# CVEs published 2026-03-27

236 CVEs were published on March 27, 2026: 22 critical, 95 high. Days are UTC.

- [CVE-2026-1679](https://cve.now/CVE-2026-1679.md): net: eswifi socket send payload length not bounded (CVSS 7.3, zephyrproject-rtos Zephyr)
- [CVE-2026-4248](https://cve.now/CVE-2026-4248.md): Ultimate Member \<= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag (CVSS 8.0, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-33996](https://cve.now/CVE-2026-33996.md): LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing (CVSS 5.8, benmcollins libjwt)
- [CVE-2026-33994](https://cve.now/CVE-2026-33994.md): Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 (CVSS 6.3, locutusjs locutus · locutus)
- [CVE-2026-33993](https://cve.now/CVE-2026-33993.md): Locutus has Prototype Pollution via \_\_proto\_\_ Key Injection in unserialize() (CVSS 6.9, locutusjs locutus · locutus)
- [CVE-2026-33992](https://cve.now/CVE-2026-33992.md): pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration (CVSS 9.3, pyload · pyload-ng)
- [CVE-2026-33991](https://cve.now/CVE-2026-33991.md): WeGIA has SQL Injection in deletar\_tag.php (CVSS 8.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-33936](https://cve.now/CVE-2026-33936.md): python-ecdsa: Denial of Service via improper DER length validation in crafted private keys (CVSS 5.3, tlsfuzzer python-ecdsa · ecdsa)
- [CVE-2026-4992](https://cve.now/CVE-2026-4992.md): wandb OpenUI HTMLAnnotator server.py get\_share HTML injection (CVSS 5.3, wandb OpenUI)
- [CVE-2026-4991](https://cve.now/CVE-2026-4991.md): QDOCS Smart School Management System Admission Enquiry enquiry cross site scripting (CVSS 5.1, QDOCS Smart School Management System)
- [CVE-2026-33989](https://cve.now/CVE-2026-33989.md): @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools (CVSS 8.1, mobile-next mobile-mcp · @mobilenext/mobile-mcp)
- [CVE-2026-33981](https://cve.now/CVE-2026-33981.md): Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters (CVSS 8.3, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2026-33980](https://cve.now/CVE-2026-33980.md): Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries (CVSS 8.3, pab1it0 adx-mcp-server · adx-mcp-server)
- [CVE-2026-33979](https://cve.now/CVE-2026-33979.md): Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk) (CVSS 8.2, AhmedAdelFahim express-xss-sanitizer · express-xss-sanitizer)
- [CVE-2026-33955](https://cve.now/CVE-2026-33955.md): Notesnook vulnerable to RCE via stored XSS in Note History diff viewer (CVSS 8.6, streetwriters Notesnook Web/Desktop)
- [CVE-2026-4990](https://cve.now/CVE-2026-4990.md): chatwoot Signup Endpoint login improper authorization (CVSS 6.9, chatwoot)
- [CVE-2026-4988](https://cve.now/CVE-2026-4988.md): Open5GS CCA Message smf\_s6b denial of service (CVSS 6.3, Open5GS)
- [CVE-2026-4985](https://cve.now/CVE-2026-4985.md): dloebl CGIF GIF Image cgif.c cgif\_addframe integer overflow (CVSS 5.3, dloebl CGIF)
- [CVE-2026-33976](https://cve.now/CVE-2026-33976.md): Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering (CVSS 9.7, streetwriters Notesnook Web/Desktop · streetwriters Notesno…)
- [CVE-2026-33954](https://cve.now/CVE-2026-33954.md): LinkAce discloses private notesto unauthorized authenticated users via the web link detail page (CVSS 6.5, Kovah LinkAce)
- [CVE-2026-33953](https://cve.now/CVE-2026-33953.md): LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce (CVSS 8.5, Kovah LinkAce)
- [CVE-2026-27309](https://cve.now/CVE-2026-27309.md): Substance3D - Stager | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2026-33946](https://cve.now/CVE-2026-33946.md): MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay (CVSS 8.2, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2019-25652](https://cve.now/CVE-2019-25652.md): UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM (CVSS 7.7, Ubiquiti UniFi Network Controller)
- [CVE-2026-34226](https://cve.now/CVE-2026-34226.md): Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies (CVSS 7.5, capricorn86 happy-dom · happy-dom)
- [CVE-2019-25651](https://cve.now/CVE-2019-25651.md): Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control (CVSS 9.0, Ubiquiti UniFi Network Controller · Ubiquiti UniFi UAP F… +3)
- [CVE-2026-33943](https://cve.now/CVE-2026-33943.md): Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code (CVSS 8.8, capricorn86 happy-dom · happy-dom)
- [CVE-2026-33941](https://cve.now/CVE-2026-33941.md): Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options (CVSS 8.3, handlebars-lang handlebars.js · handlebars)
