# CVEs published 2026-03-20

304 CVEs were published on March 20, 2026: 27 critical, 142 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-33238](https://cve.now/CVE-2026-33238.md): AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration (CVSS 4.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33237](https://cve.now/CVE-2026-33237.md): AVideo has SSRF in Scheduler Plugin via callbackURL Missing \`isSSRFSafeURL()\` Validation (CVSS 5.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-2430](https://cve.now/CVE-2026-2430.md): Autoptimize \<= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes (CVSS 6.4, optimizingmatters Autoptimize)
- [CVE-2026-3474](https://cve.now/CVE-2026-3474.md): EmailKit \<= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter (CVSS 4.9, roxnor EmailKit – Email Customizer for WooCommerce & WP)
- [CVE-2026-3350](https://cve.now/CVE-2026-3350.md): Image Alt Text Manager \<= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title (CVSS 6.4, wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For…)
- [CVE-2026-3567](https://cve.now/CVE-2026-3567.md): RepairBuddy \<= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc\_rep\_shop\_settings\_submission AJAX Action (CVSS 5.3, sweetdaisy86 RepairBuddy – Repair Shop CRM & Booking Plugin…)
- [CVE-2026-3516](https://cve.now/CVE-2026-3516.md): Contact List \<= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '\_cl\_map\_iframe' Parameter (CVSS 6.4, anssilaitila Contact List – Online Staff Directory & Addres…)
- [CVE-2026-2352](https://cve.now/CVE-2026-2352.md): Autoptimize \<= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao\_post\_preload' Meta Value (CVSS 6.4, optimizingmatters Autoptimize)
- [CVE-2026-3572](https://cve.now/CVE-2026-3572.md): iTracker360 \<= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker\_license' Settings Field (CVSS 6.1, iTracker360)
- [CVE-2026-4083](https://cve.now/CVE-2026-4083.md): Scoreboard for HTML5 Games Lite \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, demonisblack Scoreboard for HTML5 Games Lite)
- [CVE-2026-3577](https://cve.now/CVE-2026-3577.md): Keep Backup Daily \<= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title (CVSS 4.4, fahadmahmood Keep Backup Daily)
- [CVE-2026-3368](https://cve.now/CVE-2026-3368.md): Injection Guard \<= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name (CVSS 7.2, fahadmahmood Injection Guard)
- [CVE-2026-3339](https://cve.now/CVE-2026-3339.md): Keep Backup Daily \<= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd\_path' Parameter (CVSS 2.7, fahadmahmood Keep Backup Daily)
- [CVE-2026-33428](https://cve.now/CVE-2026-33428.md): Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership (CVSS 4.9, discourse)
- [CVE-2026-33427](https://cve.now/CVE-2026-33427.md): Discourse Authorization Page Displays Unvalidated Redirect Domain (CVSS 2.7, discourse)
- [CVE-2026-24060](https://cve.now/CVE-2026-24060.md): Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information (CVSS 9.1, Automated Logic WebCTRL Premium Server)
- [CVE-2026-32666](https://cve.now/CVE-2026-32666.md): Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing (CVSS 7.5, Automated Logic WebCTRL Premium Server)
- [CVE-2026-33426](https://cve.now/CVE-2026-33426.md): Discourse users can edit or synonymize hidden tags they can't see (CVSS 3.5, discourse)
- [CVE-2026-25086](https://cve.now/CVE-2026-25086.md): Automated Logic WebCTRL Premium Server Multiple Binds to the Same Port (CVSS 7.7, Automated Logic WebCTRL Premium Server)
- [CVE-2026-33425](https://cve.now/CVE-2026-33425.md): Discourse has inferable private group membership or existence via exclude\_groups parameter (CVSS 6.9, discourse)
- [CVE-2026-33424](https://cve.now/CVE-2026-33424.md): PM access granted through invites after access revocation (CVSS 5.9, discourse)
- [CVE-2026-33228](https://cve.now/CVE-2026-33228.md): flatted: Prototype Pollution via parse() (CVSS 8.9, WebReflection flatted · flatted)
- [CVE-2026-33423](https://cve.now/CVE-2026-33423.md): Discourse staff can modify any user's group notification level (CVSS 1.3, discourse)
- [CVE-2026-31926](https://cve.now/CVE-2026-31926.md): IGL-Technologies eParking.fi Insufficiently Protected Credentials (CVSS 6.5, IGL-Technologies eParking.fi)
- [CVE-2026-33422](https://cve.now/CVE-2026-33422.md): Discourse exposes ip\_address of flagged user (CVSS 3.5, discourse)
- [CVE-2026-33226](https://cve.now/CVE-2026-33226.md): Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview (CVSS 8.7, budibase)
- [CVE-2026-33221](https://cve.now/CVE-2026-33221.md): Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload (CVSS 2.1, nhost · github.com/nhost/nhost)
- [CVE-2026-32663](https://cve.now/CVE-2026-32663.md): IGL-Technologies eParking.fi Insufficient Session Expiration (CVSS 7.3, IGL-Technologies eParking.fi)
- [CVE-2026-33411](https://cve.now/CVE-2026-33411.md): Discourse's solved topic stream has potential stored XSS in topic title (CVSS 5.4, discourse)
- [CVE-2026-33210](https://cve.now/CVE-2026-33210.md): Ruby JSON has a format string injection vulnerability (CVSS 8.3, ruby json · json)
- [CVE-2026-31903](https://cve.now/CVE-2026-31903.md): IGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, IGL-Technologies eParking.fi)
- [CVE-2026-33291](https://cve.now/CVE-2026-33291.md): Discourse user can create Zendesk tickets even when it does not have access to topic (CVSS 5.1, discourse)
- [CVE-2026-29796](https://cve.now/CVE-2026-29796.md): IGL-Technologies eParking.fi Missing Authentication for Critical Function (CVSS 9.4, IGL-Technologies eParking.fi)
- [CVE-2026-22163](https://cve.now/CVE-2026-22163.md): GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-33251](https://cve.now/CVE-2026-33251.md): Discourse has a Hidden Solved topics permission bypass (CVSS 5.4, discourse)
