# CVEs published 2026-03-19

244 CVEs were published on March 19, 2026: 30 critical, 86 high. Days are UTC.

- [CVE-2026-22737](https://cve.now/CVE-2026-22737.md): Spring Framework Improper Path Limitation with Script View Templates (CVSS 5.9, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2026-32761](https://cve.now/CVE-2026-32761.md): File Browser has an Authorization Policy Bypass in its Public Share Download Flow (CVSS 6.5, filebrowser · github.com/filebrowser/filebrowser +2)
- [CVE-2026-32760](https://cve.now/CVE-2026-32760.md): File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin (CVSS 10.0, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-22735](https://cve.now/CVE-2026-22735.md): Server Sent Event stream corruption (CVSS 2.6, Spring Foundation · org.springframework:spring-webmvc +1)
- [CVE-2026-32759](https://cve.now/CVE-2026-32759.md): File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely (CVSS 5.3, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-22733](https://cve.now/CVE-2026-22733.md): Authentication Bypass under Actuator CloudFoundry endpoints (CVSS 8.2, Spring Security · org.springframework.boot:spring-boot-star…)
- [CVE-2026-32758](https://cve.now/CVE-2026-32758.md): File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter (CVSS 6.5, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-32763](https://cve.now/CVE-2026-32763.md): SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using \`Kysely\<any\>\`. (CVSS 8.2, kysely-org kysely · kysely)
- [CVE-2026-32697](https://cve.now/CVE-2026-32697.md): SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR) (CVSS 6.5, SuiteCRM-Core)
- [CVE-2026-32757](https://cve.now/CVE-2026-32757.md): Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection (CVSS 5.4, admidio · admidio/admidio)
- [CVE-2026-29109](https://cve.now/CVE-2026-29109.md): SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing (CVSS 8.6, SuiteCRM-Core)
- [CVE-2026-29108](https://cve.now/CVE-2026-29108.md): Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User (CVSS 6.5, SuiteCRM-Core)
- [CVE-2026-33289](https://cve.now/CVE-2026-33289.md): SuiterCRM has LDAP Filter Injection in Authentication Module (CVSS 8.8, SuiteCRM)
- [CVE-2026-33288](https://cve.now/CVE-2026-33288.md): SuiteCRM has Authenticated SQL Injection in Authentication Module (CVSS 8.8, SuiteCRM)
- [CVE-2026-32756](https://cve.now/CVE-2026-32756.md): Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module (CVSS 8.8, admidio · admidio/admidio)
- [CVE-2026-29189](https://cve.now/CVE-2026-29189.md): SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints (CVSS 8.1, SuiteCRM)
- [CVE-2026-29107](https://cve.now/CVE-2026-29107.md): SuiteCRM vulnerable to authenticated SSRF via PDF export (CVSS 5.0, SuiteCRM)
- [CVE-2026-29106](https://cve.now/CVE-2026-29106.md): SuiteCRM has blind XSS in return\_id parameter (CVSS 5.9, SuiteCRM)
- [CVE-2026-32818](https://cve.now/CVE-2026-32818.md): Admidio is Missing Authorization on Forum Topic and Post Deletion (CVSS 6.5, admidio · admidio/admidio)
- [CVE-2026-29105](https://cve.now/CVE-2026-29105.md): SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture (CVSS 5.4, SuiteCRM)
- [CVE-2026-32816](https://cve.now/CVE-2026-32816.md): Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions (CVSS 5.7, admidio · admidio/admidio)
- [CVE-2026-29104](https://cve.now/CVE-2026-29104.md): SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM (CVSS 2.7, SuiteCRM)
- [CVE-2026-29103](https://cve.now/CVE-2026-29103.md): SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass (CVSS 9.1, SuiteCRM)
- [CVE-2026-29102](https://cve.now/CVE-2026-29102.md): SuiteCRM has Authenticated RCE in Modules (CVSS 7.2, SuiteCRM)
- [CVE-2026-32755](https://cve.now/CVE-2026-32755.md): Admidio is Missing CSRF Protection on Role Membership Date Changes (CVSS 5.7, admidio · admidio/admidio)
- [CVE-2026-29101](https://cve.now/CVE-2026-29101.md): SuiteCRM Vulnerable to Directory Traversal to DoS in Modules (CVSS 4.9, SuiteCRM)
- [CVE-2026-29100](https://cve.now/CVE-2026-29100.md): SuiteCRM has Reflected HTML Injection in Login Page via default\_user\_name Parameter (CVSS 7.1, SuiteCRM)
- [CVE-2026-22732](https://cve.now/CVE-2026-22732.md): Under Some Conditions Spring Security HTTP Headers Are not Written (CVSS 9.1, VMware Spring Security · org.springframework.security:sprin…)
- [CVE-2026-29099](https://cve.now/CVE-2026-29099.md): SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality. (CVSS 8.8, SuiteCRM)
- [CVE-2026-32721](https://cve.now/CVE-2026-32721.md): LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal (CVSS 8.6, openwrt luci · openwrt)