- [CVE-2026-33940](https://cve.now/CVE-2026-33940.md): Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial (CVSS 8.1, handlebars-lang handlebars.js · handlebars)
- [CVE-2026-33939](https://cve.now/CVE-2026-33939.md): Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation (CVSS 7.5, handlebars-lang handlebars.js · handlebars)
- [CVE-2026-33938](https://cve.now/CVE-2026-33938.md): Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block (CVSS 8.1, handlebars-lang handlebars.js · handlebars)
- [CVE-2026-33937](https://cve.now/CVE-2026-33937.md): Handlebars.js has JavaScript Injection via AST Type Confusion (CVSS 9.8, handlebars-lang handlebars.js · handlebars)
- [CVE-2026-33916](https://cve.now/CVE-2026-33916.md): Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection (CVSS 4.7, handlebars-lang handlebars.js · handlebars)
- [CVE-2026-33907](https://cve.now/CVE-2026-33907.md): Ella Core Panics during NAS Authentication Response/Failure with missing IEs (CVSS 6.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33906](https://cve.now/CVE-2026-33906.md): Ella Core has Privilege Escalation via Database Restore by NetworkManager role (CVSS 7.2, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33904](https://cve.now/CVE-2026-33904.md): Ella Core has a Denial of Service via SCTP connection cleanup deadlock (CVSS 6.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33903](https://cve.now/CVE-2026-33903.md): Ella Core panics when processing a crafted NGAP LocationReport message (CVSS 6.5, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-33896](https://cve.now/CVE-2026-33896.md): Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) (CVSS 7.4, digitalbazaar forge · node-forge)
- [CVE-2026-33895](https://cve.now/CVE-2026-33895.md): Forge has signature forgery in Ed25519 due to missing S \> L check (CVSS 7.5, digitalbazaar forge · node-forge)
- [CVE-2026-33894](https://cve.now/CVE-2026-33894.md): Forge has signature forgery in RSA-PKCS due to ASN.1 extra field (CVSS 7.5, digitalbazaar forge · node-forge)
- [CVE-2026-33891](https://cve.now/CVE-2026-33891.md): Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input (CVSS 7.5, digitalbazaar forge · node-forge)
- [CVE-2026-33887](https://cve.now/CVE-2026-33887.md): Statamic allows unauthorized content access through missing authorization in its revision controllers (CVSS 5.4, statamic cms · statamic/cms)
- [CVE-2026-33886](https://cve.now/CVE-2026-33886.md): Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields (CVSS 6.5, statamic cms · statamic/cms)
- [CVE-2026-33885](https://cve.now/CVE-2026-33885.md): Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential (CVSS 6.1, statamic cms · statamic/cms)
- [CVE-2026-33884](https://cve.now/CVE-2026-33884.md): Statamic's live preview token bypasses content protection for unrelated entries (CVSS 4.3, statamic cms · statamic/cms)
- [CVE-2026-33883](https://cve.now/CVE-2026-33883.md): Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag (CVSS 6.1, statamic cms · statamic/cms)
- [CVE-2026-33882](https://cve.now/CVE-2026-33882.md): Statamic's Markdown preview endpoint exposes sensitive user data (CVSS 6.5, statamic cms · statamic/cms)
- [CVE-2026-33881](https://cve.now/CVE-2026-33881.md): Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor (CVSS 7.3, windmill-labs windmill)
- [CVE-2026-33879](https://cve.now/CVE-2026-33879.md): FLIP doesn't have rate limiting or brute-force protection on login (CVSS 2.7, londonaicentre FLIP)
- [CVE-2026-4976](https://cve.now/CVE-2026-4976.md): Totolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflow (CVSS 8.7, Totolink LR350)
- [CVE-2026-33875](https://cve.now/CVE-2026-33875.md): Authenticator Vulnerable to Authentication Flow Hijack (CVSS 9.3, gematik app-Authenticator)
- [CVE-2026-33874](https://cve.now/CVE-2026-33874.md): Authenticator vulnerable to Remote Code Execution (CVSS 7.8, gematik app-Authenticator)
- [CVE-2026-34046](https://cve.now/CVE-2026-34046.md): Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check (CVSS 8.7, langflow-ai langflow · langflow-ai langflow-base +2)
- [CVE-2026-33873](https://cve.now/CVE-2026-33873.md): Langflow has Authenticated Code Execution in Agentic Assistant Validation (CVSS 9.3, langflow-ai langflow · langflow)
- [CVE-2026-33872](https://cve.now/CVE-2026-33872.md): elixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race Condition (CVSS 7.1, revelrylabs elixir-nodejs)
- [CVE-2026-33871](https://cve.now/CVE-2026-33871.md): Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass (CVSS 8.7, netty · io.netty:netty-codec-http2)