- [CVE-2026-33243](https://cve.now/CVE-2026-33243.md): barebox: FIT Signature Verification Bypass Vulnerability (CVSS 8.3, barebox)
- [CVE-2026-21732](https://cve.now/CVE-2026-21732.md): GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation (CVSS 9.6, Imagination Technologies Graphics DDK)
- [CVE-2026-28204](https://cve.now/CVE-2026-28204.md): CTEK Chargeportal Insufficiently Protected Credentials (CVSS 6.5, CTEK Chargeportal)
- [CVE-2026-33236](https://cve.now/CVE-2026-33236.md): NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite (CVSS 8.1, nltk)
- [CVE-2026-27649](https://cve.now/CVE-2026-27649.md): CTEK Chargeportal Insufficient Session Expiration (CVSS 7.3, CTEK Chargeportal)
- [CVE-2026-33231](https://cve.now/CVE-2026-33231.md): NLTK has unauthenticated remote shutdown in nltk.app.wordnet\_app (CVSS 7.5, nltk)
- [CVE-2026-31904](https://cve.now/CVE-2026-31904.md): CTEK Chargeportal Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, CTEK Chargeportal)
- [CVE-2026-33230](https://cve.now/CVE-2026-33230.md): nltk Vulnerable to Cross-site Scripting (CVSS 6.1, nltk)
- [CVE-2026-25192](https://cve.now/CVE-2026-25192.md): CTEK Chargeportal Missing Authentication for Critical Function (CVSS 9.4, CTEK Chargeportal)
- [CVE-2026-32810](https://cve.now/CVE-2026-32810.md): Halloy has insecure file permissions on credential files (CVSS 4.8, squidowl halloy)
- [CVE-2026-33209](https://cve.now/CVE-2026-33209.md): Avo has a XSS vulnerability on \`return\_to\` param (CVSS 5.3, avo-hq avo · avo)
- [CVE-2026-32733](https://cve.now/CVE-2026-32733.md): Halloy has a file transfer path traveral vulnerability (CVSS 8.7, squidowl halloy)
- [CVE-2026-33204](https://cve.now/CVE-2026-33204.md): SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering (CVSS 7.5, kelvinmo simplejwt · kelvinmo/simplejwt)
- [CVE-2026-33476](https://cve.now/CVE-2026-33476.md): SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal (CVSS 7.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-33203](https://cve.now/CVE-2026-33203.md): SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass (CVSS 7.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-4508](https://cve.now/CVE-2026-4508.md): PbootCMS Member Login MemberController.php checkUsername sql injection (CVSS 6.9, PbootCMS)
- [CVE-2026-33194](https://cve.now/CVE-2026-33194.md): SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (CVSS 6.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-33186](https://cve.now/CVE-2026-33186.md): gRPC-Go has an authorization bypass via missing leading slash in :path (CVSS 9.1, grpc-go · google.golang.org/grpc)
- [CVE-2026-3864](https://cve.now/CVE-2026-3864.md): CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server (CVSS 6.5, Kubernetes CSI Driver for NFS · github.com/kubernetes-csi/c…)
- [CVE-2026-33180](https://cve.now/CVE-2026-33180.md): HAPI FHIR HTTP authentication leak in redirects (CVSS 7.5, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.f… +11)
- [CVE-2026-4507](https://cve.now/CVE-2026-4507.md): Mindinventory MindSQL mindsql\_core.py ask\_db sql injection (CVSS 5.3, Mindinventory MindSQL)
- [CVE-2026-4506](https://cve.now/CVE-2026-4506.md): Mindinventory MindSQL mindsql\_core.py ask\_db code injection (CVSS 5.3, Mindinventory MindSQL · mindsql)
- [CVE-2026-23536](https://cve.now/CVE-2026-23536.md): Feast: unauthenticated arbitrary file read (CVSS 7.5, Red Hat OpenShift AI)
- [CVE-2026-33177](https://cve.now/CVE-2026-33177.md): Statamic is missing authorization check on taxonomy term creation via fieldtype (CVSS 4.3, statamic cms · statamic/cms)
- [CVE-2026-33172](https://cve.now/CVE-2026-33172.md): Statamic has Stored XSS via SVG Sanitization Bypass (CVSS 8.7, statamic cms · statamic/cms)
- [CVE-2026-33171](https://cve.now/CVE-2026-33171.md): Statamic has a path traversal in file dictionary fieldtype (CVSS 4.3, statamic cms · statamic/cms)
- [CVE-2026-33166](https://cve.now/CVE-2026-33166.md): Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers) (CVSS 8.6, allure-framework allure2 · io.qameta.allure:allure-generator)
- [CVE-2026-32887](https://cve.now/CVE-2026-32887.md): Effect Bug: \`AsyncLocalStorage\` context lost/contaminated inside Effect fibers under concurrent load with RPC (CVSS 7.4, Effect-TS effect · effect)
- [CVE-2026-3584](https://cve.now/CVE-2026-3584.md): Kali Forms \<= 2.4.9 - Unauthenticated Remote Code Execution via form\_process (CVSS 9.8, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-2378](https://cve.now/CVE-2026-2378.md): Address bar spoofing risk in ArcSearch on Android (CVSS 7.4, The BrowserCompany of New York ArcSearch)
- [CVE-2026-33164](https://cve.now/CVE-2026-33164.md): NULL Pointer Dereference in libde265 (CVSS 8.7, strukturag libde265)
- [CVE-2026-33165](https://cve.now/CVE-2026-33165.md): heap out-of-bounds write in libde265 1.0.16 (CVSS 5.5, strukturag libde265)
- [CVE-2026-33156](https://cve.now/CVE-2026-33156.md): DLL Sideloading in ScreenToGif (CVSS 7.8, NickeManarin ScreenToGif)
- [CVE-2026-33155](https://cve.now/CVE-2026-33155.md): DeepDiff has Memory Exhaustion DoS through SAFE\_TO\_IMPORT (CVSS 8.7, seperman deepdiff · deepdiff)
- [CVE-2026-33154](https://cve.now/CVE-2026-33154.md): dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver (CVSS 7.5, dynaconf)
- [CVE-2026-33150](https://cve.now/CVE-2026-33150.md): Use After Free in libfuse (CVSS 7.8, libfuse)
- [CVE-2026-33179](https://cve.now/CVE-2026-33179.md): libfuse: NULL Pointer Dereference and Memory Leak in io\_uring Queue Initialization (CVSS 5.5, libfuse)
- [CVE-2026-33151](https://cve.now/CVE-2026-33151.md): socket.io allows an unbounded number of binary attachments (CVSS 8.7, socketio socket.io · socket.io-parser)
