# CVEs published 2026-03-22

80 CVEs were published on March 22, 2026: 1 critical, 27 high. Days are UTC.

- [CVE-2026-4564](https://cve.now/CVE-2026-4564.md): yangzongzhuan RuoYi Quartz Job job code injection (CVSS 5.1, yangzongzhuan RuoYi)
- [CVE-2026-4563](https://cve.now/CVE-2026-4563.md): MacCMS Member Order Detail User.php order\_info authorization (CVSS 5.3, MacCMS)
- [CVE-2026-2580](https://cve.now/CVE-2026-2580.md): WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters \<= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter (CVSS 7.5, flippercode WP Maps – Store Locator,Google Maps,OpenStreetM…)
- [CVE-2026-4562](https://cve.now/CVE-2026-4562.md): MacCMS Timming API Endpoint Timming.php weak authentication (CVSS 6.9, MacCMS)
- [CVE-2026-4558](https://cve.now/CVE-2026-4558.md): Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection (CVSS 8.7, Linksys MR9600)
- [CVE-2026-4557](https://cve.now/CVE-2026-4557.md): code-projects Exam Form Submission update\_s1.php cross site scripting (CVSS 5.3, code-projects Exam Form Submission)
- [CVE-2026-33296](https://cve.now/CVE-2026-33296.md): AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php (CVSS 2.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33295](https://cve.now/CVE-2026-33295.md): AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php (CVSS 8.2, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33294](https://cve.now/CVE-2026-33294.md): AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources (CVSS 5.0, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4555](https://cve.now/CVE-2026-4555.md): D-Link DIR-513 boa formEasySetTimezone memory corruption (CVSS 8.7, D-Link DIR-513)
- [CVE-2026-4554](https://cve.now/CVE-2026-4554.md): Tenda F453 WriteFacMac FormWriteFacMac privilege escalation (CVSS 5.3, Tenda F453)
- [CVE-2026-33293](https://cve.now/CVE-2026-33293.md): AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33319](https://cve.now/CVE-2026-33319.md): AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command (CVSS 5.9, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33292](https://cve.now/CVE-2026-33292.md): AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4553](https://cve.now/CVE-2026-4553.md): Tenda F453 Parameters Natlimit fromNatlimit stack-based overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-4552](https://cve.now/CVE-2026-4552.md): Tenda F453 Parameters VirtualSer fromVirtualSer memory corruption (CVSS 8.7, Tenda F453)
- [CVE-2026-4551](https://cve.now/CVE-2026-4551.md): Tenda F453 Parameters SafeClientFilter fromSafeClientFilter memory corruption (CVSS 8.7, Tenda F453)
- [CVE-2026-4550](https://cve.now/CVE-2026-4550.md): code-projects Simple Gym Management System func.php sql injection (CVSS 5.1, code-projects Simple Gym Management System)
- [CVE-2026-4549](https://cve.now/CVE-2026-4549.md): mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization (CVSS 2.3, mickasmt next-saas-stripe-starter)
- [CVE-2019-25619](https://cve.now/CVE-2019-25619.md): FTP Shell Server 6.83 Buffer Overflow via Account Name (CVSS 8.6, Ftpshell FTP Shell Server)
- [CVE-2019-25618](https://cve.now/CVE-2019-25618.md): AdminExpress 1.2.5 Denial of Service via System Compare (CVSS 6.9, Admin-Express AdminExpress)
- [CVE-2019-25617](https://cve.now/CVE-2019-25617.md): Ease Audio Converter 5.30 Denial of Service via Audio Cutter (CVSS 6.9, Audiotool Ease Audio Converter)
- [CVE-2019-25616](https://cve.now/CVE-2019-25616.md): AnMing MP3 CD Burner 2.0 Local Denial of Service (CVSS 6.9, Ddz1977 AnMing MP3 CD Burner)
- [CVE-2019-25615](https://cve.now/CVE-2019-25615.md): Lavavo CD Ripper 4.20 Local SEH Buffer Overflow (CVSS 8.6, Lavavosoftware Lavavo CD Ripper)
- [CVE-2019-25614](https://cve.now/CVE-2019-25614.md): Free Float FTP 1.0 STOR Command Remote Buffer Overflow (CVSS 9.3, Freefloat Free Float FTP)
- [CVE-2019-25613](https://cve.now/CVE-2019-25613.md): Easy Chat Server 3.1 Denial of Service via message Parameter (CVSS 8.7, Echatserver Easy Chat)