- [CVE-2026-33870](https://cve.now/CVE-2026-33870.md): Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVSS 7.5, netty · io.netty:netty-codec-http)
- [CVE-2026-4975](https://cve.now/CVE-2026-4975.md): Tenda AC15 POST Request setcfm formSetCfm memory corruption (CVSS 8.7, Tenda AC15)
- [CVE-2026-4974](https://cve.now/CVE-2026-4974.md): Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption (CVSS 8.7, Tenda AC7)
- [CVE-2026-4973](https://cve.now/CVE-2026-4973.md): SourceCodester Online Quiz System add-question.php cross site scripting (CVSS 5.1, SourceCodester Online Quiz System)
- [CVE-2026-33869](https://cve.now/CVE-2026-33869.md): Mastodon has a denial of service for quote authorization (CVSS 4.8, mastodon)
- [CVE-2026-33868](https://cve.now/CVE-2026-33868.md): Mastodon has a GET-Based Open Redirect via '/web/%2F\<domain\>' (CVSS 4.3, mastodon)
- [CVE-2026-33765](https://cve.now/CVE-2026-33765.md): Pi-hole Web Interface has a Command Injection Vulnerability (CVSS 8.9, pi-hole web)
- [CVE-2026-33739](https://cve.now/CVE-2026-33739.md): FOG has Stored XSS in Multiple Management Pages (CVSS 5.7, fogproject)
- [CVE-2026-33654](https://cve.now/CVE-2026-33654.md): Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling (CVSS 8.9, HKUDS nanobot)
- [CVE-2026-34205](https://cve.now/CVE-2026-34205.md): Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode (CVSS 9.7, home-assistant Home Assistant Operating System · home-assis…)
- [CVE-2026-34475](https://cve.now/CVE-2026-34475.md): Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / (CVSS 5.4, varnish-software Varnish Cache)
- [CVE-2026-33045](https://cve.now/CVE-2026-33045.md): Home Assistant has stored XSS in history-graphs (CVSS 7.3, home-assistant core · homeassistant)
- [CVE-2026-33044](https://cve.now/CVE-2026-33044.md): Home Assistant has stored XSS in Map-card through malicious device name (CVSS 7.3, home-assistant core · homeassistant)
- [CVE-2026-32241](https://cve.now/CVE-2026-32241.md): Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection (CVSS 7.5, flannel-io flannel · github.com/flannel-io/flannel)
- [CVE-2026-31951](https://cve.now/CVE-2026-31951.md): LibreChat's MCP Server Header Injection Enables OAuth Token Theft (CVSS 6.8, danny-avila LibreChat)
- [CVE-2026-31950](https://cve.now/CVE-2026-31950.md): LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats (CVSS 5.3, danny-avila LibreChat)
- [CVE-2026-31945](https://cve.now/CVE-2026-31945.md): LibreChat Server-Side Request Forgery using DNS resolution (CVSS 7.7, danny-avila LibreChat)
- [CVE-2026-31943](https://cve.now/CVE-2026-31943.md): LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP (CVSS 8.5, danny-avila LibreChat)
- [CVE-2026-34391](https://cve.now/CVE-2026-34391.md): Fleet Vulnerable to Windows MDM cross-device command disclosure (CVSS 6.6, fleetdm fleet)
- [CVE-2026-34389](https://cve.now/CVE-2026-34389.md): Fleet's user account creation via invite does not enforce invited email address (CVSS 4.9, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-4972](https://cve.now/CVE-2026-4972.md): code-projects Online Reviewer System btn\_functions.php cross site scripting (CVSS 4.8, code-projects Online Reviewer System)
- [CVE-2026-4971](https://cve.now/CVE-2026-4971.md): SourceCodester Note Taking App cross-site request forgery (CVSS 5.3, SourceCodester Note Taking App)
- [CVE-2026-34388](https://cve.now/CVE-2026-34388.md): Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint (CVSS 6.6, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-34387](https://cve.now/CVE-2026-34387.md): Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts (CVSS 5.7, fleetdm fleet)
- [CVE-2026-34386](https://cve.now/CVE-2026-34386.md): Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin (CVSS 6.3, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-34385](https://cve.now/CVE-2026-34385.md): Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database (CVSS 6.2, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-29180](https://cve.now/CVE-2026-29180.md): Fleet's team maintainer can transfer hosts from any team via missing source team authorization (CVSS 4.9, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-4970](https://cve.now/CVE-2026-4970.md): code-projects Social Networking Site Endpoint delete\_photos.php sql injection (CVSS 5.3, code-projects Social Networking Site)
- [CVE-2026-4969](https://cve.now/CVE-2026-4969.md): code-projects Social Networking Site Alert home.php cross site scripting (CVSS 5.1, code-projects Social Networking Site)
