CVEs published March 24, 2026
252 CVEs were published on March 24, 2026: 41 critical, 125 high.
- Published
- 252
- Critical
- 41
- High
- 125
- Medium
- 77
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 135
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 45
- go-vikunja vikunja · code.vikunja.io/api
- 13
- parse-community parse-server · parse-server
- 11
- Google Chrome
- 8
- MolotovCherry Android-ImageMagick7
- 8
- craftcms cms · craftcms/cms
- 6
- ellite Wallos
- 5
- F5 NGINX Open Source · F5 NGINX Plus
- 5
- NVIDIA Megatron LM
- 5
- SourceCodester Sales and Inventory System
- 5
Critical 41
- CVE-2025-33244NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data.NVIDIA Apex
- CVE-2026-33419MinIO: LDAP login brute-force via user enumeration and missing rate limitminio · github.com/minio/minio
- CVE-2026-33322MinIO: JWT Algorithm Confusion in OIDC Authenticationminio · github.com/minio/minio
- CVE-2026-2417Missing Authentication for Critical Function in Pharos Controls Mosaic Show ControllerPharos Controls Mosaic Show Controller
- CVE-2026-33340LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpointParisNeo lollms-webui
- CVE-2026-33475Langflow GitHub Actions Shell Injectionlangflow-ai langflow
- CVE-2026-33309Langflow has an Arbitrary File Write (RCE) via v2 APIlangflow-ai langflow · langflow
- CVE-2026-4721Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149Mozilla Firefox · Mozilla Thunderbird
- CVE-2026-4729Memory safety bugs fixed in Firefox 149 and Thunderbird 149Mozilla Firefox · Mozilla Thunderbird
- CVE-2026-4720Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149Mozilla Firefox · Mozilla Thunderbird
- CVE-2026-4717Privilege escalation in the Netmonitor componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4716Incorrect boundary conditions, uninitialized memory in the JavaScript Engine componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4715Uninitialized memory in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4725Sandbox escape due to use-after-free in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4711Use-after-free in the Widget: Cocoa componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4710Incorrect boundary conditions in the Audio/Video componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4705Undefined behavior in the WebRTC: Signaling componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4724Undefined behavior in the Audio/Video componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4723Use-after-free in the JavaScript Engine componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4702JIT miscompilation in the JavaScript Engine componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4701Use-after-free in the JavaScript Engine componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4700Mitigation bypass in the Networking: HTTP componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4696Use-after-free in the Layout: Text and Fonts componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4692Sandbox escape in the Responsive Design Mode componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4691Use-after-free in the CSS Parsing and Computation componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4690Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4689Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4688Sandbox escape due to use-after-free in the Disability Access APIs componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4687Sandbox escape due to incorrect boundary conditions in the Telemetry componentMozilla Firefox · Mozilla Thunderbird
- CVE-2019-25646Tabs Mail Carrier 2.5.1 Buffer Overflow via MAIL FROMTabs Mail Carrier
- CVE-2019-25628Download Accelerator Plus DAP 10.0.6.0 SEH Buffer OverflowSpeedbit Download Accelerator Plus DAP
- CVE-2026-4755CWE-20 in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-4753Out-of-bounds Read in slajerek RetroDebuggerslajerek RetroDebugger
- CVE-2026-4750Out-of-bounds Read in fabiangreffrath wooffabiangreffrath woof
- CVE-2026-4283WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Userslegalweb WP DSGVO Tools
- CVE-2026-4746Heap Buffer Over-Write Vulenrabilty in timeplus-io/protontimeplus-io proton
- CVE-2026-4745Arbitrary Code Execution via Crafted Bytecode in dendibakh/perf-ninjadendibakh perf-ninja
- CVE-2026-4744Notepad3 Bundled Oniguruma compile_string_node() Heap Buffer Overflow via Crafted Regex Pattern Allows Arbitrary Code Executionrizonesoft Notepad3
- CVE-2026-4739Integer overflow vulnerabilities in InsightSoftwareConsortium/ITKInsightSoftwareConsortium ITK
- CVE-2026-4738GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code ExecutionOSGeo gdal
- CVE-2026-4734Heap Buffer Overflow in yoyofr/modizeryoyofr modizer
High 125
- CVE-2026-3912TIBCO ActiveMatrix BusinessWorks Injection VulnerabilityTibco ActiveMatrix BusinessWorks · Tibco Enterprise Adminis…
- CVE-2026-24159NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution.NVIDIA NeMo Framework · nemo-toolkit
- CVE-2026-4371Out of bounds read in IMAP parsingMozilla Thunderbird
- CVE-2026-24157NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution.NVIDIA NeMo Framework · nemo-toolkit
- CVE-2026-24141NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deseNVIDIA Model Optimizer
- CVE-2026-24158NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a NVIDIA Triton Inference Server
- CVE-2025-33254NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption.NVIDIA Triton Inference Server
- CVE-2025-33238NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception.NVIDIA Triton Inference Server
- CVE-2026-24152NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciouNVIDIA Megatron LM
- CVE-2026-24151NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously craNVIDIA Megatron LM
