CVEs published March 26, 2026
293 CVEs were published on March 26, 2026: 13 critical, 106 high.
- Published
- 293
- Critical
- 13
- High
- 106
- Medium
- 148
- Low
- 23
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 156
Most affected products
- everest-core
- 18
- HCL Aftermarket DPC
- 17
- Red Hat Enterprise Linux · Red Hat Hardened Images +1
- 6
- TandoorRecipes recipes
- 6
- code-projects Online Food Ordering System
- 5
- dameng100 muucmf
- 4
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 4
- open-webui
- 4
- Red Hat Enterprise Linux
- 4
- Tenda AC5
- 4
Critical 13
- CVE-2026-33945Abitrary file write through systemd-creds optionlxc incus · github.com/lxc/incus +1
- CVE-2026-33897Incus vulnerable to arbitrary file read and write through pongo templateslxc incus · github.com/lxc/incus/v6 +1
- CVE-2026-33670SiYuan has directory traversal within its publishing servicesiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33669SiYuan has Arbitrary Document Reading within the Publishing Servicesiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33640Outline has a rate limit bypass that allows brute force of email login OTPoutline
- CVE-2026-33152Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationTandoorRecipes recipes
- CVE-2026-33494Ory Oathkeeper has a path traversal authorization bypassory oathkeeper · github.com/ory/oathkeeper
- CVE-2026-33396OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probeoneuptime
- CVE-2026-4809Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediableplank laravel-mediable
- CVE-2014-125112Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code executionMIYAGAWA Plack::Middleware::Session::Cookie
- CVE-2026-33526Squid vulnerable to Denial of Service in ICP Request handlingsquid-cache squid
- CVE-2026-30457An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.
- CVE-2026-30458An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
High 106
- CVE-2026-27893vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-outvllm-project vllm · vllm
- CVE-2026-28788Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwriteopen-webui
- CVE-2026-33697CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keysultravioletrs cocos
- CVE-2026-33898Local Incus UI web server vulnerable to nuthentication bypasslxc incus · github.com/lxc/incus/v6/cmd/incus +2
- CVE-2026-4905Tenda AC5 POST Request WifiWpsOOB formWifiWpsOOB stack-based overflowTenda AC5
- CVE-2026-4904Tenda AC5 POST Request setcfm formSetCfm stack-based overflowTenda AC5
- CVE-2026-34352In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an applicationTigerVNC
- CVE-2026-4903Tenda AC5 POST Request QuickIndex formQuickIndex memory corruptionTenda AC5
- CVE-2026-4902Tenda AC5 POST Request addressNat fromAddressNat memory corruptionTenda AC5
- CVE-2026-33686Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtilcode16 sharp · code16/sharp
- CVE-2025-12805Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicyRed Hat OpenShift AI
- CVE-2026-33687Sharp has Unrestricted File Upload via Client-Controlled Validation Rulescode16 sharp · code16/sharp
- CVE-2026-33673PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variablesPrestaShop · prestashop/prestashop
- CVE-2026-28377S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)Grafana Tempo · github.com/grafana/tempo
- CVE-2026-33671Picomatch has a ReDoS vulnerability via extglob quantifiersmicromatch picomatch · picomatch
- CVE-2026-33664Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fieldskestra-io kestra
- CVE-2026-3650Grassroots DICOM Missing release of memory after effective lifetimeGrassroots DICOM
- CVE-2026-33661WeChat Pay callback signature verification bypassed when Host header is localhostyansongda pay · yansongda/pay
- CVE-2026-33645Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`ShaneIsrael fireshare
- CVE-2026-3622Denial-of-Service Vulnerability in UPnP Component of TP Link's TL-WR841NTP-Link Systems TL-WR841N
- CVE-2026-4933Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029Drupal Unpublished Node Permissions · drupal/unpublished_no…
- CVE-2026-3573AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028Drupal AI · drupal/ai