- [CVE-2026-26061](https://cve.now/CVE-2026-26061.md): Fleet's unbounded request body read allows remote Denial of Service (CVSS 8.7, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-26060](https://cve.now/CVE-2026-26060.md): Fleet: Password reset tokens remain valid after password change for 24 hours (CVSS 6.0, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-34375](https://cve.now/CVE-2026-34375.md): AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page (CVSS 8.2, WWBN AVideo · wwbn/avideo)
- [CVE-2026-34374](https://cve.now/CVE-2026-34374.md): AVideo has SQL Injection in Live\_schedule::keyExists() via Unparameterized Stream Key (CVSS 9.1, WWBN AVideo)
- [CVE-2025-15612](https://cve.now/CVE-2025-15612.md): Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE (CVSS 6.3, Wazuh Provisioning Scripts)
- [CVE-2026-34369](https://cve.now/CVE-2026-34369.md): AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-34368](https://cve.now/CVE-2026-34368.md): AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-34364](https://cve.now/CVE-2026-34364.md): AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2025-15617](https://cve.now/CVE-2025-15617.md): Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials (CVSS 8.3, Wazuh)
- [CVE-2026-4968](https://cve.now/CVE-2026-4968.md): SourceCodester Diary App diary.php cross-site request forgery (CVSS 5.3, SourceCodester Diary App)
- [CVE-2026-4966](https://cve.now/CVE-2026-4966.md): itsourcecode Free Hotel Reservation System index.php sql injection (CVSS 5.3, itsourcecode Free Hotel Reservation System)
- [CVE-2026-4965](https://cve.now/CVE-2026-4965.md): letta-ai letta Incomplete Fix CVE-2025-6101 ast\_parsers.py resolve\_type eval injection (CVSS 6.9, letta-ai letta)
- [CVE-2026-4964](https://cve.now/CVE-2026-4964.md): letta-ai letta File URL message\_helper.py \_convert\_message\_create\_to\_message server-side request forgery (CVSS 5.3, letta-ai letta)
- [CVE-2026-4963](https://cve.now/CVE-2026-4963.md): huggingface smolagents Incomplete Fix CVE-2025-9959 local\_python\_executor.py evaluate\_with code injection (CVSS 5.3, huggingface smolagents · smolagents)
- [CVE-2026-4962](https://cve.now/CVE-2026-4962.md): UltraVNC Service version.dll uncontrolled search path (CVSS 7.3, UltraVNC)
- [CVE-2026-34362](https://cve.now/CVE-2026-34362.md): AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-34247](https://cve.now/CVE-2026-34247.md): AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2025-15616](https://cve.now/CVE-2025-15616.md): Wazuh Agent and Manager OS Command Injection and Untrusted Search Path (CVSS 7.1, wazuh-agent · wazuh-manager)
- [CVE-2026-34245](https://cve.now/CVE-2026-34245.md): AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking (CVSS 6.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33867](https://cve.now/CVE-2026-33867.md): AVideo has Plaintext Video Password Storage (CVSS 9.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-34411](https://cve.now/CVE-2026-34411.md): Appsmith \< 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs (CVSS 6.9, Appsmith)
- [CVE-2025-15615](https://cve.now/CVE-2025-15615.md): Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service (CVSS 6.9, wazuh-manager)
- [CVE-2025-15381](https://cve.now/CVE-2025-15381.md): Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow (CVSS 8.1, mlflow/mlflow · mlflow)
- [CVE-2026-33770](https://cve.now/CVE-2026-33770.md): AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean\_title and id Variables (CVSS 7.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-28369](https://cve.now/CVE-2026-28369.md): Undertow: undertow: request smuggling via malformed http request headers (CVSS 8.7, Red Hat JBoss Enterprise Application Platform · Red Hat… +7)
- [CVE-2026-28367](https://cve.now/CVE-2026-28367.md): Undertow: undertow: request smuggling via \`\\r\\r\\r\` as a header block terminator (CVSS 8.7, Red Hat JBoss Enterprise Application Platform · Red Hat… +7)
- [CVE-2026-28368](https://cve.now/CVE-2026-28368.md): Undertow: undertow: request smuggling via inconsistent header parsing (CVSS 8.7, Red Hat JBoss Enterprise Application Platform · Red Hat… +7)
- [CVE-2026-33767](https://cve.now/CVE-2026-33767.md): AVideo has SQL Injection via Partial Prepared Statement — videos\_id Concatenated Directly into Query (CVSS 7.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-4961](https://cve.now/CVE-2026-4961.md): Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow (CVSS 8.7, Tenda AC6)
