# CVEs published 2026-03-28

56 CVEs were published on March 28, 2026: 9 critical, 20 high. Days are UTC.

- [CVE-2026-5019](https://cve.now/CVE-2026-5019.md): code-projects Simple Food Order System Parameter all-orders.php sql injection (CVSS 6.9, code-projects Simple Food Order System)
- [CVE-2026-5018](https://cve.now/CVE-2026-5018.md): code-projects Simple Food Order System Parameter register-router.php sql injection (CVSS 6.9, code-projects Simple Food Order System)
- [CVE-2026-5017](https://cve.now/CVE-2026-5017.md): code-projects Simple Food Order System Parameter all-tickets.php sql injection (CVSS 6.9, code-projects Simple Food Order System)
- [CVE-2026-5016](https://cve.now/CVE-2026-5016.md): elecV2 elecV2P URL mock eAxios server-side request forgery (CVSS 6.9, elecV2P)
- [CVE-2026-5015](https://cve.now/CVE-2026-5015.md): elecV2 elecV2P Endpoint logs cross site scripting (CVSS 5.3, elecV2P)
- [CVE-2026-5014](https://cve.now/CVE-2026-5014.md): elecV2 elecV2P Wildcard log path.join path traversal (CVSS 6.9, elecV2P)
- [CVE-2026-5013](https://cve.now/CVE-2026-5013.md): elecV2 elecV2P :key path.join path traversal (CVSS 6.9, elecV2P)
- [CVE-2026-5012](https://cve.now/CVE-2026-5012.md): elecV2 elecV2P rpc pm2run os command injection (CVSS 6.9, elecV2P)
- [CVE-2026-3256](https://cve.now/CVE-2026-3256.md): HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids (CVSS 9.8, KTAT HTTP::Session)
- [CVE-2025-15604](https://cve.now/CVE-2025-15604.md): Amon2 versions before 6.17 for Perl use an insecure random\_string implementation for security functions (CVSS 9.8, TOKUHIROM Amon2)
- [CVE-2026-5011](https://cve.now/CVE-2026-5011.md): elecV2 elecV2P JSON webhook runJSFile code injection (CVSS 5.3, elecV2P)
- [CVE-2026-5007](https://cve.now/CVE-2026-5007.md): kazuph mcp-docs-rag add\_git\_repository/add\_text\_file index.ts cloneRepository os command injection (CVSS 4.8, kazuph mcp-docs-rag)
- [CVE-2026-5004](https://cve.now/CVE-2026-5004.md): Wavlink WL-WN579X3-C UPNP firewall.cgi sub\_4019FC stack-based overflow (CVSS 8.7, Wavlink WL-WN579X3-C)
- [CVE-2026-5003](https://cve.now/CVE-2026-5003.md): PromtEngineer localGPT Web api\_server.py handle\_index information disclosure (CVSS 6.9, PromtEngineer localGPT)
- [CVE-2026-5002](https://cve.now/CVE-2026-5002.md): PromtEngineer localGPT LLM Prompt server.py \_route\_using\_overviews injection (CVSS 6.9, PromtEngineer localGPT)
- [CVE-2026-5001](https://cve.now/CVE-2026-5001.md): PromtEngineer localGPT server.py do\_POST unrestricted upload (CVSS 6.9, PromtEngineer localGPT)
- [CVE-2026-5000](https://cve.now/CVE-2026-5000.md): PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication (CVSS 6.9, PromtEngineer localGPT)
- [CVE-2026-4999](https://cve.now/CVE-2026-4999.md): z-9527 admin isImg Check upload.js uploadFile path traversal (CVSS 5.3, z-9527 admin)
- [CVE-2026-4998](https://cve.now/CVE-2026-4998.md): Sinaptik AI PandasAI Chat Message code\_executor.py CodeExecutor.execute code injection (CVSS 6.9, Sinaptik AI PandasAI)
- [CVE-2026-4997](https://cve.now/CVE-2026-4997.md): Sinaptik AI PandasAI sql\_sanitizer.py is\_sql\_query\_safe path traversal (CVSS 6.9, Sinaptik AI PandasAI)
- [CVE-2017-20228](https://cve.now/CVE-2017-20228.md): Flat Assembler 1.71.21 Stack-Based Buffer Overflow ROP (CVSS 8.6, Flatassembler Flat Assembler)
- [CVE-2018-25225](https://cve.now/CVE-2018-25225.md): SIPP 3.3 Stack-Based Buffer Overflow via Configuration File (CVSS 8.6, SIPP)
- [CVE-2018-25224](https://cve.now/CVE-2018-25224.md): PMS 0.42 Stack-Based Buffer Overflow via Configuration File (CVSS 8.6, PMS)
- [CVE-2018-25223](https://cve.now/CVE-2018-25223.md): Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution (CVSS 9.3, Crashmail)
- [CVE-2018-25222](https://cve.now/CVE-2018-25222.md): SC v7.16 Stack-Based Buffer Overflow Remote Code Execution (CVSS 8.6, SC)
- [CVE-2018-25221](https://cve.now/CVE-2018-25221.md): EChat Server 3.1 Buffer Overflow via chat.ghp username Parameter (CVSS 9.3, Echatserver EChat Server)
- [CVE-2018-25220](https://cve.now/CVE-2018-25220.md): Bochs 2.6-5 Buffer Overflow Remote Code Execution (CVSS 9.3, BOCHS)
- [CVE-2017-20229](https://cve.now/CVE-2017-20229.md): MAWK 1.3.3-17 Stack-Based Buffer Overflow (CVSS 9.3, MAWK)