- CVE-2026-32287Infinite loop in github.com/antchfx/xpathgithub.com/antchfx/xpath
- CVE-2026-32286Denial of service in github.com/jackc/pgproto3/v2github.com/jackc/pgproto3/v2
- CVE-2026-32285Denial of service in github.com/buger/jsonparsergithub.com/buger/jsonparser
- CVE-2026-32284Denial of service in github.com/shamaton/msgpackgithub.com/shamaton/msgpack · github.com/shamaton/msgpac… +1
- CVE-2026-33530InvenTree Vulnerable to ORM Filter InjectionInvenTree
- CVE-2026-33632ClearanceKit: opfilter policy bypass via exchangedata and clone operationscraigjbass clearancekit
- CVE-2026-33631ClearanceKit: opfilter policy bypass via non-open file operationscraigjbass clearancekit
- CVE-2023-7338Ruckus Unleashed Authenticated RCE in Gateway ModeRuckus Networks RUCKUS H350 · Ruckus Networks RUCKUS H5… +28
- CVE-2026-33153Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicTandoorRecipes recipes
- CVE-2026-26213thingino-firmware api.cgi Unauthenticated Command Injection in Captive Portalthemactep thingino-firmware
- CVE-2026-4926path-to-regexp vulnerable to Denial of Service via sequential optional groupspath-to-regexp
- CVE-2026-33149Tandoor Recipes Vulnerable to Host Header InjectionTandoorRecipes recipes
- CVE-2026-33506DOM-Based XSS in Ory Polis Login Pageory polis
- CVE-2026-33491Zen-C has Stack-Based Buffer Overflow in Identifier Manglingzenc-lang zenc
- CVE-2026-33505Ory Keto has a SQL injection via forged pagination tokensory keto · github.com/ory/keto
- CVE-2026-33504Ory Hydra has a SQL injection via forged pagination tokensory hydra · github.com/ory/hydra +1
- CVE-2026-33503Ory Kratos has a SQL injection via forged pagination tokensory kratos · github.com/ory/kratos
- CVE-2026-33496Ory Oathkeeper has an authentication bypass by cache key confusionory oathkeeper · github.com/ory/oathkeeper
- CVE-2026-32857Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect ValidationFirecrawl
- CVE-2026-33487goxmldsig has validateSignature Loop Variable Capture Signature Bypassrussellhaering goxmldsig · github.com/russellhaering/goxmld…
- CVE-2026-33468Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL stringskysely-org kysely · kysely
- CVE-2026-33442Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.kysely-org kysely · kysely
- CVE-2026-33430Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissionsbeeware briefcase · briefcase
- CVE-2026-33636LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64pnggroup libpng
- CVE-2026-33416LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`pnggroup libpng
- CVE-2026-33009EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptioeverest-core
- CVE-2026-32846OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File ReadOpenClaw
- CVE-2026-26074EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data raceeverest-core
- CVE-2026-3108Terminal Escape Injection in mmctl Report Posts CommandMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-4867path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameterspath-to-regexp
- CVE-2026-26008EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModeseverest-core
- CVE-2026-23995EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZeverest-core
- CVE-2026-22790EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payloadeverest-core
- CVE-2026-27664A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base system (All versions < VSiemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2026-22593EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsingeverest-core
- CVE-2026-33413etcd: Authorization bypasses in multiple APIsetcd-io etcd · go.etcd.io/etcd/v3 +1
- CVE-2026-2231Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameterstechjewel Fluent Booking – The Ultimate Appointments Schedu…
- CVE-2026-2511JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameterrabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2019-25650River Past CamDo 3.7.6 Structured Exception Handler Buffer Overflowriverpast River Past CamDo
- CVE-2018-25219PassFab Excel Password Recovery 8.3.1 SEH Buffer OverflowPassfab Excel Password Recovery
- CVE-2018-25218PassFab RAR Password Recovery 9.3.2 SEH Buffer OverflowPassfab RAR Password Recovery
- CVE-2018-25217PDF Explorer 1.5.66.2 Structured Exception Handler Local Code ExecutionRttsoftware PDF Explorer
