# CVEs published 2026-03-26

293 CVEs were published on March 26, 2026: 13 critical, 106 high. Days are UTC.

- [CVE-2026-33699](https://cve.now/CVE-2026-33699.md): pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read\_from\_stream (CVSS 4.6, py-pdf pypdf · pypdf)
- [CVE-2026-27893](https://cve.now/CVE-2026-27893.md): vLLM's hardcoded trust\_remote\_code=True in NemotronVL and KimiK25 bypasses user security opt-out (CVSS 8.8, vllm-project vllm · vllm)
- [CVE-2026-29071](https://cve.now/CVE-2026-29071.md): Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories (CVSS 3.1, open-webui)
- [CVE-2026-29070](https://cve.now/CVE-2026-29070.md): Open WebUI has unauthorized deletion of knowledge files (CVSS 5.4, open-webui)
- [CVE-2026-28788](https://cve.now/CVE-2026-28788.md): Open WebUI's process\_files\_batch() endpoint missing ownership check, allows unauthorized file overwrite (CVSS 7.1, open-webui)
- [CVE-2026-28786](https://cve.now/CVE-2026-28786.md): Open WebUI vulnerable to Path Traversal in \`POST /api/v1/audio/transcriptions\` (CVSS 4.3, open-webui)
- [CVE-2026-33697](https://cve.now/CVE-2026-33697.md): CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys (CVSS 7.5, ultravioletrs cocos)
- [CVE-2026-33945](https://cve.now/CVE-2026-33945.md): Abitrary file write through systemd-creds option (CVSS 10.0, lxc incus · github.com/lxc/incus +1)
- [CVE-2026-33898](https://cve.now/CVE-2026-33898.md): Local Incus UI web server vulnerable to nuthentication bypass (CVSS 8.8, lxc incus · github.com/lxc/incus/v6/cmd/incus +2)
- [CVE-2026-4905](https://cve.now/CVE-2026-4905.md): Tenda AC5 POST Request WifiWpsOOB formWifiWpsOOB stack-based overflow (CVSS 8.7, Tenda AC5)
- [CVE-2026-4904](https://cve.now/CVE-2026-4904.md): Tenda AC5 POST Request setcfm formSetCfm stack-based overflow (CVSS 8.7, Tenda AC5)
- [CVE-2026-33897](https://cve.now/CVE-2026-33897.md): Incus vulnerable to arbitrary file read and write through pongo templates (CVSS 10.0, lxc incus · github.com/lxc/incus/v6 +1)
- [CVE-2026-33743](https://cve.now/CVE-2026-33743.md): Incus vulnerable to denial of source through crafted bucket backup file (CVSS 6.5, lxc incus · github.com/lxc/incus +1)
- [CVE-2026-33711](https://cve.now/CVE-2026-33711.md): Incus vulnerable to local privilege escalation through VM screenshot path (CVSS 4.7, lxc incus · github.com/lxc/incus/v6 +1)
- [CVE-2026-33542](https://cve.now/CVE-2026-33542.md): Incus does not verify combined fingerprint when downloading images from simplestreams servers (CVSS 5.7, lxc incus · github.com/lxc/incus +2)
- [CVE-2026-34352](https://cve.now/CVE-2026-34352.md): In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application (CVSS 8.5, TigerVNC)
- [CVE-2026-4903](https://cve.now/CVE-2026-4903.md): Tenda AC5 POST Request QuickIndex formQuickIndex memory corruption (CVSS 8.7, Tenda AC5)
- [CVE-2026-4902](https://cve.now/CVE-2026-4902.md): Tenda AC5 POST Request addressNat fromAddressNat memory corruption (CVSS 8.7, Tenda AC5)
- [CVE-2026-4900](https://cve.now/CVE-2026-4900.md): code-projects Online Food Ordering System localhost.sql privilege escalation (CVSS 6.9, code-projects Online Food Ordering System)
- [CVE-2026-4899](https://cve.now/CVE-2026-4899.md): code-projects Online Food Ordering System food.php cross site scripting (CVSS 4.8, code-projects Online Food Ordering System)
- [CVE-2026-33686](https://cve.now/CVE-2026-33686.md): Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil (CVSS 8.8, code16 sharp · code16/sharp)
- [CVE-2025-12805](https://cve.now/CVE-2025-12805.md): Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy (CVSS 8.1, Red Hat OpenShift AI)
- [CVE-2026-33687](https://cve.now/CVE-2026-33687.md): Sharp has Unrestricted File Upload via Client-Controlled Validation Rules (CVSS 8.8, code16 sharp · code16/sharp)
- [CVE-2026-33682](https://cve.now/CVE-2026-33682.md): Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure) (CVSS 4.7, streamlit)
- [CVE-2026-33674](https://cve.now/CVE-2026-33674.md): PrestaShop: Improper Use of Validation Framework (CVSS 2.0, PrestaShop · prestashop/prestashop)
- [CVE-2026-33673](https://cve.now/CVE-2026-33673.md): PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables (CVSS 7.7, PrestaShop · prestashop/prestashop)
- [CVE-2026-28377](https://cve.now/CVE-2026-28377.md): S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) (CVSS 7.5, Grafana Tempo · github.com/grafana/tempo)
- [CVE-2026-33672](https://cve.now/CVE-2026-33672.md): Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching (CVSS 5.3, micromatch picomatch · picomatch)
- [CVE-2026-33671](https://cve.now/CVE-2026-33671.md): Picomatch has a ReDoS vulnerability via extglob quantifiers (CVSS 7.5, micromatch picomatch · picomatch)
- [CVE-2026-0748](https://cve.now/CVE-2026-0748.md): Access bypass in Drupal 7 i18n\_node translation UI (CVSS 5.3, Drupal Internationalization (i18n) - i18n\_node submodule)
- [CVE-2026-4346](https://cve.now/CVE-2026-4346.md): Cleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850N (CVSS 5.1, TP-Link Systems TL-WR850N)
- [CVE-2026-33670](https://cve.now/CVE-2026-33670.md): SiYuan has directory traversal within its publishing service (CVSS 9.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-33669](https://cve.now/CVE-2026-33669.md): SiYuan has Arbitrary Document Reading within the Publishing Service (CVSS 9.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-1556](https://cve.now/CVE-2026-1556.md): Information disclosure via file URI overwrite in File (Field) Paths (CVSS 6.9, Drupal File (Field) Paths)
- [CVE-2026-33664](https://cve.now/CVE-2026-33664.md): Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields (CVSS 7.3, kestra-io kestra)
- [CVE-2026-3650](https://cve.now/CVE-2026-3650.md): Grassroots DICOM Missing release of memory after effective lifetime (CVSS 8.7, Grassroots DICOM)