- [CVE-2026-4960](https://cve.now/CVE-2026-4960.md): Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow (CVSS 8.7, Tenda AC6)
- [CVE-2023-7340](https://cve.now/CVE-2023-7340.md): Wazuh authd service (os\_auth) Heap-based Buffer Overflow (CVSS 5.3, Wazuh)
- [CVE-2026-32983](https://cve.now/CVE-2026-32983.md): SSL/TLS Renegotiation DoS in Wazuh Manager authd service (CVSS 6.9, wazuh-manager)
- [CVE-2026-4959](https://cve.now/CVE-2026-4959.md): OpenBMB XAgent ShareServer WebSocket Endpoint share.py check\_user missing authentication (CVSS 6.9, OpenBMB XAgent)
- [CVE-2026-4958](https://cve.now/CVE-2026-4958.md): OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send\_data authorization (CVSS 2.3, OpenBMB XAgent)
- [CVE-2026-32984](https://cve.now/CVE-2026-32984.md): Heap buffer overflow in wazuh-authd (CVSS 5.3, Wazuh)
- [CVE-2026-5027](https://cve.now/CVE-2026-5027.md): Langflow - Path Traversal Arbitrary File Write via upload\_user\_file (CVSS 8.8, langflow-ai langflow)
- [CVE-2026-4957](https://cve.now/CVE-2026-4957.md): OpenBMB XAgent API Key function\_handler.py FunctionHandler.handle\_tool\_call log file (CVSS 5.1, OpenBMB XAgent)
- [CVE-2026-4956](https://cve.now/CVE-2026-4956.md): Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injection (CVSS 6.9, Shenzhen Ruiming Technology Streamax Crocus)
- [CVE-2026-4955](https://cve.now/CVE-2026-4955.md): Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injection (CVSS 6.9, Shenzhen Ruiming Technology Streamax Crocus)
- [CVE-2026-4980](https://cve.now/CVE-2026-4980.md): Improper Restriction of XML External Entity Reference in Inkscape (CVSS 6.3, Inkscape)
- [CVE-2026-5026](https://cve.now/CVE-2026-5026.md): Langflow - Stored XSS via Malicious SVG Upload (CVSS 7.0, langflow-ai langflow)
- [CVE-2026-5025](https://cve.now/CVE-2026-5025.md): Langflow - Application Logs Exposed to All Authenticated Users (CVSS 6.5, langflow-ai langflow)
- [CVE-2026-5010](https://cve.now/CVE-2026-5010.md): Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu (CVSS 5.1, Sanoma Clickedu)
- [CVE-2026-5022](https://cve.now/CVE-2026-5022.md): Langflow - Missing Authorization on download\_image Endpoint (CVSS 6.3, langflow-ai langflow)
- [CVE-2026-33766](https://cve.now/CVE-2026-33766.md): AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33764](https://cve.now/CVE-2026-33764.md): AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions (CVSS 4.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-27879](https://cve.now/CVE-2026-27879.md): Query resampling can cause unbounded memory allocations (CVSS 6.5, Grafana)
- [CVE-2026-28375](https://cve.now/CVE-2026-28375.md): Grafana Testdata datasource can issue unbounded memory allocations (CVSS 6.5, Grafana)
- [CVE-2026-33763](https://cve.now/CVE-2026-33763.md): AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-27876](https://cve.now/CVE-2026-27876.md): RCE on Grafana via sqlExpressions (CVSS 9.1, Grafana)
- [CVE-2026-33761](https://cve.now/CVE-2026-33761.md): AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-33759](https://cve.now/CVE-2026-33759.md): AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-1496](https://cve.now/CVE-2026-1496.md): Coverity CLI Authentication Bypass (CVSS 9.3, Black Duck Coverity)
- [CVE-2026-4984](https://cve.now/CVE-2026-4984.md): Botpress - Credential Disclosure via Twilio Webhook Handler (CVSS 8.2, botpress)
- [CVE-2026-4954](https://cve.now/CVE-2026-4954.md): mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection (CVSS 5.3, mingSoft MCMS)
- [CVE-2026-4953](https://cve.now/CVE-2026-4953.md): mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery (CVSS 6.9, mingSoft MCMS)
- [CVE-2026-33758](https://cve.now/CVE-2026-33758.md): OpenBao has Reflected XSS in its OIDC authentication error message (CVSS 9.4, openbao · github.com/openbao/openbao)
- [CVE-2026-27880](https://cve.now/CVE-2026-27880.md): OpenFeature evaluation API reads input data with no bounds (CVSS 7.5, Grafana)
- [CVE-2026-33757](https://cve.now/CVE-2026-33757.md): OpenBao lacks user confirmation for OIDC direct callback mode (CVSS 9.6, openbao · github.com/openbao/openbao)
- [CVE-2024-11604](https://cve.now/CVE-2024-11604.md): Insertion of Sensitive Information into Log File (CVSS 7.3, OpenText IDM Driver and Extensions)
- [CVE-2026-33755](https://cve.now/CVE-2026-33755.md): Authenticated SQL Injection in Contact/query addressBookIds filter (CVSS 8.8, Intermesh groupoffice)
- [CVE-2026-33750](https://cve.now/CVE-2026-33750.md): brace-expansion: Zero-step sequence causes process hang and memory exhaustion (CVSS 6.5, juliangruber brace-expansion · brace-expansion)
