cve.now/CVE-2026-32722.md): Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata (CVSS 3.6, bloomberg memray · memray)
- [CVE-2026-32703](https://cve.now/CVE-2026-32703.md): OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy (CVSS 9.1, opf openproject)
- [CVE-2026-32698](https://cve.now/CVE-2026-32698.md): OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution (CVSS 9.1, opf openproject)
- [CVE-2026-32700](https://cve.now/CVE-2026-32700.md): Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to (CVSS 6.0, heartcombo devise · devise)
- [CVE-2026-25873](https://cve.now/CVE-2026-25873.md): OmniGen2-RL Reward Server Unsafe Deserialization RCE (CVSS 9.3, Beijing Academy of Artificial Intelligence (BAAI) OmniGen2-…)
- [CVE-2026-32638](https://cve.now/CVE-2026-32638.md): StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens (CVSS 2.7, withstudiocms studiocms · studiocms)
- [CVE-2026-32636](https://cve.now/CVE-2026-32636.md): ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-32321](https://cve.now/CVE-2026-32321.md): ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration (CVSS 8.8, MacWarrior clipbucket-v5)
- [CVE-2026-31973](https://cve.now/CVE-2026-31973.md): NULL pointer dereference in samtools cram-size (CVSS 6.9, samtools)
- [CVE-2026-31972](https://cve.now/CVE-2026-31972.md): samtools mpileup has use-after-free leading to an invalid read (CVSS 6.9, samtools)
- [CVE-2026-25745](https://cve.now/CVE-2026-25745.md): OpenEMR's Message Update Ignores Patient id (CVSS 6.5, openemr)
- [CVE-2026-31971](https://cve.now/CVE-2026-31971.md): HTSlib CRAM decoder vulnerable to buffer overflow (CVSS 7.1, samtools htslib)
- [CVE-2026-31970](https://cve.now/CVE-2026-31970.md): HTSlib BGZF index file reader has a heap buffer overflow (CVSS 7.1, samtools htslib)
- [CVE-2026-31969](https://cve.now/CVE-2026-31969.md): HTSlib CRAM decoder has a heap buffer overflow (CVSS 7.1, samtools htslib)
- [CVE-2026-4396](https://cve.now/CVE-2026-4396.md): Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in- (CVSS 8.3, Devolutions Hub Reporting Service)
- [CVE-2026-31968](https://cve.now/CVE-2026-31968.md): HTSlib CRAM decoder vulnerable to buffer overflow (CVSS 8.8, samtools htslib)
- [CVE-2026-31967](https://cve.now/CVE-2026-31967.md): HTSlib CRAM reader has out-of-bounds read due to improper validation of input (CVSS 6.9, samtools htslib)
- [CVE-2026-31966](https://cve.now/CVE-2026-31966.md): HTSlib CRAM reader has out-of-bounds read due to improper validation of input (CVSS 6.9, samtools htslib)
- [CVE-2026-31965](https://cve.now/CVE-2026-31965.md): HTSlib CRAM reader has out-of-bounds reads due to improper validation of input (CVSS 6.9, samtools htslib)
- [CVE-2026-31964](https://cve.now/CVE-2026-31964.md): HTSlib CRAM decoder has a NULL Pointer Dereference (CVSS 6.9, samtools htslib)
- [CVE-2026-31963](https://cve.now/CVE-2026-31963.md): HTSlib CRAM reader has heap buffer overflow due to improper validation of input (CVSS 8.8, samtools htslib)
- [CVE-2026-3479](https://cve.now/CVE-2026-3479.md): pkgutil.get\_data() does not enforce documented restrictions (CVSS 0.0, Python Software Foundation CPython)
- [CVE-2026-31962](https://cve.now/CVE-2026-31962.md): HTSlib CRAM reader has heap buffer overflow due to improper validation of input (CVSS 8.8, samtools htslib)
- [CVE-2026-27135](https://cve.now/CVE-2026-27135.md): nghttp2 Denial of service: Assertion failure due to the missing state validation (CVSS 7.5, nghttp2)
- [CVE-2026-32634](https://cve.now/CVE-2026-32634.md): Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers (CVSS 8.1, nicolargo glances · glances)