- [CVE-2026-33147](https://cve.now/CVE-2026-33147.md): GMT: Stack-based Buffer Overflow in gmt\_remote\_dataset\_id (CVSS 7.3, GenericMappingTools gmt)
- [CVE-2026-33144](https://cve.now/CVE-2026-33144.md): GPAC MP4Box Heap Buffer Overflow Write in gf\_xml\_parse\_bit\_sequence\_bs (NHML BS Parsing) (CVSS 5.8, gpac)
- [CVE-2026-33142](https://cve.now/CVE-2026-33142.md): OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters (CVSS 8.1, oneuptime)
- [CVE-2026-33143](https://cve.now/CVE-2026-33143.md): OneUptime: WhatsApp Webhook Missing Signature Verification (CVSS 8.7, oneuptime)
- [CVE-2026-4505](https://cve.now/CVE-2026-4505.md): eosphoros-ai DB-GPT FastAPI Endpoint controller.py module\_plugin.refresh\_plugins unrestricted upload (CVSS 5.3, eosphoros-ai DB-GPT)
- [CVE-2026-4504](https://cve.now/CVE-2026-4504.md): eosphoros-ai db-gpt Incomplete Fix editor sql injection (CVSS 6.9, eosphoros-ai db-gpt)
- [CVE-2026-33140](https://cve.now/CVE-2026-33140.md): PySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution (CVSS 5.3, ParzivalHack PySpector · pyspector)
- [CVE-2026-33139](https://cve.now/CVE-2026-33139.md): PySpector: Plugin Sandbox Bypass leads to Arbitrary Code Execution (CVSS 8.3, ParzivalHack PySpector · pyspector)
- [CVE-2026-4438](https://cve.now/CVE-2026-4438.md): gethostbyaddr and gethostbyaddr\_r return invalid DNS hostnames (CVSS 5.4, The GNU C Library glibc)
- [CVE-2026-4437](https://cve.now/CVE-2026-4437.md): gethostbyaddr and gethostbyaddr\_r may incorrectly handle DNS response (CVSS 7.5, The GNU C Library glibc)
- [CVE-2026-33126](https://cve.now/CVE-2026-33126.md): Frigate has SSRF vulnerability in /ffprobe endpoint (CVSS 5.0, blakeblackshear frigate)
- [CVE-2026-4500](https://cve.now/CVE-2026-4500.md): bagofwords1 bagofwords code\_execution.py generate\_df injection (CVSS 5.3, bagofwords1 bagofwords)
- [CVE-2026-4499](https://cve.now/CVE-2026-4499.md): D-Link DIR-820LW SSDP ssdpcgi\_main os command injection (CVSS 6.9, D-Link DIR-820LW)
- [CVE-2026-4497](https://cve.now/CVE-2026-4497.md): Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection (CVSS 6.9, Totolink WA300)
- [CVE-2026-33010](https://cve.now/CVE-2026-33010.md): mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft (CVSS 8.1, doobidoo mcp-memory-service · mcp-memory-service)
- [CVE-2026-4496](https://cve.now/CVE-2026-4496.md): sigmade Git-MCP-Server gitUtils.ts child\_process.exec os command injection (CVSS 4.8, sigmade Git-MCP-Server)
- [CVE-2026-32710](https://cve.now/CVE-2026-32710.md): Heap-based Buffer Overflow in MariaDB (CVSS 8.6, MariaDB server)
- [CVE-2026-32317](https://cve.now/CVE-2026-32317.md): Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API (CVSS 7.6, cryptomator android)
- [CVE-2026-32318](https://cve.now/CVE-2026-32318.md): Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API (CVSS 7.6, cryptomator ios)
- [CVE-2026-32310](https://cve.now/CVE-2026-32310.md): Cryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths (CVSS 4.1, cryptomator)
- [CVE-2026-32309](https://cve.now/CVE-2026-32309.md): Cryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes (CVSS 8.7, cryptomator)
- [CVE-2026-4495](https://cve.now/CVE-2026-4495.md): atjiu pybbs CommentApiController.java create cross site scripting (CVSS 5.1, atjiu pybbs)
- [CVE-2026-32303](https://cve.now/CVE-2026-32303.md): Cryptomator: Tampered vault configuration allows MITM attack on Hub API (CVSS 7.6, cryptomator)
- [CVE-2026-31836](https://cve.now/CVE-2026-31836.md): Mass Assignment Privilege Escalation in Checkmate (CVSS 8.1, bluewave-labs Checkmate)
- [CVE-2026-4494](https://cve.now/CVE-2026-4494.md): atjiu pybbs TopicApiController.java create cross site scripting (CVSS 5.1, atjiu pybbs)
- [CVE-2026-4493](https://cve.now/CVE-2026-4493.md): Tenda A18 Pro MAC Filtering Configuration Endpoint setMacFilterCfg sub\_423B50 stack-based overflow (CVSS 8.7, Tenda A18 Pro)
- [CVE-2026-32844](https://cve.now/CVE-2026-32844.md): XinLiangCoder / php\_api\_doc Reflected XSS via list\_method.php (CVSS 5.1, XinLiangCoder php\_api\_doc)
- [CVE-2026-4492](https://cve.now/CVE-2026-4492.md): Tenda A18 Pro formSetQosBand set\_qosMib\_list stack-based overflow (CVSS 8.7, Tenda A18 Pro)
- [CVE-2026-4491](https://cve.now/CVE-2026-4491.md): Tenda A18 Pro SetIpMacBind fromSetIpMacBind stack-based overflow (CVSS 8.7, Tenda A18 Pro)
- [CVE-2026-4490](https://cve.now/CVE-2026-4490.md): Tenda A18 Pro openSchedWifi setSchedWifi stack-based overflow (CVSS 8.7, Tenda A18 Pro)
- [CVE-2025-15608](https://cve.now/CVE-2025-15608.md): Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55 (CVSS 7.7, TP-Link Systems AX53 · TP-Link Systems AX55)
- [CVE-2025-15607](https://cve.now/CVE-2025-15607.md): Authenticated Command Injection in mcsd Service of TP-Link Archer AX53 (CVSS 7.3, TP-Link Systems AX53)
- [CVE-2025-59383](https://cve.now/CVE-2025-59383.md): Media Streaming Add-on (CVSS 2.7, QNAP Systems Media Streaming Add-on)
- [CVE-2025-62843](https://cve.now/CVE-2025-62843.md): QuRouter (CVSS 0.9, QNAP Systems QuRouter)
- [CVE-2025-62844](https://cve.now/CVE-2025-62844.md): QuRouter (CVSS 4.0, QNAP Systems QuRouter)
- [CVE-2025-62845](https://cve.now/CVE-2025-62845.md): QuRouter (CVSS 5.6, QNAP Systems QuRouter)
- [CVE-2025-62846](https://cve.now/CVE-2025-62846.md): QuRouter (CVSS 7.3, QNAP Systems QuRouter)
- [CVE-2026-22895](https://cve.now/CVE-2026-22895.md): QuFTP Service (CVSS 6.2, QNAP Systems QuFTP Service)
- [CVE-2026-22897](https://cve.now/CVE-2026-22897.md): QuNetSwitch (CVSS 8.1, QNAP Systems QuNetSwitch)
- [CVE-2026-22898](https://cve.now/CVE-2026-22898.md): QVR Pro (CVSS 9.3, QNAP Systems QVR Pro)
- [CVE-2026-22900](https://cve.now/CVE-2026-22900.md): QuNetSwitch (CVSS 6.8, QNAP Systems QuNetSwitch)