- [CVE-2026-27877](https://cve.now/CVE-2026-27877.md): Public dashboards discloses all direct mode datasources (CVSS 6.5, Grafana · github.com/grafana/grafana)
- [CVE-2026-33748](https://cve.now/CVE-2026-33748.md): BuildKit Git URL subdir component can cause access to restricted files (CVSS 8.2, moby buildkit · github.com/moby/buildkit)
- [CVE-2026-33284](https://cve.now/CVE-2026-33284.md): GlobalLeaks has insufficient URL validation in user support API (CVSS 1.2, globaleaks-whistleblowing-software)
- [CVE-2026-33206](https://cve.now/CVE-2026-33206.md): calibre has a path traversal vulnerability (CVSS 8.2, kovidgoyal calibre)
- [CVE-2026-33205](https://cve.now/CVE-2026-33205.md): calibre has Server-Side Request Forgery in ebook viewer backend (CVSS 4.8, kovidgoyal calibre)
- [CVE-2026-33433](https://cve.now/CVE-2026-33433.md): Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField (CVSS 5.1, traefik · github.com/traefik/traefik +2)
- [CVE-2026-32695](https://cve.now/CVE-2026-32695.md): Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass (CVSS 6.3, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2025-13478](https://cve.now/CVE-2025-13478.md): Cache Misconfiguration Leading to Cross-User Data Exposure (CVSS 8.4, OpenText Identity Manager)
- [CVE-2026-32859](https://cve.now/CVE-2026-32859.md): ByteDance DeerFlow Stored XSS via Inline Artifact Rendering (CVSS 5.1, Bytedance DeerFlow)
- [CVE-2026-4982](https://cve.now/CVE-2026-4982.md): Unauthorized access to chat contents (CVSS 7.3, pretix Venueless)
- [CVE-2026-25099](https://cve.now/CVE-2026-25099.md): Remote Code Execution via Unrestricted File Upload in Bludit (CVSS 8.7, Bludit)
- [CVE-2026-25100](https://cve.now/CVE-2026-25100.md): Stored XSS via SVG File Upload in Bludit (CVSS 4.8, Bludit)
- [CVE-2026-25101](https://cve.now/CVE-2026-25101.md): Session Fixation in Bludit (CVSS 4.8, Bludit)
- [CVE-2026-4620](https://cve.now/CVE-2026-4620.md): OS Command Injection vulnerability in NEC Platforms, Ltd. (CVSS 7.1, NEC Platforms Aterm WX1500HP · NEC Platforms Aterm WX3600HP)
- [CVE-2026-4622](https://cve.now/CVE-2026-4622.md): OS Command Injection vulnerability in NEC Platforms, Ltd. (CVSS 7.1, NEC Platforms Aterm WG2600HS · NEC Platforms Aterm WF120… +7)
- [CVE-2026-4621](https://cve.now/CVE-2026-4621.md): Hidden Functionality vulnerability in NEC Platforms, Ltd. (CVSS 6.3, NEC Platforms Aterm W1200EX · NEC Platforms Aterm WG120… +23)
- [CVE-2026-4619](https://cve.now/CVE-2026-4619.md): Path Traversal vulnerability in NEC Platforms, Ltd. (CVSS 6.0, NEC Platforms Aterm WX3600HP)
- [CVE-2026-4309](https://cve.now/CVE-2026-4309.md): Missing Authorization vulnerability in NEC Platforms, Ltd. (CVSS 6.3, NEC Platforms Aterm W1200EX · NEC Platforms Aterm WG120… +22)
- [CVE-2023-7339](https://cve.now/CVE-2023-7339.md): Data collection for dowloading leads into buffer overflow (CVSS 6.5, Softing pnGate · Softing epGate +3)
- [CVE-2026-3457](https://cve.now/CVE-2026-3457.md): Stored XSS vulnerability in Sentinel ACC (CVSS 7.0, Thalesgroup Sentinel LDK Runtime)
- [CVE-2026-27860](https://cve.now/CVE-2026-27860.md): If auth\_username\_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. (CVSS 3.7, Open-Xchange OX Dovecot Pro)
- [CVE-2026-27859](https://cve.now/CVE-2026-27859.md): A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. (CVSS 5.3, Open-Xchange OX Dovecot Pro)
- [CVE-2026-27858](https://cve.now/CVE-2026-27858.md): Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. (CVSS 7.5, Open-Xchange OX Dovecot Pro)
- [CVE-2026-27857](https://cve.now/CVE-2026-27857.md): Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. (CVSS 4.3, Open-Xchange OX Dovecot Pro)
- [CVE-2026-27856](https://cve.now/CVE-2026-27856.md): Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. (CVSS 7.4, Open-Xchange OX Dovecot Pro)
- [CVE-2026-27855](https://cve.now/CVE-2026-27855.md): Dovecot OTP authentication is vulnerable to replay attack under specific conditions. (CVSS 6.8, Open-Xchange OX Dovecot Pro)
- [CVE-2026-24031](https://cve.now/CVE-2026-24031.md): Dovecot SQL based authentication can be bypassed when auth\_username\_chars is cleared by admin. (CVSS 7.7, Open-Xchange OX Dovecot Pro)
- [CVE-2026-0394](https://cve.now/CVE-2026-0394.md): When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added (CVSS 5.3, Open-Xchange OX Dovecot Pro)
- [CVE-2025-59032](https://cve.now/CVE-2025-59032.md): ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. (CVSS 7.5, Open-Xchange OX Dovecot Pro)