- [CVE-2019-25612](https://cve.now/CVE-2019-25612.md): Admin Express 1.2.5.485 Local SEH Buffer Overflow via Folder Path (CVSS 8.5, Admin-Express)
- [CVE-2019-25611](https://cve.now/CVE-2019-25611.md): MiniFtp parseconf\_load\_setting Buffer Overflow via Configuration (CVSS 8.6, skyqinsc MiniFtp)
- [CVE-2019-25610](https://cve.now/CVE-2019-25610.md): NetNumber Titan Master 7.9.1 Path Traversal via drp (CVSS 7.1, NetNumber Titan ENUM/DNS/NP)
- [CVE-2019-25609](https://cve.now/CVE-2019-25609.md): JetAudio jetCast Server 2.0 Local SEH Buffer Overflow (CVSS 8.6, Jetaudio Server)
- [CVE-2019-25608](https://cve.now/CVE-2019-25608.md): Iperius Backup 6.1.0 Privilege Escalation via Backup Job (CVSS 8.6, Iperius Backup)
- [CVE-2019-25607](https://cve.now/CVE-2019-25607.md): Axessh 4.2 Local Stack-based Buffer Overflow via Log File Name (CVSS 8.6, Labf Axessh)
- [CVE-2019-25606](https://cve.now/CVE-2019-25606.md): Fast AVI MPEG Joiner 1.2.0812 Buffer Overflow Denial of Service (CVSS 6.8, Alloksoft Fast AVI MPEG Joiner)
- [CVE-2019-25605](https://cve.now/CVE-2019-25605.md): EquityPandit 1.0 Insecure Logging Information Disclosure (CVSS 8.7, Play EquityPandit)
- [CVE-2019-25604](https://cve.now/CVE-2019-25604.md): DVDXPlayer Pro 5.5 Local Buffer Overflow with SEH (CVSS 8.6, Dvd-X-Player DVDXPlayer)
- [CVE-2019-25603](https://cve.now/CVE-2019-25603.md): TuneClone 2.20 Structured Exception Handler Buffer Overflow (CVSS 8.6, TuneClone)
- [CVE-2019-25602](https://cve.now/CVE-2019-25602.md): GSearch 1.0.1.0 Denial of Service via Search Input (CVSS 6.8, GSearch)
- [CVE-2019-25601](https://cve.now/CVE-2019-25601.md): UltraVNC Launcher 1.2.2.4 Denial of Service Buffer Overflow (CVSS 6.9, Uvnc UltraVNC Launcher)
- [CVE-2019-25600](https://cve.now/CVE-2019-25600.md): UltraVNC Viewer 1.2.2.4 Denial of Service via Buffer Overflow (CVSS 7.1, Uvnc UltraVNC Viewer)
- [CVE-2019-25599](https://cve.now/CVE-2019-25599.md): Backup Key Recovery 2.2.4 Denial of Service via Name Field (CVSS 6.9, Nsauditor Backup Key Recovery)
- [CVE-2019-25598](https://cve.now/CVE-2019-25598.md): HeidiSQL Portable 10.1.0.5464 Denial of Service via Buffer Overflow (CVSS 6.9, HeidiSQL Portable)
- [CVE-2019-25597](https://cve.now/CVE-2019-25597.md): NSauditor 3.1.2.0 Denial of Service via Community Field (CVSS 6.9, NSauditor)
- [CVE-2019-25596](https://cve.now/CVE-2019-25596.md): SpotAuditor 5.2.6 Name Field Denial of Service (CVSS 6.9, Nsauditor SpotAuditor)
- [CVE-2019-25595](https://cve.now/CVE-2019-25595.md): jetAudio 8.1.7.20702 Basic Denial of Service via URL Handler (CVSS 6.9, jetAudio)
- [CVE-2019-25594](https://cve.now/CVE-2019-25594.md): ASPRunner.NET 10.1 Denial of Service via Table Name Field (CVSS 6.9, Xlinesoft ASPRunner.NET)
- [CVE-2019-25593](https://cve.now/CVE-2019-25593.md): jetCast Server 2.0 Denial of Service via Log Directory (CVSS 6.8, Jetaudio jetCast Server)
- [CVE-2019-25592](https://cve.now/CVE-2019-25592.md): PHPRunner 10.1 Denial of Service via Dashboard Name Field (CVSS 6.9, Xlinesoft PHPRunner)
- [CVE-2019-25591](https://cve.now/CVE-2019-25591.md): DNSS Domain Name Search Software 2.1.8 Denial of Service (CVSS 6.9, nsauditor DNSS Domain Name Search Software)
- [CVE-2019-25590](https://cve.now/CVE-2019-25590.md): Axessh 4.2 Denial of Service via Log File Name (CVSS 6.9, Labf Axessh)
- [CVE-2026-4548](https://cve.now/CVE-2026-4548.md): mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization (CVSS 5.3, mickasmt next-saas-stripe-starter)
- [CVE-2026-4547](https://cve.now/CVE-2026-4547.md): mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error (CVSS 5.3, mickasmt next-saas-stripe-starter)
- [CVE-2026-4546](https://cve.now/CVE-2026-4546.md): Flos Freeware Notepad2 TextShaping.dll uncontrolled search path (CVSS 7.3, Flos Freeware Notepad2)
- [CVE-2026-4115](https://cve.now/CVE-2026-4115.md): PuTTY Ed25519 Signature ecc-ssh.c eddsa\_verify signature verification (CVSS 6.3, PuTTY)
- [CVE-2026-4545](https://cve.now/CVE-2026-4545.md): Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path (CVSS 7.3, Flos Freeware Notepad2)
