CVEs published March 28, 2026
56 CVEs were published on March 28, 2026: 9 critical, 20 high.
- Published
- 56
- Critical
- 9
- High
- 20
- Medium
- 26
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- elecV2P
- 6
- PromtEngineer localGPT
- 4
- code-projects Simple Food Order System
- 3
- Sinaptik AI PandasAI
- 3
- wandb OpenUI
- 3
- Varaneckas JAD Java Decompiler
- 2
- BOCHS
- 1
- brainstormforce SureForms – Contact Form, Payment Form & Ot…
- 1
- Crashmail
- 1
- Echatserver EChat Server
- 1
Critical 9
- CVE-2026-3256HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session idsKTAT HTTP::Session
- CVE-2025-15604Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functionsTOKUHIROM Amon2
- CVE-2018-25223Crashmail 1.6 Stack-based Buffer Overflow Remote Code ExecutionCrashmail
- CVE-2018-25221EChat Server 3.1 Buffer Overflow via chat.ghp username ParameterEchatserver EChat Server
- CVE-2018-25220Bochs 2.6-5 Buffer Overflow Remote Code ExecutionBOCHS
- CVE-2017-20229MAWK 1.3.3-17 Stack-Based Buffer OverflowMAWK
- CVE-2017-20227JAD 1.5.8e-1kali1 Stack-Based Buffer OverflowVaraneckas JAD Java Decompiler
- CVE-2017-20225TiEmu 2.08 Stack-Based Buffer Overflow Vulnerabilityticalc TiEmu
- CVE-2016-20049JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code ExecutionVaraneckas JAD Java Decompiler
High 20
- CVE-2026-5004Wavlink WL-WN579X3-C UPNP firewall.cgi sub_4019FC stack-based overflowWavlink WL-WN579X3-C
- CVE-2017-20228Flat Assembler 1.71.21 Stack-Based Buffer Overflow ROPFlatassembler Flat Assembler
- CVE-2018-25225SIPP 3.3 Stack-Based Buffer Overflow via Configuration FileSIPP
- CVE-2018-25224PMS 0.42 Stack-Based Buffer Overflow via Configuration FilePMS
- CVE-2018-25222SC v7.16 Stack-Based Buffer Overflow Remote Code ExecutionSC
- CVE-2017-20226Mapscrn 2.0.3 Stack-Based Buffer Overflowmsk Mapscrn
- CVE-2016-20048iSelect 1.4.0-2+b1 Local Buffer Overflow via key parameteriSelect
- CVE-2016-20047EKG Gadu 1.9 Local Buffer Overflow via Username ParameterEKG Gadu
- CVE-2016-20046zFTP Client 20061220+dfsg3-4.1 Local Buffer OverflowzFTP Client
- CVE-2016-20045HNB Organizer 1.9.18-10 Local Buffer Overflow via -rc ParameterHNB
- CVE-2016-20044PInfo 0.6.9-5.1 Local Buffer Overflow via -m ParameterPInfo
- CVE-2016-20043NRSS RSS Reader 0.3.9-1 Stack Buffer OverflowNRSS Reader
- CVE-2016-20042TRN 3.6-23 Stack Buffer Overflow Local Code Executiontrn Threaded USENET News Reader
- CVE-2016-20041Yasr 0.6.9-5 Buffer Overflow via Command-line ParameterYasr Screen Reader
- CVE-2016-20040TiEmu 3.03-nogdb+dfsg-3 Buffer Overflow via ROM Parameterticalc Texas Instrument Emulator
- CVE-2016-20039Multi Emulator Super System 0.154-3.1 Buffer Overflowmamedev Mess Emulator
- CVE-2016-20038yTree 1.94-1.1 Stack-Based Buffer Overflowwerner yTree
- CVE-2016-20037xwpe 1.5.30a-2.1 Stack-based Buffer OverflowIdenticalsoftware xWPE
- CVE-2025-12886Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_pathLaborator Oxygen - WooCommerce WordPress Theme
- CVE-2026-4987SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'brainstormforce SureForms – Contact Form, Payment Form & Ot…
Medium, low and unrated 27
- CVE-2026-5019code-projects Simple Food Order System Parameter all-orders.php sql injectioncode-projects Simple Food Order System
- CVE-2026-5018code-projects Simple Food Order System Parameter register-router.php sql injectioncode-projects Simple Food Order System
- CVE-2026-5017code-projects Simple Food Order System Parameter all-tickets.php sql injectioncode-projects Simple Food Order System
- CVE-2026-5016elecV2 elecV2P URL mock eAxios server-side request forgeryelecV2P
- CVE-2026-5015elecV2 elecV2P Endpoint logs cross site scriptingelecV2P
- CVE-2026-5014elecV2 elecV2P Wildcard log path.join path traversalelecV2P
- CVE-2026-5013elecV2 elecV2P :key path.join path traversalelecV2P
- CVE-2026-5012elecV2 elecV2P rpc pm2run os command injectionelecV2P
- CVE-2026-5011elecV2 elecV2P JSON webhook runJSFile code injectionelecV2P
- CVE-2026-5007kazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injectionkazuph mcp-docs-rag
- CVE-2026-5003PromtEngineer localGPT Web api_server.py handle_index information disclosurePromtEngineer localGPT
- CVE-2026-5002PromtEngineer localGPT LLM Prompt server.py _route_using_overviews injectionPromtEngineer localGPT
- CVE-2026-5001PromtEngineer localGPT server.py do_POST unrestricted uploadPromtEngineer localGPT
- CVE-2026-5000PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authenticationPromtEngineer localGPT
- CVE-2026-4999z-9527 admin isImg Check upload.js uploadFile path traversalz-9527 admin
- CVE-2026-4998Sinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injectionSinaptik AI PandasAI
- CVE-2026-4997Sinaptik AI PandasAI sql_sanitizer.py is_sql_query_safe path traversalSinaptik AI PandasAI
- CVE-2026-4996Sinaptik AI PandasAI pandasai-lancedb Extension lancedb.py get_relevant_docs_by_id sql injectionSinaptik AI PandasAI
- CVE-2026-2595Quads Ads Manager for Google AdSense <= 2.0.98.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameterswpquads Quads Ads Manager for Google AdSense
- CVE-2025-9497Hardcoded Upgrade Decryption PasswordsMicrochip Time Provider
- CVE-2026-4995wandb OpenUI Window Message Event index.html cross site scriptingwandb OpenUI
- CVE-2026-2442Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'softaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2026-4994wandb OpenUI APIStatusError server.py generic_exception_handler information exposurewandb OpenUI
- CVE-2026-4993wandb OpenUI config.py hard-coded credentialswandb OpenUI
- CVE-2026-23399nf_tables: nft_dynset: fix possible stateful expression memleak in error pathLinux
- CVE-2026-1307Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Tokenkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2025-15445Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/ActivationRestaurant Cafeteria