# CVEs published 2026-03-23

201 CVEs were published on March 23, 2026: 26 critical, 69 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-33290](https://cve.now/CVE-2026-33290.md): WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment\_approved) without moderate\_comments permission (CVSS 4.3, wp-graphql)
- [CVE-2026-33211](https://cve.now/CVE-2026-33211.md): Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod (CVSS 9.6, tektoncd pipeline · github.com/tektoncd/pipeline)
- [CVE-2026-33286](https://cve.now/CVE-2026-33286.md): Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names (CVSS 9.1, graphiti-api graphiti · graphiti)
- [CVE-2026-33283](https://cve.now/CVE-2026-33283.md): Ella Core panics on malformed ULNASTransport Message without a Request Type (CVSS 6.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33282](https://cve.now/CVE-2026-33282.md): Ella Core panics on malformed NGAP Location Report (CVSS 7.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33281](https://cve.now/CVE-2026-33281.md): Ella Core panics on invalid PDU Session IDs in NGAP messages (CVSS 6.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33252](https://cve.now/CVE-2026-33252.md): MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion (CVSS 7.1, modelcontextprotocol go-sdk · github.com/modelcontextprotoc…)
- [CVE-2026-33241](https://cve.now/CVE-2026-33241.md): Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing (CVSS 8.7, salvo-rs salvo · salvo)
- [CVE-2026-33242](https://cve.now/CVE-2026-33242.md): Salvo has a Path Traversal in salvo-proxy::encode\_url\_path allows API Gateway Bypass (CVSS 7.5, salvo-rs salvo · salvo)
- [CVE-2026-4615](https://cve.now/CVE-2026-4615.md): SourceCodester Online Catering Reservation search.php sql injection (CVSS 6.9, SourceCodester Online Catering Reservation)
- [CVE-2026-4614](https://cve.now/CVE-2026-4614.md): itsourcecode sanitize or validate this input Parameter subjects.php sql injection (CVSS 5.3, itsourcecode sanitize or validate this input)
- [CVE-2026-33250](https://cve.now/CVE-2026-33250.md): Crash when receiving specially-crafted packets (CVSS 7.5, longturn freeciv21)
- [CVE-2026-33202](https://cve.now/CVE-2026-33202.md): Rails Active Storage has possible glob injection in its DiskService (CVSS 6.6, rails activestorage · activestorage)
- [CVE-2026-33195](https://cve.now/CVE-2026-33195.md): Rails Active Storage has possible Path Traversal in DiskService (CVSS 8.0, rails activestorage · activestorage)
- [CVE-2026-33176](https://cve.now/CVE-2026-33176.md): Rails Active Support has a possible DoS vulnerability in its number helpers (CVSS 6.6, rails activesupport · activesupport)
- [CVE-2026-4021](https://cve.now/CVE-2026-4021.md): Contest Gallery \<= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion (CVSS 8.1, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2026-4056](https://cve.now/CVE-2026-4056.md): User Registration & Membership \<= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation (CVSS 5.4, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-3533](https://cve.now/CVE-2026-3533.md): JupiterX Core \<= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import (CVSS 8.8, artbees Jupiter X Core)
- [CVE-2026-4001](https://cve.now/CVE-2026-4001.md): Woocommerce Custom Product Addons Pro \<= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula (CVSS 9.8, acowebs Woocommerce Custom Product Addons Pro)
- [CVE-2026-33174](https://cve.now/CVE-2026-33174.md): Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests (CVSS 6.6, rails activestorage · activestorage)
- [CVE-2026-33173](https://cve.now/CVE-2026-33173.md): Rails Active Storage has possible content type bypass via metadata in direct uploads (CVSS 5.3, rails activestorage · activestorage)
- [CVE-2026-33170](https://cve.now/CVE-2026-33170.md): Rails Active Support has a possible XSS vulnerability in SafeBuffer#% (CVSS 5.3, rails activesupport · activesupport)
- [CVE-2026-33169](https://cve.now/CVE-2026-33169.md): Rails Active Support has a possible ReDoS vulnerability in number\_to\_delimited (CVSS 6.9, rails activesupport · activesupport)
- [CVE-2026-4613](https://cve.now/CVE-2026-4613.md): SourceCodester E-Commerce Site products.php sql injection (CVSS 6.9, SourceCodester E-Commerce Site)
- [CVE-2026-33168](https://cve.now/CVE-2026-33168.md): Rails has a possible XSS vulnerability in its Action View tag helpers (CVSS 2.3, rails actionview · actionview)
