CVEs published March 23, 2026
201 CVEs were published on March 23, 2026: 26 critical, 69 high. 2 are now in CISA KEV.
- Published
- 201
- Critical
- 26
- High
- 69
- Medium
- 98
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 75
Most affected products
- WWBN AVideo · wwbn/avideo
- 34
- blinkospace blinko
- 10
- opensource-workshop connect-cms · opensource-workshop/conne…
- 6
- code-projects Exam Form Submission
- 5
- jsrsasign · org.webjars.npm:jsrsasign
- 5
- kalcaddle kodbox
- 5
- Nexxt Solutions Nebula 300+
- 5
- SourceCodester Sales and Inventory System
- 5
- Census CSWeb
- 4
- rails activestorage · activestorage
- 4
Critical 26
- CVE-2026-33211Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver podtektoncd pipeline · github.com/tektoncd/pipeline
- CVE-2026-33286Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Namesgraphiti-api graphiti · graphiti
- CVE-2026-4001Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formulaacowebs Woocommerce Custom Product Addons Pro
- CVE-2026-4681Critical Remote Code Execution vulnerability reported in WindchillPTC Windchill PDMLink · PTC FlexPLM
- CVE-2026-33634Trivy ecosystem supply chain briefly compromisedaquasecurity setup-trivy · aquasecurity trivy-action +6
- CVE-2025-60949Census CSWeb leaked configuration filesCensus CSWeb
- CVE-2026-3055Insufficient input validation leading to memory overreadNetScaler ADC · NetScaler Gateway
- CVE-2026-2298Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement alSalesforce Marketing Cloud Engagement
- CVE-2026-30849MantisBT SOAP API has an authentication bypass vulnerability on MySQLmantisbt · mantisbt/mantisbt
- CVE-2026-33716AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-0898An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.Pegasystems Pega Robot Studio
- CVE-2026-33502AVideo has Unauthenticated SSRF via plugin/Live/test.phpWWBN AVideo · wwbn/avideo
- CVE-2026-4404Use of hard coded credentials in GoHarbor HarborHarbor · github.com/goharbor/harbor
- CVE-2026-33478AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionWWBN AVideo · wwbn/avideo
- CVE-2026-33352AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)WWBN AVideo · wwbn/avideo
- CVE-2026-33351AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification BypassWWBN AVideo · wwbn/avideo
- CVE-2025-41008SQL Injection in SinturnoSinturno
- CVE-2025-41007SQL Injection in CuantisCuantis
- CVE-2026-32968Unauthenticated RCE in com_mb24sysapiMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-4585Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injectionTiandy Easy7 Integrated Management Platform
- CVE-2026-3587Hidden CLI Function Allows Root AccessWAGO Lean Managed Switch 852-1812 · WAGO Lean Managed S… +14
- CVE-2026-4601Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash projsrsasign · org.webjars.npm:jsrsasign
- CVE-2026-4599Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandojsrsasign · org.webjars.npm:jsrsasign
- CVE-2026-4600Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-paramejsrsasign · org.webjars.npm:jsrsasign
- CVE-2026-4567Tenda A15 UploadCfg stack-based overflowTenda A15
- CVE-2026-4606GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level PrivilegeGeoVision GV-Edge Recording Manager
High 69
- CVE-2026-33282Ella Core panics on malformed NGAP Location Reportellanetworks core · github.com/ellanetworks/core
- CVE-2026-33252MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrionmodelcontextprotocol go-sdk · github.com/modelcontextprotoc…
- CVE-2026-33241Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsingsalvo-rs salvo · salvo
- CVE-2026-33242Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypasssalvo-rs salvo · salvo
- CVE-2026-33250Crash when receiving specially-crafted packetslongturn freeciv21
- CVE-2026-33195Rails Active Storage has possible Path Traversal in DiskServicerails activestorage · activestorage
- CVE-2026-4021Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusioncontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2026-3533JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Importartbees Jupiter X Core
- CVE-2026-33046Indico discloses local files resulting in Remote Code Execution through LaTeX injectionindico
- CVE-2026-4306WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameterwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2026-32300Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Informationopensource-workshop connect-cms · opensource-workshop/conne…
- CVE-2026-32299Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Featureopensource-workshop connect-cms · opensource-workshop/conne…
- CVE-2026-32913OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin RedirectsOpenClaw
- CVE-2026-32278Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Pluginopensource-workshop connect-cms · opensource-workshop/conne…
- CVE-2026-32277Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List Viewopensource-workshop connect-cms · opensource-workshop/conne…
- CVE-2026-4611TOTOLINK X6000R shttpd setLanCfg privilege escalationTOTOLINK X6000R
- CVE-2026-32276Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Pluginopensource-workshop connect-cms · opensource-workshop/conne…
- CVE-2025-60947Census CSWeb arbitrary file uploadCensus CSWeb