- [CVE-2026-4898](https://cve.now/CVE-2026-4898.md): code-projects Online Food Ordering System contact.php cross site scripting (CVSS 5.3, code-projects Online Food Ordering System)
- [CVE-2026-33661](https://cve.now/CVE-2026-33661.md): WeChat Pay callback signature verification bypassed when Host header is localhost (CVSS 8.6, yansongda pay · yansongda/pay)
- [CVE-2026-33658](https://cve.now/CVE-2026-33658.md): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests (CVSS 2.3, rails activestorage · activestorage)
- [CVE-2026-33653](https://cve.now/CVE-2026-33653.md): Uploady Vulnerable to Stored Cross-Site Scripting (XSS) (CVSS 4.6, farisc0de Uploady)
- [CVE-2026-33645](https://cve.now/CVE-2026-33645.md): Fireshare has Path Traversal Arbitrary File Write in \`/api/uploadChunked\` (CVSS 7.1, ShaneIsrael fireshare)
- [CVE-2026-33640](https://cve.now/CVE-2026-33640.md): Outline has a rate limit bypass that allows brute force of email login OTP (CVSS 9.1, outline)
- [CVE-2026-33638](https://cve.now/CVE-2026-33638.md): Ech0 authenticated user-list exposed data via public \`/api/allusers\` endpoint (CVSS 5.3, lin-snow Ech0 · github.com/lin-snow/ech0)
- [CVE-2026-33742](https://cve.now/CVE-2026-33742.md): Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes (CVSS 5.4, invoiceninja)
- [CVE-2026-33628](https://cve.now/CVE-2026-33628.md): Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items (CVSS 5.4, invoiceninja · invoiceninja/invoiceninja)
- [CVE-2026-33623](https://cve.now/CVE-2026-33623.md): PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution (CVSS 6.7, pinchtab · github.com/pinchtab/pinchtab/cmd/pinchtab +1)
- [CVE-2026-33622](https://cve.now/CVE-2026-33622.md): A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution (CVSS 6.1, pinchtab · github.com/pinchtab/pinchtab/cmd/pinchtab +1)
- [CVE-2026-33621](https://cve.now/CVE-2026-33621.md): PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token (CVSS 4.8, pinchtab · github.com/pinchtab/pinchtab)
- [CVE-2026-33620](https://cve.now/CVE-2026-33620.md): PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems (CVSS 4.3, pinchtab · github.com/pinchtab/pinchtab)
- [CVE-2026-3622](https://cve.now/CVE-2026-3622.md): Denial-of-Service Vulnerability in UPnP Component of TP Link's TL-WR841N (CVSS 7.1, TP-Link Systems TL-WR841N)
- [CVE-2026-33619](https://cve.now/CVE-2026-33619.md): PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl (CVSS 4.1, pinchtab · github.com/pinchtab/pinchtab)
- [CVE-2026-33545](https://cve.now/CVE-2026-33545.md): MobSF has SQL Injection in its SQLite Database Viewer Utils (CVSS 5.3, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2026-33635](https://cve.now/CVE-2026-33635.md): iCalendar has ICS injection via unsanitized URI property values (CVSS 4.3, icalendar)
- [CVE-2026-33541](https://cve.now/CVE-2026-33541.md): TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service (CVSS 6.5, miraheze TSPortal · miraheze/ts-portal)
- [CVE-2026-33738](https://cve.now/CVE-2026-33738.md): Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) (CVSS 4.8, LycheeOrg Lychee)
- [CVE-2026-4393](https://cve.now/CVE-2026-4393.md): Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030 (CVSS 4.3, Drupal Automated Logout · drupal/autologout)
- [CVE-2026-4933](https://cve.now/CVE-2026-4933.md): Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029 (CVSS 7.5, Drupal Unpublished Node Permissions · drupal/unpublished\_no…)
- [CVE-2026-3573](https://cve.now/CVE-2026-3573.md): AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028 (CVSS 7.5, Drupal AI · drupal/ai)
- [CVE-2026-0965](https://cve.now/CVE-2026-0965.md): Libssh: libssh: denial of service via improper configuration file handling (CVSS 3.3, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-0967](https://cve.now/CVE-2026-0967.md): Libssh: libssh: denial of service via inefficient regular expression processing (CVSS 2.2, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-0968](https://cve.now/CVE-2026-0968.md): Libssh: libssh: denial of service due to malformed sftp message (CVSS 3.1, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-0964](https://cve.now/CVE-2026-0964.md): Libssh: improper sanitation of paths received from scp servers (CVSS 5.0, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-0966](https://cve.now/CVE-2026-0966.md): Libssh: libssh: denial of service via zero-length input in ssh\_get\_hexa() (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-21724](https://cve.now/CVE-2026-21724.md): Missing Protected-field Authorization in Provisioning Contact Points API (CVSS 5.4, Grafana OSS · github.com/grafana/grafana)
- [CVE-2026-33375](https://cve.now/CVE-2026-33375.md): Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS (CVSS 6.5, Grafana OSS)
- [CVE-2026-33644](https://cve.now/CVE-2026-33644.md): Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs (CVSS 2.3, LycheeOrg Lychee)
- [CVE-2026-3532](https://cve.now/CVE-2026-3532.md): OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027 (CVSS 4.2, Drupal OpenID Connect / OAuth client · drupal/openid\_connect)
- [CVE-2026-3531](https://cve.now/CVE-2026-3531.md): OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026 (CVSS 6.5, Drupal OpenID Connect / OAuth client · drupal/openid\_connect)
- [CVE-2026-3530](https://cve.now/CVE-2026-3530.md): OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025 (CVSS 4.3, Drupal OpenID Connect / OAuth client · drupal/openid\_connect)
- [CVE-2026-3529](https://cve.now/CVE-2026-3529.md): Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024 (CVSS 6.1, Drupal Google Analytics GA4 · drupal/ga4\_google\_analytics)
- [CVE-2026-3528](https://cve.now/CVE-2026-3528.md): Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023 (CVSS 6.1, Drupal Calculation Fields · drupal/calculation\_fields)