- [CVE-2026-33167](https://cve.now/CVE-2026-33167.md): Rails has a possible XSS vulnerability in its Action Pack debug exceptions (CVSS 1.3, rails actionpack · actionpack)
- [CVE-2026-33046](https://cve.now/CVE-2026-33046.md): Indico discloses local files resulting in Remote Code Execution through LaTeX injection (CVSS 7.7, indico)
- [CVE-2026-3225](https://cve.now/CVE-2026-3225.md): LearnPress \<= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion (CVSS 4.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-4306](https://cve.now/CVE-2026-4306.md): WP Job Portal \<= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter (CVSS 7.5, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2026-2412](https://cve.now/CVE-2026-2412.md): Quiz and Survey Master (QSM) \<= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged\_question' Parameter (CVSS 6.5, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2026-4066](https://cve.now/CVE-2026-4066.md): Smart Custom Fields \<= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search (CVSS 4.3, inc2734 Smart Custom Fields)
- [CVE-2026-4612](https://cve.now/CVE-2026-4612.md): itsourcecode Free Hotel Reservation System Parameter index.php sql injection (CVSS 6.9, itsourcecode Free Hotel Reservation System)
- [CVE-2026-4681](https://cve.now/CVE-2026-4681.md): Critical Remote Code Execution vulnerability reported in Windchill (CVSS 9.3, PTC Windchill PDMLink · PTC FlexPLM)
- [CVE-2026-33634](https://cve.now/CVE-2026-33634.md): Trivy ecosystem supply chain briefly compromised (CVSS 9.4, KEV, aquasecurity setup-trivy · aquasecurity trivy-action +6)
- [CVE-2026-32300](https://cve.now/CVE-2026-32300.md): Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information (CVSS 8.1, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-32299](https://cve.now/CVE-2026-32299.md): Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature (CVSS 7.5, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-32279](https://cve.now/CVE-2026-32279.md): Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin (CVSS 6.8, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-32913](https://cve.now/CVE-2026-32913.md): OpenClaw \< 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects (CVSS 8.8, OpenClaw)
- [CVE-2026-27646](https://cve.now/CVE-2026-27646.md): OpenClaw \< 2026.3.7 - Sandbox Escape via /acp spawn Command (CVSS 5.8, OpenClaw)
- [CVE-2026-27183](https://cve.now/CVE-2026-27183.md): OpenClaw \< 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch (CVSS 2.1, OpenClaw)
- [CVE-2026-32278](https://cve.now/CVE-2026-32278.md): Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin (CVSS 8.2, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-1940](https://cve.now/CVE-2026-1940.md): Gstreamer: incomplete fix of cve-2026-1940 (CVSS 5.1, Red Hat Enterprise Linux)
- [CVE-2026-32277](https://cve.now/CVE-2026-32277.md): Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View (CVSS 8.7, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-4611](https://cve.now/CVE-2026-4611.md): TOTOLINK X6000R shttpd setLanCfg privilege escalation (CVSS 8.6, TOTOLINK X6000R)
- [CVE-2026-32276](https://cve.now/CVE-2026-32276.md): Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin (CVSS 8.8, opensource-workshop connect-cms · opensource-workshop/conne…)
- [CVE-2026-29111](https://cve.now/CVE-2026-29111.md): systemd: Local unprivileged user can trigger an assert (CVSS 5.5, systemd)
- [CVE-2025-60949](https://cve.now/CVE-2025-60949.md): Census CSWeb leaked configuration files (CVSS 9.3, Census CSWeb)
- [CVE-2025-60948](https://cve.now/CVE-2025-60948.md): Census CSWeb stored XSS (CVSS 4.6, Census CSWeb)
- [CVE-2025-60947](https://cve.now/CVE-2025-60947.md): Census CSWeb arbitrary file upload (CVSS 8.8, Census CSWeb)
- [CVE-2025-60946](https://cve.now/CVE-2025-60946.md): Census CSWeb path traversal (CVSS 8.8, Census CSWeb)
- [CVE-2026-23882](https://cve.now/CVE-2026-23882.md): Blinko: Admin RCE - MCP Server Command Injection (CVSS 8.6, blinkospace blinko)
- [CVE-2026-23485](https://cve.now/CVE-2026-23485.md): Blinko: Unauthorized Path Traversal File Enumeration - music-metadata (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23488](https://cve.now/CVE-2026-23488.md): Blinko: multiple interfaces in the comment feature allow unauthorized access (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23487](https://cve.now/CVE-2026-23487.md): Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token (CVSS 6.0, blinkospace blinko)