- CVE-2025-60946Census CSWeb path traversalCensus CSWeb
- CVE-2026-23882Blinko: Admin RCE - MCP Server Command Injectionblinkospace blinko
- CVE-2026-23482Blinko: Unauthorized Arbitrary File Read - /api/file/tempblinkospace blinko
- CVE-2026-4368Race Condition leading to User Session MixupNetScaler ADC · NetScaler Gateway
- CVE-2026-33548MantisBT has Stored HTML Injection / XSS when displaying Tags in Timelinemantisbt · mantisbt/mantisbt
- CVE-2026-33517MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmationmantisbt · mantisbt/mantisbt
- CVE-2026-26209cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loadsagronholm cbor2 · cbor2
- CVE-2026-33723AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.phpWWBN AVideo · wwbn/avideo
- CVE-2026-33719AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-33717AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation AbortWWBN AVideo · wwbn/avideo
- CVE-2026-33681AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin NameWWBN AVideo · wwbn/avideo
- CVE-2026-33651AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()WWBN AVideo · wwbn/avideo
- CVE-2025-15606Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961NTP-Link Systems TD-W8961N
- CVE-2026-25075strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer UnderflowstrongSwan
- CVE-2026-33650AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video DeletionWWBN AVideo · wwbn/avideo
- CVE-2026-33649AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission ModificationWWBN AVideo · wwbn/avideo
- CVE-2026-33648AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File PathWWBN AVideo · wwbn/avideo
- CVE-2026-33647AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File UploadWWBN AVideo · wwbn/avideo
- CVE-2026-33513AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)WWBN AVideo · wwbn/avideo
- CVE-2026-33512AVideo has an unauthenticated decrypt oracle leaking any ciphertextWWBN AVideo · wwbn/avideo
- CVE-2025-15605Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2
- CVE-2025-15519Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2
- CVE-2025-15518Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2
- CVE-2025-15517Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2
- CVE-2026-33507AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin UploadWWBN AVideo · wwbn/avideo
- CVE-2026-33493AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI ParameterWWBN AVideo · wwbn/avideo
- CVE-2026-33492AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session RegenerationWWBN AVideo · wwbn/avideo
- CVE-2026-33488AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl PluginWWBN AVideo · wwbn/avideo
- CVE-2026-33485AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name ParameterWWBN AVideo · wwbn/avideo
- CVE-2026-33483AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-33482AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()WWBN AVideo · wwbn/avideo
- CVE-2026-33480AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks ProxyWWBN AVideo · wwbn/avideo
- CVE-2026-33479AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against AdminWWBN AVideo · wwbn/avideo
- CVE-2026-33354AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`WWBN AVideo · wwbn/avideo
- CVE-2026-1958Hard-coded passwords in KlinikaXPBRI KlinikaXP Insertino · BRI KlinikaXP
- CVE-2026-31851Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force AttacksNexxt Solutions Nebula 300+
- CVE-2026-31849Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+Nexxt Solutions Nebula 300+
- CVE-2026-31848Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+Nexxt Solutions Nebula 300+
- CVE-2026-31847Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+Nexxt Solutions Nebula 300+
- CVE-2026-31846Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+Nexxt Solutions Nebula 300+ / Tenda F3 V2.0 Firmware
- CVE-2026-32969Pre-Auth Blind SQLi in userinfo EndpointMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-23555Xenstored DoS by unprivileged domainXen
- CVE-2026-23554Use after free of paging structures in EPTXen
- CVE-2025-10679ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code ExecutionReviewX – Multi-Criteria Reviews for WooCommerce with Googl…
- CVE-2026-4598Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInjsrsasign · org.webjars.npm:jsrsasign
- CVE-2026-4602Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponejsrsasign · org.webjars.npm:jsrsasign
- CVE-2026-4566Belkin F9K1122 formWISP5G stack-based overflowBelkin F9K1122
- CVE-2026-4565Tenda AC21 SetNetControlList formSetQosBand buffer overflowTenda AC21
- CVE-2026-24516A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2.github.com/digitalocean/droplet-agent
- CVE-2026-26828A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to caus
- CVE-2026-26829A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Den
Medium, low and unrated 106
- CVE-2026-33290WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permissionwp-graphql
- CVE-2026-33283Ella Core panics on malformed ULNASTransport Message without a Request Typeellanetworks core · github.com/ellanetworks/core
- CVE-2026-33281Ella Core panics on invalid PDU Session IDs in NGAP messagesellanetworks core · github.com/ellanetworks/core