- [CVE-2026-22901](https://cve.now/CVE-2026-22901.md): QuNetSwitch (CVSS 6.3, QNAP Systems QuNetSwitch)
- [CVE-2026-22902](https://cve.now/CVE-2026-22902.md): QuNetSwitch (CVSS 5.7, QNAP Systems QuNetSwitch)
- [CVE-2026-4489](https://cve.now/CVE-2026-4489.md): Tenda A18 Pro fast\_setting\_wifi\_set form\_fast\_setting\_wifi\_set stack-based overflow (CVSS 8.7, Tenda A18 Pro)
- [CVE-2026-32989](https://cve.now/CVE-2026-32989.md): Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload (CVSS 8.6, Precurio Intranet Portal)
- [CVE-2026-32986](https://cve.now/CVE-2026-32986.md): Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection (CVSS 5.1, Textpattern CMS)
- [CVE-2026-4488](https://cve.now/CVE-2026-4488.md): UTT HiPER 1250GW setSysAdm strcpy buffer overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-4519](https://cve.now/CVE-2026-4519.md): webbrowser.open() allows leading dashes in URLs (CVSS 7.0, Python Software Foundation CPython)
- [CVE-2026-22172](https://cve.now/CVE-2026-22172.md): OpenClaw \< 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections (CVSS 9.4, OpenClaw)
- [CVE-2026-33312](https://cve.now/CVE-2026-33312.md): Read-only Vikunja users can delete project background images via broken object-level authorization (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-29794](https://cve.now/CVE-2026-29794.md): Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-4487](https://cve.now/CVE-2026-4487.md): UTT HiPER 1200GW websHostFilter strcpy buffer overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-4486](https://cve.now/CVE-2026-4486.md): D-Link DIR-513 Web Service formEasySetPassword stack-based overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2026-4485](https://cve.now/CVE-2026-4485.md): itsourcecode College Management System search\_student.php sql injection (CVSS 5.3, itsourcecode College Management System)
- [CVE-2026-31382](https://cve.now/CVE-2026-31382.md): Gainsight Assist reflected XSS/HTML injection (CVSS 6.1, Gainsight Assist)
- [CVE-2026-31381](https://cve.now/CVE-2026-31381.md): Gainsight Assist plugin information disclosure (CVSS 5.3, Gainsight Assist)
- [CVE-2026-4434](https://cve.now/CVE-2026-4434.md): Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack vi (CVSS 8.1, Devolutions Server)
- [CVE-2026-33136](https://cve.now/CVE-2026-33136.md): WeGIA has Reflected Cross-Site Scripting (XSS) in \`listar\_memorandos\_ativos.php\` via \`sccd\` parameter (CVSS 9.3, LabRedesCefetRJ WeGIA)
- [CVE-2026-33135](https://cve.now/CVE-2026-33135.md): WeGIA has Reflected Cross-Site Scripting (XSS) in \`novo\_memorandoo.php\` via \`sccs\` parameter (CVSS 9.3, LabRedesCefetRJ WeGIA)
- [CVE-2026-33134](https://cve.now/CVE-2026-33134.md): WeGIA has Authenticated Time-Based Blind SQL Injection in \`restaurar\_produto.php\` via \`id\_produto\` parameter (CVSS 9.3, LabRedesCefetRJ WeGIA)
- [CVE-2026-33133](https://cve.now/CVE-2026-33133.md): WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive (CVSS 8.6, LabRedesCefetRJ WeGIA)
- [CVE-2026-33132](https://cve.now/CVE-2026-33132.md): ZITADEL is missing enforcement of organization scopes (CVSS 5.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-33131](https://cve.now/CVE-2026-33131.md): h3 has a middleware bypass with one gadget (CVSS 7.4, h3js h3 · h3)
- [CVE-2026-32595](https://cve.now/CVE-2026-32595.md): Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration (CVSS 6.3, traefik · github.com/traefik/traefik +2)
- [CVE-2026-25792](https://cve.now/CVE-2026-25792.md): Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin (CVSS 6.5, greenshot)
- [CVE-2026-32305](https://cve.now/CVE-2026-32305.md): Traefik mTLS bypass via fragmented ClientHello SNI extraction failure (CVSS 7.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-33130](https://cve.now/CVE-2026-33130.md): Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh) (CVSS 6.5, louislam uptime-kuma)
- [CVE-2026-33129](https://cve.now/CVE-2026-33129.md): h3 has an observable timing discrepancy in basic auth utils (CVSS 5.9, h3js h3 · h3)
- [CVE-2026-33128](https://cve.now/CVE-2026-33128.md): h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields (CVSS 7.5, h3js h3 · h3)
- [CVE-2026-22324](https://cve.now/CVE-2026-22324.md): WordPress Melania theme \<= 2.5.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Melania)
- [CVE-2026-0677](https://cve.now/CVE-2026-0677.md): WordPress TotalContest Lite plugin \<= 2.9.1 - PHP Object Injection vulnerability (CVSS 6.3, TotalSuite TotalContest Lite)
- [CVE-2026-33125](https://cve.now/CVE-2026-33125.md): Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts (CVSS 7.1, blakeblackshear frigate · frigate)
- [CVE-2026-33124](https://cve.now/CVE-2026-33124.md): Frigate has insecure password change functionality (CVSS 8.6, blakeblackshear frigate)
- [CVE-2024-32537](https://cve.now/CVE-2024-32537.md): WordPress Flash Video Player plugin \<= 5.0.4 - CSRF to XSS vulnerability (CVSS 7.1, joshuae1974 Flash Video Player)
- [CVE-2026-33123](https://cve.now/CVE-2026-33123.md): pypdf has inefficient decoding of array-based streams (CVSS 5.1, py-pdf pypdf · pypdf)
- [CVE-2024-31119](https://cve.now/CVE-2024-31119.md): WordPress Download Special Box for Content plugin \<= 1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Vasilis Triantafyllou Special Box for Content)
- [CVE-2026-33081](https://cve.now/CVE-2026-33081.md): PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation (CVSS 5.8, pinchtab · github.com/pinchtab/pinchtab)
- [CVE-2026-33080](https://cve.now/CVE-2026-33080.md): Filament: Unvalidated Range and Values summarizer values can be used for XSS (CVSS 7.3, filamentphp filament · filament/tables)