- CVE-2018-25213Nsauditor 3.0.28.0 Local SEH Buffer OverflowNsauditor Local SEH Buffer Overflow
- CVE-2018-25212Boxoft wav-wma Converter 1.0 Local Buffer Overflow SEHBoxoft WAV to WMA Converter
- CVE-2018-25211Allok Video Splitter 3.1.1217 Buffer Overflow via License NameAlloksoft Splitter
- CVE-2025-55261HCL Aftermarket DPC is affected by Missing Functional Level Access ControlHCL Aftermarket DPC
- CVE-2025-55262HCL Aftermarket DPC is affected by SQL InjectionHCL Aftermarket DPC
- CVE-2025-55263HCL Aftermarket DPC is affected by Hardcoded Sensitive DataHCL Aftermarket DPC
- CVE-2026-1961Forman: foreman: remote code execution via command injection in websocket proxyRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +2
- CVE-2025-41359Multiple vulnerabilities in Small HTTP server by SmallsrvSmallsrv Small HTTP
- CVE-2018-25210WebOfisi E-Ticaret 4.0 SQL Injection via urun ParameterWeb-Ofisi Ticaret
- CVE-2018-25209OpenBiz Cubi Lite 3.0.8 SQL Injection via username ParameterSourceforge OpenBiz Cubi Lite
- CVE-2018-25208qdPM 9.1 SQL Injection via filter_by ParametersqdPM
- CVE-2018-25207Online Quiz Maker 1.0 SQL Injection via catid ParameterHscripts Online Quiz Maker
- CVE-2018-25206KomSeo Cart 1.3 SQL Injection via edit.phpSitemakin KomSeo Cart
- CVE-2018-25205ASP.NET jVideo Kit 1.0 SQL Injection via query ParameterMediasoftpro ASP.NET jVideo Kit
- CVE-2018-25204Library CMS 1.0 SQL Injection via admin loginWecodex Library CMS
- CVE-2018-25203Online Store System CMS 1.0 SQL Injection via clientaccessWecodex Online Store System CMS
- CVE-2018-25202SAT CFDI 3.3 SQL Injection via signIn endpointWecodex SAT CFDI
- CVE-2018-25201School Management System CMS 1.0 Admin Login SQL InjectionWecodex Solutions School Management System CMS
- CVE-2018-25195Wecodex Hotel CMS 1.0 SQL Injection via Admin LoginWecodex Hotel CMS
- CVE-2018-25185Wecodex Restaurant CMS 1.0 SQL Injection via LoginWecodex Restaurant CMS
- CVE-2018-25183Shipping System CMS 1.0 SQL Injection via admin loginWecodex Shipping System CMS
- CVE-2025-41368Multiple vulnerabilities in Small HTTP server by SmallsrvSmallsrv Small HTTP
- CVE-2026-24068Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic LibraryVienna Symphonic Library Vienna Assistant
- CVE-2026-4862UTT HiPER 1250GW Parameter formConfigDnsFilterGlobal strcpy buffer overflowUTT HiPER 1250GW
- CVE-2026-4861Wavlink WL-NU516U1 nas.cgi ftext stack-based overflowWavlink WL-NU516U1
- CVE-2026-32680The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder.RATOC Systems RATOC RAID Monitoring Manager for Windows
- CVE-2026-28760The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs.RATOC Systems RATOC RAID Monitoring Manager for Windows
- CVE-2026-4747Remote code execution via RPCSEC_GSS packet validationFreeBSD
- CVE-2026-4652Remote denial of service via null pointer dereferenceFreeBSD
- CVE-2026-4247TCP: remotely exploitable DoS vector (mbuf leak)FreeBSD
- CVE-2026-4840Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injectionNetcore Power 15AX
- CVE-2026-4329Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Headerspecialk Blackhole for Bad Bots
- CVE-2026-2931Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Changeameliabooking Booking for Appointments and Events Calendar…
- CVE-2026-3328Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Postsshabti Frontend Admin by DynamiApps
- CVE-2025-15101An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administratoASUS Router
- CVE-2026-4484Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to AdministratorMasteriyo LMS – Online Course Builder for eLearning, LMS &…
- CVE-2026-33285LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crashharttle liquidjs · liquidjs
- CVE-2026-33287LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Patternharttle liquidjs · liquidjs
- CVE-2026-33942Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)saloonphp saloon · saloonphp/saloon
- CVE-2026-33183Saloon has a Fixture Name Path Traversal Vulnerabilitysaloonphp saloon · saloonphp/saloon
- CVE-2026-32748Squid has Denial of Service in ICP Response handlingsquid-cache squid
- CVE-2026-30463Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.