- CVE-2026-24150NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciouNVIDIA Megatron LM
- CVE-2025-33248NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load NVIDIA Megatron LM
- CVE-2025-33247NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution.NVIDIA Megatron LM
- CVE-2026-33353Soft Serve: Authenticated repo import can clone server-local private repositoriescharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2026-33344Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAGdagu-org dagu · github.com/dagu-org/dagu
- CVE-2026-33331oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringifymiddleapi orpc · @orpc/openapi
- CVE-2026-33330FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callbackerror311 FileRise
- CVE-2026-33329FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracleerror311 FileRise
- CVE-2026-22559An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is sociaUbiquiti UniFi Network Server
- CVE-2026-33511pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoadpyload
- CVE-2026-33509pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configurationpyload · pyload-ng
- CVE-2026-30932Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIfroxlor · froxlor/froxlor
- CVE-2026-33627Parse Server: Auth data exposed via /users/me endpointparse-community parse-server · parse-server
- CVE-2026-23921Blind, read-only SQL injection in Zabbix API via sortfield parameterZabbix
- CVE-2026-23920Host and event action script regex validation can be bypassed in certain situations, leading to potential command injectionZabbix
- CVE-2026-33539Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapterparse-community parse-server · parse-server
- CVE-2026-23919Insufficient isolation of JavaScript (Duktape) execution context on Zabbix ServerZabbix
- CVE-2026-33538Parse Server: Denial of service via unindexed database query for unconfigured auth providersparse-community parse-server · parse-server
- CVE-2026-33508Parse Server: LiveQuery subscription query depth bypassparse-community parse-server · parse-server
- CVE-2026-33498Parse Server: Query condition depth bypass via pre-validation transform pipelineparse-community parse-server · parse-server
- CVE-2026-33421Parse Server: LiveQuery bypasses CLP pointer permission enforcementparse-community parse-server · parse-server
- CVE-2026-33409Parse Server: Auth provider validation bypass on login via partial authDataparse-community parse-server · parse-server
- CVE-2026-1995IDrive Cloud Backup Client for Windows contains a privilege escalation vulnerabilityIDrive Cloud Backup Client for Windows
- CVE-2026-33401Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.phpellite Wallos
- CVE-2026-33399Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840ellite Wallos
- CVE-2026-33407Wallos: SSRF via HTTP Proxy Environment Variableellite Wallos
- CVE-2026-33157Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms cms · craftcms/cms
- CVE-2026-33680Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33678Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletiongo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33668Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connectgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33316Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablementgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-4775Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processingRed Hat Enterprise Linux · Red Hat AI Inference Server +2
- CVE-2026-27651NGINX ngx_mail_auth_http_module vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2026-27654NGINX ngx_http_dav_module vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2026-32647NGINX ngx_http_mp4_module vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2026-27784NGINX ngx_http_mp4_module vulnerabilityF5 NGINX Open Source
- CVE-2026-33418@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injectiondicebear · @dicebear/converter
- CVE-2026-33310Intake has a Command Injection via shell() Expansion in Parameter Defaultsintake
- CVE-2026-33497Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file readinglangflow-ai langflow · langflow
- CVE-2026-33484Langflow has Unauthenticated IDOR on Image Downloadslangflow-ai langflow · langflow
- CVE-2026-4719Incorrect boundary conditions in the Graphics: Text componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4718Undefined behavior in the WebRTC: Signaling componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4727Denial-of-service in the Libraries component in NSSMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4726Denial-of-service in the XML componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4714Incorrect boundary conditions in the Audio/Video componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4713Incorrect boundary conditions in the Graphics componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4712Information disclosure in the Widget: Cocoa componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4709Incorrect boundary conditions in the Audio/Video: GMP componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4708Incorrect boundary conditions in the Graphics componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4707Incorrect boundary conditions in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4706Incorrect boundary conditions in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4704Denial-of-service in the WebRTC: Signaling componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4722Privilege escalation in the IPC componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4699Incorrect boundary conditions in the Layout: Text and Fonts componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4698JIT miscompilation in the JavaScript Engine: JIT componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4697Incorrect boundary conditions in the Audio/Video: Web Codecs componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4695Incorrect boundary conditions in the Audio/Video: Web Codecs componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4694Incorrect boundary conditions, integer overflow in the Graphics componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4693Incorrect boundary conditions in the Audio/Video: Playback componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4686Incorrect boundary conditions in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4685Incorrect boundary conditions in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-4684Race condition, use-after-free in the Graphics: WebRender componentMozilla Firefox · Mozilla Thunderbird