- [CVE-2017-20227](https://cve.now/CVE-2017-20227.md): JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow (CVSS 9.3, Varaneckas JAD Java Decompiler)
- [CVE-2017-20226](https://cve.now/CVE-2017-20226.md): Mapscrn 2.0.3 Stack-Based Buffer Overflow (CVSS 8.6, msk Mapscrn)
- [CVE-2017-20225](https://cve.now/CVE-2017-20225.md): TiEmu 2.08 Stack-Based Buffer Overflow Vulnerability (CVSS 9.3, ticalc TiEmu)
- [CVE-2016-20049](https://cve.now/CVE-2016-20049.md): JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Execution (CVSS 9.3, Varaneckas JAD Java Decompiler)
- [CVE-2016-20048](https://cve.now/CVE-2016-20048.md): iSelect 1.4.0-2+b1 Local Buffer Overflow via key parameter (CVSS 8.6, iSelect)
- [CVE-2016-20047](https://cve.now/CVE-2016-20047.md): EKG Gadu 1.9 Local Buffer Overflow via Username Parameter (CVSS 8.6, EKG Gadu)
- [CVE-2016-20046](https://cve.now/CVE-2016-20046.md): zFTP Client 20061220+dfsg3-4.1 Local Buffer Overflow (CVSS 8.6, zFTP Client)
- [CVE-2016-20045](https://cve.now/CVE-2016-20045.md): HNB Organizer 1.9.18-10 Local Buffer Overflow via -rc Parameter (CVSS 8.6, HNB)
- [CVE-2016-20044](https://cve.now/CVE-2016-20044.md): PInfo 0.6.9-5.1 Local Buffer Overflow via -m Parameter (CVSS 8.6, PInfo)
- [CVE-2016-20043](https://cve.now/CVE-2016-20043.md): NRSS RSS Reader 0.3.9-1 Stack Buffer Overflow (CVSS 8.6, NRSS Reader)
- [CVE-2016-20042](https://cve.now/CVE-2016-20042.md): TRN 3.6-23 Stack Buffer Overflow Local Code Execution (CVSS 8.6, trn Threaded USENET News Reader)
- [CVE-2016-20041](https://cve.now/CVE-2016-20041.md): Yasr 0.6.9-5 Buffer Overflow via Command-line Parameter (CVSS 8.6, Yasr Screen Reader)
- [CVE-2016-20040](https://cve.now/CVE-2016-20040.md): TiEmu 3.03-nogdb+dfsg-3 Buffer Overflow via ROM Parameter (CVSS 8.6, ticalc Texas Instrument Emulator)
- [CVE-2016-20039](https://cve.now/CVE-2016-20039.md): Multi Emulator Super System 0.154-3.1 Buffer Overflow (CVSS 8.6, mamedev Mess Emulator)
- [CVE-2016-20038](https://cve.now/CVE-2016-20038.md): yTree 1.94-1.1 Stack-Based Buffer Overflow (CVSS 8.6, werner yTree)
- [CVE-2016-20037](https://cve.now/CVE-2016-20037.md): xwpe 1.5.30a-2.1 Stack-based Buffer Overflow (CVSS 8.6, Identicalsoftware xWPE)
- [CVE-2026-4996](https://cve.now/CVE-2026-4996.md): Sinaptik AI PandasAI pandasai-lancedb Extension lancedb.py get\_relevant\_docs\_by\_id sql injection (CVSS 6.9, Sinaptik AI PandasAI)
- [CVE-2026-2595](https://cve.now/CVE-2026-2595.md): Quads Ads Manager for Google AdSense \<= 2.0.98.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters (CVSS 5.4, wpquads Quads Ads Manager for Google AdSense)
- [CVE-2025-9497](https://cve.now/CVE-2025-9497.md): Hardcoded Upgrade Decryption Passwords (CVSS 5.5, Microchip Time Provider)
- [CVE-2026-4995](https://cve.now/CVE-2026-4995.md): wandb OpenUI Window Message Event index.html cross site scripting (CVSS 5.1, wandb OpenUI)
- [CVE-2026-2442](https://cve.now/CVE-2026-2442.md): Pagelayer \<= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email' (CVSS 5.3, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2026-4994](https://cve.now/CVE-2026-4994.md): wandb OpenUI APIStatusError server.py generic\_exception\_handler information exposure (CVSS 5.1, wandb OpenUI)
- [CVE-2026-4993](https://cve.now/CVE-2026-4993.md): wandb OpenUI config.py hard-coded credentials (CVSS 4.8, wandb OpenUI)
- [CVE-2026-23399](https://cve.now/CVE-2026-23399.md): nf\_tables: nft\_dynset: fix possible stateful expression memleak in error path (no CVSS, Linux)
- [CVE-2026-1307](https://cve.now/CVE-2026-1307.md): Ninja Forms \<= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token (CVSS 6.5, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2025-15445](https://cve.now/CVE-2025-15445.md): Restaurant Cafeteria \<= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation (CVSS 5.4, Restaurant Cafeteria)
- [CVE-2025-12886](https://cve.now/CVE-2025-12886.md): Oxygen \<= 6.0.8 - Unauthenticated Server-Side Request Forgery via route\_path (CVSS 7.2, Laborator Oxygen - WooCommerce WordPress Theme)
- [CVE-2026-4987](https://cve.now/CVE-2026-4987.md): SureForms \<= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form\_id' (CVSS 7.5, brainstormforce SureForms – Contact Form, Payment Form & Ot…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.