Medium, low and unrated 174
- CVE-2026-33699pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_streampy-pdf pypdf · pypdf
- CVE-2026-29071Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memoriesopen-webui
- CVE-2026-29070Open WebUI has unauthorized deletion of knowledge filesopen-webui
- CVE-2026-28786Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`open-webui
- CVE-2026-33743Incus vulnerable to denial of source through crafted bucket backup filelxc incus · github.com/lxc/incus +1
- CVE-2026-33711Incus vulnerable to local privilege escalation through VM screenshot pathlxc incus · github.com/lxc/incus/v6 +1
- CVE-2026-33542Incus does not verify combined fingerprint when downloading images from simplestreams serverslxc incus · github.com/lxc/incus +2
- CVE-2026-4900code-projects Online Food Ordering System localhost.sql privilege escalationcode-projects Online Food Ordering System
- CVE-2026-4899code-projects Online Food Ordering System food.php cross site scriptingcode-projects Online Food Ordering System
- CVE-2026-33682Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)streamlit
- CVE-2026-33674PrestaShop: Improper Use of Validation FrameworkPrestaShop · prestashop/prestashop
- CVE-2026-33672Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matchingmicromatch picomatch · picomatch
- CVE-2026-0748Access bypass in Drupal 7 i18n_node translation UIDrupal Internationalization (i18n) - i18n_node submodule
- CVE-2026-4346Cleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850NTP-Link Systems TL-WR850N
- CVE-2026-1556Information disclosure via file URI overwrite in File (Field) PathsDrupal File (Field) Paths
- CVE-2026-4898code-projects Online Food Ordering System contact.php cross site scriptingcode-projects Online Food Ordering System
- CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsrails activestorage · activestorage
- CVE-2026-33653Uploady Vulnerable to Stored Cross-Site Scripting (XSS)farisc0de Uploady
- CVE-2026-33638Ech0 authenticated user-list exposed data via public `/api/allusers` endpointlin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-33742Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notesinvoiceninja
- CVE-2026-33628Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Itemsinvoiceninja · invoiceninja/invoiceninja
- CVE-2026-33623PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Executionpinchtab · github.com/pinchtab/pinchtab/cmd/pinchtab +1
- CVE-2026-33622A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Executionpinchtab · github.com/pinchtab/pinchtab/cmd/pinchtab +1
- CVE-2026-33621PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Tokenpinchtab · github.com/pinchtab/pinchtab
- CVE-2026-33620PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systemspinchtab · github.com/pinchtab/pinchtab
- CVE-2026-33619PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrlpinchtab · github.com/pinchtab/pinchtab
- CVE-2026-33545MobSF has SQL Injection in its SQLite Database Viewer UtilsMobile-Security-Framework-MobSF · mobsf
- CVE-2026-33635iCalendar has ICS injection via unsanitized URI property valuesicalendar
- CVE-2026-33541TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Servicemiraheze TSPortal · miraheze/ts-portal
- CVE-2026-33738Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)LycheeOrg Lychee
- CVE-2026-4393Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030Drupal Automated Logout · drupal/autologout
- CVE-2026-0965Libssh: libssh: denial of service via improper configuration file handlingRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-0967Libssh: libssh: denial of service via inefficient regular expression processingRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-0968Libssh: libssh: denial of service due to malformed sftp messageRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-0964Libssh: improper sanitation of paths received from scp serversRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-0966Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()Red Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-21724Missing Protected-field Authorization in Provisioning Contact Points APIGrafana OSS · github.com/grafana/grafana
- CVE-2026-33375Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoSGrafana OSS
- CVE-2026-33644Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPsLycheeOrg Lychee
- CVE-2026-3532OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027Drupal OpenID Connect / OAuth client · drupal/openid_connect
- CVE-2026-3531OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026Drupal OpenID Connect / OAuth client · drupal/openid_connect