- [CVE-2025-59031](https://cve.now/CVE-2025-59031.md): Dovecot has provided a script to use for attachment to text conversion. (CVSS 4.3, Open-Xchange OX Dovecot Pro)
- [CVE-2025-59028](https://cve.now/CVE-2025-59028.md): When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai (CVSS 5.3, Open-Xchange OX Dovecot Pro)
- [CVE-2024-14028](https://cve.now/CVE-2024-14028.md): Multiple implicit reads in parallel can result in a crash or denial of service (CVSS 6.5, Softing smartLink HW-DP · Softing smartLink HW-PN)
- [CVE-2026-22744](https://cve.now/CVE-2026-22744.md): In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strin (CVSS 7.5, Spring AI · org.springframework.ai:spring-ai-redis-store)
- [CVE-2026-22743](https://cve.now/CVE-2026-22743.md): Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore (CVSS 7.5, Spring AI · org.springframework.ai:spring-ai-neo4j-store)
- [CVE-2026-4948](https://cve.now/CVE-2026-4948.md): Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-22742](https://cve.now/CVE-2026-22742.md): Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching (CVSS 8.6, Spring AI · org.springframework.ai:spring-ai-bedrock-conver…)
- [CVE-2026-33366](https://cve.now/CVE-2026-33366.md): Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the pro (CVSS 5.3, BUFFALO Wi-Fi router products)
- [CVE-2026-33280](https://cve.now/CVE-2026-33280.md): Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging fu (CVSS 7.2, BUFFALO Wi-Fi router products)
- [CVE-2026-32678](https://cve.now/CVE-2026-32678.md): Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings wi (CVSS 7.5, BUFFALO Wi-Fi router products)
- [CVE-2026-32669](https://cve.now/CVE-2026-32669.md): Code injection vulnerability exists in BUFFALO Wi-Fi router products. (CVSS 8.8, BUFFALO Wi-Fi router products)
- [CVE-2026-27650](https://cve.now/CVE-2026-27650.md): OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. (CVSS 8.8, BUFFALO Wi-Fi router products)
- [CVE-2026-22738](https://cve.now/CVE-2026-22738.md): SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution (CVSS 9.8, Spring AI · org.springframework.ai:spring-ai-vector-store)
- [CVE-2026-33559](https://cve.now/CVE-2026-33559.md): WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. (CVSS 5.4, MiKa OpenStreetMap)
- [CVE-2026-34353](https://cve.now/CVE-2026-34353.md): In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is proc (CVSS 5.9, OCaml)
- [CVE-2026-3098](https://cve.now/CVE-2026-3098.md): Smart Slider 3 \<= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll (CVSS 6.5, nextendweb Smart Slider)
- [CVE-2026-4910](https://cve.now/CVE-2026-4910.md): Shenzhen Ruiming Technology Streamax Crocus Endpoint RemoteFormat.do sql injection (CVSS 6.9, Shenzhen Ruiming Technology Streamax Crocus)
- [CVE-2026-4909](https://cve.now/CVE-2026-4909.md): code-projects Exam Form Submission update\_s7.php cross site scripting (CVSS 4.8, code-projects Exam Form Submission)
- [CVE-2026-4908](https://cve.now/CVE-2026-4908.md): code-projects Simple Laundry System Parameter modstaffinfo.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-4907](https://cve.now/CVE-2026-4907.md): Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery (CVSS 5.3, Page-Replica Page Replica)
- [CVE-2026-4906](https://cve.now/CVE-2026-4906.md): Tenda AC5 POST Request WizardHandle decodePwd stack-based overflow (CVSS 8.7, Tenda AC5)
- [CVE-2026-33747](https://cve.now/CVE-2026-33747.md): BuildKit vulnerable to malicious frontend causing file escape outside of storage root (CVSS 8.4, moby buildkit · github.com/moby/buildkit)
- [CVE-2026-33745](https://cve.now/CVE-2026-33745.md): cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect (CVSS 7.4, yhirose cpp-httplib)
- [CVE-2026-33744](https://cve.now/CVE-2026-33744.md): BentoML has Dockerfile Command Injection via system\_packages in bentofile.yaml (CVSS 7.8, BentoML)
- [CVE-2026-33935](https://cve.now/CVE-2026-33935.md): MyTube has Unauthenticated Account Lockout via Shared Login Attempt State (CVSS 7.7, franklioxygen MyTube)
- [CVE-2026-33890](https://cve.now/CVE-2026-33890.md): MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration (CVSS 8.9, franklioxygen MyTube)
- [CVE-2026-33735](https://cve.now/CVE-2026-33735.md): MyTube has an Improper Access Control that Allows Complete Application Takeover (CVSS 7.4, franklioxygen MyTube)
- [CVE-2026-33730](https://cve.now/CVE-2026-33730.md): Open Source Point of Sale has an IDOR in Password Change (Home) (CVSS 6.5, opensourcepos)