- [CVE-2026-23486](https://cve.now/CVE-2026-23486.md): Blinko: Unauthorized User Information Leak (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23480](https://cve.now/CVE-2026-23480.md): Blinko: Low Privilege User Privilege Escalation - upsertUser Endpoint (CVSS 5.3, blinkospace blinko)
- [CVE-2026-23481](https://cve.now/CVE-2026-23481.md): Blinko: Authenticated Arbitrary File Write - saveAdditionalDevFile (CVSS 5.3, blinkospace blinko)
- [CVE-2026-23484](https://cve.now/CVE-2026-23484.md): Blinko: Authenticated Arbitrary File Write - saveDevPlugin (CVSS 5.3, blinkospace blinko)
- [CVE-2026-23483](https://cve.now/CVE-2026-23483.md): Blinko: Unauthorized Arbitrary File Read - /plugins (CVSS 6.9, blinkospace blinko)
- [CVE-2026-23482](https://cve.now/CVE-2026-23482.md): Blinko: Unauthorized Arbitrary File Read - /api/file/temp (CVSS 8.2, blinkospace blinko)
- [CVE-2026-3055](https://cve.now/CVE-2026-3055.md): Insufficient input validation leading to memory overread (CVSS 9.3, KEV, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-4597](https://cve.now/CVE-2026-4597.md): 648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection (CVSS 5.3, 648540858 wvp-GB28181-pro)
- [CVE-2026-4368](https://cve.now/CVE-2026-4368.md): Race Condition leading to User Session Mixup (CVSS 7.7, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-2298](https://cve.now/CVE-2026-2298.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement al (CVSS 9.4, Salesforce Marketing Cloud Engagement)
- [CVE-2026-32879](https://cve.now/CVE-2026-32879.md): New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure (CVSS 4.9, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-4596](https://cve.now/CVE-2026-4596.md): projectworlds Lawyer Management System lawyers.php cross site scripting (CVSS 5.1, projectworlds Lawyer Management System)
- [CVE-2026-30886](https://cve.now/CVE-2026-30886.md): New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check (CVSS 6.5, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-33548](https://cve.now/CVE-2026-33548.md): MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline (CVSS 8.6, mantisbt · mantisbt/mantisbt)
- [CVE-2026-33517](https://cve.now/CVE-2026-33517.md): MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation (CVSS 8.6, mantisbt · mantisbt/mantisbt)
- [CVE-2026-30849](https://cve.now/CVE-2026-30849.md): MantisBT SOAP API has an authentication bypass vulnerability on MySQL (CVSS 9.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-32852](https://cve.now/CVE-2026-32852.md): MailEnable \< 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter (CVSS 5.1, MailEnable)
- [CVE-2026-32851](https://cve.now/CVE-2026-32851.md): MailEnable \< 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter (CVSS 5.1, MailEnable)
- [CVE-2026-32850](https://cve.now/CVE-2026-32850.md): MailEnable \< 10.55 Reflected XSS via ManageShares.aspx SelectedIndex Parameter (CVSS 5.1, MailEnable)
- [CVE-2026-27131](https://cve.now/CVE-2026-27131.md): Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground (CVSS 5.5, putyourlightson craft-sprig · putyourlightson/craft-sprig)
- [CVE-2026-26209](https://cve.now/CVE-2026-26209.md): cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads (CVSS 7.5, agronholm cbor2 · cbor2)
- [CVE-2026-33723](https://cve.now/CVE-2026-33723.md): AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user\_id Parameter in subscribe.php (CVSS 7.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33719](https://cve.now/CVE-2026-33719.md): AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php (CVSS 8.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33717](https://cve.now/CVE-2026-33717.md): AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33716](https://cve.now/CVE-2026-33716.md): AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php (CVSS 9.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33690](https://cve.now/CVE-2026-33690.md): AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33688](https://cve.now/CVE-2026-33688.md): AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33685](https://cve.now/CVE-2026-33685.md): AVideo Allows Unauthenticated Access to AD\_Server reports.json.php that Exposes Ad Campaign Analytics and User Data (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-0898](https://cve.now/CVE-2026-0898.md): An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. (CVSS 9.0, Pegasystems Pega Robot Studio)