- CVE-2026-3530OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025Drupal OpenID Connect / OAuth client · drupal/openid_connect
- CVE-2026-3529Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024Drupal Google Analytics GA4 · drupal/ga4_google_analytics
- CVE-2026-3528Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023Drupal Calculation Fields · drupal/calculation_fields
- CVE-2026-3527AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022Drupal AJAX Dashboard · drupal/ajax_dashboard
- CVE-2026-3526File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021Drupal File Access Fix · drupal/file_access_fix
- CVE-2026-3525File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020Drupal File Access Fix · drupal/file_access_fix
- CVE-2026-2100P11-kit: null dereference via c_derivekey with specific null parametersp11-glue p11-kit · Red Hat Enterprise Linux +6
- CVE-2026-33537Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blockedLycheeOrg Lychee
- CVE-2026-2239Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflowRed Hat Enterprise Linux
- CVE-2026-2272Gimp: gimp: memory corruption due to integer overflow in ico file handlingRed Hat Enterprise Linux
- CVE-2026-2271Gimp: gimp: denial of service via crafted psp image fileRed Hat Enterprise Linux
- CVE-2026-33536ImageMagick has an Out-of-bounds Write via InterpretImageFilenameImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-33535ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interactionImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-33532yaml is vulnerable to Stack Overflow via deeply nested YAML collectionseemeli yaml · yaml
- CVE-2026-33531InvenTree has Path Traversal In Report TemplatesInvenTree
- CVE-2026-2436Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshakeRed Hat Enterprise Linux
- CVE-2021-4474Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File AccessRuckus Wireless RUCKUS Access Point · RUCKUS Unleashed +4
- CVE-2026-33529Zoraxy: Authenticated Path Traversal in Config Import leads to RCEtobychui zoraxy · github.com/tobychui/zoraxy
- CVE-2026-33528GoDoxy has a Path Traversal Vulnerability in its File APIyusing godoxy · github.com/yusing/godoxy
- CVE-2026-33525Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scriptingauthelia · github.com/authelia/authelia/v4 +1
- CVE-2026-3121Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permissionRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2026-3190Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection apiRed Hat build of Keycloak · org.keycloak:keycloak-server… +2
- CVE-2026-33148URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyTandoorRecipes recipes
- CVE-2026-29055Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PIITandoorRecipes recipes
- CVE-2026-4923path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardspath-to-regexp
- CVE-2026-28503Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404TandoorRecipes recipes
- CVE-2026-33495Ory Oathkeeper has an authentication bypass by usage of untrusted headerory oathkeeper · github.com/ory/oathkeeper
- CVE-2026-33732srvx is vulnerable to middleware bypass via absolute URI in request lineh3js srvx · srvx
- CVE-2026-33490h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routesh3js h3 · h3
- CVE-2026-33486Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documentsroadiz core-bundle-dev-app · roadiz/documents
- CVE-2026-33481Syft improper temporary file cleanupanchore syft · github.com/anchore/syft
- CVE-2026-33477FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file contenterror311 FileRise
- CVE-2026-33470Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webpblakeblackshear frigate
- CVE-2026-33469Authenticated Frigate users can read the full unredacted configuration via `/api/config/rawblakeblackshear frigate
- CVE-2026-34071Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML ExportStirling-Tools Stirling-PDF
- CVE-2026-33438Stirling-PDF vulnerable to DoS via add-watermarkStirling-Tools Stirling-PDF
- CVE-2026-33402SAK-52311: Sakai site-manage group titles can contain XSS contentsakaiproject sakai
- CVE-2026-33015EVerest has RemoteStop Bypass via BCB Toggle Session Restarteverest-core
- CVE-2026-33014EVerest has Delayed Authorization Response Bypasses Termination After RemoteStopeverest-core
- CVE-2026-29044EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStartedeverest-core
- CVE-2026-27828EVerest: ISO15118 session_setup use-after-free can crash EVSE processeverest-core
- CVE-2026-27816EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE stateeverest-core
- CVE-2026-27815EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE stateeverest-core