- [CVE-2026-3527](https://cve.now/CVE-2026-3527.md): AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022 (CVSS 6.5, Drupal AJAX Dashboard · drupal/ajax\_dashboard)
- [CVE-2026-3526](https://cve.now/CVE-2026-3526.md): File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021 (CVSS 5.3, Drupal File Access Fix · drupal/file\_access\_fix)
- [CVE-2026-3525](https://cve.now/CVE-2026-3525.md): File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020 (CVSS 5.3, Drupal File Access Fix · drupal/file\_access\_fix)
- [CVE-2026-2100](https://cve.now/CVE-2026-2100.md): P11-kit: null dereference via c\_derivekey with specific null parameters (CVSS 5.3, p11-glue p11-kit · Red Hat Enterprise Linux +6)
- [CVE-2026-33537](https://cve.now/CVE-2026-33537.md): Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked (CVSS 5.3, LycheeOrg Lychee)
- [CVE-2026-2239](https://cve.now/CVE-2026-2239.md): Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow (CVSS 2.8, Red Hat Enterprise Linux)
- [CVE-2026-2272](https://cve.now/CVE-2026-2272.md): Gimp: gimp: memory corruption due to integer overflow in ico file handling (CVSS 4.3, Red Hat Enterprise Linux)
- [CVE-2026-2271](https://cve.now/CVE-2026-2271.md): Gimp: gimp: denial of service via crafted psp image file (CVSS 3.3, Red Hat Enterprise Linux)
- [CVE-2026-33536](https://cve.now/CVE-2026-33536.md): ImageMagick has an Out-of-bounds Write via InterpretImageFilename (CVSS 5.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-33535](https://cve.now/CVE-2026-33535.md): ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction (CVSS 4.0, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-33532](https://cve.now/CVE-2026-33532.md): yaml is vulnerable to Stack Overflow via deeply nested YAML collections (CVSS 4.3, eemeli yaml · yaml)
- [CVE-2026-32287](https://cve.now/CVE-2026-32287.md): Infinite loop in github.com/antchfx/xpath (CVSS 7.5, github.com/antchfx/xpath)
- [CVE-2026-32286](https://cve.now/CVE-2026-32286.md): Denial of service in github.com/jackc/pgproto3/v2 (CVSS 7.5, github.com/jackc/pgproto3/v2)
- [CVE-2026-32285](https://cve.now/CVE-2026-32285.md): Denial of service in github.com/buger/jsonparser (CVSS 7.5, github.com/buger/jsonparser)
- [CVE-2026-32284](https://cve.now/CVE-2026-32284.md): Denial of service in github.com/shamaton/msgpack (CVSS 7.5, github.com/shamaton/msgpack · github.com/shamaton/msgpac… +1)
- [CVE-2026-33531](https://cve.now/CVE-2026-33531.md): InvenTree has Path Traversal In Report Templates (CVSS 4.9, InvenTree)
- [CVE-2026-33530](https://cve.now/CVE-2026-33530.md): InvenTree Vulnerable to ORM Filter Injection (CVSS 7.7, InvenTree)
- [CVE-2026-33632](https://cve.now/CVE-2026-33632.md): ClearanceKit: opfilter policy bypass via exchangedata and clone operations (CVSS 8.4, craigjbass clearancekit)
- [CVE-2026-2436](https://cve.now/CVE-2026-2436.md): Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-33631](https://cve.now/CVE-2026-33631.md): ClearanceKit: opfilter policy bypass via non-open file operations (CVSS 8.7, craigjbass clearancekit)
- [CVE-2021-4474](https://cve.now/CVE-2021-4474.md): Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access (CVSS 6.9, Ruckus Wireless RUCKUS Access Point · RUCKUS Unleashed +4)
- [CVE-2026-33529](https://cve.now/CVE-2026-33529.md): Zoraxy: Authenticated Path Traversal in Config Import leads to RCE (CVSS 3.3, tobychui zoraxy · github.com/tobychui/zoraxy)
- [CVE-2026-33528](https://cve.now/CVE-2026-33528.md): GoDoxy has a Path Traversal Vulnerability in its File API (CVSS 6.5, yusing godoxy · github.com/yusing/godoxy)
- [CVE-2026-33525](https://cve.now/CVE-2026-33525.md): Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting (CVSS 0.5, authelia · github.com/authelia/authelia/v4 +1)
- [CVE-2023-7338](https://cve.now/CVE-2023-7338.md): Ruckus Unleashed Authenticated RCE in Gateway Mode (CVSS 7.7, Ruckus Networks RUCKUS H350 · Ruckus Networks RUCKUS H5… +28)
- [CVE-2026-3121](https://cve.now/CVE-2026-3121.md): Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission (CVSS 6.5, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-3190](https://cve.now/CVE-2026-3190.md): Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api (CVSS 4.3, Red Hat build of Keycloak · org.keycloak:keycloak-server… +2)
- [CVE-2026-33152](https://cve.now/CVE-2026-33152.md): Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication (CVSS 9.1, TandoorRecipes recipes)
- [CVE-2026-33153](https://cve.now/CVE-2026-33153.md): Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic (CVSS 7.7, TandoorRecipes recipes)
- [CVE-2026-33148](https://cve.now/CVE-2026-33148.md): URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key (CVSS 6.5, TandoorRecipes recipes)
- [CVE-2026-29055](https://cve.now/CVE-2026-29055.md): Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII (CVSS 5.3, TandoorRecipes recipes)
- [CVE-2026-4923](https://cve.now/CVE-2026-4923.md): path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards (CVSS 5.9, path-to-regexp)
- [CVE-2026-26213](https://cve.now/CVE-2026-26213.md): thingino-firmware api.cgi Unauthenticated Command Injection in Captive Portal (CVSS 8.7, themactep thingino-firmware)
- [CVE-2026-4926](https://cve.now/CVE-2026-4926.md): path-to-regexp vulnerable to Denial of Service via sequential optional groups (CVSS 7.5, path-to-regexp)
- [CVE-2026-28503](https://cve.now/CVE-2026-28503.md): Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query\_synced\_folder: missing space scoping on get\_object\_or\_404 (CVSS 5.5, TandoorRecipes recipes)
- [CVE-2026-33149](https://cve.now/CVE-2026-33149.md): Tandoor Recipes Vulnerable to Host Header Injection (CVSS 8.1, TandoorRecipes recipes)
- [CVE-2026-33506](https://cve.now/CVE-2026-33506.md): DOM-Based XSS in Ory Polis Login Page (CVSS 8.8, ory polis)