- [CVE-2026-29098](https://cve.now/CVE-2026-29098.md): SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action (CVSS 4.9, SuiteCRM)
- [CVE-2026-29097](https://cve.now/CVE-2026-29097.md): SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet (CVSS 7.1, SuiteCRM)
- [CVE-2026-29096](https://cve.now/CVE-2026-29096.md): SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field\_function in Report Fields (CVSS 8.1, SuiteCRM)
- [CVE-2026-22731](https://cve.now/CVE-2026-22731.md): Authentication Bypass under Actuator Health groups paths (CVSS 8.2, Spring Boot · org.springframework.boot:spring-boot-starter-…)
- [CVE-2026-30874](https://cve.now/CVE-2026-30874.md): OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation (CVSS 1.8, openwrt)
- [CVE-2026-33408](https://cve.now/CVE-2026-33408.md): Discourse has Improper Authorization in "Post Edits" Report For Moderators (CVSS 2.2, discourse)
- [CVE-2026-33395](https://cve.now/CVE-2026-33395.md): Discourse has stored click‑based XSS via Graphviz SVG javascript: links (CVSS 4.4, discourse)
- [CVE-2026-32041](https://cve.now/CVE-2026-32041.md): OpenClaw \< 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap (CVSS 7.5, OpenClaw)
- [CVE-2026-32040](https://cve.now/CVE-2026-32040.md): OpenClaw \< 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation (CVSS 2.4, OpenClaw)
- [CVE-2026-32039](https://cve.now/CVE-2026-32039.md): OpenClaw \< 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender (CVSS 6.0, OpenClaw)
- [CVE-2026-32038](https://cve.now/CVE-2026-32038.md): OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter (CVSS 9.3, OpenClaw)
- [CVE-2026-32037](https://cve.now/CVE-2026-32037.md): OpenClaw \< 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling (CVSS 2.3, OpenClaw)
- [CVE-2026-32036](https://cve.now/CVE-2026-32036.md): OpenClaw \< 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels (CVSS 8.3, OpenClaw)
- [CVE-2026-32035](https://cve.now/CVE-2026-32035.md): OpenClaw \< 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler (CVSS 5.8, OpenClaw)
- [CVE-2026-32034](https://cve.now/CVE-2026-32034.md): OpenClaw \< 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP (CVSS 6.1, OpenClaw)
- [CVE-2026-32033](https://cve.now/CVE-2026-32033.md): OpenClaw \< 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation (CVSS 6.0, OpenClaw)
- [CVE-2026-32032](https://cve.now/CVE-2026-32032.md): OpenClaw \< 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable (CVSS 7.3, OpenClaw)
- [CVE-2026-32031](https://cve.now/CVE-2026-32031.md): OpenClaw \< 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway (CVSS 6.3, OpenClaw)
- [CVE-2026-32030](https://cve.now/CVE-2026-32030.md): OpenClaw \< 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal (CVSS 8.2, OpenClaw)
- [CVE-2026-32029](https://cve.now/CVE-2026-32029.md): OpenClaw \< 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing (CVSS 6.3, OpenClaw)
- [CVE-2026-32028](https://cve.now/CVE-2026-32028.md): OpenClaw \< 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress (CVSS 6.3, OpenClaw)
- [CVE-2026-32027](https://cve.now/CVE-2026-32027.md): OpenClaw \< 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlist (CVSS 7.1, OpenClaw)
- [CVE-2026-32026](https://cve.now/CVE-2026-32026.md): OpenClaw \< 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandbox (CVSS 7.1, OpenClaw)
- [CVE-2026-32025](https://cve.now/CVE-2026-32025.md): OpenClaw \< 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass (CVSS 7.5, OpenClaw)
- [CVE-2026-32024](https://cve.now/CVE-2026-32024.md): OpenClaw \< 2026.2.22 - Symlink Traversal in Avatar Handling (CVSS 6.8, OpenClaw)
- [CVE-2026-32023](https://cve.now/CVE-2026-32023.md): OpenClaw \< 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.run (CVSS 6.0, OpenClaw)
- [CVE-2026-32022](https://cve.now/CVE-2026-32022.md): OpenClaw \< 2026.2.21 - Arbitrary File Read via grep -e Flag Policy Bypass (CVSS 6.0, OpenClaw)
- [CVE-2026-32021](https://cve.now/CVE-2026-32021.md): OpenClaw \< 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom (CVSS 6.3, OpenClaw)
- [CVE-2026-32020](https://cve.now/CVE-2026-32020.md): OpenClaw \< 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler (CVSS 4.8, OpenClaw)
- [CVE-2026-32019](https://cve.now/CVE-2026-32019.md): OpenClaw \< 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard (CVSS 2.3, OpenClaw)
- [CVE-2026-32018](https://cve.now/CVE-2026-32018.md): OpenClaw \< 2026.2.19 - Race Condition in Sandbox Registry Write Operations (CVSS 2.0, OpenClaw)