- [CVE-2026-33683](https://cve.now/CVE-2026-33683.md): AVideo vulnerable to Stored XSS via html\_entity\_decode() Reversing xss\_esc() Sanitization in Channel About Field (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33681](https://cve.now/CVE-2026-33681.md): AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name (CVSS 7.2, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33651](https://cve.now/CVE-2026-33651.md): AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live\_schedule\_id in Scheduler\_commands::getAllActiveOrToRepeat() (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4595](https://cve.now/CVE-2026-4595.md): code-projects Exam Form Submission update\_s6.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2025-15606](https://cve.now/CVE-2025-15606.md): Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N (CVSS 7.1, TP-Link Systems TD-W8961N)
- [CVE-2026-25075](https://cve.now/CVE-2026-25075.md): strongSwan 4.5.0 \< 6.0.5 EAP-TTLS AVP Parsing Integer Underflow (CVSS 8.7, strongSwan)
- [CVE-2026-33650](https://cve.now/CVE-2026-33650.md): AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion (CVSS 7.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33649](https://cve.now/CVE-2026-33649.md): AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33648](https://cve.now/CVE-2026-33648.md): AVideo Vulnerable to OS Command Injection via Unsanitized \`users\_id\` and \`liveTransmitionHistory\_id\` in Restreamer Log File Path (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33647](https://cve.now/CVE-2026-33647.md): AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33513](https://cve.now/CVE-2026-33513.md): AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) (CVSS 8.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33512](https://cve.now/CVE-2026-33512.md): AVideo has an unauthenticated decrypt oracle leaking any ciphertext (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2025-15605](https://cve.now/CVE-2025-15605.md): Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.5, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2025-15519](https://cve.now/CVE-2025-15519.md): Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.5, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2025-15518](https://cve.now/CVE-2025-15518.md): Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.5, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2025-15517](https://cve.now/CVE-2025-15517.md): Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600 (CVSS 8.6, TP-Link Systems Archer NX600 · TP-Link Systems Archer NX… +2)
- [CVE-2026-4594](https://cve.now/CVE-2026-4594.md): erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injection (CVSS 6.9, erupts erupt)
- [CVE-2026-4593](https://cve.now/CVE-2026-4593.md): erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injection (CVSS 5.3, erupts erupt)
- [CVE-2026-33507](https://cve.now/CVE-2026-33507.md): AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33502](https://cve.now/CVE-2026-33502.md): AVideo has Unauthenticated SSRF via plugin/Live/test.php (CVSS 9.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33501](https://cve.now/CVE-2026-33501.md): AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33500](https://cve.now/CVE-2026-33500.md): AVideo Vulnerable to Stored XSS via Markdown \`javascript:\` URI Bypasses ParsedownSafeWithLinks Sanitization (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33499](https://cve.now/CVE-2026-33499.md): AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php (CVSS 6.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4592](https://cve.now/CVE-2026-4592.md): kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication (CVSS 6.3, kalcaddle kodbox)
- [CVE-2026-33493](https://cve.now/CVE-2026-33493.md): AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter (CVSS 7.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-32845](https://cve.now/CVE-2026-32845.md): jkuhlmann / cgltf \<= 1.15 Sparse Accessor Validation Integer Overflow (CVSS 6.9, jkuhlmann cgltf)
- [CVE-2026-33492](https://cve.now/CVE-2026-33492.md): AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration (CVSS 7.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33488](https://cve.now/CVE-2026-33488.md): AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin (CVSS 7.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4591](https://cve.now/CVE-2026-4591.md): kalcaddle kodbox fileThumb Endpoint app.php checkBin os command injection (CVSS 5.1, kalcaddle kodbox)