- [CVE-2026-32701](https://cve.now/CVE-2026-32701.md): Qwik has array method pollution in FormData processing, allowing type confusion and DoS (CVSS 7.5, QwikDev qwik · @builder.io/qwik-city)
- [CVE-2026-27625](https://cve.now/CVE-2026-27625.md): Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction (CVSS 8.1, Stirling-Tools Stirling-PDF)
- [CVE-2026-33075](https://cve.now/CVE-2026-33075.md): FastGPT has Arbitrary Code Execution in GitHub Actions via pull\_request\_target in fastgpt-preview-image.yml (CVSS 9.4, labring FastGPT)
- [CVE-2026-33072](https://cve.now/CVE-2026-33072.md): FileRise: Default Encryption Key Enables Token Forgery and Config Decryption (CVSS 8.2, error311 FileRise)
- [CVE-2026-33071](https://cve.now/CVE-2026-33071.md): FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads (CVSS 4.3, error311 FileRise)
- [CVE-2026-2432](https://cve.now/CVE-2026-2432.md): CM Custom Reports \<= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels (CVSS 4.4, creativemindssolutions CM Custom Reports – Flexible reporti…)
- [CVE-2026-3550](https://cve.now/CVE-2026-3550.md): RockPress \<= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions (CVSS 5.3, firetree RockPress)
- [CVE-2026-2421](https://cve.now/CVE-2026-2421.md): ilGhera Carta Docente for WooCommerce \<= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter (CVSS 6.5, ghera74 ilGhera Carta Docente for WooCommerce)
- [CVE-2026-33070](https://cve.now/CVE-2026-33070.md): FileRise has Unauthenticated Share Link Deletion (CVSS 3.7, error311 FileRise)
- [CVE-2026-33069](https://cve.now/CVE-2026-33069.md): PJSIP has an Out-of-bounds Read in SIP multipart parsing (CVSS 6.9, pjsip pjproject)
- [CVE-2026-33068](https://cve.now/CVE-2026-33068.md): Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File (CVSS 7.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2026-33067](https://cve.now/CVE-2026-33067.md): SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata (CVSS 5.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-33066](https://cve.now/CVE-2026-33066.md): SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering (CVSS 5.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-33192](https://cve.now/CVE-2026-33192.md): free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques (CVSS 8.7, free5gc · github.com/free5gc/udm)
- [CVE-2026-23278](https://cve.now/CVE-2026-23278.md): netfilter: nf\_tables: always walk all pending catchall elements (CVSS 7.8, Linux)
- [CVE-2026-23277](https://cve.now/CVE-2026-23277.md): net/sched: teql: fix NULL pointer dereference in iptunnel\_xmit on TEQL slave xmit (no CVSS, Linux)
- [CVE-2026-23276](https://cve.now/CVE-2026-23276.md): net: add xmit recursion limit to tunnel xmit functions (no CVSS, Linux)
- [CVE-2026-23275](https://cve.now/CVE-2026-23275.md): io\_uring: ensure ctx-\>rings is stable for task work flags manipulation (CVSS 7.8, Linux)
- [CVE-2026-23274](https://cve.now/CVE-2026-23274.md): netfilter: xt\_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVSS 7.8, Linux)
- [CVE-2026-23273](https://cve.now/CVE-2026-23273.md): macvlan: observe an RCU grace period in macvlan\_common\_newlink() error path (CVSS 7.8, Linux)
- [CVE-2026-23272](https://cve.now/CVE-2026-23272.md): netfilter: nf\_tables: unconditionally bump set-\>nelems before insertion (CVSS 7.8, Linux)
- [CVE-2026-23271](https://cve.now/CVE-2026-23271.md): perf: Fix \_\_perf\_event\_overflow() vs perf\_remove\_from\_context() race (CVSS 7.8, Linux)
- [CVE-2026-33065](https://cve.now/CVE-2026-33065.md): free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request (CVSS 6.9, free5gc · github.com/free5gc/udm)
- [CVE-2026-33064](https://cve.now/CVE-2026-33064.md): free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference (CVSS 8.7, free5gc · github.com/free5gc/udm)
- [CVE-2026-33191](https://cve.now/CVE-2026-33191.md): free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error (CVSS 8.7, free5gc · github.com/free5gc/udm)
- [CVE-2026-33022](https://cve.now/CVE-2026-33022.md): Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun (CVSS 6.5, tektoncd pipeline · github.com/tektoncd/pipeline)
- [CVE-2026-33061](https://cve.now/CVE-2026-33061.md): Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template (CVSS 5.8, Jexactyl)
- [CVE-2026-33060](https://cve.now/CVE-2026-33060.md): CKAN MCP Server: SSRF via base\_url allows access to internal networks (CVSS 5.3, ondata ckan-mcp-server · @aborruso/ckan-mcp-server)
- [CVE-2026-33057](https://cve.now/CVE-2026-33057.md): Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py (CVSS 9.8, mesop-dev mesop · mesop)
- [CVE-2026-33056](https://cve.now/CVE-2026-33056.md): tar-rs: unpack\_in can chmod arbitrary directories by following symlinks (CVSS 5.1, alexcrichton tar-rs · tar)
- [CVE-2026-33055](https://cve.now/CVE-2026-33055.md): tar-rs incorrectly ignores PAX size headers if header size is nonzero (CVSS 5.1, alexcrichton tar-rs · tar)
- [CVE-2026-4478](https://cve.now/CVE-2026-4478.md): Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification (CVSS 9.2, Yi Technology YI Home Camera)
- [CVE-2026-4477](https://cve.now/CVE-2026-4477.md): Yi Technology YI Home Camera WPA/WPS hard-coded key (CVSS 2.3, Yi Technology YI Home Camera)
- [CVE-2026-33054](https://cve.now/CVE-2026-33054.md): Mesop: Path Traversal utilizing \`FileStateSessionBackend\` leads to Application Denial of Service and File Write/Deletion (CVSS 10.0, mesop-dev mesop · mesop)
- [CVE-2026-33053](https://cve.now/CVE-2026-33053.md): Langflow has Missing Ownership Verification in API Key Deletion (IDOR) (CVSS 6.1, langflow-ai langflow · langflow)
- [CVE-2026-4476](https://cve.now/CVE-2026-4476.md): Yi Technology YI Home Camera CGI Endpoint ipc missing authentication (CVSS 5.3, Yi Technology YI Home Camera)