- [CVE-2026-33491](https://cve.now/CVE-2026-33491.md): Zen-C has Stack-Based Buffer Overflow in Identifier Mangling (CVSS 7.8, zenc-lang zenc)
- [CVE-2026-33505](https://cve.now/CVE-2026-33505.md): Ory Keto has a SQL injection via forged pagination tokens (CVSS 7.2, ory keto · github.com/ory/keto)
- [CVE-2026-33504](https://cve.now/CVE-2026-33504.md): Ory Hydra has a SQL injection via forged pagination tokens (CVSS 7.2, ory hydra · github.com/ory/hydra +1)
- [CVE-2026-33503](https://cve.now/CVE-2026-33503.md): Ory Kratos has a SQL injection via forged pagination tokens (CVSS 7.2, ory kratos · github.com/ory/kratos)
- [CVE-2026-33496](https://cve.now/CVE-2026-33496.md): Ory Oathkeeper has an authentication bypass by cache key confusion (CVSS 8.1, ory oathkeeper · github.com/ory/oathkeeper)
- [CVE-2026-32857](https://cve.now/CVE-2026-32857.md): Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation (CVSS 7.8, Firecrawl)
- [CVE-2026-33495](https://cve.now/CVE-2026-33495.md): Ory Oathkeeper has an authentication bypass by usage of untrusted header (CVSS 6.5, ory oathkeeper · github.com/ory/oathkeeper)
- [CVE-2026-33494](https://cve.now/CVE-2026-33494.md): Ory Oathkeeper has a path traversal authorization bypass (CVSS 10.0, ory oathkeeper · github.com/ory/oathkeeper)
- [CVE-2026-33732](https://cve.now/CVE-2026-33732.md): srvx is vulnerable to middleware bypass via absolute URI in request line (CVSS 4.8, h3js srvx · srvx)
- [CVE-2026-33490](https://cve.now/CVE-2026-33490.md): h3: Missing Path Segment Boundary Check in \`mount()\` Causes Middleware Execution on Unrelated Prefix-Matching Routes (CVSS 3.7, h3js h3 · h3)
- [CVE-2026-33487](https://cve.now/CVE-2026-33487.md): goxmldsig has validateSignature Loop Variable Capture Signature Bypass (CVSS 7.5, russellhaering goxmldsig · github.com/russellhaering/goxmld…)
- [CVE-2026-33486](https://cve.now/CVE-2026-33486.md): Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents (CVSS 6.8, roadiz core-bundle-dev-app · roadiz/documents)
- [CVE-2026-33481](https://cve.now/CVE-2026-33481.md): Syft improper temporary file cleanup (CVSS 5.3, anchore syft · github.com/anchore/syft)
- [CVE-2026-33477](https://cve.now/CVE-2026-33477.md): FileRise has incorrect authorization in /api/file/snippet.php allows read\_own users to read other users’ file content (CVSS 4.3, error311 FileRise)
- [CVE-2026-33470](https://cve.now/CVE-2026-33470.md): Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event\_id}/snapshot-clean.webp (CVSS 6.5, blakeblackshear frigate)
- [CVE-2026-33469](https://cve.now/CVE-2026-33469.md): Authenticated Frigate users can read the full unredacted configuration via \`/api/config/raw (CVSS 6.5, blakeblackshear frigate)
- [CVE-2026-33468](https://cve.now/CVE-2026-33468.md): Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in \`sql.lit(string)\` usage or similar methods that append string literal values into the compiled SQL strings (CVSS 8.1, kysely-org kysely · kysely)
- [CVE-2026-33442](https://cve.now/CVE-2026-33442.md): Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. (CVSS 8.1, kysely-org kysely · kysely)
- [CVE-2026-34071](https://cve.now/CVE-2026-34071.md): Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export (CVSS 5.4, Stirling-Tools Stirling-PDF)
- [CVE-2026-33438](https://cve.now/CVE-2026-33438.md): Stirling-PDF vulnerable to DoS via add-watermark (CVSS 6.5, Stirling-Tools Stirling-PDF)
- [CVE-2026-33430](https://cve.now/CVE-2026-33430.md): Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions (CVSS 7.3, beeware briefcase · briefcase)
- [CVE-2026-33636](https://cve.now/CVE-2026-33636.md): LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 (CVSS 7.6, pnggroup libpng)
- [CVE-2026-33416](https://cve.now/CVE-2026-33416.md): LIBPNG has use-after-free via pointer aliasing in \`png\_set\_tRNS\` and \`png\_set\_PLTE\` (CVSS 7.5, pnggroup libpng)
- [CVE-2026-33402](https://cve.now/CVE-2026-33402.md): SAK-52311: Sakai site-manage group titles can contain XSS content (CVSS 1.3, sakaiproject sakai)
- [CVE-2026-33015](https://cve.now/CVE-2026-33015.md): EVerest has RemoteStop Bypass via BCB Toggle Session Restart (CVSS 5.2, everest-core)
- [CVE-2026-33014](https://cve.now/CVE-2026-33014.md): EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop (CVSS 5.2, everest-core)
- [CVE-2026-33009](https://cve.now/CVE-2026-33009.md): EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio (CVSS 8.2, everest-core)
- [CVE-2026-29044](https://cve.now/CVE-2026-29044.md): EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted (CVSS 5.0, everest-core)
- [CVE-2026-32846](https://cve.now/CVE-2026-32846.md): OpenClaw \< 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read (CVSS 8.7, OpenClaw)
- [CVE-2026-27828](https://cve.now/CVE-2026-27828.md): EVerest: ISO15118 session\_setup use-after-free can crash EVSE process (CVSS 5.5, everest-core)
- [CVE-2026-27816](https://cve.now/CVE-2026-27816.md): EVerest's ISO15118 update\_energy\_transfer\_modes overflow can corrupt EVSE state (CVSS 5.5, everest-core)
- [CVE-2026-27815](https://cve.now/CVE-2026-27815.md): EVerest: ISO15118 session\_setup payment options overflow can corrupt EVSE state (CVSS 5.5, everest-core)
- [CVE-2026-3112](https://cve.now/CVE-2026-3112.md): Arbitrary File Read via Advanced Logging Support Packet (CVSS 6.8, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-3109](https://cve.now/CVE-2026-3109.md): Missing timestamp validation in Zoom webhook handler (CVSS 2.2, Mattermost)
- [CVE-2026-27814](https://cve.now/CVE-2026-27814.md): EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition (CVSS 4.2, everest-core)
- [CVE-2026-27813](https://cve.now/CVE-2026-27813.md): EVerest has use-after-free in auth timeout timer via race condition (CVSS 5.3, everest-core)