- [CVE-2026-23270](https://cve.now/CVE-2026-23270.md): net/sched: Only allow act\_ct to bind to clsact/ingress qdiscs and shared blocks (CVSS 7.8, Linux)
- [CVE-2026-23269](https://cve.now/CVE-2026-23269.md): apparmor: validate DFA start states are in bounds in unpack\_pdb (CVSS 7.1, Linux)
- [CVE-2026-23268](https://cve.now/CVE-2026-23268.md): apparmor: fix unprivileged local user can do privileged policy management (CVSS 7.8, Linux)
- [CVE-2026-32633](https://cve.now/CVE-2026-32633.md): Glances's Browser API Exposes Reusable Downstream Credentials via \`/api/4/serverslist\` (CVSS 9.1, nicolargo glances · glances)
- [CVE-2026-32632](https://cve.now/CVE-2026-32632.md): Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding (CVSS 5.9, nicolargo glances · glances)
- [CVE-2026-23267](https://cve.now/CVE-2026-23267.md): f2fs: fix IS\_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (no CVSS, Linux)
- [CVE-2026-23266](https://cve.now/CVE-2026-23266.md): fbdev: rivafb: fix divide error in nv3\_arb() (no CVSS, Linux)
- [CVE-2026-23265](https://cve.now/CVE-2026-23265.md): f2fs: fix to do sanity check on node footer in {read,write}\_end\_io (no CVSS, Linux)
- [CVE-2026-23264](https://cve.now/CVE-2026-23264.md): Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (no CVSS, Linux)
- [CVE-2026-23263](https://cve.now/CVE-2026-23263.md): io\_uring/zcrx: fix page array leak (no CVSS, Linux)
- [CVE-2026-23262](https://cve.now/CVE-2026-23262.md): gve: Fix stats report corruption on queue count change (no CVSS, Linux)
- [CVE-2026-23261](https://cve.now/CVE-2026-23261.md): nvme-fc: release admin tagset if init fails (no CVSS, Linux)
- [CVE-2026-23260](https://cve.now/CVE-2026-23260.md): regmap: maple: free entry on mas\_store\_gfp() failure (no CVSS, Linux)
- [CVE-2026-23259](https://cve.now/CVE-2026-23259.md): io\_uring/rw: free potentially allocated iovec on cache put failure (no CVSS, Linux)
- [CVE-2026-23258](https://cve.now/CVE-2026-23258.md): net: liquidio: Initialize netdev pointer before queue setup (no CVSS, Linux)
- [CVE-2026-23257](https://cve.now/CVE-2026-23257.md): net: liquidio: Fix off-by-one error in PF setup\_nic\_devices() cleanup (no CVSS, Linux)
- [CVE-2026-23256](https://cve.now/CVE-2026-23256.md): net: liquidio: Fix off-by-one error in VF setup\_nic\_devices() cleanup (no CVSS, Linux)
- [CVE-2026-23255](https://cve.now/CVE-2026-23255.md): net: add proper RCU protection to /proc/net/ptype (no CVSS, Linux)
- [CVE-2026-23254](https://cve.now/CVE-2026-23254.md): net: gro: fix outer network offset (no CVSS, Linux)
- [CVE-2025-71270](https://cve.now/CVE-2025-71270.md): LoongArch: Enable exception fixup for specific ADE subcode (no CVSS, Linux)
- [CVE-2025-71269](https://cve.now/CVE-2025-71269.md): btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVSS 7.5, Linux)
- [CVE-2025-71268](https://cve.now/CVE-2025-71268.md): btrfs: fix reservation leak in some error paths when inserting inline extent (CVSS 7.5, Linux)
- [CVE-2026-26948](https://cve.now/CVE-2026-26948.md): Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an Exp (CVSS 4.9, Integrated Dell Remote Access Controller)
- [CVE-2026-26945](https://cve.now/CVE-2026-26945.md): Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integr (CVSS 5.3, Integrated Dell Remote Access Controller)
- [CVE-2026-32611](https://cve.now/CVE-2026-32611.md): Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements (CVSS 7.0, nicolargo glances · glances)
- [CVE-2026-23253](https://cve.now/CVE-2026-23253.md): media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (CVSS 7.8, Linux)
- [CVE-2026-23252](https://cve.now/CVE-2026-23252.md): xfs: get rid of the xchk\_xfile\_\*\_descr calls (no CVSS, Linux)
