CVEs published March 27, 2026
236 CVEs were published on March 27, 2026: 22 critical, 95 high.
- Published
- 236
- Critical
- 22
- High
- 95
- Medium
- 115
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 116
Most affected products
- WWBN AVideo · wwbn/avideo
- 15
- Open-Xchange OX Dovecot Pro
- 11
- fleetdm fleet · github.com/fleetdm/fleet/v4
- 7
- handlebars-lang handlebars.js · handlebars
- 6
- statamic cms · statamic/cms
- 6
- BUFFALO Wi-Fi router products
- 5
- danny-avila LibreChat
- 4
- digitalbazaar forge · node-forge
- 4
- ellanetworks core · github.com/ellanetworks/core
- 4
- Grafana
- 4
Critical 22
- CVE-2026-33992pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltrationpyload · pyload-ng
- CVE-2026-33976Notesnook vulnerable to RCE via stored XSS in Web Clipper renderingstreetwriters Notesnook Web/Desktop · streetwriters Notesno…
- CVE-2019-25651Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device ControlUbiquiti UniFi Network Controller · Ubiquiti UniFi UAP F… +3
- CVE-2026-33937Handlebars.js has JavaScript Injection via AST Type Confusionhandlebars-lang handlebars.js · handlebars
- CVE-2026-33875Authenticator Vulnerable to Authentication Flow Hijackgematik app-Authenticator
- CVE-2026-33873Langflow has Authenticated Code Execution in Agentic Assistant Validationlangflow-ai langflow · langflow
- CVE-2026-34205Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Modehome-assistant Home Assistant Operating System · home-assis…
- CVE-2026-34374AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream KeyWWBN AVideo
- CVE-2026-33867AVideo has Plaintext Video Password StorageWWBN AVideo · wwbn/avideo
- CVE-2026-27876RCE on Grafana via sqlExpressionsGrafana
- CVE-2026-1496Coverity CLI Authentication BypassBlack Duck Coverity
- CVE-2026-33758OpenBao has Reflected XSS in its OIDC authentication error messageopenbao · github.com/openbao/openbao
- CVE-2026-33757OpenBao lacks user confirmation for OIDC direct callback modeopenbao · github.com/openbao/openbao
- CVE-2026-22738SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code ExecutionSpring AI · org.springframework.ai:spring-ai-vector-store
- CVE-2026-33728dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code executionDataDog dd-trace-java · com.datadoghq:dd-java-agent
- CVE-2026-33701OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Executionopen-telemetry opentelemetry-java-instrumentation · io.open…
- CVE-2026-30302The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanis
- CVE-2026-30303The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ine
- CVE-2026-30304In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands.
- CVE-2026-30530A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_custo
- CVE-2026-30532A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php file via the "id" para
- CVE-2026-30533A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php file via the "id" pa
High 95
- CVE-2026-1679net: eswifi socket send payload length not boundedzephyrproject-rtos Zephyr
- CVE-2026-4248Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tagultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-33991WeGIA has SQL Injection in deletar_tag.phpLabRedesCefetRJ WeGIA
- CVE-2026-33989@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture toolsmobile-next mobile-mcp · @mobilenext/mobile-mcp
- CVE-2026-33981Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filtersdgtlmoon changedetection.io · changedetection-io
- CVE-2026-33980Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queriespab1it0 adx-mcp-server · adx-mcp-server
- CVE-2026-33979Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)AhmedAdelFahim express-xss-sanitizer · express-xss-sanitizer
- CVE-2026-33955Notesnook vulnerable to RCE via stored XSS in Note History diff viewerstreetwriters Notesnook Web/Desktop
- CVE-2026-33953LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAceKovah LinkAce
- CVE-2026-27309Substance3D - Stager | Use After Free (CWE-416)Adobe Substance3D - Stager
- CVE-2026-33946MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replaymodelcontextprotocol ruby-sdk · mcp
- CVE-2019-25652UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITMUbiquiti UniFi Network Controller
- CVE-2026-34226Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiescapricorn86 happy-dom · happy-dom
- CVE-2026-33943Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codecapricorn86 happy-dom · happy-dom
- CVE-2026-33941Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Optionshandlebars-lang handlebars.js · handlebars
- CVE-2026-33940Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialhandlebars-lang handlebars.js · handlebars
- CVE-2026-33939Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilationhandlebars-lang handlebars.js · handlebars
- CVE-2026-33938Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockhandlebars-lang handlebars.js · handlebars
- CVE-2026-33906Ella Core has Privilege Escalation via Database Restore by NetworkManager roleellanetworks core · github.com/ellanetworks/core