- [CVE-2026-3115](https://cve.now/CVE-2026-3115.md): Guest users can view group member IDs without respecting view restrictions (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-3114](https://cve.now/CVE-2026-3114.md): Zip Bomb Denial of Service via Unrestricted Archive Decompression (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-26074](https://cve.now/CVE-2026-26074.md): EVerest: OCPP201 startup event\_queue lock mismatch leads to std::map/std::queue data race (CVSS 7.0, everest-core)
- [CVE-2026-3116](https://cve.now/CVE-2026-3116.md): Improper Input Validation in Zoom Plugin Webhook Handler (CVSS 4.9, Mattermost)
- [CVE-2026-3113](https://cve.now/CVE-2026-3113.md): mmctl export download command doesn’t restrict permissions to created file to file owner (CVSS 5.0, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-3108](https://cve.now/CVE-2026-3108.md): Terminal Escape Injection in mmctl Report Posts Command (CVSS 8.0, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-4867](https://cve.now/CVE-2026-4867.md): path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters (CVSS 7.5, path-to-regexp)
- [CVE-2026-26073](https://cve.now/CVE-2026-26073.md): EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event\_queue (CVSS 5.9, everest-core)
- [CVE-2026-4897](https://cve.now/CVE-2026-4897.md): Polkit: polkit: denial of service via unbounded input processing through standard input (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-26072](https://cve.now/CVE-2026-26072.md): EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse\_soc\_map (CVSS 4.2, everest-core)
- [CVE-2026-26071](https://cve.now/CVE-2026-26071.md): EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free (CVSS 4.2, everest-core)
- [CVE-2026-26070](https://cve.now/CVE-2026-26070.md): EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash (CVSS 4.6, everest-core)
- [CVE-2026-26008](https://cve.now/CVE-2026-26008.md): EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes (CVSS 7.5, everest-core)
- [CVE-2026-23995](https://cve.now/CVE-2026-23995.md): EVerest has stack buffer overflow in ifreq.ifr\_name when interface name exceeds IFNAMSIZ (CVSS 8.4, everest-core)
- [CVE-2026-22790](https://cve.now/CVE-2026-22790.md): EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup\_payload (CVSS 8.8, everest-core)
- [CVE-2026-28298](https://cve.now/CVE-2026-28298.md): SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability (CVSS 5.9, SolarWinds Observability Self-Hosted)
- [CVE-2026-27664](https://cve.now/CVE-2026-27664.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V26.10), SICORE Base system (All versions \< V (CVSS 7.5, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2026-27663](https://cve.now/CVE-2026-27663.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V26.10), RTUM85 RTU Base (All versions \< V26. (CVSS 6.5, Siemens CPCI85 Central Processing/Communication · Siemens R…)
- [CVE-2026-28297](https://cve.now/CVE-2026-28297.md): SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability (CVSS 6.1, SolarWinds Observability Self-Hosted)
- [CVE-2026-22593](https://cve.now/CVE-2026-22593.md): EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing (CVSS 8.4, everest-core)
- [CVE-2026-33397](https://cve.now/CVE-2026-33397.md): Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass (CVSS 6.9, angular-cli · @angular/ssr)
- [CVE-2026-33396](https://cve.now/CVE-2026-33396.md): OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe (CVSS 10.0, oneuptime)
- [CVE-2026-33413](https://cve.now/CVE-2026-33413.md): etcd: Authorization bypasses in multiple APIs (CVSS 8.8, etcd-io etcd · go.etcd.io/etcd/v3 +1)
- [CVE-2026-2389](https://cve.now/CVE-2026-2389.md): Complianz – GDPR/CCPA Cookie Consent \<= 7.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Filter (CVSS 4.9, Complianz – GDPR/CCPA Cookie Consent)
- [CVE-2026-1032](https://cve.now/CVE-2026-1032.md): Conditional Menus \<= 1.2.6 - Cross-Site Request Forgery to Menu Options Update (CVSS 4.3, themifyme Conditional Menus)
- [CVE-2026-2231](https://cve.now/CVE-2026-2231.md): Fluent Booking \<= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters (CVSS 7.2, techjewel Fluent Booking – The Ultimate Appointments Schedu…)
- [CVE-2026-2511](https://cve.now/CVE-2026-2511.md): JS Help Desk – AI-Powered Support & Ticketing System \<= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter (CVSS 7.5, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2019-25650](https://cve.now/CVE-2019-25650.md): River Past CamDo 3.7.6 Structured Exception Handler Buffer Overflow (CVSS 8.6, riverpast River Past CamDo)
- [CVE-2019-25649](https://cve.now/CVE-2019-25649.md): River Past Audio Converter 7.7.16 Local Buffer Overflow DoS (CVSS 6.8, riverpast River Past Audio Converter)
- [CVE-2019-25648](https://cve.now/CVE-2019-25648.md): MyVideoConverter Pro 3.14 Denial of Service Buffer Overflow (CVSS 6.9, Ivideogo MyVideoConverter Pro)
- [CVE-2018-25219](https://cve.now/CVE-2018-25219.md): PassFab Excel Password Recovery 8.3.1 SEH Buffer Overflow (CVSS 8.6, Passfab Excel Password Recovery)
- [CVE-2018-25218](https://cve.now/CVE-2018-25218.md): PassFab RAR Password Recovery 9.3.2 SEH Buffer Overflow (CVSS 8.6, Passfab RAR Password Recovery)
- [CVE-2018-25217](https://cve.now/CVE-2018-25217.md): PDF Explorer 1.5.66.2 Structured Exception Handler Local Code Execution (CVSS 8.6, Rttsoftware PDF Explorer)
- [CVE-2018-25216](https://cve.now/CVE-2018-25216.md): AnyBurn 4.3 Denial of Service Local Buffer Overflow (CVSS 6.9, AnyBurn)
- [CVE-2018-25215](https://cve.now/CVE-2018-25215.md): Excel Password Recovery Professional 8.2.0.0 Local Buffer Overflow DoS (CVSS 6.8, Recoverlostpassword Excel Password Recovery Professional)
- [CVE-2018-25214](https://cve.now/CVE-2018-25214.md): MegaPing Local Buffer Overflow Denial of Service (CVSS 6.9, Magnetosoft MegaPing)