- [CVE-2026-32017](https://cve.now/CVE-2026-32017.md): OpenClaw \< 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec Allowlist (CVSS 6.0, OpenClaw)
- [CVE-2026-32016](https://cve.now/CVE-2026-32016.md): OpenClaw \< 2026.2.22 - Path Traversal via Basename-Only Allowlist Matching on macOS (CVSS 7.3, OpenClaw)
- [CVE-2026-32015](https://cve.now/CVE-2026-32015.md): OpenClaw 2026.1.21 \< 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation (CVSS 7.3, OpenClaw)
- [CVE-2026-32014](https://cve.now/CVE-2026-32014.md): OpenClaw \< 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields (CVSS 8.6, OpenClaw)
- [CVE-2026-32013](https://cve.now/CVE-2026-32013.md): OpenClaw \< 2026.2.25 - Symlink Traversal in agents.files Methods (CVSS 8.7, OpenClaw)
- [CVE-2026-32011](https://cve.now/CVE-2026-32011.md): OpenClaw \< 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing (CVSS 8.7, OpenClaw)
- [CVE-2026-32010](https://cve.now/CVE-2026-32010.md): OpenClaw \< 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter (CVSS 5.8, OpenClaw)
- [CVE-2026-32009](https://cve.now/CVE-2026-32009.md): OpenClaw \< 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins (CVSS 7.0, OpenClaw)
- [CVE-2026-32008](https://cve.now/CVE-2026-32008.md): OpenClaw \< 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard (CVSS 7.1, OpenClaw)
- [CVE-2026-32007](https://cve.now/CVE-2026-32007.md): OpenClaw \< 2026.2.23 - Sandbox Bypass in apply\_patch Tool via Workspace-Only Check Bypass (CVSS 7.6, OpenClaw)
- [CVE-2026-32006](https://cve.now/CVE-2026-32006.md): OpenClaw \< 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group Allowlist (CVSS 2.3, OpenClaw)
- [CVE-2026-32005](https://cve.now/CVE-2026-32005.md): OpenClaw \< 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skip (CVSS 7.6, OpenClaw)
- [CVE-2026-32004](https://cve.now/CVE-2026-32004.md): OpenClaw \< 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route (CVSS 8.3, OpenClaw)
- [CVE-2026-32003](https://cve.now/CVE-2026-32003.md): OpenClaw \< 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.run (CVSS 7.5, OpenClaw)
- [CVE-2026-32002](https://cve.now/CVE-2026-32002.md): OpenClaw \< 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass (CVSS 6.0, OpenClaw)
- [CVE-2026-32001](https://cve.now/CVE-2026-32001.md): OpenClaw \< 2026.2.22 - Node Role Device-Identity Bypass via WebSocket Authentication (CVSS 5.3, OpenClaw)
- [CVE-2026-33394](https://cve.now/CVE-2026-33394.md): Discourse leaks PM post edits to moderators (CVSS 2.7, discourse)
- [CVE-2026-33393](https://cve.now/CVE-2026-33393.md): Discourse fixes loose hostname matching in spam host allowlist (CVSS 4.3, discourse)
- [CVE-2026-33355](https://cve.now/CVE-2026-33355.md): Discourse filters whisper posts from private-posts feed (CVSS 6.5, discourse)
- [CVE-2026-30873](https://cve.now/CVE-2026-30873.md): OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens (CVSS 2.4, openwrt)
- [CVE-2026-33410](https://cve.now/CVE-2026-33410.md): Discourse hardens chat DM channel creation and expansion (CVSS 5.4, discourse)
- [CVE-2026-30872](https://cve.now/CVE-2026-30872.md): OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup (CVSS 9.5, openwrt)
- [CVE-2026-32099](https://cve.now/CVE-2026-32099.md): Discourse prevents hidden profile data leak via user onebox (CVSS 4.3, discourse)
- [CVE-2026-4342](https://cve.now/CVE-2026-4342.md): ingress-nginx comment-based nginx configuration injection (CVSS 8.8, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2026-30871](https://cve.now/CVE-2026-30871.md): OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query (CVSS 9.5, openwrt)
- [CVE-2026-29072](https://cve.now/CVE-2026-29072.md): Discourse missing permission check for policy creation in discourse-policy (CVSS 8.2, discourse)
- [CVE-2026-28282](https://cve.now/CVE-2026-28282.md): Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin (CVSS 2.3, discourse)
- [CVE-2026-27936](https://cve.now/CVE-2026-27936.md): Discourse discloses restricted post-action counts to non-privileged users (CVSS 6.9, discourse)
- [CVE-2026-32815](https://cve.now/CVE-2026-32815.md): SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure (CVSS 5.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-32754](https://cve.now/CVE-2026-32754.md): FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread-\>body !!}) (CVSS 9.3, freescout-help-desk freescout)
- [CVE-2026-27935](https://cve.now/CVE-2026-27935.md): Discourse leaks private topic metadata to non-authorized users (CVSS 6.9, discourse)
- [CVE-2026-32753](https://cve.now/CVE-2026-32753.md): FreeScout: Stored XSS through SVG file upload with filter bypass (CVSS 8.5, freescout-help-desk freescout)