- CVE-2026-33896Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)digitalbazaar forge · node-forge
- CVE-2026-33895Forge has signature forgery in Ed25519 due to missing S > L checkdigitalbazaar forge · node-forge
- CVE-2026-33894Forge has signature forgery in RSA-PKCS due to ASN.1 extra fielddigitalbazaar forge · node-forge
- CVE-2026-33891Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Inputdigitalbazaar forge · node-forge
- CVE-2026-33881Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executorwindmill-labs windmill
- CVE-2026-4976Totolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflowTotolink LR350
- CVE-2026-33874Authenticator vulnerable to Remote Code Executiongematik app-Authenticator
- CVE-2026-34046Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Checklangflow-ai langflow · langflow-ai langflow-base +2
- CVE-2026-33872elixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race Conditionrevelrylabs elixir-nodejs
- CVE-2026-33871Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypassnetty · io.netty:netty-codec-http2
- CVE-2026-33870Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsingnetty · io.netty:netty-codec-http
- CVE-2026-4975Tenda AC15 POST Request setcfm formSetCfm memory corruptionTenda AC15
- CVE-2026-4974Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruptionTenda AC7
- CVE-2026-33765Pi-hole Web Interface has a Command Injection Vulnerabilitypi-hole web
- CVE-2026-33654Zero-Click Indirect Prompt Injection and Authentication Bypass via Email PollingHKUDS nanobot
- CVE-2026-33045Home Assistant has stored XSS in history-graphshome-assistant core · homeassistant
- CVE-2026-33044Home Assistant has stored XSS in Map-card through malicious device namehome-assistant core · homeassistant
- CVE-2026-32241Flannel vulnerable to cross-node remote code execution via extension backend BackendData injectionflannel-io flannel · github.com/flannel-io/flannel
- CVE-2026-31945LibreChat Server-Side Request Forgery using DNS resolutiondanny-avila LibreChat
- CVE-2026-31943LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIPdanny-avila LibreChat
- CVE-2026-26061Fleet's unbounded request body read allows remote Denial of Servicefleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-34375AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageWWBN AVideo · wwbn/avideo
- CVE-2025-15617Wazuh GitHub Actions Workflow Exposure of Sensitive CredentialsWazuh
- CVE-2026-4962UltraVNC Service version.dll uncontrolled search pathUltraVNC
- CVE-2025-15616Wazuh Agent and Manager OS Command Injection and Untrusted Search Pathwazuh-agent · wazuh-manager
- CVE-2025-15381Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-33770AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id VariablesWWBN AVideo · wwbn/avideo
- CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headersRed Hat JBoss Enterprise Application Platform · Red Hat… +7
- CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminatorRed Hat JBoss Enterprise Application Platform · Red Hat… +7
- CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsingRed Hat JBoss Enterprise Application Platform · Red Hat… +7
- CVE-2026-33767AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into QueryWWBN AVideo · wwbn/avideo
- CVE-2026-4961Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflowTenda AC6
- CVE-2026-4960Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflowTenda AC6
- CVE-2026-5027Langflow - Path Traversal Arbitrary File Write via upload_user_filelangflow-ai langflow
- CVE-2026-5026Langflow - Stored XSS via Malicious SVG Uploadlangflow-ai langflow
- CVE-2026-4984Botpress - Credential Disclosure via Twilio Webhook Handlerbotpress
- CVE-2026-27880OpenFeature evaluation API reads input data with no boundsGrafana
- CVE-2024-11604Insertion of Sensitive Information into Log FileOpenText IDM Driver and Extensions
- CVE-2026-33755Authenticated SQL Injection in Contact/query addressBookIds filterIntermesh groupoffice
- CVE-2026-33748BuildKit Git URL subdir component can cause access to restricted filesmoby buildkit · github.com/moby/buildkit
- CVE-2026-33206calibre has a path traversal vulnerabilitykovidgoyal calibre
- CVE-2025-13478Cache Misconfiguration Leading to Cross-User Data ExposureOpenText Identity Manager
- CVE-2026-4982Unauthorized access to chat contentspretix Venueless
- CVE-2026-25099Remote Code Execution via Unrestricted File Upload in BluditBludit
- CVE-2026-4620OS Command Injection vulnerability in NEC Platforms, Ltd.NEC Platforms Aterm WX1500HP · NEC Platforms Aterm WX3600HP
- CVE-2026-4622OS Command Injection vulnerability in NEC Platforms, Ltd.NEC Platforms Aterm WG2600HS · NEC Platforms Aterm WF120… +7
- CVE-2026-3457Stored XSS vulnerability in Sentinel ACCThalesgroup Sentinel LDK Runtime
- CVE-2026-27858Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.Open-Xchange OX Dovecot Pro
- CVE-2026-27856Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack.Open-Xchange OX Dovecot Pro
