CVEs published March 22, 2026
80 CVEs were published on March 22, 2026: 1 critical, 27 high.
- Published
- 80
- Critical
- 1
- High
- 27
- Medium
- 48
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- WWBN AVideo · wwbn/avideo
- 6
- Tenda F453
- 4
- mickasmt next-saas-stripe-starter
- 3
- Alinto SOGo
- 2
- Bpftpserver BulletProof FTP Server
- 2
- code-projects Simple Food Ordering System
- 2
- Dev Deluge · deluge
- 2
- Flos Freeware Notepad2
- 2
- Labf Axessh
- 2
- MacCMS
- 2
Critical 1
High 27
- CVE-2026-2580WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameterflippercode WP Maps – Store Locator,Google Maps,OpenStreetM…
- CVE-2026-4558Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injectionLinksys MR9600
- CVE-2026-33295AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.phpWWBN AVideo · wwbn/avideo
- CVE-2026-4555D-Link DIR-513 boa formEasySetTimezone memory corruptionD-Link DIR-513
- CVE-2026-33293AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump ParameterWWBN AVideo · wwbn/avideo
- CVE-2026-33292AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid VideosWWBN AVideo · wwbn/avideo
- CVE-2026-4553Tenda F453 Parameters Natlimit fromNatlimit stack-based overflowTenda F453
- CVE-2026-4552Tenda F453 Parameters VirtualSer fromVirtualSer memory corruptionTenda F453
- CVE-2026-4551Tenda F453 Parameters SafeClientFilter fromSafeClientFilter memory corruptionTenda F453
- CVE-2019-25619FTP Shell Server 6.83 Buffer Overflow via Account NameFtpshell FTP Shell Server
- CVE-2019-25615Lavavo CD Ripper 4.20 Local SEH Buffer OverflowLavavosoftware Lavavo CD Ripper
- CVE-2019-25613Easy Chat Server 3.1 Denial of Service via message ParameterEchatserver Easy Chat
- CVE-2019-25612Admin Express 1.2.5.485 Local SEH Buffer Overflow via Folder PathAdmin-Express
- CVE-2019-25611MiniFtp parseconf_load_setting Buffer Overflow via Configurationskyqinsc MiniFtp
- CVE-2019-25610NetNumber Titan Master 7.9.1 Path Traversal via drpNetNumber Titan ENUM/DNS/NP
- CVE-2019-25609JetAudio jetCast Server 2.0 Local SEH Buffer OverflowJetaudio Server
- CVE-2019-25608Iperius Backup 6.1.0 Privilege Escalation via Backup JobIperius Backup
- CVE-2019-25607Axessh 4.2 Local Stack-based Buffer Overflow via Log File NameLabf Axessh
- CVE-2019-25605EquityPandit 1.0 Insecure Logging Information DisclosurePlay EquityPandit
- CVE-2019-25604DVDXPlayer Pro 5.5 Local Buffer Overflow with SEHDvd-X-Player DVDXPlayer
- CVE-2019-25603TuneClone 2.20 Structured Exception Handler Buffer OverflowTuneClone
- CVE-2019-25600UltraVNC Viewer 1.2.2.4 Denial of Service via Buffer OverflowUvnc UltraVNC Viewer
- CVE-2026-4546Flos Freeware Notepad2 TextShaping.dll uncontrolled search pathFlos Freeware Notepad2
- CVE-2026-4545Flos Freeware Notepad2 PROPSYS.dll uncontrolled search pathFlos Freeware Notepad2
- CVE-2026-4535Tenda FH451 WrlclientSet stack-based overflowTenda FH451
- CVE-2026-4534Tenda FH451 WrlExtraSet formWrlExtraSet stack-based overflowTenda FH451
- CVE-2026-4314The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Modulewpextended The Ultimate WordPress Toolkit – WP Extended
Medium, low and unrated 52
- CVE-2026-4564yangzongzhuan RuoYi Quartz Job job code injectionyangzongzhuan RuoYi
- CVE-2026-4563MacCMS Member Order Detail User.php order_info authorizationMacCMS
- CVE-2026-4562MacCMS Timming API Endpoint Timming.php weak authenticationMacCMS
- CVE-2026-4557code-projects Exam Form Submission update_s1.php cross site scriptingcode-projects Exam Form Submission
- CVE-2026-33296AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.phpWWBN AVideo · wwbn/avideo
- CVE-2026-33294AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network ResourcesWWBN AVideo · wwbn/avideo
- CVE-2026-4554Tenda F453 WriteFacMac FormWriteFacMac privilege escalationTenda F453
- CVE-2026-33319AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell CommandWWBN AVideo · wwbn/avideo
- CVE-2026-4550code-projects Simple Gym Management System func.php sql injectioncode-projects Simple Gym Management System
- CVE-2026-4549mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorizationmickasmt next-saas-stripe-starter