- [CVE-2018-25213](https://cve.now/CVE-2018-25213.md): Nsauditor 3.0.28.0 Local SEH Buffer Overflow (CVSS 8.6, Nsauditor Local SEH Buffer Overflow)
- [CVE-2018-25212](https://cve.now/CVE-2018-25212.md): Boxoft wav-wma Converter 1.0 Local Buffer Overflow SEH (CVSS 8.6, Boxoft WAV to WMA Converter)
- [CVE-2018-25211](https://cve.now/CVE-2018-25211.md): Allok Video Splitter 3.1.1217 Buffer Overflow via License Name (CVSS 8.5, Alloksoft Splitter)
- [CVE-2026-33343](https://cve.now/CVE-2026-33343.md): etcd: Nested etcd transactions bypass RBAC authorization checks (CVSS 0.0, etcd-io etcd · go.etcd.io/etcd +1)
- [CVE-2025-55261](https://cve.now/CVE-2025-55261.md): HCL Aftermarket DPC is affected by Missing Functional Level Access Control (CVSS 8.1, HCL Aftermarket DPC)
- [CVE-2025-55262](https://cve.now/CVE-2025-55262.md): HCL Aftermarket DPC is affected by SQL Injection (CVSS 8.3, HCL Aftermarket DPC)
- [CVE-2026-4877](https://cve.now/CVE-2026-4877.md): itsourcecode Payroll Management System index.php cross site scripting (CVSS 5.3, itsourcecode Payroll Management System)
- [CVE-2026-4876](https://cve.now/CVE-2026-4876.md): itsourcecode Free Hotel Reservation System index.php sql injection (CVSS 5.3, itsourcecode Free Hotel Reservation System)
- [CVE-2025-55263](https://cve.now/CVE-2025-55263.md): HCL Aftermarket DPC is affected by Hardcoded Sensitive Data (CVSS 7.3, HCL Aftermarket DPC)
- [CVE-2025-55264](https://cve.now/CVE-2025-55264.md): HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change (CVSS 5.5, HCL Aftermarket DPC)
- [CVE-2025-55265](https://cve.now/CVE-2025-55265.md): HCL Aftermarket DPC is affected by File Discovery (CVSS 6.5, HCL Aftermarket DPC)
- [CVE-2025-55266](https://cve.now/CVE-2025-55266.md): HCL Aftermarket DPC is affected by Session Fixation (CVSS 5.9, HCL Aftermarket DPC)
- [CVE-2025-55267](https://cve.now/CVE-2025-55267.md): HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability (CVSS 5.7, HCL Aftermarket DPC)
- [CVE-2025-55268](https://cve.now/CVE-2025-55268.md): HCL Aftermarket DPC is affected by Spamming Vulnerability (CVSS 4.3, HCL Aftermarket DPC)
- [CVE-2025-55269](https://cve.now/CVE-2025-55269.md): HCL Aftermarket DPC is affected by Weak Password Policy vulnerability (CVSS 4.2, HCL Aftermarket DPC)
- [CVE-2025-55270](https://cve.now/CVE-2025-55270.md): HCL Aftermarket DPC is affected by Improper Input Validation (CVSS 3.5, HCL Aftermarket DPC)
- [CVE-2025-55271](https://cve.now/CVE-2025-55271.md): HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability (CVSS 3.1, HCL Aftermarket DPC)
- [CVE-2025-55272](https://cve.now/CVE-2025-55272.md): HCL Aftermarket DPC is affected by Banner Disclosure vulnerability (CVSS 3.1, HCL Aftermarket DPC)
- [CVE-2026-1961](https://cve.now/CVE-2026-1961.md): Forman: foreman: remote code execution via command injection in websocket proxy (CVSS 8.0, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +2)
- [CVE-2025-55273](https://cve.now/CVE-2025-55273.md): HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability (CVSS 4.3, HCL Aftermarket DPC)
- [CVE-2025-55274](https://cve.now/CVE-2025-55274.md): HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability (CVSS 2.6, HCL Aftermarket DPC)
- [CVE-2025-55275](https://cve.now/CVE-2025-55275.md): HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability (CVSS 3.7, HCL Aftermarket DPC)
- [CVE-2025-55276](https://cve.now/CVE-2025-55276.md): HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability (CVSS 3.1, HCL Aftermarket DPC)
- [CVE-2025-55277](https://cve.now/CVE-2025-55277.md): HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability (CVSS 2.6, HCL Aftermarket DPC)
- [CVE-2025-41027](https://cve.now/CVE-2025-41027.md): Multiple vulnerabilities in GDTaller (CVSS 5.1, GDTaller)
- [CVE-2025-41026](https://cve.now/CVE-2025-41026.md): Multiple vulnerabilities in GDTaller (CVSS 5.1, GDTaller)
- [CVE-2026-4875](https://cve.now/CVE-2026-4875.md): itsourcecode Free Hotel Reservation System index.php unrestricted upload (CVSS 5.1, itsourcecode Free Hotel Reservation System)
- [CVE-2025-41359](https://cve.now/CVE-2025-41359.md): Multiple vulnerabilities in Small HTTP server by Smallsrv (CVSS 8.5, Smallsrv Small HTTP)
- [CVE-2026-4887](https://cve.now/CVE-2026-4887.md): Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image (CVSS 6.1, Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red…)
- [CVE-2018-25210](https://cve.now/CVE-2018-25210.md): WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameter (CVSS 8.8, Web-Ofisi Ticaret)
- [CVE-2018-25209](https://cve.now/CVE-2018-25209.md): OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter (CVSS 8.8, Sourceforge OpenBiz Cubi Lite)
- [CVE-2018-25208](https://cve.now/CVE-2018-25208.md): qdPM 9.1 SQL Injection via filter\_by Parameters (CVSS 8.8, qdPM)
- [CVE-2018-25207](https://cve.now/CVE-2018-25207.md): Online Quiz Maker 1.0 SQL Injection via catid Parameter (CVSS 7.1, Hscripts Online Quiz Maker)
- [CVE-2018-25206](https://cve.now/CVE-2018-25206.md): KomSeo Cart 1.3 SQL Injection via edit.php (CVSS 8.8, Sitemakin KomSeo Cart)
- [CVE-2018-25205](https://cve.now/CVE-2018-25205.md): ASP.NET jVideo Kit 1.0 SQL Injection via query Parameter (CVSS 8.8, Mediasoftpro ASP.NET jVideo Kit)
- [CVE-2018-25204](https://cve.now/CVE-2018-25204.md): Library CMS 1.0 SQL Injection via admin login (CVSS 8.8, Wecodex Library CMS)
- [CVE-2018-25203](https://cve.now/CVE-2018-25203.md): Online Store System CMS 1.0 SQL Injection via clientaccess (CVSS 8.8, Wecodex Online Store System CMS)
- [CVE-2018-25202](https://cve.now/CVE-2018-25202.md): SAT CFDI 3.3 SQL Injection via signIn endpoint (CVSS 8.8, Wecodex SAT CFDI)
- [CVE-2018-25201](https://cve.now/CVE-2018-25201.md): School Management System CMS 1.0 Admin Login SQL Injection (CVSS 7.1, Wecodex Solutions School Management System CMS)