- CVE-2026-24031Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin.Open-Xchange OX Dovecot Pro
- CVE-2025-59032ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response.Open-Xchange OX Dovecot Pro
- CVE-2026-22744In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strinSpring AI · org.springframework.ai:spring-ai-redis-store
- CVE-2026-22743Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStoreSpring AI · org.springframework.ai:spring-ai-neo4j-store
- CVE-2026-22742Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL FetchingSpring AI · org.springframework.ai:spring-ai-bedrock-conver…
- CVE-2026-33280Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging fuBUFFALO Wi-Fi router products
- CVE-2026-32678Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings wiBUFFALO Wi-Fi router products
- CVE-2026-32669Code injection vulnerability exists in BUFFALO Wi-Fi router products.BUFFALO Wi-Fi router products
- CVE-2026-27650OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products.BUFFALO Wi-Fi router products
- CVE-2026-4906Tenda AC5 POST Request WizardHandle decodePwd stack-based overflowTenda AC5
- CVE-2026-33747BuildKit vulnerable to malicious frontend causing file escape outside of storage rootmoby buildkit · github.com/moby/buildkit
- CVE-2026-33745cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirectyhirose cpp-httplib
- CVE-2026-33744BentoML has Dockerfile Command Injection via system_packages in bentofile.yamlBentoML
- CVE-2026-33935MyTube has Unauthenticated Account Lockout via Shared Login Attempt Statefranklioxygen MyTube
- CVE-2026-33890MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registrationfranklioxygen MyTube
- CVE-2026-33735MyTube has an Improper Access Control that Allows Complete Application Takeoverfranklioxygen MyTube
- CVE-2026-33725Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Importmetabase
- CVE-2026-33718OpenHands is Vulnerable to Command Injection through its Git Diff HandlerOpenHands · openhands-ai
- CVE-2025-69986A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32.
- CVE-2026-29871A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the
- CVE-2026-30529A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user
- CVE-2026-30531A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_categ
- CVE-2026-30534A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/manage_category.php via the "id" parameter.
- CVE-2026-30574A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file.
- CVE-2026-30575A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file.
- CVE-2026-30576A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file.
- CVE-2026-30637Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before.
Medium, low and unrated 119
- CVE-2026-33996LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsingbenmcollins libjwt
- CVE-2026-33994Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521locutusjs locutus · locutus
- CVE-2026-33993Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()locutusjs locutus · locutus
- CVE-2026-33936python-ecdsa: Denial of Service via improper DER length validation in crafted private keystlsfuzzer python-ecdsa · ecdsa
- CVE-2026-4992wandb OpenUI HTMLAnnotator server.py get_share HTML injectionwandb OpenUI
- CVE-2026-4991QDOCS Smart School Management System Admission Enquiry enquiry cross site scriptingQDOCS Smart School Management System
- CVE-2026-4990chatwoot Signup Endpoint login improper authorizationchatwoot
- CVE-2026-4988Open5GS CCA Message smf_s6b denial of serviceOpen5GS
- CVE-2026-4985dloebl CGIF GIF Image cgif.c cgif_addframe integer overflowdloebl CGIF
- CVE-2026-33954LinkAce discloses private notesto unauthorized authenticated users via the web link detail pageKovah LinkAce
- CVE-2026-33916Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injectionhandlebars-lang handlebars.js · handlebars
- CVE-2026-33907Ella Core Panics during NAS Authentication Response/Failure with missing IEsellanetworks core · github.com/ellanetworks/core
- CVE-2026-33904Ella Core has a Denial of Service via SCTP connection cleanup deadlockellanetworks core · github.com/ellanetworks/core
- CVE-2026-33903Ella Core panics when processing a crafted NGAP LocationReport messageellanetworks core · github.com/ellanetworks/core
- CVE-2026-33887Statamic allows unauthorized content access through missing authorization in its revision controllersstatamic cms · statamic/cms
- CVE-2026-33886Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fieldsstatamic cms · statamic/cms
- CVE-2026-33885Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differentialstatamic cms · statamic/cms
- CVE-2026-33884Statamic's live preview token bypasses content protection for unrelated entriesstatamic cms · statamic/cms
- CVE-2026-33883Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tagstatamic cms · statamic/cms
- CVE-2026-33882Statamic's Markdown preview endpoint exposes sensitive user datastatamic cms · statamic/cms
- CVE-2026-33879FLIP doesn't have rate limiting or brute-force protection on loginlondonaicentre FLIP