- [CVE-2026-32752](https://cve.now/CVE-2026-32752.md): FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages (CVSS 0.0, freescout-help-desk freescout)
- [CVE-2026-32194](https://cve.now/CVE-2026-32194.md): Microsoft Bing Images Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Bing Images)
- [CVE-2026-4159](https://cve.now/CVE-2026-4159.md): wc\_PKCS7\_DecodeEnvelopedData 1 byte out-of-bounds read (CVSS 1.2, wolfSSL)
- [CVE-2026-27934](https://cve.now/CVE-2026-27934.md): Discourse leaks private topic title and post excerpt via user action API endpoint (CVSS 8.7, discourse)
- [CVE-2026-32750](https://cve.now/CVE-2026-32750.md): SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes (CVSS 6.8, siyuan-note siyuan · github.com/siyuan-note/siyuan)
- [CVE-2026-32751](https://cve.now/CVE-2026-32751.md): SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface (CVSS 5.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-32749](https://cve.now/CVE-2026-32749.md): SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write (CVSS 7.6, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-3229](https://cve.now/CVE-2026-3229.md): Integer Overflow in Certificate Chain Allocation (CVSS 1.2, wofSSL wolfSSL)
- [CVE-2026-26137](https://cve.now/CVE-2026-26137.md): Microsoft Exchange Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Exchange Online)
- [CVE-2026-26136](https://cve.now/CVE-2026-26136.md): Microsoft Copilot Information Disclosure Vulnerability (CVSS 6.5, Microsoft Copilot)
- [CVE-2026-24299](https://cve.now/CVE-2026-24299.md): M365 Copilot Information Disclosure Vulnerability (CVSS 5.3, Microsoft 365 Copilot)
- [CVE-2026-23659](https://cve.now/CVE-2026-23659.md): Azure Data Factory Information Disclosure Vulnerability (CVSS 8.6, Microsoft Azure Data Factory)
- [CVE-2026-26120](https://cve.now/CVE-2026-26120.md): Microsoft Bing Tampering Vulnerability (CVSS 6.5, Microsoft Bing)
- [CVE-2026-23658](https://cve.now/CVE-2026-23658.md): Azure DevOps: msazure Elevation of Privilege Vulnerability (CVSS 8.6, Microsoft Azure DevOps: msazure)
- [CVE-2026-32191](https://cve.now/CVE-2026-32191.md): Microsoft Bing Images Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Bing Images)
- [CVE-2026-26138](https://cve.now/CVE-2026-26138.md): Microsoft Purview Elevation of Privilege Vulnerability (CVSS 8.6, Microsoft Purview)
- [CVE-2026-26139](https://cve.now/CVE-2026-26139.md): Microsoft Purview Elevation of Privilege Vulnerability (CVSS 8.6, Microsoft Purview)
- [CVE-2026-32169](https://cve.now/CVE-2026-32169.md): Azure Cloud Shell Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Cloud Shell)
- [CVE-2026-32747](https://cve.now/CVE-2026-32747.md): SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets (CVSS 6.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-3230](https://cve.now/CVE-2026-3230.md): Improper key\_share validation in TLS 1.3 HelloRetryRequest (CVSS 1.2, wolfSSL)
- [CVE-2026-27740](https://cve.now/CVE-2026-27740.md): Discourse has Stored XSS in AI Triage Automation (CVSS 5.1, discourse)
- [CVE-2026-32622](https://cve.now/CVE-2026-32622.md): SQLBot: Remote Code Execution via Terminology Poisoning (CVSS 8.6, dataease SQLBot)
- [CVE-2026-27570](https://cve.now/CVE-2026-27570.md): Discourse Vulnerable to Stored XSS via Shared AI Conversation Onebox (CVSS 5.1, discourse)
- [CVE-2026-27491](https://cve.now/CVE-2026-27491.md): Discourse has a bypass of official warnings messages by non-staff users (CVSS 6.9, discourse)
- [CVE-2026-30924](https://cve.now/CVE-2026-30924.md): qui CORS Misconfiguration: Arbitrary Origins Trusted (CVSS 9.0, autobrr qui · github.com/autobrr/qui)
- [CVE-2026-4395](https://cve.now/CVE-2026-4395.md): Heap-based buffer overflow in wc\_ecc\_import\_x963\_ex KCAPI path (CVSS 1.3, wolfssl)
- [CVE-2026-27454](https://cve.now/CVE-2026-27454.md): Discourse has check revision visibility on posts endpoint (CVSS 5.3, discourse)
- [CVE-2026-4428](https://cve.now/CVE-2026-4428.md): CRL Distribution Point Scope Check Logic Error in AWS-LC (CVSS 7.4, AWS-LC · AWS-LC-FIPS +2)
- [CVE-2026-30836](https://cve.now/CVE-2026-30836.md): Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) (CVSS 10.0, smallstep certificates · github.com/smallstep/certificates)
- [CVE-2026-33346](https://cve.now/CVE-2026-33346.md): OpenEMR has stored XSS in portal\_payment.php via Unescaped table\_args (CVSS 8.7, openemr)
- [CVE-2026-33305](https://cve.now/CVE-2026-33305.md): OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor (CVSS 5.4, openemr)