- [CVE-2026-23251](https://cve.now/CVE-2026-23251.md): xfs: only call xf{array,blob}\_destroy if we have a valid pointer (no CVSS, Linux)
- [CVE-2026-23250](https://cve.now/CVE-2026-23250.md): xfs: check return value of xchk\_scrub\_create\_subord (no CVSS, Linux)
- [CVE-2026-23249](https://cve.now/CVE-2026-23249.md): xfs: check for deleted cursors when revalidating two btrees (no CVSS, Linux)
- [CVE-2026-32610](https://cve.now/CVE-2026-32610.md): Glances's Default CORS Configuration Allows Cross-Origin Credential Theft (CVSS 8.1, nicolargo glances · glances)
- [CVE-2026-1463](https://cve.now/CVE-2026-1463.md): Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \<= 4.0.4 - Authenticated (Author+) Local File Inclusion (CVSS 8.8, smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…)
- [CVE-2026-24063](https://cve.now/CVE-2026-24063.md): World-writable uninstall script executed as root in Arturia Software Center (CVSS 8.2, Arturia Software Center)
- [CVE-2026-2992](https://cve.now/CVE-2026-2992.md): KiviCare \<= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard (CVSS 8.2, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2026-2991](https://cve.now/CVE-2026-2991.md): KiviCare – Clinic & Patient Management System (EHR) \<= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token (CVSS 7.3, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2026-3090](https://cve.now/CVE-2026-3090.md): Post SMTP \<= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event\_type' (CVSS 7.2, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2026-2512](https://cve.now/CVE-2026-2512.md): Code Embed \<= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields (CVSS 6.4, dartiss Code Embed)
- [CVE-2026-2559](https://cve.now/CVE-2026-2559.md): Post SMTP \<= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite (CVSS 5.3, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2026-24062](https://cve.now/CVE-2026-24062.md): Insufficient XPC Client validation leading to local privilege escalation in Arturia Software Center (CVSS 7.8, Arturia Software Center)
- [CVE-2026-33004](https://cve.now/CVE-2026-33004.md): Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential (CVSS 4.3, Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…)
- [CVE-2026-33003](https://cve.now/CVE-2026-33003.md): Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they (CVSS 4.3, Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…)
- [CVE-2026-33002](https://cve.now/CVE-2026-33002.md): Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t (CVSS 7.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-33001](https://cve.now/CVE-2026-33001.md): Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, (CVSS 8.8, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-32609](https://cve.now/CVE-2026-32609.md): Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials (CVSS 7.5, nicolargo glances · glances)
- [CVE-2026-3278](https://cve.now/CVE-2026-3278.md): XSS Vulnerability discovered in OpenText™ ZENworks Service Desk. (CVSS 7.4, OpenText™ ZENworks Service Desk)
- [CVE-2026-25449](https://cve.now/CVE-2026-25449.md): WordPress Traveler theme \< 3.2.8.1 - PHP Object Injection vulnerability (CVSS 9.8, shinetheme Traveler)
- [CVE-2026-32694](https://cve.now/CVE-2026-32694.md): Insecure Direct Object Reference attack via predictable secret ID in Juju (CVSS 6.6, Canonical Juju · github.com/juju/juju)
- [CVE-2026-32693](https://cve.now/CVE-2026-32693.md): Unauthorized access to Kubernetes secrets in Juju (CVSS 8.8, Canonical Juju · github.com/juju/juju)
- [CVE-2026-32692](https://cve.now/CVE-2026-32692.md): Unauthorized update of out-of-scope Vault secrets (CVSS 7.6, Canonical Juju · github.com/juju/juju)