- CVE-2026-4615SourceCodester Online Catering Reservation search.php sql injectionSourceCodester Online Catering Reservation
- CVE-2026-4614itsourcecode sanitize or validate this input Parameter subjects.php sql injectionitsourcecode sanitize or validate this input
- CVE-2026-33202Rails Active Storage has possible glob injection in its DiskServicerails activestorage · activestorage
- CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpersrails activesupport · activesupport
- CVE-2026-4056User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulationwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsrails activestorage · activestorage
- CVE-2026-33173Rails Active Storage has possible content type bypass via metadata in direct uploadsrails activestorage · activestorage
- CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%rails activesupport · activesupport
- CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimitedrails activesupport · activesupport
- CVE-2026-4613SourceCodester E-Commerce Site products.php sql injectionSourceCodester E-Commerce Site
- CVE-2026-33168Rails has a possible XSS vulnerability in its Action View tag helpersrails actionview · actionview
- CVE-2026-33167Rails has a possible XSS vulnerability in its Action Pack debug exceptionsrails actionpack · actionpack
- CVE-2026-3225LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletionthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-2412Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameterexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2026-4066Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Searchinc2734 Smart Custom Fields
- CVE-2026-4612itsourcecode Free Hotel Reservation System Parameter index.php sql injectionitsourcecode Free Hotel Reservation System
- CVE-2026-32279Connect CMS has SSRF in the External Page Migration Feature of its Page Management Pluginopensource-workshop connect-cms · opensource-workshop/conne…
- CVE-2026-27646OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn CommandOpenClaw
- CVE-2026-27183OpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth MismatchOpenClaw
- CVE-2026-1940Gstreamer: incomplete fix of cve-2026-1940Red Hat Enterprise Linux
- CVE-2026-29111systemd: Local unprivileged user can trigger an assertsystemd
- CVE-2025-60948Census CSWeb stored XSSCensus CSWeb
- CVE-2026-23485Blinko: Unauthorized Path Traversal File Enumeration - music-metadatablinkospace blinko
- CVE-2026-23488Blinko: multiple interfaces in the comment feature allow unauthorized accessblinkospace blinko
- CVE-2026-23487Blinko: IDOR - user.detail Endpoint Leaks Superadmin Tokenblinkospace blinko
- CVE-2026-23486Blinko: Unauthorized User Information Leakblinkospace blinko
- CVE-2026-23480Blinko: Low Privilege User Privilege Escalation - upsertUser Endpointblinkospace blinko
- CVE-2026-23481Blinko: Authenticated Arbitrary File Write - saveAdditionalDevFileblinkospace blinko
- CVE-2026-23484Blinko: Authenticated Arbitrary File Write - saveDevPluginblinkospace blinko
- CVE-2026-23483Blinko: Unauthorized Arbitrary File Read - /pluginsblinkospace blinko
- CVE-2026-4597648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection648540858 wvp-GB28181-pro
- CVE-2026-32879New API has passkey-based secure step-up verification bypass for root-only channel secret disclosureQuantumNous new-api · github.com/QuantumNous/new-api
- CVE-2026-4596projectworlds Lawyer Management System lawyers.php cross site scriptingprojectworlds Lawyer Management System
- CVE-2026-30886New API: IDOR in VideoProxy allows cross-user video content access via missing ownership checkQuantumNous new-api · github.com/QuantumNous/new-api
- CVE-2026-32852MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate ParameterMailEnable
- CVE-2026-32851MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate ParameterMailEnable
- CVE-2026-32850MailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex ParameterMailEnable
- CVE-2026-27131Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playgroundputyourlightson craft-sprig · putyourlightson/craft-sprig
- CVE-2026-33690AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()WWBN AVideo · wwbn/avideo
- CVE-2026-33688AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery EndpointWWBN AVideo · wwbn/avideo
- CVE-2026-33685AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User DataWWBN AVideo · wwbn/avideo
- CVE-2026-33683AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About FieldWWBN AVideo · wwbn/avideo
- CVE-2026-4595code-projects Exam Form Submission update_s6.php cross site scriptingcode-projects Exam Form Submission
- CVE-2026-4594erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injectionerupts erupt
- CVE-2026-4593erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injectionerupts erupt
- CVE-2026-33501AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions PluginWWBN AVideo · wwbn/avideo
- CVE-2026-33500AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks SanitizationWWBN AVideo · wwbn/avideo
- CVE-2026-33499AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.phpWWBN AVideo · wwbn/avideo
- CVE-2026-4592kalcaddle kodbox Password Login index.class.php tfaVerify improper authenticationkalcaddle kodbox
- CVE-2026-32845jkuhlmann / cgltf <= 1.15 Sparse Accessor Validation Integer Overflowjkuhlmann cgltf