- [CVE-2026-3849](https://cve.now/CVE-2026-3849.md): Buffer Overflow in HPKE via Oversized ECH Config (CVSS 6.9, wolfSSL)
- [CVE-2026-27166](https://cve.now/CVE-2026-27166.md): Discourse vulnerable to HTML injection via prohibited iframe URLs (CVSS 4.1, discourse)
- [CVE-2026-33304](https://cve.now/CVE-2026-33304.md): OpenEMR has Authorization Bypass in Dated Reminders Log (CVSS 6.5, openemr)
- [CVE-2026-33303](https://cve.now/CVE-2026-33303.md): OpenEMR Vulnerable to Stored XSS via Unescaped portal\_login\_username in Credential Print View (CVSS 5.4, openemr)
- [CVE-2026-33302](https://cve.now/CVE-2026-33302.md): OpenEMR: zhAclCheck Ignores Explicit ACL Denies (CVSS 7.3, openemr)
- [CVE-2026-27953](https://cve.now/CVE-2026-27953.md): ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor (CVSS 7.1, ormar-orm ormar · ormar)
- [CVE-2026-3547](https://cve.now/CVE-2026-3547.md): wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation (CVSS 7.5, wolfSSL)
- [CVE-2026-33321](https://cve.now/CVE-2026-33321.md): OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF) (CVSS 7.2, openemr)
- [CVE-2026-33301](https://cve.now/CVE-2026-33301.md): OpenEMR has arbitrary image file read via PDF generator (CVSS 7.1, openemr)
- [CVE-2026-3549](https://cve.now/CVE-2026-3549.md): ECH parsing heap buffer overflow (CVSS 8.3, wofSSL wolfSSL)
- [CVE-2026-33299](https://cve.now/CVE-2026-33299.md): OpenEMR has Stored XSS in patient encounter Eye Exam form answers (CVSS 8.5, openemr)
- [CVE-2026-3580](https://cve.now/CVE-2026-3580.md): Compiler-induced timing leak in sp\_256\_get\_entry\_256\_9 on RISC-V (CVSS 2.1, wolfSSL)
- [CVE-2026-32119](https://cve.now/CVE-2026-32119.md): OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page (CVSS 4.4, openemr)
- [CVE-2026-3579](https://cve.now/CVE-2026-3579.md): Non-constant time multiplication subroutine \_\_muldi3 on RISC-V RV32I (CVSS 2.1, wolfSSL)
- [CVE-2026-32238](https://cve.now/CVE-2026-32238.md): OpenEMR has Remote Code Execution in backup functionality (CVSS 9.1, openemr)
- [CVE-2026-25928](https://cve.now/CVE-2026-25928.md): OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders (CVSS 6.5, openemr)
- [CVE-2026-25744](https://cve.now/CVE-2026-25744.md): OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals (CVSS 6.5, openemr)
- [CVE-2026-3503](https://cve.now/CVE-2026-3503.md): Fault injection attack with ML-DSA and ML-KEM on ARM (CVSS 4.3, wolfSSL)
- [CVE-2026-3548](https://cve.now/CVE-2026-3548.md): Buffer overflow in CRL number parsing in wolfSSL (CVSS 7.2, wolfSSL)
- [CVE-2026-2646](https://cve.now/CVE-2026-2646.md): Heap buffer overflow in session parsing with wolfSSL\_d2i\_SSL\_SESSION() function (CVSS 5.0, wolfssl)
- [CVE-2026-26940](https://cve.now/CVE-2026-26940.md): Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-26939](https://cve.now/CVE-2026-26939.md): Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration (CVSS 6.5, Elastic Kibana)
- [CVE-2026-2645](https://cve.now/CVE-2026-2645.md): Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2 (CVSS 5.5, wolfSSL)
- [CVE-2026-26933](https://cve.now/CVE-2026-26933.md): Improper Validation of Array Index in Packetbeat Leading to Denial of Service (CVSS 5.7, Elastic Packetbeat · github.com/elastic/beats/v7 +1)
- [CVE-2026-26931](https://cve.now/CVE-2026-26931.md): Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service (CVSS 5.7, Elastic Metricbeat · github.com/elastic/beats/v7 +1)
- [CVE-2026-1005](https://cve.now/CVE-2026-1005.md): Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path (CVSS 2.1, wolfSSL)
- [CVE-2026-0819](https://cve.now/CVE-2026-0819.md): Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes (CVSS 2.2, wolfSSL)
- [CVE-2026-3029](https://cve.now/CVE-2026-3029.md): CVE-2026-3029 (CVSS 7.5, Artifex Software Inc. \*PyMuPDF\* PyMuPDF · pymupdf)
- [CVE-2026-32869](https://cve.now/CVE-2026-32869.md): OPEXUS eComplaint and eCASE XSS via Name of Organization field (CVSS 5.1, OPEXUS eComplaint · OPEXUS eCASE)
- [CVE-2026-32868](https://cve.now/CVE-2026-32868.md): OPEXUS eComplaint and eCASE XSS via my information (CVSS 5.1, OPEXUS eComplaint · OPEXUS eCASE)
- [CVE-2026-32867](https://cve.now/CVE-2026-32867.md): OPEXUS eComplaint unauthenticated file upload (CVSS 5.4, OPEXUS eComplaint)
- [CVE-2026-32866](https://cve.now/CVE-2026-32866.md): OPEXUS eComplaint and eCase stored XSS via profile first and last name (CVSS 5.1, OPEXUS eCASE)
- [CVE-2026-32865](https://cve.now/CVE-2026-32865.md): OPEXUS eComplaint and eCase insecure password reset (CVSS 9.2, OPEXUS eComplaint · OPEXUS eCASE)