- [CVE-2026-32691](https://cve.now/CVE-2026-32691.md): Timing ownership claim attack on new external back-end secrets (CVSS 5.3, Canonical Juju · github.com/juju/juju)
- [CVE-2026-33265](https://cve.now/CVE-2026-33265.md): In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. (CVSS 6.3, LibreChat)
- [CVE-2025-41258](https://cve.now/CVE-2025-41258.md): LibreChat RAG API Authentication Bypass (CVSS 8.0, danny-avila LibreChat)
- [CVE-2025-12518](https://cve.now/CVE-2025-12518.md): Stored XSS in beefree.io (CVSS 5.3, Bee Content Design Befree SDK)
- [CVE-2026-23248](https://cve.now/CVE-2026-23248.md): perf/core: Fix refcount bug and potential UAF in perf\_mmap (CVSS 7.8, Linux)
- [CVE-2026-23247](https://cve.now/CVE-2026-23247.md): tcp: secure\_seq: add back ports to TS offset (no CVSS, Linux)
- [CVE-2026-23246](https://cve.now/CVE-2026-23246.md): wifi: mac80211: bounds-check link\_id in ieee80211\_ml\_reconfiguration (CVSS 8.8, Linux)
- [CVE-2026-23245](https://cve.now/CVE-2026-23245.md): net/sched: act\_gate: snapshot parameters with RCU on replace (CVSS 7.8, Linux)
- [CVE-2026-23244](https://cve.now/CVE-2026-23244.md): nvme: fix memory allocation in nvme\_pr\_read\_keys() (no CVSS, Linux)
- [CVE-2026-23243](https://cve.now/CVE-2026-23243.md): RDMA/umad: Reject negative data\_len in ib\_umad\_write (CVSS 7.8, Linux)
- [CVE-2026-23242](https://cve.now/CVE-2026-23242.md): RDMA/siw: Fix potential NULL pointer dereference in header processing (CVSS 7.5, Linux)
- [CVE-2025-71267](https://cve.now/CVE-2025-71267.md): fs: ntfs3: fix infinite loop triggered by zero-sized ATTR\_LIST (no CVSS, Linux)
- [CVE-2025-71266](https://cve.now/CVE-2025-71266.md): fs: ntfs3: check return value of indx\_find to avoid infinite loop (no CVSS, Linux)
- [CVE-2025-71265](https://cve.now/CVE-2025-71265.md): fs: ntfs3: fix infinite loop in attr\_load\_runs\_range on inconsistent metadata (no CVSS, Linux)
- [CVE-2026-32565](https://cve.now/CVE-2026-32565.md): WordPress Contextual Related Posts plugin \< 4.2.2 - Broken Access Control vulnerability (CVSS 5.3, Ajay Contextual Related Posts)
- [CVE-2026-1217](https://cve.now/CVE-2026-1217.md): Yoast Duplicate Post \<= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite (CVSS 5.4, Yoast Duplicate Post · yoast/duplicate-post)
- [CVE-2026-22729](https://cve.now/CVE-2026-22729.md): CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter (CVSS 8.6, VMware Spring AI · org.springframework.ai:spring-ai-vector-…)
- [CVE-2026-22730](https://cve.now/CVE-2026-22730.md): CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter (CVSS 8.8, VMware Spring AI · org.springframework.ai:spring-ai-mariadb…)
- [CVE-2026-22323](https://cve.now/CVE-2026-22323.md): Cross‑Site Request Forgery in Link Aggregation Configuration (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2026-22322](https://cve.now/CVE-2026-22322.md): Stored Cross‑Site Scripting in Link Aggregation Name Handling (CVSS 7.1, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2026-22321](https://cve.now/CVE-2026-22321.md): Stack-Based Buffer Overflow in CLI Login Username Handling over CLI (CVSS 5.3, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2026-22320](https://cve.now/CVE-2026-22320.md): Stack-Based Buffer Overflow in TFTP File-Transfer Command Handling over CLI (CVSS 6.5, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2026-22319](https://cve.now/CVE-2026-22319.md): Stack-Based Buffer Overflow in File Install Parameter Handling (CVSS 4.9, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2026-22318](https://cve.now/CVE-2026-22318.md): Stack-Based Buffer Overflow