- [CVE-2018-25195](https://cve.now/CVE-2018-25195.md): Wecodex Hotel CMS 1.0 SQL Injection via Admin Login (CVSS 8.8, Wecodex Hotel CMS)
- [CVE-2018-25185](https://cve.now/CVE-2018-25185.md): Wecodex Restaurant CMS 1.0 SQL Injection via Login (CVSS 8.8, Wecodex Restaurant CMS)
- [CVE-2018-25183](https://cve.now/CVE-2018-25183.md): Shipping System CMS 1.0 SQL Injection via admin login (CVSS 8.8, Wecodex Shipping System CMS)
- [CVE-2025-41368](https://cve.now/CVE-2025-41368.md): Multiple vulnerabilities in Small HTTP server by Smallsrv (CVSS 8.7, Smallsrv Small HTTP)
- [CVE-2026-4809](https://cve.now/CVE-2026-4809.md): Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable (CVSS 9.3, plank laravel-mediable)
- [CVE-2026-24068](https://cve.now/CVE-2026-24068.md): Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library (CVSS 8.8, Vienna Symphonic Library Vienna Assistant)
- [CVE-2026-4274](https://cve.now/CVE-2026-4274.md): Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access (CVSS 5.4, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-23398](https://cve.now/CVE-2026-23398.md): icmp: fix NULL pointer dereference in icmp\_tag\_validation() (no CVSS, Linux)
- [CVE-2026-23397](https://cve.now/CVE-2026-23397.md): nfnetlink\_osf: validate individual option lengths in fingerprints (no CVSS, Linux)
- [CVE-2026-23396](https://cve.now/CVE-2026-23396.md): wifi: mac80211: fix NULL deref in mesh\_matches\_local() (no CVSS, Linux)
- [CVE-2026-4263](https://cve.now/CVE-2026-4263.md): Incorrect authorization in HiJiffy Chatbot (CVSS 6.9, HiJiffy Chatbot)
- [CVE-2026-4262](https://cve.now/CVE-2026-4262.md): Incorrect authorization in HiJiffy Chatbot (CVSS 6.9, HiJiffy Chatbot)
- [CVE-2026-4862](https://cve.now/CVE-2026-4862.md): UTT HiPER 1250GW Parameter formConfigDnsFilterGlobal strcpy buffer overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-4861](https://cve.now/CVE-2026-4861.md): Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow (CVSS 8.7, Wavlink WL-NU516U1)
- [CVE-2026-4860](https://cve.now/CVE-2026-4860.md): 648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization (CVSS 6.9, 648540858 wvp-GB28181-pro)
- [CVE-2026-4850](https://cve.now/CVE-2026-4850.md): code-projects Simple Laundry System Parameter checkregisitem.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4849](https://cve.now/CVE-2026-4849.md): code-projects Simple Laundry System Parameter modify.php cross site scripting (CVSS 5.3, code-projects Simple Laundry System)
- [CVE-2026-4874](https://cve.now/CVE-2026-4874.md): Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation (CVSS 3.1, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-4848](https://cve.now/CVE-2026-4848.md): dameng100 muucmf list.html cross site scripting (CVSS 5.3, dameng100 muucmf)
- [CVE-2026-32680](https://cve.now/CVE-2026-32680.md): The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. (CVSS 7.8, RATOC Systems RATOC RAID Monitoring Manager for Windows)
- [CVE-2026-28760](https://cve.now/CVE-2026-28760.md): The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. (CVSS 7.8, RATOC Systems RATOC RAID Monitoring Manager for Windows)
- [CVE-2026-4847](https://cve.now/CVE-2026-4847.md): dameng100 muucmf list.html cross site scripting (CVSS 5.3, dameng100 muucmf)
- [CVE-2026-4747](https://cve.now/CVE-2026-4747.md): Remote code execution via RPCSEC\_GSS packet validation (CVSS 8.8, FreeBSD)
- [CVE-2026-4652](https://cve.now/CVE-2026-4652.md): Remote denial of service via null pointer dereference (CVSS 7.5, FreeBSD)
- [CVE-2026-4247](https://cve.now/CVE-2026-4247.md): TCP: remotely exploitable DoS vector (mbuf leak) (CVSS 7.5, FreeBSD)
- [CVE-2026-1890](https://cve.now/CVE-2026-1890.md): LeadConnector \< 3.0.22 - Unauthenticated Rest Call (CVSS 5.3, LeadConnector)
- [CVE-2026-1430](https://cve.now/CVE-2026-1430.md): WP Lightbox 2 \< 3.0.7 - Admin+ Stored XSS (CVSS 4.8, WP Lightbox)
- [CVE-2025-15488](https://cve.now/CVE-2025-15488.md): Responsive Plus \< 3.4.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, Responsive Plus)
- [CVE-2025-15433](https://cve.now/CVE-2025-15433.md): Shared Files \< 1.7.58 - Contributor+ Arbitrary File Download (CVSS 6.8, Shared Files)
- [CVE-2026-4846](https://cve.now/CVE-2026-4846.md): dameng100 muucmf autoReply.html cross site scripting (CVSS 5.3, dameng100 muucmf)
- [CVE-2026-4845](https://cve.now/CVE-2026-4845.md): dameng100 muucmf index.html cross site scripting (CVSS 5.3, dameng100 muucmf)
- [CVE-2026-1206](https://cve.now/CVE-2026-1206.md): Elementor Website Builder \<= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template (CVSS 4.3, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2026-4844](https://cve.now/CVE-2026-4844.md): code-projects Online Food Ordering System Admin Login admin.php sql injection (CVSS 6.9, code-projects Online Food Ordering System)
- [CVE-2026-4842](https://cve.now/CVE-2026-4842.md): itsourcecode Online Enrollment System Parameter index.php sql injection (CVSS 6.9, itsourcecode Online Enrollment System)
- [CVE-2026-4389](https://cve.now/CVE-2026-4389.md): DSGVO snippet for Leaflet Map and its Extensions \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute (CVSS 6.4, hupe13 DSGVO snippet for Leaflet Map and its Extensions)
- [CVE-2026-33201](https://cve.now/CVE-2026-33201.md): Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. (CVSS 6.8, GREEN HOUSE CO. Digital Photo Frame GH-WDF10A)
- [CVE-2026-4841](https://cve.now/CVE-2026-4841.md): code-projects Online Food Ordering System Shopping Cart cart.php sql injection (CVSS 6.9, code-projects Online Food Ordering System)
- [CVE-2026-4840](https://cve.now/CVE-2026-4840.md): Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection (CVSS 8.7, Netcore Power 15AX)
- [CVE-2026-4278](https://cve.now/CVE-2026-4278.md): Simple Download Counter \<= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute (CVSS 6.4, specialk Simple Download Counter)