- CVE-2019-25647PhreeBooks ERP 5.2.3 Remote Code Execution via Image ManagerPhreesoft PhreeBooks ERP
- CVE-2019-25643eNdonesia Portal v8.7 SQL Injection via banners.phpeNdonesia Portal
- CVE-2019-25642Bootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact ModulesBootstrapy CMS
- CVE-2019-25641Netartmedia Vlog System Lastest SQL Injection via email ParameterNetartmedia Vlog System
- CVE-2019-25640Inout Article Base CMS Lastest SQL Injection via portalLogin.phpInoutscripts Inout Article Base CMS
- CVE-2019-25639Matrimony Website Script M-Plus Multiple SQL InjectionMatri4Web Matrimony Website Script
- CVE-2019-25638Meeplace Business Review Script Lastest SQL Injection via addclick.phpMeeplace Business Review Script
- CVE-2019-25637X-NetStat Pro 5.63 Local Buffer Overflow via EggHunterFreshsoftware NetStat Pro
- CVE-2019-25636Zeeways Jobsite CMS Lastest SQL Injection via id ParameterZeeways Jobsite CMS
- CVE-2019-25635Zeeways Matrimony CMS Lastest SQL Injection via profile_listZeeways Matrimony CMS
- CVE-2019-25634Base64 Decoder 1.1.2 Local Buffer Overflow SEH Egghunter4Mhz Base64 Decoder
- CVE-2019-25633AIDA64 Extreme 5.99.4900 SEH Buffer Overflow via EggHunterAIDA64 Extreme
- CVE-2019-25631AIDA64 Business 5.99.4900 SEH Buffer Overflow via EggHunterAIDA64 Business
- CVE-2019-25630PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image ManagerPhreesoft PhreeBooks ERP
- CVE-2019-25629AIDA64 Extreme 5.99.4900 SEH Buffer Overflow via LoggingAIDA64 Extreme
- CVE-2019-25627FlexHEX 2.71 Local Buffer Overflow via SEH UnicodeFlexHEX
- CVE-2019-25626River Past Cam Do 3.7.6 Local Buffer Overflow in Activation CodeFlexhex River Past Cam Do
- CVE-2025-64998Session hijacking via exposed session signing secret in distributed Checkmk setupsCheckmk
- CVE-2026-3509CODESYS Control Audit Log Format String DoSCODESYS Control RTE · CODESYS Control Win +12
- CVE-2025-41660CODESYS Control Boot Application Replacement Enables Code ExecutionCODESYS Control RTE · CODESYS Control Win +13
- CVE-2026-4756Out-of-bounds Write in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-33852Missing Release of Memory after Effective Lifetime in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-33856Missing Release of Memory after Effective Lifetime in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-33854Out-of-bounds Write in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-33847Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvmslinkingvision rapidvms
- CVE-2026-33849Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvmslinkingvision rapidvms
- CVE-2026-33848Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvmslinkingvision rapidvms
- CVE-2026-33851Improper Restriction of Operations within the Bounds of a Memory Buffer in joncampbell123 doslibjoncampbell123 doslib
- CVE-2026-33850Out-of-bounds Write in WujekFoliarz DualSenseY-v2WujekFoliarz DualSenseY-v2
- CVE-2026-4662JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' ParameterCrocoblock JetEngine
- CVE-2026-4640Galaxy Software Services｜Vitals ESP - Missing AuthenticationGalaxy Software Services Vitals ESP
- CVE-2026-4639Galaxy Software Services｜Vitals ESP - Incorrect AuthorizationGalaxy Software Services Vitals ESP
- CVE-2026-4627D-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so handler_update_system_time os command injectionD-Link DIR-825 · D-Link DIR-825R
- CVE-2026-4741Path Traversal Vulnerability in TeamJCD/JoyConDroidTeamJCD JoyConDroid
- CVE-2026-4737Use-After-Free Vulnerability in No-Chicken/Echo-MateNo-Chicken Echo-Mate
- CVE-2026-4736Math Issue in No-Chicken/Echo-MateNo-Chicken Echo-Mate
- CVE-2026-4735A stack overflow and DoS vulnerability in DTStack/chunjunDTStack chunjun
- CVE-2026-4732Out-of-bounds Read Overflow in tildearrow/furnacetildearrow furnace
- CVE-2026-4731An Integer Overflow Vulnerability in artraweditor/ARTartraweditor ART
- CVE-2026-33307mod_gnutils has stack-based buffer overflow caused by a long client certificate chainairtower-luna mod_gnutls
- CVE-2026-4680Use after free in FedCM in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-4679Integer overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a Google Chrome
- CVE-2026-4678Use after free in WebGPU in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via aGoogle Chrome
- CVE-2026-4677Inappropriate implementation in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memoGoogle Chrome
- CVE-2026-4676Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-4675Heap buffer overflow in WebGL in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read viaGoogle Chrome
- CVE-2026-4674Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crGoogle Chrome
- CVE-2026-4673Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory writeGoogle Chrome
- CVE-2026-22739Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF AttacksSpring Cloud · org.springframework.cloud:spring-cloud-confi…
- CVE-2026-33298llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsingggml-org llama.cpp
- CVE-2026-29839DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.