in File Transfer Parameter Handling (CVSS 4.9, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2026-22317](https://cve.now/CVE-2026-22317.md): Command Injection Vulnerability in Root CA Certificate Transfer Workflow (CVSS 7.2, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2026-22316](https://cve.now/CVE-2026-22316.md): Buffer Overflow using TFTP Filename (CVSS 6.5, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2025-31703](https://cve.now/CVE-2025-31703.md): A vulnerability found in Dahua NVR/XVR device. (CVSS 2.4, dahua NVR2-4KS3 · dahua XVR4232AN-I/T +1)
- [CVE-2026-3512](https://cve.now/CVE-2026-3512.md): Writeprint Stylometry \<= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter (CVSS 6.1, alhadeff Writeprint Stylometry)
- [CVE-2026-32608](https://cve.now/CVE-2026-32608.md): Glances has a Command Injection via Process Names in Action Command Templates (CVSS 7.0, nicolargo glances · glances)
- [CVE-2025-15363](https://cve.now/CVE-2025-15363.md): Get Use APIs \< 2.0.10 - Contributor+ Stored XSS (CVSS 5.9, Get Use APIs)
- [CVE-2026-32596](https://cve.now/CVE-2026-32596.md): Glances exposes the REST API without authentication (CVSS 8.7, nicolargo glances · glances)
- [CVE-2026-32606](https://cve.now/CVE-2026-32606.md): IncusOS has a LUKS encryption bypass due to insufficient TPM policy (CVSS 7.7, lxc incus-os · github.com/lxc/incus-os/incus-osd)
- [CVE-2026-32268](https://cve.now/CVE-2026-32268.md): Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability (CVSS 8.7, craftcms azure-blob · craftcms/azure-blob)
- [CVE-2026-4366](https://cve.now/CVE-2026-4366.md): Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak (CVSS 5.8, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +1)
- [CVE-2026-32266](https://cve.now/CVE-2026-32266.md): Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability (CVSS 2.4, craftcms google-cloud · craftcms/google-cloud)
- [CVE-2026-1926](https://cve.now/CVE-2026-1926.md): Subscriptions for WooCommerce \<= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation (CVSS 5.3, wpswings Subscriptions for WooCommerce)
- [CVE-2026-1780](https://cve.now/CVE-2026-1780.md): \[CR\]Paid Link Manager \<= 0.5 - Reflected Cross-Site Scripting (CVSS 6.1, silentwind \[CR\]Paid Link Manager)
- [CVE-2026-32265](https://cve.now/CVE-2026-32265.md): Amazon S3 for Craft CMS has an Information Disclosure vulnerability (CVSS 6.9, craftcms aws-s3 · craftcms/aws-s3)
- [CVE-2026-32256](https://cve.now/CVE-2026-32256.md): music-metadata has an infinite loop vulnerability in ASF parser (CVSS 7.5, Borewit music-metadata · music-metadata)
- [CVE-2026-2575](https://cve.now/CVE-2026-2575.md): Keycloak: keycloak: denial of service due to excessive samlrequest decompression (CVSS 5.3, Red Hat build of Keycloak · Red Hat Single Sign-On +4)
- [CVE-2026-32254](https://cve.now/CVE-2026-32254.md): Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS (CVSS 7.1, cloudnativelabs kube-router · github.com/cloudnativelabs… +1)
- [CVE-2026-31938](https://cve.now/CVE-2026-31938.md): jsPDF has HTML Injection in New Window paths (CVSS 9.6, parallax jsPDF · jspdf)
- [CVE-2026-31898](https://cve.now/CVE-2026-31898.md): jsPDF has a PDF Object Injection via FreeText color (CVSS 8.1, parallax jsPDF · jspdf)
- [CVE-2026-31891](https://cve.now/CVE-2026-31891.md): Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() (CVSS 7.7, Cockpit-HQ Cockpit · cockpit-hq/cockpit)
- [CVE-2026-31865](https://cve.now/CVE-2026-31865.md): Elysia Cookie Value Prototype Pollution (CVSS 6.5, elysiajs elysia · elysia)
- [CVE-2026-30922](https://cve.now/CVE-2026-30922.md): pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVSS 7.5, pyasn1)