- [CVE-2026-4329](https://cve.now/CVE-2026-4329.md): Blackhole for Bad Bots \<= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header (CVSS 7.2, specialk Blackhole for Bad Bots)
- [CVE-2026-4281](https://cve.now/CVE-2026-4281.md): FormLift for Infusionsoft Web Forms \<= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow (CVSS 5.3, trainingbusinesspros FormLift for Infusionsoft Web Forms)
- [CVE-2026-2931](https://cve.now/CVE-2026-2931.md): Amelia Booking \<= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 8.8, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2026-4331](https://cve.now/CVE-2026-4331.md): Blog2Social: Social Media Auto Post & Scheduler \<= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s\_reset\_social\_meta\_tags' AJAX Action (CVSS 4.3, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2026-4839](https://cve.now/CVE-2026-4839.md): SourceCodester Food Ordering System Parameter purchase.php sql injection (CVSS 6.9, SourceCodester Food Ordering System)
- [CVE-2026-4838](https://cve.now/CVE-2026-4838.md): SourceCodester Malawi Online Market display.php sql injection (CVSS 6.9, SourceCodester Malawi Online Market)
- [CVE-2026-4075](https://cve.now/CVE-2026-4075.md): BWL Advanced FAQ Manager Lite \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox\_id' Shortcode Attribute (CVSS 6.4, xenioushk BWL Advanced FAQ Manager Lite)
- [CVE-2026-1986](https://cve.now/CVE-2026-1986.md): FloristPress for Woo \<= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameter (CVSS 6.1, bakkbone FloristPress for Woo – Customize your eCommerce st…)
- [CVE-2026-4335](https://cve.now/CVE-2026-4335.md): ShortPixel Image Optimizer \<= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title (CVSS 5.4, ShortPixel Image Optimizer – Optimize Images, Convert WebP…)
- [CVE-2026-3328](https://cve.now/CVE-2026-3328.md): Frontend Admin by DynamiApps \<= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post\_content' of Admin Form Posts (CVSS 7.2, shabti Frontend Admin by DynamiApps)
- [CVE-2014-125112](https://cve.now/CVE-2014-125112.md): Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution (CVSS 9.8, MIYAGAWA Plack::Middleware::Session::Cookie)
- [CVE-2025-15101](https://cve.now/CVE-2025-15101.md): An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrato (CVSS 8.6, ASUS Router)
- [CVE-2026-4836](https://cve.now/CVE-2026-4836.md): code-projects Accounting System delete.php sql injection (CVSS 5.3, code-projects Accounting System)
- [CVE-2026-4835](https://cve.now/CVE-2026-4835.md): code-projects Accounting System Web Application add\_costumer.php cross site scripting (CVSS 5.1, code-projects Accounting System)
- [CVE-2026-4484](https://cve.now/CVE-2026-4484.md): Masteriyo LMS \<= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator (CVSS 8.8, Masteriyo LMS – Online Course Builder for eLearning, LMS &…)
- [CVE-2026-4833](https://cve.now/CVE-2026-4833.md): Orc discount Markdown markdown.c compile recursion (CVSS 4.8, Orc discount)
- [CVE-2026-4831](https://cve.now/CVE-2026-4831.md): kalcaddle kodbox Password-protected Share auth.class.php can improper authentication (CVSS 6.3, kalcaddle kodbox)
- [CVE-2026-33285](https://cve.now/CVE-2026-33285.md): LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash (CVSS 7.5, harttle liquidjs · liquidjs)
- [CVE-2026-33287](https://cve.now/CVE-2026-33287.md): LiquidJS has Exponential Memory Amplification through its replace\_first Filter $& Pattern (CVSS 7.5, harttle liquidjs · liquidjs)
- [CVE-2026-33942](https://cve.now/CVE-2026-33942.md): Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE) (CVSS 8.1, saloonphp saloon · saloonphp/saloon)
- [CVE-2026-33183](https://cve.now/CVE-2026-33183.md): Saloon has a Fixture Name Path Traversal Vulnerability (CVSS 8.0, saloonphp saloon · saloonphp/saloon)
- [CVE-2026-33182](https://cve.now/CVE-2026-33182.md): Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL (CVSS 6.6, saloonphp saloon · saloonphp/saloon)
- [CVE-2026-4830](https://cve.now/CVE-2026-4830.md): kalcaddle kodbox Public Share userShare.class.php add privilege escalation (CVSS 6.3, kalcaddle kodbox)
- [CVE-2026-33526](https://cve.now/CVE-2026-33526.md): Squid vulnerable to Denial of Service in ICP Request handling (CVSS 9.2, squid-cache squid)
- [CVE-2026-33515](https://cve.now/CVE-2026-33515.md): Squid has issues in ICP message handling (CVSS 6.9, squid-cache squid)
- [CVE-2026-32748](https://cve.now/CVE-2026-32748.md): Squid has Denial of Service in ICP Response handling (CVSS 8.7, squid-cache squid)
- [CVE-2026-29905](https://cve.now/CVE-2026-29905.md): Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed (CVSS 6.5)
- [CVE-2026-29933](https://cve.now/CVE-2026-29933.md): A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary (CVSS 6.1)
- [CVE-2026-29934](https://cve.now/CVE-2026-29934.md): A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Ja (CVSS 6.1)
- [CVE-2026-29969](https://cve.now/CVE-2026-29969.md): A cross-site scripting (XSS) vulnerability in the wff\_cols\_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbi (CVSS 6.1)
- [CVE-2026-29976](https://cve.now/CVE-2026-29976.md): Buffer Overflow vulnerability in ZerBea hcxpcapngtool v. (CVSS 6.2)
- [CVE-2026-30162](https://cve.now/CVE-2026-30162.md): Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field. (CVSS 6.1)
- [CVE-2026-30457](https://cve.now/CVE-2026-30457.md): An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code. (CVSS 9.8)
- [CVE-2026-30458](https://cve.now/CVE-2026-30458.md): An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack. (CVSS 9.1)
- [CVE-2026-30463](https://cve.now/CVE-2026-30463.md): Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component. (CVSS 7.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.