- CVE-2019-25618AdminExpress 1.2.5 Denial of Service via System CompareAdmin-Express AdminExpress
- CVE-2019-25617Ease Audio Converter 5.30 Denial of Service via Audio CutterAudiotool Ease Audio Converter
- CVE-2019-25616AnMing MP3 CD Burner 2.0 Local Denial of ServiceDdz1977 AnMing MP3 CD Burner
- CVE-2019-25606Fast AVI MPEG Joiner 1.2.0812 Buffer Overflow Denial of ServiceAlloksoft Fast AVI MPEG Joiner
- CVE-2019-25602GSearch 1.0.1.0 Denial of Service via Search InputGSearch
- CVE-2019-25601UltraVNC Launcher 1.2.2.4 Denial of Service Buffer OverflowUvnc UltraVNC Launcher
- CVE-2019-25599Backup Key Recovery 2.2.4 Denial of Service via Name FieldNsauditor Backup Key Recovery
- CVE-2019-25598HeidiSQL Portable 10.1.0.5464 Denial of Service via Buffer OverflowHeidiSQL Portable
- CVE-2019-25597NSauditor 3.1.2.0 Denial of Service via Community FieldNSauditor
- CVE-2019-25596SpotAuditor 5.2.6 Name Field Denial of ServiceNsauditor SpotAuditor
- CVE-2019-25595jetAudio 8.1.7.20702 Basic Denial of Service via URL HandlerjetAudio
- CVE-2019-25594ASPRunner.NET 10.1 Denial of Service via Table Name FieldXlinesoft ASPRunner.NET
- CVE-2019-25593jetCast Server 2.0 Denial of Service via Log DirectoryJetaudio jetCast Server
- CVE-2019-25592PHPRunner 10.1 Denial of Service via Dashboard Name FieldXlinesoft PHPRunner
- CVE-2019-25591DNSS Domain Name Search Software 2.1.8 Denial of Servicensauditor DNSS Domain Name Search Software
- CVE-2019-25590Axessh 4.2 Denial of Service via Log File NameLabf Axessh
- CVE-2026-4548mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorizationmickasmt next-saas-stripe-starter
- CVE-2026-4547mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic errormickasmt next-saas-stripe-starter
- CVE-2026-4115PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verificationPuTTY
- CVE-2026-4544Wavlink WL-WN578W2 POST Request login.cgi cross site scriptingWavlink WL-WN578W2
- CVE-2026-4543Wavlink WL-WN578W2 POST Request firewall.cgi command injectionWavlink WL-WN578W2
- CVE-2026-4542SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversalSSCMS
- CVE-2026-4541janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verificationjanmojzis tinyssh
- CVE-2026-4540projectworlds Online Notes Sharing System Parameters login.php sql injectionprojectworlds Online Notes Sharing System
- CVE-2026-4539pygments archetype.py AdlLexer redospygments
- CVE-2026-4538PyTorch pt2 Loading deserializationPyTorch · torch
- CVE-2026-4537Cudy TR1200 ipsec.lua action_ipsec_conn command injectionCudy TR1200
- CVE-2026-4536Acrel Environmental Monitoring Cloud Platform unrestricted uploadAcrel Environmental Monitoring Cloud Platform
- CVE-2026-3427Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block AttributeYoast SEO – Advanced SEO with real-time guidance and built-…
- CVE-2026-33550SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommAlinto SOGo
- CVE-2025-71276SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.Alinto SOGo
- CVE-2026-33549SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an authoSPIP
- CVE-2026-4533code-projects Simple Food Ordering System all-tickets.php sql injectioncode-projects Simple Food Ordering System
- CVE-2026-4532code-projects Simple Food Ordering System Database Backup food.sql file accesscode-projects Simple Food Ordering System
- CVE-2026-4531Free5GC AMF handler.go HandleRegistrationComplete denial of serviceFree5GC · github.com/free5gc/amf
- CVE-2019-25589ZOC Terminal 7.23.4 Buffer Overflow Denial of ServiceEmtec ZOC Terminal
- CVE-2019-25588BulletProof FTP Server 2019.0.0.50 Denial of Service via DNS AddressBpftpserver BulletProof FTP Server
- CVE-2019-25587BulletProof FTP Server 2019.0.0.50 Storage-Path Denial of ServiceBpftpserver BulletProof FTP Server
- CVE-2019-25586Deluge 1.3.15 Denial of Service via URL FieldDev Deluge · deluge
- CVE-2019-25585Deluge 1.3.15 Denial of Service via Webseeds FieldDev Deluge · deluge
- CVE-2019-25584RarmaRadio 2.72.3 Server Field Buffer Overflow Denial of ServiceRaimersoft RarmaRadio
- CVE-2019-25583RarmaRadio 2.72.3 Username Field Denial of ServiceRaimersoft RarmaRadio