- CVE-2026-4973SourceCodester Online Quiz System add-question.php cross site scriptingSourceCodester Online Quiz System
- CVE-2026-33869Mastodon has a denial of service for quote authorizationmastodon
- CVE-2026-33868Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'mastodon
- CVE-2026-33739FOG has Stored XSS in Multiple Management Pagesfogproject
- CVE-2026-34475Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / varnish-software Varnish Cache
- CVE-2026-31951LibreChat's MCP Server Header Injection Enables OAuth Token Theftdanny-avila LibreChat
- CVE-2026-31950LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chatsdanny-avila LibreChat
- CVE-2026-34391Fleet Vulnerable to Windows MDM cross-device command disclosurefleetdm fleet
- CVE-2026-34389Fleet's user account creation via invite does not enforce invited email addressfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-4972code-projects Online Reviewer System btn_functions.php cross site scriptingcode-projects Online Reviewer System
- CVE-2026-4971SourceCodester Note Taking App cross-site request forgerySourceCodester Note Taking App
- CVE-2026-34388Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpointfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-34387Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scriptsfleetdm fleet
- CVE-2026-34386Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global adminfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-34385Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the databasefleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-29180Fleet's team maintainer can transfer hosts from any team via missing source team authorizationfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-4970code-projects Social Networking Site Endpoint delete_photos.php sql injectioncode-projects Social Networking Site
- CVE-2026-4969code-projects Social Networking Site Alert home.php cross site scriptingcode-projects Social Networking Site
- CVE-2026-26060Fleet: Password reset tokens remain valid after password change for 24 hoursfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2025-15612Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCEWazuh Provisioning Scripts
- CVE-2026-34369AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password VerificationWWBN AVideo · wwbn/avideo
- CVE-2026-34368AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceWWBN AVideo · wwbn/avideo
- CVE-2026-34364AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-4968SourceCodester Diary App diary.php cross-site request forgerySourceCodester Diary App
- CVE-2026-4966itsourcecode Free Hotel Reservation System index.php sql injectionitsourcecode Free Hotel Reservation System
- CVE-2026-4965letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injectionletta-ai letta
- CVE-2026-4964letta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgeryletta-ai letta
- CVE-2026-4963huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injectionhuggingface smolagents · smolagents
- CVE-2026-34362AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()WWBN AVideo · wwbn/avideo
- CVE-2026-34247AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket NotificationsWWBN AVideo · wwbn/avideo
- CVE-2026-34245AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast HijackingWWBN AVideo · wwbn/avideo
- CVE-2026-34411Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIsAppsmith
- CVE-2025-15615Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Servicewazuh-manager
- CVE-2023-7340Wazuh authd service (os_auth) Heap-based Buffer OverflowWazuh
- CVE-2026-32983SSL/TLS Renegotiation DoS in Wazuh Manager authd servicewazuh-manager
- CVE-2026-4959OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authenticationOpenBMB XAgent
- CVE-2026-4958OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorizationOpenBMB XAgent
- CVE-2026-32984Heap buffer overflow in wazuh-authdWazuh
- CVE-2026-4957OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log fileOpenBMB XAgent
- CVE-2026-4956Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injectionShenzhen Ruiming Technology Streamax Crocus
- CVE-2026-4955Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injectionShenzhen Ruiming Technology Streamax Crocus
- CVE-2026-4980Improper Restriction of XML External Entity Reference in InkscapeInkscape
- CVE-2026-5025Langflow - Application Logs Exposed to All Authenticated Userslangflow-ai langflow
- CVE-2026-5010Reflected Cross-Site Scripting (XSS) in Sanoma’s ClickeduSanoma Clickedu
- CVE-2026-5022Langflow - Missing Authorization on download_image Endpointlangflow-ai langflow
- CVE-2026-33766AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download EndpointsWWBN AVideo · wwbn/avideo
- CVE-2026-33764AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and TranscriptionsWWBN AVideo · wwbn/avideo
- CVE-2026-27879Query resampling can cause unbounded memory allocationsGrafana
- CVE-2026-28375Grafana Testdata datasource can issue unbounded memory allocationsGrafana