- [CVE-2026-4475](https://cve.now/CVE-2026-4475.md): Yi Technology YI Home Camera ipc hard-coded credentials (CVSS 8.7, Yi Technology YI Home Camera)
- [CVE-2026-4474](https://cve.now/CVE-2026-4474.md): itsourcecode University Management System admin\_single\_student\_update.php cross site scripting (CVSS 4.8, itsourcecode University Management System)
- [CVE-2026-33051](https://cve.now/CVE-2026-33051.md): Craft CMS Vulnerable to Stored XSS in Revision Context Menu (CVSS 5.3, craftcms cms · craftcms/cms)
- [CVE-2026-33043](https://cve.now/CVE-2026-33043.md): AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33041](https://cve.now/CVE-2026-33041.md): AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33040](https://cve.now/CVE-2026-33040.md): libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow (CVSS 8.7, rust-libp2p · libp2p-gossipsub)
- [CVE-2026-33039](https://cve.now/CVE-2026-33039.md): AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy (CVSS 8.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33038](https://cve.now/CVE-2026-33038.md): AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4473](https://cve.now/CVE-2026-4473.md): itsourcecode Online Doctor Appointment System appointment\_action.php sql injection (CVSS 5.1, itsourcecode Online Doctor Appointment System)
- [CVE-2026-32768](https://cve.now/CVE-2026-32768.md): Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace (CVSS 7.9, ctfer-io chall-manager · github.com/ctfer-io/chall-manag… +1)
- [CVE-2026-33037](https://cve.now/CVE-2026-33037.md): WWBN AVideo has predictable default admin credentials in official Docker deployment path (CVSS 8.1, WWBN AVideo)
- [CVE-2026-33036](https://cve.now/CVE-2026-33036.md): fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) (CVSS 7.5, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2026-33035](https://cve.now/CVE-2026-33035.md): Unauthenticated Reflected XSS via innerHTML in AVideo (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4472](https://cve.now/CVE-2026-4472.md): itsourcecode Online Frozen Foods Ordering System admin\_edit\_supplier.php sql injection (CVSS 5.3, itsourcecode Online Frozen Foods Ordering System)
- [CVE-2026-4471](https://cve.now/CVE-2026-4471.md): itsourcecode Online Frozen Foods Ordering System admin\_edit\_employee.php sql injection (CVSS 5.1, itsourcecode Online Frozen Foods Ordering System)
- [CVE-2026-33025](https://cve.now/CVE-2026-33025.md): AVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause (CVSS 8.6, WWBN AVideo-Encoder)
- [CVE-2026-33024](https://cve.now/CVE-2026-33024.md): AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator (CVSS 9.3, WWBN AVideo-Encoder)
- [CVE-2026-33017](https://cve.now/CVE-2026-33017.md): Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint (CVSS 9.3, KEV, langflow-ai langflow · langflow)
- [CVE-2026-33013](https://cve.now/CVE-2026-33013.md): Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices (CVSS 8.2, micronaut-projects micronaut-core · io.micronaut:micronaut-…)
- [CVE-2026-33012](https://cve.now/CVE-2026-33012.md): Micronaut Framework vulnerable to a Denial of Service in HTML error response caching (CVSS 7.5, micronaut-projects micronaut-core · io.micronaut:micronaut-…)
- [CVE-2026-33011](https://cve.now/CVE-2026-33011.md): Nest Fastify HEAD Request Middleware Bypass (CVSS 8.7, nestjs nest · @nestjs/platform-fastify)
- [CVE-2026-4470](https://cve.now/CVE-2026-4470.md): itsourcecode Online Frozen Foods Ordering System admin\_edit\_menu.php sql injection (CVSS 5.1, itsourcecode Online Frozen Foods Ordering System)
- [CVE-2026-32954](https://cve.now/CVE-2026-32954.md): ERP has a possibility SQL Injection vulnerability due to missing validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-32953](https://cve.now/CVE-2026-32953.md): Tillitis: TKey Client has an Error in Protocol Implementation (CVSS 4.7, tillitis tkeyclient · github.com/tillitis/tkeyclient)
- [CVE-2026-32950](https://cve.now/CVE-2026-32950.md): SQLBot: RCE via SQL Injection in Excel Upload Endpoint (CVSS 8.6, dataease SQLBot)
- [CVE-2026-32949](https://cve.now/CVE-2026-32949.md): SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL (CVSS 8.7, dataease SQLBot)
- [CVE-2026-32947](https://cve.now/CVE-2026-32947.md): Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier) (CVSS 4.6, step-security harden-runner)
- [CVE-2026-4469](https://cve.now/CVE-2026-4469.md): itsourcecode Online Frozen Foods Ordering System admin\_edit\_menu\_action.php sql injection (CVSS 5.1, itsourcecode Online Frozen Foods Ordering System)
- [CVE-2026-32946](https://cve.now/CVE-2026-32946.md): Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier) (CVSS 4.6, step-security harden-runner)
- [CVE-2026-32945](https://cve.now/CVE-2026-32945.md): PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser (CVSS 8.4, pjsip pjproject)
- [CVE-2026-32942](https://cve.now/CVE-2026-32942.md): PJSIP has ICE session use-after-free race conditions (CVSS 8.0, pjsip pjproject)
- [CVE-2026-32941](https://cve.now/CVE-2026-32941.md): Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports (CVSS 5.7, BishopFox sliver · github.com/bishopfox/sliver)
- [CVE-2026-4136](https://cve.now/CVE-2026-4136.md): Membership Plugin – Restrict Content \<= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp\_redirect (CVSS 4.3, stellarwp Membership Plugin – Restrict Content)
- [CVE-2026-4038](https://cve.now/CVE-2026-4038.md): Aimogen Pro \<= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call (CVSS 9.8, CodeRevolution Aimogen Pro - All-in-One AI Content Writer,…)
- [CVE-2026-32940](https://cve.now/CVE-2026-32940.md): SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) (CVSS 9.3, siyuan-note siyuan · github.com/siyuan-note/siyuan)