- CVE-2026-30653An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of
- CVE-2026-33554ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer overflows on response messages.FreeIPMI
Medium, low and unrated 86
- CVE-2026-4781SourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4780SourceCodester Sales and Inventory System HTTP GET Parameter update_out_standing.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4779SourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4778SourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-4777SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-33215NATS is vulnerable to MQTT hijacking via Client IDnats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2026-3889Spoofing issue in ThunderbirdMozilla Thunderbird
- CVE-2026-4433An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnTenable Operation Technology
- CVE-2025-33242NVIDIA B300 MCU contains a vulnerability in the CX8 MCU that could allow a malicious actor to modify unsupported registries, causing a bad sNVIDIA HGX and DGX B300
- CVE-2025-33216NVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an incorrect calculationNVIDIA SNAP-4 Container
- CVE-2025-33215NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointeNVIDIA SNAP-4 Container
- CVE-2026-21790HCL Traveler is susceptible to a weak default HTTP header validation vulnerabilityHCLSoftware Traveler
- CVE-2026-21783HCL Traveler is affected by sensitive information disclosureHCLSoftware Traveler
- CVE-2026-33412Vim affected by Command injection via newline in glob()vim
- CVE-2026-33349fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy EvaluationNaturalIntelligence fast-xml-parser · fast-xml-parser
- CVE-2026-33345solidtime vulnerable to IDOR in private projectssolidtime-io solidtime
- CVE-2026-33347league/commonmark has an embed extension allowed_domains bypassthephpleague commonmark · league/commonmark
- CVE-2026-33332NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustionzauberzeug nicegui · nicegui
- CVE-2026-33326@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findManykeystonejs keystone · @keystone-6/core
- CVE-2026-33314pyload-ng: Improper Authentication and Origin Validation Errorpyload · pyload-ng
- CVE-2026-32948sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windowssbt · org.scala-sbt:sbt
- CVE-2026-33769Astro: Remote allowlist bypass via unanchored matchPathname wildcardwithastro astro · astro
- CVE-2026-33768Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`withastro astro · @astrojs/vercel
- CVE-2026-29772Astro: Memory exhaustion DoS due to missing request body size limit in Server Islandswithastro astro · @astrojs/node
- CVE-2026-23924Agent 2 Docker plugin arbitrary file read via Docker API injectionZabbix
- CVE-2026-23923Unauthenticated arbitrary PHP class instantiationZabbix
- CVE-2026-33624Parse Server: MFA recovery code single-use bypass via concurrent requestsparse-community parse-server · parse-server
- CVE-2026-33527Parse Server: Session update endpoint allows overwriting server-generated session fieldsparse-community parse-server · parse-server
- CVE-2026-33429Parse Server: Protected field change detection oracle via LiveQuery watch parameterparse-community parse-server · parse-server
- CVE-2026-33323Parse Server: Email verification resend page leaks user existenceparse-community parse-server · parse-server
- CVE-2026-33417Wallos: Password Reset Tokens Never Expireellite Wallos
- CVE-2026-33400Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpointellite Wallos
- CVE-2026-33162Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissionscraftcms cms · craftcms/cms
- CVE-2026-32854LibVNCServer httpd proxy NULL Pointer DereferenceLibVNCServer
- CVE-2026-33161Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized userscraftcms cms · craftcms/cms
- CVE-2026-32853LibVNCServer UltraZip Encoding Heap Out-of-bounds ReadLibVNCServer
- CVE-2026-33160Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URLcraftcms cms · craftcms/cms
- CVE-2026-33159Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted userscraftcms cms · craftcms/cms
- CVE-2026-33158Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)craftcms cms · craftcms/cms
- CVE-2025-11571Command Execution vulnerability in Simplicity Installersilabs.com Simplicity Studio · silabs.com Simplicity Instal…