- [CVE-2026-30884](https://cve.now/CVE-2026-30884.md): mdjnelson/moodle-mod\_customcert Vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 9.6, mdjnelson moodle-mod\_customcert)
- [CVE-2026-29112](https://cve.now/CVE-2026-29112.md): @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions (CVSS 7.5, dicebear · @dicebear/converter)
- [CVE-2026-33058](https://cve.now/CVE-2026-33058.md): Kanboard has Authenticated SQL Injection in Project Permissions Handler (CVSS 8.4, kanboard)
- [CVE-2026-29056](https://cve.now/CVE-2026-29056.md): Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin (CVSS 7.0, kanboard)
- [CVE-2026-27545](https://cve.now/CVE-2026-27545.md): OpenClaw \< 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind (CVSS 6.9, OpenClaw)
- [CVE-2026-27524](https://cve.now/CVE-2026-27524.md): OpenClaw \< 2026.2.21 - Prototype Pollution via Debug Override Path (CVSS 2.3, OpenClaw)
- [CVE-2026-27523](https://cve.now/CVE-2026-27523.md): OpenClaw \< 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths (CVSS 6.9, OpenClaw)
- [CVE-2026-27522](https://cve.now/CVE-2026-27522.md): OpenClaw \< 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions (CVSS 7.1, OpenClaw)
- [CVE-2026-22217](https://cve.now/CVE-2026-22217.md): OpenClaw 2026.2.22 \< 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback (CVSS 5.8, OpenClaw)
- [CVE-2026-22181](https://cve.now/CVE-2026-22181.md): OpenClaw \< 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web\_fetch (CVSS 6.1, OpenClaw)
- [CVE-2026-22180](https://cve.now/CVE-2026-22180.md): OpenClaw \< 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations (CVSS 4.8, OpenClaw)
- [CVE-2026-22179](https://cve.now/CVE-2026-22179.md): OpenClaw \< 2026.2.22 - Allowlist Bypass via Command Substitution in system.run (CVSS 7.5, OpenClaw)
- [CVE-2026-22178](https://cve.now/CVE-2026-22178.md): OpenClaw \< 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata (CVSS 6.9, OpenClaw)
- [CVE-2026-22177](https://cve.now/CVE-2026-22177.md): OpenClaw \< 2026.2.21 - Environment Variable Injection via Config env.vars (CVSS 6.9, OpenClaw)
- [CVE-2026-22175](https://cve.now/CVE-2026-22175.md): OpenClaw \< 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappers (CVSS 7.1, OpenClaw)
- [CVE-2026-22174](https://cve.now/CVE-2026-22174.md): OpenClaw \< 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe (CVSS 5.9, OpenClaw)
- [CVE-2026-22171](https://cve.now/CVE-2026-22171.md): OpenClaw \< 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming (CVSS 8.8, OpenClaw)
- [CVE-2026-22170](https://cve.now/CVE-2026-22170.md): OpenClaw \< 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration (CVSS 6.3, OpenClaw)
- [CVE-2026-22169](https://cve.now/CVE-2026-22169.md): OpenClaw \< 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins (CVSS 7.1, OpenClaw)
- [CVE-2026-22168](https://cve.now/CVE-2026-22168.md): OpenClaw \< 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run (CVSS 7.1, OpenClaw)
- [CVE-2026-4268](https://cve.now/CVE-2026-4268.md): WP Go Maps (formerly WP Google Maps) \<= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin\_post\_wpgmza\_save\_settings (CVSS 6.4, wpgmaps WP Go Maps)
- [CVE-2026-28499](https://cve.now/CVE-2026-28499.md): LeafKit's HTML escaping may be skipped for Collection values, enabling XSS (CVSS 6.9, vapor leaf-kit)
- [CVE-2026-28500](https://cve.now/CVE-2026-28500.md): ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack (CVSS 8.6, onnx)
- [CVE-2026-2603](https://cve.now/CVE-2026-2603.md): Keycloak: keycloak: unauthorized authentication via disabled saml identity provider (CVSS 8.1, Red Hat build of Keycloak · org.keycloak:keycloak-servic… +1)