- [CVE-2026-33729](https://cve.now/CVE-2026-33729.md): OpenFGA has an Authorization Bypass through cached keys (CVSS 5.8, openfga · github.com/openfga/openfga)
- [CVE-2026-33728](https://cve.now/CVE-2026-33728.md): dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution (CVSS 9.3, DataDog dd-trace-java · com.datadoghq:dd-java-agent)
- [CVE-2026-33726](https://cve.now/CVE-2026-33726.md): Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic (CVSS 5.4, cilium · github.com/cilium/cilium)
- [CVE-2026-33725](https://cve.now/CVE-2026-33725.md): Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import (CVSS 7.2, metabase)
- [CVE-2026-33721](https://cve.now/CVE-2026-33721.md): MapServer has heap buffer overflow in SLD \`Categorize\` Threshold parsing (CVSS 5.3, MapServer)
- [CVE-2026-33718](https://cve.now/CVE-2026-33718.md): OpenHands is Vulnerable to Command Injection through its Git Diff Handler (CVSS 7.6, OpenHands · openhands-ai)
- [CVE-2026-33693](https://cve.now/CVE-2026-33693.md): Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4\_is\_invalid() (CVSS 6.5, LemmyNet lemmy · activitypub\_federation)
- [CVE-2026-33701](https://cve.now/CVE-2026-33701.md): OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution (CVSS 9.3, open-telemetry opentelemetry-java-instrumentation · io.open…)
- [CVE-2025-61190](https://cve.now/CVE-2025-61190.md): A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functional (CVSS 6.1)
- [CVE-2025-69986](https://cve.now/CVE-2025-69986.md): A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. (CVSS 7.2)
- [CVE-2025-69988](https://cve.now/CVE-2025-69988.md): BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control. (CVSS 6.5)
- [CVE-2026-29871](https://cve.now/CVE-2026-29871.md): A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the (CVSS 7.5)
- [CVE-2026-30302](https://cve.now/CVE-2026-30302.md): The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanis (CVSS 10.0)
- [CVE-2026-30303](https://cve.now/CVE-2026-30303.md): The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ine (CVSS 9.8)
- [CVE-2026-30304](https://cve.now/CVE-2026-30304.md): In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands. (CVSS 9.6)
- [CVE-2026-30527](https://cve.now/CVE-2026-30527.md): A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management modul (CVSS 4.8)
- [CVE-2026-30529](https://cve.now/CVE-2026-30529.md): A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save\_user (CVSS 8.8)
- [CVE-2026-30530](https://cve.now/CVE-2026-30530.md): A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save\_custo (CVSS 9.8)
- [CVE-2026-30531](https://cve.now/CVE-2026-30531.md): A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save\_categ (CVSS 8.8)
- [CVE-2026-30532](https://cve.now/CVE-2026-30532.md): A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view\_product.php file via the "id" para (CVSS 9.8)
- [CVE-2026-30533](https://cve.now/CVE-2026-30533.md): A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage\_product.php file via the "id" pa (CVSS 9.8)
- [CVE-2026-30534](https://cve.now/CVE-2026-30534.md): A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/manage\_category.php via the "id" parameter. (CVSS 8.3)
- [CVE-2026-30567](https://cve.now/CVE-2026-30567.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view\_product.php file vi (CVSS 6.1)
- [CVE-2026-30568](https://cve.now/CVE-2026-30568.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in in the view\_purchase.php fil (CVSS 4.8)
- [CVE-2026-30569](https://cve.now/CVE-2026-30569.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. (CVSS 6.1)
- [CVE-2026-30570](https://cve.now/CVE-2026-30570.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view\_sales.php file via (CVSS 6.1)
- [CVE-2026-30571](https://cve.now/CVE-2026-30571.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view\_category.php file v (CVSS 6.1)
- [CVE-2026-30574](https://cve.now/CVE-2026-30574.md): A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. (CVSS 7.5)
- [CVE-2026-30575](https://cve.now/CVE-2026-30575.md): A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file. (CVSS 7.5)
- [CVE-2026-30576](https://cve.now/CVE-2026-30576.md): A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file. (CVSS 7.5)
- [CVE-2026-30637](https://cve.now/CVE-2026-30637.md): Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. (CVSS 7.5)
- [CVE-2026-30689](https://cve.now/CVE-2026-30689.md): In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. (CVSS 4.3, anjoy8 Blog.Core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.