- [CVE-2026-4404](https://cve.now/CVE-2026-4404.md): Use of hard coded credentials in GoHarbor Harbor (CVSS 9.4, Harbor · github.com/goharbor/harbor)
- [CVE-2026-4590](https://cve.now/CVE-2026-4590.md): kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery (CVSS 2.3, kalcaddle kodbox)
- [CVE-2026-33485](https://cve.now/CVE-2026-33485.md): AVideo has an Unauthenticated Blind SQL Injection in RTMP on\_publish Callback via Stream Name Parameter (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33483](https://cve.now/CVE-2026-33483.md): AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33482](https://cve.now/CVE-2026-33482.md): AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33480](https://cve.now/CVE-2026-33480.md): AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy (CVSS 8.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33479](https://cve.now/CVE-2026-33479.md): AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33478](https://cve.now/CVE-2026-33478.md): AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection (CVSS 10.0, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33354](https://cve.now/CVE-2026-33354.md): AVideo has an authenticated arbitrary local file read via \`chunkFile\` path injection in \`aVideoEncoder.json.php\` (CVSS 7.6, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33352](https://cve.now/CVE-2026-33352.md): AVideo has an Unauthenticated SQL Injection via \`doNotShowCats\` Parameter (Backslash Escape Bypass) (CVSS 9.8, WWBN AVideo · wwbn/avideo)
- [CVE-2026-3635](https://cve.now/CVE-2026-3635.md): Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function (CVSS 6.1, fastify)
- [CVE-2026-33351](https://cve.now/CVE-2026-33351.md): AVideo has Unauthenticated SSRF via \`webSiteRootURL\` Parameter in saveDVR.json.php, Chaining to Verification Bypass (CVSS 9.1, WWBN AVideo · wwbn/avideo)
- [CVE-2019-25625](https://cve.now/CVE-2019-25625.md): Blob Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Blob Studio)
- [CVE-2019-25624](https://cve.now/CVE-2019-25624.md): Liquid Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Liquid Studio)
- [CVE-2019-25623](https://cve.now/CVE-2019-25623.md): Luminance Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Luminance Studio)
- [CVE-2019-25622](https://cve.now/CVE-2019-25622.md): Paint Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Paint Studio)
- [CVE-2019-25621](https://cve.now/CVE-2019-25621.md): Pixel Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Pixel Studio)
- [CVE-2019-25620](https://cve.now/CVE-2019-25620.md): Tree Studio 2.17 Denial of Service via Malformed Input (CVSS 6.9, Pixarra Tree Studio)
- [CVE-2026-33297](https://cve.now/CVE-2026-33297.md): AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php (CVSS 5.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4647](https://cve.now/CVE-2026-4647.md): Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library (CVSS 6.1, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-4589](https://cve.now/CVE-2026-4589.md): kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery (CVSS 5.3, kalcaddle kodbox)
- [CVE-2025-41008](https://cve.now/CVE-2025-41008.md): SQL Injection in Sinturno (CVSS 9.3, Sinturno)
- [CVE-2026-4588](https://cve.now/CVE-2026-4588.md): kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key (CVSS 6.3, kalcaddle kodbox)
- [CVE-2026-4587](https://cve.now/CVE-2026-4587.md): HybridAuth SSL Curl.php certificate validation (CVSS 6.3, HybridAuth · hybridauth/hybridauth)
- [CVE-2026-1958](https://cve.now/CVE-2026-1958.md): Hard-coded passwords in KlinikaXP (CVSS 8.7, BRI KlinikaXP Insertino · BRI KlinikaXP)
- [CVE-2026-31851](https://cve.now/CVE-2026-31851.md): Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks (CVSS 7.7, Nexxt Solutions Nebula 300+)
- [CVE-2026-31850](https://cve.now/CVE-2026-31850.md): Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+ (CVSS 6.8, Nexxt Solutions Nebula 300+)
- [CVE-2026-31849](https://cve.now/CVE-2026-31849.md): Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+ (CVSS 7.2, Nexxt Solutions Nebula 300+)
- [CVE-2026-31848](https://cve.now/CVE-2026-31848.md): Reversible ecos\_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+ (CVSS 8.7, Nexxt Solutions Nebula 300+)
- [CVE-2026-4586](https://cve.now/CVE-2026-4586.md): CodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload (CVSS 5.3, CodePhiliaX Chat2DB)
- [CVE-2025-41007](https://cve.now/CVE-2025-41007.md): SQL Injection in Cuantis (CVSS 9.3, Cuantis)