- [CVE-2026-4468](https://cve.now/CVE-2026-4468.md): Comfast CF-AC100 mbox-config command injection (CVSS 5.1, Comfast CF-AC100)
- [CVE-2026-32939](https://cve.now/CVE-2026-32939.md): DataEase is Vulnerable to H2 JDBC RCE Bypass (CVSS 7.7, dataease)
- [CVE-2026-32938](https://cve.now/CVE-2026-32938.md): SiYuan has an Arbitrary File Read in its Desktop Publish Service (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-32114](https://cve.now/CVE-2026-32114.md): Discourse's unscoped status lookups leak restricted metadata (CVSS 5.3, discourse)
- [CVE-2026-31869](https://cve.now/CVE-2026-31869.md): Discourse: Composer mentions endpoint leaks hidden group membership through PM \`allowed\_names\` check (CVSS 5.3, discourse)
- [CVE-2026-31805](https://cve.now/CVE-2026-31805.md): Discourse has a poll authorization bypass via post\_id array parameter (CVSS 5.3, discourse)
- [CVE-2026-30891](https://cve.now/CVE-2026-30891.md): Discourse hasUnauthorized Exposure of Private User Action Types (CVSS 5.3, discourse)
- [CVE-2026-30889](https://cve.now/CVE-2026-30889.md): Discourse has Unauthorized Post Data Exposure in discourse-user-notes (CVSS 5.3, discourse)
- [CVE-2026-30888](https://cve.now/CVE-2026-30888.md): Discourse has moderator privilege escalation via arbitrary post\_id in suspend/silence endpoint (CVSS 2.2, discourse)
- [CVE-2026-33063](https://cve.now/CVE-2026-33063.md): free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion (CVSS 8.7, free5gc ausf · github.com/free5gc/ausf)
- [CVE-2026-32935](https://cve.now/CVE-2026-32935.md): phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack (CVSS 8.2, phpseclib · phpseclib/phpseclib)
- [CVE-2026-33062](https://cve.now/CVE-2026-33062.md): free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter (CVSS 8.7, free5gc nrf · github.com/free5gc/nrf)
- [CVE-2026-32937](https://cve.now/CVE-2026-32937.md): free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS (CVSS 7.1, free5gc chf · github.com/free5gc/chf)
- [CVE-2026-32891](https://cve.now/CVE-2026-32891.md): Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS (CVSS 9.1, openVESSL Anchorr)
- [CVE-2026-32933](https://cve.now/CVE-2026-32933.md): AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion (CVSS 7.5, LuckyPennySoftware AutoMapper · AutoMapper)
- [CVE-2026-32890](https://cve.now/CVE-2026-32890.md): Anchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config (CVSS 9.7, openVESSL Anchorr)
- [CVE-2026-4467](https://cve.now/CVE-2026-4467.md): Comfast CF-AC100 mbox-config command injection (CVSS 5.1, Comfast CF-AC100)
- [CVE-2026-21992](https://cve.now/CVE-2026-21992.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manag (CVSS 9.8, Oracle Identity Manager · Oracle Web Services Manager)
- [CVE-2026-32889](https://cve.now/CVE-2026-32889.md): tinytag: Denial of Service via non-terminating SYLT frame parsing loop (CVSS 6.5, tinytag)
- [CVE-2026-32888](https://cve.now/CVE-2026-32888.md): Open Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality (CVSS 8.8, opensourcepos)
- [CVE-2026-32813](https://cve.now/CVE-2026-32813.md): Admidio: Second-Order SQL Injection via List Configuration (lsc\_special\_field, lsc\_sort, lsc\_filter) (CVSS 8.0, admidio · admidio/admidio)
- [CVE-2026-4466](https://cve.now/CVE-2026-4466.md): Comfast CF-AC100 mbox-config command injection (CVSS 5.1, Comfast CF-AC100)
- [CVE-2026-4465](https://cve.now/CVE-2026-4465.md): D-Link DIR-513 formSysCmd os command injection (CVSS 5.3, D-Link DIR-513)
- [CVE-2026-32817](https://cve.now/CVE-2026-32817.md): Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion (CVSS 9.1, admidio · admidio/admidio)
- [CVE-2026-32812](https://cve.now/CVE-2026-32812.md): Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint (CVSS 6.8, admidio · admidio/admidio)
- [CVE-2026-32811](https://cve.now/CVE-2026-32811.md): Heimdall: Path received via Envoy gRPC corrupted when containing query string (CVSS 8.2, dadrus heimdall · github.com/dadrus/heimdall)
- [CVE-2026-32808](https://cve.now/CVE-2026-32808.md): pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification (CVSS 8.1, pyload)
- [CVE-2026-32875](https://cve.now/CVE-2026-32875.md): UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop (CVSS 7.5, ultrajson · ujson)
- [CVE-2026-4464](https://cve.now/CVE-2026-4464.md): Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-4463](https://cve.now/CVE-2026-4463.md): Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-4462](https://cve.now/CVE-2026-4462.md): Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.8, Google Chrome)
- [CVE-2026-4461](https://cve.now/CVE-2026-4461.md): Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2026-4460](https://cve.now/CVE-2026-4460.md): Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.8, Google Chrome)
- [CVE-2026-4459](https://cve.now/CVE-2026-4459.md): Out of bounds read and write in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corr (CVSS 8.8, Google Chrome)
- [CVE-2026-4458](https://cve.now/CVE-2026-4458.md): Use after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who convinced a user to install a malicious extens (CVSS 8.8, Google Chrome)
- [CVE-2026-4457](https://cve.now/CVE-2026-4457.md): Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-4456](https://cve.now/CVE-2026-4456.md): Use after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the rendere (CVSS 8.8, Google Chrome)
- [CVE-2026-4455](https://cve.now/CVE-2026-4455.md): Heap buffer overflow in PDFium in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-4454](https://cve.now/CVE-2026-4454.md): Use after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-4453](https://cve.now/CVE-2026-4453.md): Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2026-4452](https://cve.now/CVE-2026-4452.md): Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corrupti (CVSS 8.8, Google Chrome)