- [CVE-2026-4544](https://cve.now/CVE-2026-4544.md): Wavlink WL-WN578W2 POST Request login.cgi cross site scripting (CVSS 4.8, Wavlink WL-WN578W2)
- [CVE-2026-4543](https://cve.now/CVE-2026-4543.md): Wavlink WL-WN578W2 POST Request firewall.cgi command injection (CVSS 5.3, Wavlink WL-WN578W2)
- [CVE-2026-4542](https://cve.now/CVE-2026-4542.md): SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal (CVSS 5.3, SSCMS)
- [CVE-2026-4541](https://cve.now/CVE-2026-4541.md): janmojzis tinyssh Ed25519 Signature crypto\_sign\_ed25519\_tinyssh.c signature verification (CVSS 2.0, janmojzis tinyssh)
- [CVE-2026-4540](https://cve.now/CVE-2026-4540.md): projectworlds Online Notes Sharing System Parameters login.php sql injection (CVSS 6.9, projectworlds Online Notes Sharing System)
- [CVE-2026-4539](https://cve.now/CVE-2026-4539.md): pygments archetype.py AdlLexer redos (CVSS 4.8, pygments)
- [CVE-2026-4538](https://cve.now/CVE-2026-4538.md): PyTorch pt2 Loading deserialization (CVSS 4.8, PyTorch · torch)
- [CVE-2026-4537](https://cve.now/CVE-2026-4537.md): Cudy TR1200 ipsec.lua action\_ipsec\_conn command injection (CVSS 5.1, Cudy TR1200)
- [CVE-2026-4536](https://cve.now/CVE-2026-4536.md): Acrel Environmental Monitoring Cloud Platform unrestricted upload (CVSS 6.9, Acrel Environmental Monitoring Cloud Platform)
- [CVE-2026-4535](https://cve.now/CVE-2026-4535.md): Tenda FH451 WrlclientSet stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2026-4534](https://cve.now/CVE-2026-4534.md): Tenda FH451 WrlExtraSet formWrlExtraSet stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2026-3427](https://cve.now/CVE-2026-3427.md): Yoast SEO \<= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute (CVSS 6.4, Yoast SEO – Advanced SEO with real-time guidance and built-…)
- [CVE-2026-4314](https://cve.now/CVE-2026-4314.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module (CVSS 8.8, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2026-33550](https://cve.now/CVE-2026-33550.md): SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recomm (CVSS 2.0, Alinto SOGo)
- [CVE-2025-71276](https://cve.now/CVE-2025-71276.md): SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories. (CVSS 6.4, Alinto SOGo)
- [CVE-2026-33549](https://cve.now/CVE-2026-33549.md): SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an autho (CVSS 6.7, SPIP)
- [CVE-2026-4533](https://cve.now/CVE-2026-4533.md): code-projects Simple Food Ordering System all-tickets.php sql injection (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2026-4532](https://cve.now/CVE-2026-4532.md): code-projects Simple Food Ordering System Database Backup food.sql file access (CVSS 6.9, code-projects Simple Food Ordering System)
- [CVE-2026-4531](https://cve.now/CVE-2026-4531.md): Free5GC AMF handler.go HandleRegistrationComplete denial of service (CVSS 6.9, Free5GC · github.com/free5gc/amf)
- [CVE-2019-25589](https://cve.now/CVE-2019-25589.md): ZOC Terminal 7.23.4 Buffer Overflow Denial of Service (CVSS 6.9, Emtec ZOC Terminal)
- [CVE-2019-25588](https://cve.now/CVE-2019-25588.md): BulletProof FTP Server 2019.0.0.50 Denial of Service via DNS Address (CVSS 6.9, Bpftpserver BulletProof FTP Server)
- [CVE-2019-25587](https://cve.now/CVE-2019-25587.md): BulletProof FTP Server 2019.0.0.50 Storage-Path Denial of Service (CVSS 6.9, Bpftpserver BulletProof FTP Server)
- [CVE-2019-25586](https://cve.now/CVE-2019-25586.md): Deluge 1.3.15 Denial of Service via URL Field (CVSS 6.9, Dev Deluge · deluge)
- [CVE-2019-25585](https://cve.now/CVE-2019-25585.md): Deluge 1.3.15 Denial of Service via Webseeds Field (CVSS 6.9, Dev Deluge · deluge)
- [CVE-2019-25584](https://cve.now/CVE-2019-25584.md): RarmaRadio 2.72.3 Server Field Buffer Overflow Denial of Service (CVSS 6.9, Raimersoft RarmaRadio)
- [CVE-2019-25583](https://cve.now/CVE-2019-25583.md): RarmaRadio 2.72.3 Username Field Denial of Service (CVSS 6.9, Raimersoft RarmaRadio)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.