- CVE-2026-33763AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean OracleWWBN AVideo · wwbn/avideo
- CVE-2026-33761AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User MappingsWWBN AVideo · wwbn/avideo
- CVE-2026-33759AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist ContentsWWBN AVideo · wwbn/avideo
- CVE-2026-4954mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injectionmingSoft MCMS
- CVE-2026-4953mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgerymingSoft MCMS
- CVE-2026-33750brace-expansion: Zero-step sequence causes process hang and memory exhaustionjuliangruber brace-expansion · brace-expansion
- CVE-2026-27877Public dashboards discloses all direct mode datasourcesGrafana · github.com/grafana/grafana
- CVE-2026-33284GlobalLeaks has insufficient URL validation in user support APIglobaleaks-whistleblowing-software
- CVE-2026-33205calibre has Server-Side Request Forgery in ebook viewer backendkovidgoyal calibre
- CVE-2026-33433Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerFieldtraefik · github.com/traefik/traefik +2
- CVE-2026-32695Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypasstraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-32859ByteDance DeerFlow Stored XSS via Inline Artifact RenderingBytedance DeerFlow
- CVE-2026-25100Stored XSS via SVG File Upload in BluditBludit
- CVE-2026-25101Session Fixation in BluditBludit
- CVE-2026-4621Hidden Functionality vulnerability in NEC Platforms, Ltd.NEC Platforms Aterm W1200EX · NEC Platforms Aterm WG120… +23
- CVE-2026-4619Path Traversal vulnerability in NEC Platforms, Ltd.NEC Platforms Aterm WX3600HP
- CVE-2026-4309Missing Authorization vulnerability in NEC Platforms, Ltd.NEC Platforms Aterm W1200EX · NEC Platforms Aterm WG120… +22
- CVE-2023-7339Data collection for dowloading leads into buffer overflowSofting pnGate · Softing epGate +3
- CVE-2026-27860If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication.Open-Xchange OX Dovecot Pro
- CVE-2026-27859A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.Open-Xchange OX Dovecot Pro
- CVE-2026-27857Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage.Open-Xchange OX Dovecot Pro
- CVE-2026-27855Dovecot OTP authentication is vulnerable to replay attack under specific conditions.Open-Xchange OX Dovecot Pro
- CVE-2026-0394When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added Open-Xchange OX Dovecot Pro
- CVE-2025-59031Dovecot has provided a script to use for attachment to text conversion.Open-Xchange OX Dovecot Pro
- CVE-2025-59028When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to faiOpen-Xchange OX Dovecot Pro
- CVE-2024-14028Multiple implicit reads in parallel can result in a crash or denial of serviceSofting smartLink HW-DP · Softing smartLink HW-PN
- CVE-2026-4948Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorizationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-33366Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the proBUFFALO Wi-Fi router products
- CVE-2026-33559WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability.MiKa OpenStreetMap
- CVE-2026-34353In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is procOCaml
- CVE-2026-3098Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAllnextendweb Smart Slider
- CVE-2026-4910Shenzhen Ruiming Technology Streamax Crocus Endpoint RemoteFormat.do sql injectionShenzhen Ruiming Technology Streamax Crocus
- CVE-2026-4909code-projects Exam Form Submission update_s7.php cross site scriptingcode-projects Exam Form Submission
- CVE-2026-4908code-projects Simple Laundry System Parameter modstaffinfo.php sql injectioncode-projects Simple Laundry System
- CVE-2026-4907Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgeryPage-Replica Page Replica
- CVE-2026-33730Open Source Point of Sale has an IDOR in Password Change (Home)opensourcepos
- CVE-2026-33729OpenFGA has an Authorization Bypass through cached keysopenfga · github.com/openfga/openfga
- CVE-2026-33726Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node trafficcilium · github.com/cilium/cilium
- CVE-2026-33721MapServer has heap buffer overflow in SLD `Categorize` Threshold parsingMapServer
- CVE-2026-33693Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()LemmyNet lemmy · activitypub_federation
- CVE-2025-61190A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functional
- CVE-2025-69988BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control.
- CVE-2026-30527A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management modul
- CVE-2026-30567A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_product.php file vi
- CVE-2026-30568A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in in the view_purchase.php fil
- CVE-2026-30569A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0.
- CVE-2026-30570A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_sales.php file via
- CVE-2026-30571A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_category.php file v
- CVE-2026-30689In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure.anjoy8 Blog.Core