- CVE-2026-33700Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletiongo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33679Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protectionsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33677Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via APIgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33676Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Readgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33675Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resourcesgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33474Vikunja Affected by DoS via Image Preview Generationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33473Vikunja has TOTP Reuse During Validity Windowgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33336Vikunja Desktop vulnerable to Remote Code Execution via same-window navigationgo-vikunja vikunja
- CVE-2026-33335Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalgo-vikunja vikunja
- CVE-2026-33334Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegrationgo-vikunja vikunja
- CVE-2026-33315Vikunja has a 2FA Bypass via Caldav Basic Authgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-33313Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Commentsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-28755NGINX ngx_stream_ssl_module vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2026-28753NGINX ngx_mail_proxy_module vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2026-33311@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Optionsdicebear · @dicebear/core +1
- CVE-2026-4728Spoofing issue in the Privacy: Anti-Tracking componentMozilla Firefox · Mozilla Thunderbird
- CVE-2019-25645WinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of ServiceWinAVI iPod/3GP/MP4/PSP Converter
- CVE-2019-25644WinMPG Video Convert 9.3.5 Buffer Overflow Local Denial of ServiceWinMPG Video Convert Local Dos Exploit
- CVE-2019-25632phpFileManager 1.7.8 Local File Inclusion via index.phpSourceforge phpFileManager
- CVE-2026-4649Auth bypass in Apache Artemis allows reading all internal messagesKNIME Business Hub
- CVE-2026-32642Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permissionApache Software Foundation Apache Artemis · Apache Softw… +2
- CVE-2026-4754CWE-79 in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-33855Integer Overflow or Wraparound in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-33853NULL Pointer Dereference in MolotovCherry Android-ImageMagick7MolotovCherry Android-ImageMagick7
- CVE-2026-4752Use After Free in No-Chicken Echo-MateNo-Chicken Echo-Mate
- CVE-2026-4751NULL Pointer Dereference in tmate-io tmatetmate-io tmate
- CVE-2026-4749NVD-CWE-noinfo in albfan miraclecastalbfan miraclecast
- CVE-2026-3138Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLEwoobewoo Product Filter for WooCommerce by WBW
- CVE-2026-4632itsourcecode Online Enrollment System Parameter index.php sql injectionitsourcecode Online Enrollment System
- CVE-2026-4743Null-Pointer Dereference Vulnerability in taurusxin/ncmdumptaurusxin ncmdump
- CVE-2026-4742HTTP Request Smuggling in visualfc/liteidevisualfc liteide
- CVE-2026-4733Information disclosure in ixray-1.6-stcopixray-team ixray-1.6-stcop
- CVE-2026-4626projectworlds Lawyer Management System lawyer_booking.php cross site scriptingprojectworlds Lawyer Management System
- CVE-2026-4625SourceCodester Online Admission System programmes.php sql injectionSourceCodester Online Admission System
- CVE-2026-4624SourceCodester Online Library Management System Parameter home.php sql injectionSourceCodester Online Library Management System
- CVE-2026-4623DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgeryDefaultFuction Jeson-Customer-Relationship-Management-System
- CVE-2026-33308mod_gnutls missing key purpose check in client certificate verificationairtower-luna mod_gnutls
- CVE-2026-3079LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' ParameterStellarWP LearnDash LMS
- CVE-2026-4617SourceCodester Patients Waiting Area Queue Management System Patient Check-In api_patient_checkin.php ValidateToken improper authorizationSourceCodester Patients Waiting Area Queue Management System
- CVE-2026-4616bolo-blog Article Title article cross site scriptingbolo-blog
- CVE-2026-33306bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRubybcrypt-ruby · bcrypt
- CVE-2026-33320Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceTomWright dasel · github.com/tomwright/dasel/v3 +2
- CVE-2026-29840JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserControll
- CVE-2026-30655SQL injection in Solicitante::resetaSenha() in esiclivre/esiclivre v0.2.2 and earlier allows unauthenticated remote attackers to gain unauth
- CVE-2026-30661iCMS v8.0.0 contains a Cross-Site Scripting (XSS) vulnerability in the User Management component, specifically within the index.html file.
- CVE-2026-30662ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component.concrete5/concrete5