- [CVE-2026-4451](https://cve.now/CVE-2026-4451.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromi (CVSS 8.8, Google Chrome)
- [CVE-2026-4450](https://cve.now/CVE-2026-4450.md): Out of bounds write in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-4449](https://cve.now/CVE-2026-4449.md): Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-4448](https://cve.now/CVE-2026-4448.md): Heap buffer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-4447](https://cve.now/CVE-2026-4447.md): Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2026-4446](https://cve.now/CVE-2026-4446.md): Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-4445](https://cve.now/CVE-2026-4445.md): Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-4444](https://cve.now/CVE-2026-4444.md): Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit stack corruption v (CVSS 8.8, Google Chrome)
- [CVE-2026-4443](https://cve.now/CVE-2026-4443.md): Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandb (CVSS 8.8, Google Chrome)
- [CVE-2026-4442](https://cve.now/CVE-2026-4442.md): Heap buffer overflow in CSS in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2026-4441](https://cve.now/CVE-2026-4441.md): Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-4440](https://cve.now/CVE-2026-4440.md): Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via (CVSS 8.8, Google Chrome)
- [CVE-2026-4439](https://cve.now/CVE-2026-4439.md): Out of bounds memory access in WebGL in Google Chrome on Android prior to 146.0.7680.153 allowed a remote attacker to potentially perform a (CVSS 8.8, Google Chrome)
- [CVE-2026-32874](https://cve.now/CVE-2026-32874.md): UltraJSON has a Memory Leak parsing large integers allows DoS (CVSS 7.5, ultrajson · ujson)
- [CVE-2026-32711](https://cve.now/CVE-2026-32711.md): pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root (CVSS 7.8, pydicom)
- [CVE-2026-32881](https://cve.now/CVE-2026-32881.md): ewe has an Overly Permissive List of Allowed Inputs (CVSS 5.3, vshakitskiy ewe)
- [CVE-2026-32873](https://cve.now/CVE-2026-32873.md): ewe: Loop with Unreachable Exit Condition ('Infinite Loop') (CVSS 7.5, vshakitskiy ewe)
- [CVE-2026-32880](https://cve.now/CVE-2026-32880.md): ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php (CVSS 6.4, ChurchCRM CRM)
- [CVE-2026-32829](https://cve.now/CVE-2026-32829.md): lz4\_flex: Decompression can leak information from uninitialized memory or reused output buffer (CVSS 8.2, PSeitz lz4\_flex · lz4\_flex)
- [CVE-2026-32828](https://cve.now/CVE-2026-32828.md): Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration (CVSS 5.1, akuity kargo · github.com/akuity/kargo)
- [CVE-2026-32771](https://cve.now/CVE-2026-32771.md): Monitoring is vulnerable to Archive Slip due to missing checks in sanitization (CVSS 8.8, ctfer-io monitoring · github.com/ctfer-io/monitoring)
- [CVE-2026-32769](https://cve.now/CVE-2026-32769.md): Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace (CVSS 7.1, ctfer-io fullchain · github.com/ctfer-io/fullchain)
- [CVE-2026-32767](https://cve.now/CVE-2026-32767.md): SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API (CVSS 9.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-32766](https://cve.now/CVE-2026-32766.md): astral-tokio-tar insufficiently validates PAX extensions during extraction (CVSS 1.7, astral-sh tokio-tar · astral-tokio-tar)
- [CVE-2026-32985](https://cve.now/CVE-2026-32985.md): Xerte Online Toolkits \<= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution (CVSS 9.3, Xerte Online Toolkits)
- [CVE-2024-44722](https://cve.now/CVE-2024-44722.md): SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd. (CVSS 9.8)
- [CVE-2025-46597](https://cve.now/CVE-2025-46597.md): Bitcoin Core 0.13.0 through 29.x has an integer overflow. (CVSS 7.5)
- [CVE-2025-46598](https://cve.now/CVE-2025-46598.md): Bitcoin Core through 29.0 allows a denial of service via a crafted transaction. (CVSS 5.3)
- [CVE-2025-55988](https://cve.now/CVE-2025-55988.md): An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via (CVSS 7.2, dreamfactory/df-core)
- [CVE-2025-63260](https://cve.now/CVE-2025-63260.md): SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message. (CVSS 5.4)
- [CVE-2025-63261](https://cve.now/CVE-2025-63261.md): AWStats 8.0 is vulnerable to Command Injection via the open function (CVSS 7.8)
- [CVE-2025-67260](https://cve.now/CVE-2025-67260.md): The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may a (CVSS 8.8)
- [CVE-2026-29828](https://cve.now/CVE-2026-29828.md): DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/\<id\> page via the input field projectDesc. (CVSS 6.1)
- [CVE-2026-30578](https://cve.now/CVE-2026-30578.md): File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.5)
- [CVE-2026-30579](https://cve.now/CVE-2026-30579.md): File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.5)
- [CVE-2026-30580](https://cve.now/CVE-2026-30580.md): File Thingie 2.5.7 is vulnerable to Directory Traversal. (CVSS 4.3)
- [CVE-2026-33368](https://cve.now/CVE-2026-33368.md): Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST int (CVSS 6.1)
- [CVE-2026-33369](https://cve.now/CVE-2026-33369.md): Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operatio (CVSS 4.3)
- [CVE-2026-33370](https://cve.now/CVE-2026-33370.md): An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. (CVSS 6.1)
- [CVE-2026-33371](https://cve.now/CVE-2026-33371.md): An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. (CVSS 4.3)
- [CVE-2026-33372](https://cve.now/CVE-2026-33372.md): An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.