- [CVE-2026-31847](https://cve.now/CVE-2026-31847.md): Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+ (CVSS 8.5, Nexxt Solutions Nebula 300+)
- [CVE-2026-31846](https://cve.now/CVE-2026-31846.md): Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+ (CVSS 7.1, Nexxt Solutions Nebula 300+ / Tenda F3 V2.0 Firmware)
- [CVE-2026-32969](https://cve.now/CVE-2026-32969.md): Pre-Auth Blind SQLi in userinfo Endpoint (CVSS 7.5, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-32968](https://cve.now/CVE-2026-32968.md): Unauthenticated RCE in com\_mb24sysapi (CVSS 9.8, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-4585](https://cve.now/CVE-2026-4585.md): Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection (CVSS 9.3, Tiandy Easy7 Integrated Management Platform)
- [CVE-2026-4584](https://cve.now/CVE-2026-4584.md): Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission (CVSS 2.3, Shenzhen HCC Technology MPOS M6 PLUS)
- [CVE-2026-4633](https://cve.now/CVE-2026-4633.md): Keycloak: keycloak: user enumeration via differential error messages (CVSS 3.7, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-4583](https://cve.now/CVE-2026-4583.md): Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay (CVSS 2.3, Shenzhen HCC Technology MPOS M6 PLUS)
- [CVE-2026-28809](https://cve.now/CVE-2026-28809.md): XXE in esaml SAML library allows local file read and potential SSRF (CVSS 6.3, dropbox esaml · arekinath esaml +2)
- [CVE-2026-4582](https://cve.now/CVE-2026-4582.md): Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication (CVSS 2.3, Shenzhen HCC Technology MPOS M6 PLUS)
- [CVE-2026-4581](https://cve.now/CVE-2026-4581.md): code-projects Simple Laundry System Parameters checklogin.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4580](https://cve.now/CVE-2026-4580.md): code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4628](https://cve.now/CVE-2026-4628.md): Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control (CVSS 4.3, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-3587](https://cve.now/CVE-2026-3587.md): Hidden CLI Function Allows Root Access (CVSS 10.0, WAGO Lean Managed Switch 852-1812 · WAGO Lean Managed S… +14)
- [CVE-2026-4579](https://cve.now/CVE-2026-4579.md): code-projects Simple Laundry System Parameters viewdetail.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4578](https://cve.now/CVE-2026-4578.md): code-projects Exam Form Submission update\_s3.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2026-23555](https://cve.now/CVE-2026-23555.md): Xenstored DoS by unprivileged domain (CVSS 7.1, Xen)
- [CVE-2026-23554](https://cve.now/CVE-2026-23554.md): Use after free of paging structures in EPT (CVSS 7.8, Xen)
- [CVE-2025-13997](https://cve.now/CVE-2025-13997.md): King Addons for Elementor \<= 51.1.49 - Unauthenticated API Keys Disclosure (CVSS 5.3, kingaddons King Addons for Elementor – 80+ Elementor Widget…)
- [CVE-2025-6229](https://cve.now/CVE-2025-6229.md): Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) \<= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`Fancy Text Widget\` And \`Countdown Widget\` (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2026-4577](https://cve.now/CVE-2026-4577.md): code-projects Exam Form Submission update\_s4.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2026-1969](https://cve.now/CVE-2026-1969.md): ThemeREX Addons \< 2.38.5 - Unauthenticated Arbitrary File Upload (CVSS 5.3, trx\_addons)
- [CVE-2026-4576](https://cve.now/CVE-2026-4576.md): code-projects Exam Form Submission update\_s5.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2026-4575](https://cve.now/CVE-2026-4575.md): code-projects Exam Form Submission update\_s2.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2025-10734](https://cve.now/CVE-2025-10734.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.12 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2025-10679](https://cve.now/CVE-2025-10679.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.12 - Unauthenticated Limited Remote Code Execution (CVSS 7.3, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2025-10731](https://cve.now/CVE-2025-10731.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export (CVSS 5.3, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2026-4574](https://cve.now/CVE-2026-4574.md): SourceCodester Simple E-learning System User Profile Update sql injection (CVSS 5.3, SourceCodester Simple E-learning System)
- [CVE-2026-4573](https://cve.now/CVE-2026-4573.md): SourceCodester Simple E-learning System HTTP GET Parameter delete\_post.php sql injection (CVSS 5.3, SourceCodester Simple E-learning System)