- [CVE-2026-27043](https://cve.now/CVE-2026-27043.md): WordPress Photography theme \< 7.7.6 - Arbitrary File Upload vulnerability (CVSS 7.2, ThemeGoods Photography)
- [CVE-2026-32843](https://cve.now/CVE-2026-32843.md): Linkit ONE Location Aware Sensor System (LASS) Reflected XSS via PM25.php (CVSS 5.1, LinkItONEDevGroup Location Aware Sensor System)
- [CVE-2026-22557](https://cve.now/CVE-2026-22557.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access f (CVSS 10.0, Ubiquiti UniFi Network Application)
- [CVE-2026-22558](https://cve.now/CVE-2026-22558.md): An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to (CVSS 7.7, Ubiquiti UniFi Network Application)
- [CVE-2026-2369](https://cve.now/CVE-2026-2369.md): Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-4426](https://cve.now/CVE-2026-4426.md): Libarchive: libarchive: denial of service via malformed iso file processing (CVSS 6.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-4424](https://cve.now/CVE-2026-4424.md): Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +7)
- [CVE-2025-71260](https://cve.now/CVE-2025-71260.md): BMC FootPrints ITSM 20.20.02 \<= 20.24.01.001 VIEWSTATE Deserialization RCE (CVSS 8.7, BMC Software FootPrints)
- [CVE-2025-71259](https://cve.now/CVE-2025-71259.md): BMC FootPrints ITSM 20.20.02 \<= 20.24.01.001 Blind SSRF in externalfeed/RSS (CVSS 5.3, BMC Software FootPrints)
- [CVE-2025-71258](https://cve.now/CVE-2025-71258.md): BMC FootPrints ITSM 20.20.02 \<= 20.24.01.001 Blind SSRF in searchWeb (CVSS 5.3, BMC Software FootPrints)
- [CVE-2025-71257](https://cve.now/CVE-2025-71257.md): BMC FootPrints ITSM 20.20.02 \<= 20.24.01.001 Authentication Bypass (CVSS 6.9, BMC Software FootPrints)
- [CVE-2026-3511](https://cve.now/CVE-2026-3511.md): Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthentic (CVSS 8.6, Slovensko.Digital Autogram)
- [CVE-2026-3658](https://cve.now/CVE-2026-3658.md): Appointment Booking Calendar \<= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter (CVSS 7.5, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2006-10003](https://cve.now/CVE-2006-10003.md): XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st\_serial\_stack (CVSS 9.8, TODDR XML::Parser)
- [CVE-2006-10002](https://cve.now/CVE-2006-10002.md): XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes (CVSS 9.8, TODDR XML::Parser)
- [CVE-2025-14716](https://cve.now/CVE-2025-14716.md): Unauthorized access to information (CVSS 6.5, Secomea GateManager)
- [CVE-2026-21788](https://cve.now/CVE-2026-21788.md): HCL Connections is vulnerable to cross-site scripting (XSS) (CVSS 5.4, HCLSoftware Connections)
- [CVE-2026-27070](https://cve.now/CVE-2026-27070.md): WordPress Everest Forms Pro plugin \<= 1.9.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPEverest Everest Forms Pro)
- [CVE-2026-27068](https://cve.now/CVE-2026-27068.md): WordPress Website LLMs.txt plugin \<= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ryan Howard Website LLMs.txt)
- [CVE-2026-27067](https://cve.now/CVE-2026-27067.md): WordPress Mobile App Editor plugin \<= 1.3.1 - Arbitrary File Upload vulnerability (CVSS 9.1, Syarif Mobile App Editor)
- [CVE-2026-27065](https://cve.now/CVE-2026-27065.md): WordPress BuilderPress plugin \<= 2.0.1 - Local File Inclusion vulnerability (CVSS 9.8, ThimPress BuilderPress)
- [CVE-2026-25445](https://cve.now/CVE-2026-25445.md): WordPress WishList Member X plugin \<= 3.29.0 - PHP Object Injection vulnerability (CVSS 8.8, Membership Software WishList Member X)
- [CVE-2026-25443](https://cve.now/CVE-2026-25443.md): WordPress Fraud Prevention For Woocommerce plugin \<= 2.3.3 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Dotstore Fraud Prevention For Woocommerce)
- [CVE-2026-25442](https://cve.now/CVE-2026-25442.md): WordPress Kentha theme \<= 4.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, QantumThemes Kentha)
- [CVE-2026-25438](https://cve.now/CVE-2026-25438.md): WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin \<= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeHunk Gutenberg Blocks)
- [CVE-2025-68836](https://cve.now/CVE-2025-68836.md): WordPress Table of Contents Creator plugin \<= 1.6.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Markbeljaars Table of Contents Creator)
- [CVE-2025-67618](https://cve.now/CVE-2025-67618.md): WordPress Brookside theme \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ArtstudioWorks Brookside)
- [CVE-2025-62043](https://cve.now/CVE-2025-62043.md): WordPress WPCasa plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPSight WPCasa)
- [CVE-2025-60237](https://cve.now/CVE-2025-60237.md): WordPress Finag theme \<= 1.5.0 - PHP Object Injection vulnerability (CVSS 9.8, Themeton Finag)