- CVE-2026-3112Arbitrary File Read via Advanced Logging Support PacketMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-3109Missing timestamp validation in Zoom webhook handlerMattermost
- CVE-2026-27814EVerest EvseManager phase-switch path has unsynchronized shared-state access race conditioneverest-core
- CVE-2026-27813EVerest has use-after-free in auth timeout timer via race conditioneverest-core
- CVE-2026-3115Guest users can view group member IDs without respecting view restrictionsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-3114Zip Bomb Denial of Service via Unrestricted Archive DecompressionMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-3116Improper Input Validation in Zoom Plugin Webhook HandlerMattermost
- CVE-2026-3113mmctl export download command doesn’t restrict permissions to created file to file ownerMattermost · github.com/mattermost/mattermost-server
- CVE-2026-26073EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queueeverest-core
- CVE-2026-4897Polkit: polkit: denial of service via unbounded input processing through standard inputRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-26072EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_mapeverest-core
- CVE-2026-26071EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Freeeverest-core
- CVE-2026-26070EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crasheverest-core
- CVE-2026-28298SolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2026-27663A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.Siemens CPCI85 Central Processing/Communication · Siemens R…
- CVE-2026-28297SolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2026-33397Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypassangular-cli · @angular/ssr
- CVE-2026-2389Complianz – GDPR/CCPA Cookie Consent <= 7.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content FilterComplianz – GDPR/CCPA Cookie Consent
- CVE-2026-1032Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Updatethemifyme Conditional Menus
- CVE-2019-25649River Past Audio Converter 7.7.16 Local Buffer Overflow DoSriverpast River Past Audio Converter
- CVE-2019-25648MyVideoConverter Pro 3.14 Denial of Service Buffer OverflowIvideogo MyVideoConverter Pro
- CVE-2018-25216AnyBurn 4.3 Denial of Service Local Buffer OverflowAnyBurn
- CVE-2018-25215Excel Password Recovery Professional 8.2.0.0 Local Buffer Overflow DoSRecoverlostpassword Excel Password Recovery Professional
- CVE-2018-25214MegaPing Local Buffer Overflow Denial of ServiceMagnetosoft MegaPing
- CVE-2026-33343etcd: Nested etcd transactions bypass RBAC authorization checksetcd-io etcd · go.etcd.io/etcd +1
- CVE-2026-4877itsourcecode Payroll Management System index.php cross site scriptingitsourcecode Payroll Management System
- CVE-2026-4876itsourcecode Free Hotel Reservation System index.php sql injectionitsourcecode Free Hotel Reservation System
- CVE-2025-55264HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password ChangeHCL Aftermarket DPC
- CVE-2025-55265HCL Aftermarket DPC is affected by File DiscoveryHCL Aftermarket DPC
- CVE-2025-55266HCL Aftermarket DPC is affected by Session FixationHCL Aftermarket DPC
- CVE-2025-55267HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerabilityHCL Aftermarket DPC
- CVE-2025-55268HCL Aftermarket DPC is affected by Spamming VulnerabilityHCL Aftermarket DPC
- CVE-2025-55269HCL Aftermarket DPC is affected by Weak Password Policy vulnerabilityHCL Aftermarket DPC
- CVE-2025-55270HCL Aftermarket DPC is affected by Improper Input ValidationHCL Aftermarket DPC
- CVE-2025-55271HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerabilityHCL Aftermarket DPC
- CVE-2025-55272HCL Aftermarket DPC is affected by Banner Disclosure vulnerabilityHCL Aftermarket DPC
- CVE-2025-55273HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerabilityHCL Aftermarket DPC
- CVE-2025-55274HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerabilityHCL Aftermarket DPC
- CVE-2025-55275HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerabilityHCL Aftermarket DPC
- CVE-2025-55276HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerabilityHCL Aftermarket DPC
- CVE-2025-55277HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerabilityHCL Aftermarket DPC
- CVE-2025-41027Multiple vulnerabilities in GDTallerGDTaller
- CVE-2025-41026Multiple vulnerabilities in GDTallerGDTaller
- CVE-2026-4875itsourcecode Free Hotel Reservation System index.php unrestricted uploaditsourcecode Free Hotel Reservation System
- CVE-2026-4887Gimp: gimp:memory disclosure and denial of service via specially crafted pcx imageRed Hat Enterprise Linux 7 Extended Lifecycle Support · Red…