- [CVE-2026-4603](https://cve.now/CVE-2026-4603.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.j (CVSS 5.1, jsrsasign)
- [CVE-2026-4601](https://cve.now/CVE-2026-4601.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash pro (CVSS 9.4, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4599](https://cve.now/CVE-2026-4599.md): Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRando (CVSS 9.3, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4598](https://cve.now/CVE-2026-4598.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigIn (CVSS 8.7, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4602](https://cve.now/CVE-2026-4602.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative expone (CVSS 8.7, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2026-4600](https://cve.now/CVE-2026-4600.md): Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parame (CVSS 9.1, jsrsasign · org.webjars.npm:jsrsasign)
- [CVE-2025-10736](https://cve.now/CVE-2025-10736.md): ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More \<= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation (CVSS 6.5, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2026-4572](https://cve.now/CVE-2026-4572.md): SourceCodester Sales and Inventory System HTTP POST Request view\_product.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4571](https://cve.now/CVE-2026-4571.md): SourceCodester Sales and Inventory System HTTP POST Request view\_payments.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4570](https://cve.now/CVE-2026-4570.md): SourceCodester Sales and Inventory System HTTP POST Request view\_customers.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4569](https://cve.now/CVE-2026-4569.md): SourceCodester Sales and Inventory System HTTP POST Request view\_category.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4568](https://cve.now/CVE-2026-4568.md): SourceCodester Sales and Inventory System HTTP GET Request update\_supplier.php sql injection (CVSS 5.3, SourceCodester Sales and Inventory System)
- [CVE-2026-4567](https://cve.now/CVE-2026-4567.md): Tenda A15 UploadCfg stack-based overflow (CVSS 9.3, Tenda A15)
- [CVE-2026-4566](https://cve.now/CVE-2026-4566.md): Belkin F9K1122 formWISP5G stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2026-4606](https://cve.now/CVE-2026-4606.md): GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege (CVSS 10.0, GeoVision GV-Edge Recording Manager)
- [CVE-2026-4565](https://cve.now/CVE-2026-4565.md): Tenda AC21 SetNetControlList formSetQosBand buffer overflow (CVSS 8.7, Tenda AC21)
- [CVE-2024-46878](https://cve.now/CVE-2024-46878.md): A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. (CVSS 5.4)
- [CVE-2024-46879](https://cve.now/CVE-2024-46879.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin\_system.php in Tiki version 21.2. (CVSS 5.4)
- [CVE-2024-51222](https://cve.now/CVE-2024-51222.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 al (CVSS 4.8)
- [CVE-2024-51223](https://cve.now/CVE-2024-51223.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 al (CVSS 4.8)
- [CVE-2024-51224](https://cve.now/CVE-2024-51224.md): Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System (CVSS 4.8)
- [CVE-2024-51225](https://cve.now/CVE-2024-51225.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 (CVSS 4.8)
- [CVE-2024-51226](https://cve.now/CVE-2024-51226.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System (CVSS 6.1)
- [CVE-2025-52204](https://cve.now/CVE-2025-52204.md): A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter (CVSS 6.1)
- [CVE-2026-24516](https://cve.now/CVE-2026-24516.md): A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. (CVSS 8.8, github.com/digitalocean/droplet-agent)
- [CVE-2026-26828](https://cve.now/CVE-2026-26828.md): A NULL pointer dereference in the daap\_reply\_playlists function (src/httpd\_daap.c) of owntone-server commit 3d1652d allows attackers to caus (CVSS 7.5)
- [CVE-2026-26829](https://cve.now/CVE-2026-26829.md): A NULL pointer dereference in the safe\_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Den (CVSS 7.5)
- [CVE-2026-30006](https://cve.now/CVE-2026-30006.md): XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file. (CVSS 6.2)
- [CVE-2026-30007](https://cve.now/CVE-2026-30007.md): XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file (CVSS 6.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.