- [CVE-2025-60233](https://cve.now/CVE-2025-60233.md): WordPress Zuut theme \<= 1.4.2 - PHP Object Injection vulnerability (CVSS 9.8, Themeton Zuut)
- [CVE-2025-53222](https://cve.now/CVE-2025-53222.md): WordPress tagDiv Opt-In Builder plugin \<= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tagDiv Opt-In Builder)
- [CVE-2025-50001](https://cve.now/CVE-2025-50001.md): WordPress tagDiv Composer plugin \<= 5.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tagDiv Composer)
- [CVE-2025-32223](https://cve.now/CVE-2025-32223.md): WordPress Tutor LMS plugin \<= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, Themeum Tutor LMS)
- [CVE-2026-3475](https://cve.now/CVE-2026-3475.md): Instant Popup Builder \<= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter (CVSS 5.3, instantpopupbuilder Instant Popup Builder – Powerful Popup…)
- [CVE-2024-42210](https://cve.now/CVE-2024-42210.md): HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability (CVSS 7.6, HCLSoftware Unica Marketing Operations)
- [CVE-2026-25312](https://cve.now/CVE-2026-25312.md): WordPress EventPrime plugin \<= 4.2.8.3 - Payment Bypass vulnerability (CVSS 7.5, Metagauss EventPrime)
- [CVE-2026-25471](https://cve.now/CVE-2026-25471.md): WordPress Admin Safety Guard plugin \<= 1.2.6 - Broken Authentication vulnerability (CVSS 8.1, Themepaste Admin Safety Guard)
- [CVE-2026-27091](https://cve.now/CVE-2026-27091.md): WordPress UiPress lite plugin \<= 3.5.09 - Broken Access Control vulnerability (CVSS 6.3, UiPress lite)
- [CVE-2026-2571](https://cve.now/CVE-2026-2571.md): Download Manager \<= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter (CVSS 4.3, codename065 Download Manager)
- [CVE-2026-4006](https://cve.now/CVE-2026-4006.md): Draft List \<= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display\_name' Parameter (CVSS 6.4, dartiss Draft List)
- [CVE-2026-4120](https://cve.now/CVE-2026-4120.md): Info Cards \<= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4, bplugins Info Cards – Add Text and Media in Card Layouts)
- [CVE-2026-4068](https://cve.now/CVE-2026-4068.md): Add Custom Fields to Media \<= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter (CVSS 4.3, pattihis Add Custom Fields to Media)
- [CVE-2026-27093](https://cve.now/CVE-2026-27093.md): WordPress Tripgo theme \< 1.5.6 - Local File Inclusion vulnerability (CVSS 8.1, ovatheme Tripgo)
- [CVE-2026-27096](https://cve.now/CVE-2026-27096.md): WordPress ColorFolio - Freelance Designer WordPress Theme theme \<= 1.3 - Deserialization of untrusted data vulnerability (CVSS 8.1, BuddhaThemes ColorFolio - Freelance Designer WordPress Theme)
- [CVE-2026-27397](https://cve.now/CVE-2026-27397.md): WordPress Really Simple Security Pro plugin \<= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, Really Simple Plugins B.V. Really Simple Security Pro)
- [CVE-2026-27413](https://cve.now/CVE-2026-27413.md): WordPress Profile Builder Pro plugin \< 3.14.0 - SQL Injection vulnerability (CVSS 9.3, Cozmoslabs Profile Builder Pro)
- [CVE-2026-27540](https://cve.now/CVE-2026-27540.md): WordPress Woocommerce Wholesale Lead Capture plugin \<= 2.0.3.1 - Arbitrary File Upload vulnerability (CVSS 9.0, Rymera Web Co Pty Woocommerce Wholesale Lead Capture)
- [CVE-2026-27542](https://cve.now/CVE-2026-27542.md): WordPress Woocommerce Wholesale Lead Capture plugin \<= 2.0.3.1 - Privilege Escalation vulnerability (CVSS 9.8, Rymera Web Co Pty Woocommerce Wholesale Lead Capture)
- [CVE-2026-28044](https://cve.now/CVE-2026-28044.md): WordPress WP Rocket plugin \<= 3.19.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Media WP Rocket)
- [CVE-2026-28070](https://cve.now/CVE-2026-28070.md): WordPress WP eMember plugin \<= v10.2.2 - Broken Access Control vulnerability (CVSS 5.3, Tips and Tricks HQ WP eMember)
- [CVE-2026-28073](https://cve.now/CVE-2026-28073.md): WordPress WP eMember theme \<= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tips and Tricks HQ WP eMember)
- [CVE-2026-1238](https://cve.now/CVE-2026-1238.md): SlimStat Analytics \<= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh' (CVSS 7.2, veronalabs SlimStat Analytics)
- [CVE-2025-36051](https://cve.now/CVE-2025-36051.md): IBM QRadar SIEM Information Disclosure (CVSS 6.2, IBM QRadar SIEM)
- [CVE-2025-13995](https://cve.now/CVE-2025-13995.md): IBM QRadar SIEM Information Disclosure (CVSS 5.0, IBM QRadar)