- [CVE-2026-2092](https://cve.now/CVE-2026-2092.md): Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions (CVSS 7.7, Red Hat build of Keycloak · Red Hat Single Sign-On +2)
- [CVE-2026-4356](https://cve.now/CVE-2026-4356.md): itsourcecode University Management System add\_result.php cross site scripting (CVSS 4.8, itsourcecode University Management System)
- [CVE-2026-28674](https://cve.now/CVE-2026-28674.md): xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution) (CVSS 7.2, danvei233 xiaoheiFS)
- [CVE-2026-28673](https://cve.now/CVE-2026-28673.md): xiaoheiFS Vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation) (CVSS 7.2, danvei233 xiaoheiFS)
- [CVE-2026-29057](https://cve.now/CVE-2026-29057.md): Next.js: HTTP request smuggling in rewrites (CVSS 6.3, vercel next.js · next)
- [CVE-2026-27980](https://cve.now/CVE-2026-27980.md): Next.js: Unbounded next/image disk cache growth can exhaust storage (CVSS 6.9, vercel next.js · next)
- [CVE-2026-27979](https://cve.now/CVE-2026-27979.md): Next.js: Unbounded postponed resume buffering can lead to DoS (CVSS 6.9, vercel next.js · next)
- [CVE-2025-55040](https://cve.now/CVE-2025-55040.md): The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CS (CVSS 8.8)
- [CVE-2025-55041](https://cve.now/CVE-2025-55041.md): MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) t (CVSS 8.0)
- [CVE-2025-55043](https://cve.now/CVE-2025-55043.md): MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows u (CVSS 6.5)
- [CVE-2025-55044](https://cve.now/CVE-2025-55044.md): The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized l (CVSS 8.8)
- [CVE-2025-55045](https://cve.now/CVE-2025-55045.md): The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. (CVSS 7.1)
- [CVE-2025-55046](https://cve.now/CVE-2025-55046.md): MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash s (CVSS 8.1)
- [CVE-2025-58112](https://cve.now/CVE-2025-58112.md): Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries i (CVSS 8.8)
- [CVE-2025-67829](https://cve.now/CVE-2025-67829.md): Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. (CVSS 9.8)
- [CVE-2025-67830](https://cve.now/CVE-2025-67830.md): Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection. (CVSS 9.8)
- [CVE-2026-26740](https://cve.now/CVE-2026-26740.md): Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting (CVSS 8.2)
- [CVE-2026-29856](https://cve.now/CVE-2026-29856.md): An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial (CVSS 7.5)
- [CVE-2026-29858](https://cve.now/CVE-2026-29858.md): A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information expos (CVSS 7.5)
- [CVE-2026-29859](https://cve.now/CVE-2026-29859.md): An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file. (CVSS 9.8)
- [CVE-2026-30048](https://cve.now/CVE-2026-30048.md): A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. (CVSS 5.4, @developer.notchatbot/webchat)
- [CVE-2026-30345](https://cve.now/CVE-2026-30345.md): A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the (CVSS 7.5)
- [CVE-2026-30695](https://cve.now/CVE-2026-30695.md): A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includ (CVSS 6.1)
- [CVE-2026-30701](https://cve.now/CVE-2026-30701.md): The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the (CVSS 9.1)
- [CVE-2026-30702](https://cve.now/CVE-2026-30702.md): The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. (CVSS 9.8)
- [CVE-2026-30703](https://cve.now/CVE-2026-30703.md): A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). (CVSS 9.8)
- [CVE-2026-30704](https://cve.now/CVE-2026-30704.md): The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.