- CVE-2026-4591kalcaddle kodbox fileThumb Endpoint app.php checkBin os command injectionkalcaddle kodbox
- CVE-2026-4590kalcaddle kodbox loginSubmit API index.class.php cross-site request forgerykalcaddle kodbox
- CVE-2026-3635Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust functionfastify
- CVE-2019-25625Blob Studio 2.17 Denial of Service via Malformed InputPixarra Blob Studio
- CVE-2019-25624Liquid Studio 2.17 Denial of Service via Malformed InputPixarra Liquid Studio
- CVE-2019-25623Luminance Studio 2.17 Denial of Service via Malformed InputPixarra Luminance Studio
- CVE-2019-25622Paint Studio 2.17 Denial of Service via Malformed InputPixarra Paint Studio
- CVE-2019-25621Pixel Studio 2.17 Denial of Service via Malformed InputPixarra Pixel Studio
- CVE-2019-25620Tree Studio 2.17 Denial of Service via Malformed InputPixarra Tree Studio
- CVE-2026-33297AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-4647Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd libraryRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-4589kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgerykalcaddle kodbox
- CVE-2026-4588kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded keykalcaddle kodbox
- CVE-2026-4587HybridAuth SSL Curl.php certificate validationHybridAuth · hybridauth/hybridauth
- CVE-2026-31850Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+Nexxt Solutions Nebula 300+
- CVE-2026-4586CodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted uploadCodePhiliaX Chat2DB
- CVE-2026-4584Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmissionShenzhen HCC Technology MPOS M6 PLUS
- CVE-2026-4633Keycloak: keycloak: user enumeration via differential error messagesRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-4583Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replayShenzhen HCC Technology MPOS M6 PLUS
- CVE-2026-28809XXE in esaml SAML library allows local file read and potential SSRFdropbox esaml · arekinath esaml +2
- CVE-2026-4582Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authenticationShenzhen HCC Technology MPOS M6 PLUS
- CVE-2026-4581code-projects Simple Laundry System Parameters checklogin.php sql injectioncode-projects Simple Laundry System
- CVE-2026-4580code-projects Simple Laundry System Parameters checkupdatestatus.php sql injectioncode-projects Simple Laundry System
- CVE-2026-4628Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access controlRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2026-4579code-projects Simple Laundry System Parameters viewdetail.php sql injectioncode-projects Simple Laundry System
- CVE-2026-4578code-projects Exam Form Submission update_s3.php cross site scriptingcode-projects Exam Form Submission
- CVE-2025-13997King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosurekingaddons King Addons for Elementor – 80+ Elementor Widget…
- CVE-2025-6229Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`shaonsina Sina Extension for Elementor
- CVE-2026-4577code-projects Exam Form Submission update_s4.php cross site scriptingcode-projects Exam Form Submission
- CVE-2026-1969ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Uploadtrx_addons
- CVE-2026-4576code-projects Exam Form Submission update_s5.php cross site scriptingcode-projects Exam Form Submission
- CVE-2026-4575code-projects Exam Form Submission update_s2.php cross site scriptingcode-projects Exam Form Submission
- CVE-2025-10734ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information ExposureReviewX – Multi-Criteria Reviews for WooCommerce with Googl…
- CVE-2025-10731ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data ExportReviewX – Multi-Criteria Reviews for WooCommerce with Googl…
- CVE-2026-4574SourceCodester Simple E-learning System User Profile Update sql injectionSourceCodester Simple E-learning System
- CVE-2026-4573SourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injectionSourceCodester Simple E-learning System
- CVE-2026-4603Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.jjsrsasign
- CVE-2025-10736ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data ManipulationReviewX – Multi-Criteria Reviews for WooCommerce with Googl…
- CVE-2026-4572SourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4571SourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4570SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4569SourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4568SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injectionSourceCodester Sales and Inventory System
- CVE-2024-46878A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier.
- CVE-2024-46879A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2.
- CVE-2024-51222A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 al
- CVE-2024-51223A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 al
- CVE-2024-51224Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System
- CVE-2024-51225A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0
- CVE-2024-51226A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System
- CVE-2025-52204A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter
- CVE-2026-30006XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file.
- CVE-2026-30007XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file