- [CVE-2025-15051](https://cve.now/CVE-2025-15051.md): IBM QRadar SIEM Cross-Site Scripting (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2026-1276](https://cve.now/CVE-2026-1276.md): IBM QRadar SIEM Cross-Site Scripting (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2026-32000](https://cve.now/CVE-2026-32000.md): OpenClaw \< 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution (CVSS 5.8, OpenClaw)
- [CVE-2026-31999](https://cve.now/CVE-2026-31999.md): OpenClaw 2026.2.26 \< 2026.3.1 - Current Working Directory Injection via Windows Wrapper Resolution Fallback (CVSS 5.8, OpenClaw)
- [CVE-2026-31998](https://cve.now/CVE-2026-31998.md): OpenClaw 2026.2.22 \< 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds (CVSS 8.3, OpenClaw)
- [CVE-2026-31997](https://cve.now/CVE-2026-31997.md): OpenClaw \< 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals (CVSS 4.4, OpenClaw)
- [CVE-2026-31996](https://cve.now/CVE-2026-31996.md): OpenClaw \< 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flags (CVSS 2.0, OpenClaw)
- [CVE-2026-31995](https://cve.now/CVE-2026-31995.md): OpenClaw 2026.1.21 \< 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension (CVSS 5.8, OpenClaw)
- [CVE-2026-31994](https://cve.now/CVE-2026-31994.md): OpenClaw \< 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation (CVSS 6.9, OpenClaw)
- [CVE-2026-31993](https://cve.now/CVE-2026-31993.md): OpenClaw \< 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains (CVSS 5.6, OpenClaw)
- [CVE-2026-31992](https://cve.now/CVE-2026-31992.md): OpenClaw \< 2026.2.23 - Allowlist Exec-Guard Bypass via env -S (CVSS 7.1, OpenClaw)
- [CVE-2026-31991](https://cve.now/CVE-2026-31991.md): OpenClaw \< 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist (CVSS 2.0, OpenClaw)
- [CVE-2026-31990](https://cve.now/CVE-2026-31990.md): OpenClaw \< 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination (CVSS 6.9, OpenClaw)
- [CVE-2026-31989](https://cve.now/CVE-2026-31989.md): OpenClaw \< 2026.3.1 - Server-Side Request Forgery via web\_search Citation Redirect (CVSS 5.3, OpenClaw)
- [CVE-2026-29608](https://cve.now/CVE-2026-29608.md): OpenClaw 2026.3.1 \< 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting (CVSS 5.4, OpenClaw)
- [CVE-2026-29607](https://cve.now/CVE-2026-29607.md): OpenClaw \< 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistence (CVSS 7.1, OpenClaw)
- [CVE-2026-28461](https://cve.now/CVE-2026-28461.md): OpenClaw \< 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn (CVSS 8.7, OpenClaw)
- [CVE-2026-28460](https://cve.now/CVE-2026-28460.md): OpenClaw \< 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run (CVSS 6.0, OpenClaw)
- [CVE-2026-28449](https://cve.now/CVE-2026-28449.md): OpenClaw \< 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression (CVSS 6.3, OpenClaw)
- [CVE-2026-27670](https://cve.now/CVE-2026-27670.md): OpenClaw \< 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition (CVSS 5.8, OpenClaw)
- [CVE-2026-27566](https://cve.now/CVE-2026-27566.md): OpenClaw \< 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run (CVSS 7.1, OpenClaw)
- [CVE-2026-22176](https://cve.now/CVE-2026-22176.md): OpenClaw \< 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation (CVSS 6.9, OpenClaw)
- [CVE-2025-67112](https://cve.now/CVE-2025-67112.md): Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) (CVSS 9.8)
- [CVE-2025-67113](https://cve.now/CVE-2025-67113.md): OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804 (CVSS 9.8)
- [CVE-2025-67114](https://cve.now/CVE-2025-67114.md): Use of a deterministic credential generation algorithm in /ftl/bin/calc\_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware bef (CVSS 9.8)
- [CVE-2025-67115](https://cve.now/CVE-2025-67115.md): A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804184 (CVSS 6.5)
- [CVE-2025-69720](https://cve.now/CVE-2025-69720.md): The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze\_string in progs/infocmp.c. (CVSS 7.3, GNU ncurses)
- [CVE-2026-25667](https://cve.now/CVE-2026-25667.md): ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumpt (CVSS 7.5)
- [CVE-2026-30402](https://cve.now/CVE-2026-30402.md): An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function (CVSS 9.8)
- [CVE-2026-30403](https://cve.now/CVE-2026-30403.md): There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, w (CVSS 7.5)
- [CVE-2026-30404](https://cve.now/CVE-2026-30404.md): The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. (CVSS 7.5)
- [CVE-2026-30694](https://cve.now/CVE-2026-30694.md): An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array\_filter component (CVSS 9.8)
- [CVE-2026-30711](https://cve.now/CVE-2026-30711.md): Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.