- CVE-2026-4274Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level accessMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-23398icmp: fix NULL pointer dereference in icmp_tag_validation()Linux
- CVE-2026-23397nfnetlink_osf: validate individual option lengths in fingerprintsLinux
- CVE-2026-23396wifi: mac80211: fix NULL deref in mesh_matches_local()Linux
- CVE-2026-4263Incorrect authorization in HiJiffy ChatbotHiJiffy Chatbot
- CVE-2026-4262Incorrect authorization in HiJiffy ChatbotHiJiffy Chatbot
- CVE-2026-4860648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization648540858 wvp-GB28181-pro
- CVE-2026-4850code-projects Simple Laundry System Parameter checkregisitem.php sql injectioncode-projects Simple Laundry System
- CVE-2026-4849code-projects Simple Laundry System Parameter modify.php cross site scriptingcode-projects Simple Laundry System
- CVE-2026-4874Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulationRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2026-4848dameng100 muucmf list.html cross site scriptingdameng100 muucmf
- CVE-2026-4847dameng100 muucmf list.html cross site scriptingdameng100 muucmf
- CVE-2026-1890LeadConnector < 3.0.22 - Unauthenticated Rest CallLeadConnector
- CVE-2026-1430WP Lightbox 2 < 3.0.7 - Admin+ Stored XSSWP Lightbox
- CVE-2025-15488Responsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode ExecutionResponsive Plus
- CVE-2025-15433Shared Files < 1.7.58 - Contributor+ Arbitrary File DownloadShared Files
- CVE-2026-4846dameng100 muucmf autoReply.html cross site scriptingdameng100 muucmf
- CVE-2026-4845dameng100 muucmf index.html cross site scriptingdameng100 muucmf
- CVE-2026-1206Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templateelemntor Elementor Website Builder – more than just a page…
- CVE-2026-4844code-projects Online Food Ordering System Admin Login admin.php sql injectioncode-projects Online Food Ordering System
- CVE-2026-4842itsourcecode Online Enrollment System Parameter index.php sql injectionitsourcecode Online Enrollment System
- CVE-2026-4389DSGVO snippet for Leaflet Map and its Extensions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attributehupe13 DSGVO snippet for Leaflet Map and its Extensions
- CVE-2026-33201Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD.GREEN HOUSE CO. Digital Photo Frame GH-WDF10A
- CVE-2026-4841code-projects Online Food Ordering System Shopping Cart cart.php sql injectioncode-projects Online Food Ordering System
- CVE-2026-4278Simple Download Counter <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attributespecialk Simple Download Counter
- CVE-2026-4281FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flowtrainingbusinesspros FormLift for Infusionsoft Web Forms
- CVE-2026-4331Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Actionpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-4839SourceCodester Food Ordering System Parameter purchase.php sql injectionSourceCodester Food Ordering System
- CVE-2026-4838SourceCodester Malawi Online Market display.php sql injectionSourceCodester Malawi Online Market
- CVE-2026-4075BWL Advanced FAQ Manager Lite <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode Attributexenioushk BWL Advanced FAQ Manager Lite
- CVE-2026-1986FloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameterbakkbone FloristPress for Woo – Customize your eCommerce st…
- CVE-2026-4335ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment TitleShortPixel Image Optimizer – Optimize Images, Convert WebP…
- CVE-2026-4836code-projects Accounting System delete.php sql injectioncode-projects Accounting System
- CVE-2026-4835code-projects Accounting System Web Application add_costumer.php cross site scriptingcode-projects Accounting System
- CVE-2026-4833Orc discount Markdown markdown.c compile recursionOrc discount
- CVE-2026-4831kalcaddle kodbox Password-protected Share auth.class.php can improper authenticationkalcaddle kodbox
- CVE-2026-33182Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URLsaloonphp saloon · saloonphp/saloon
- CVE-2026-4830kalcaddle kodbox Public Share userShare.class.php add privilege escalationkalcaddle kodbox
- CVE-2026-33515Squid has issues in ICP message handlingsquid-cache squid
- CVE-2026-29905Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed
- CVE-2026-29933A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary
- CVE-2026-29934A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Ja
- CVE-2026-29969A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbi
- CVE-2026-29976Buffer Overflow vulnerability in ZerBea hcxpcapngtool v.
- CVE-2026-30162Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.