CVEs published March 29, 2026
47 CVEs were published on March 29, 2026: 7 critical, 22 high.
- Published
- 47
- Critical
- 7
- High
- 22
- Medium
- 17
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- OpenClaw
- 19
- Belkin F9K1122
- 3
- code-projects Accounting System
- 3
- parisneo/lollms · lollms
- 3
- Tenda FH1201
- 2
- BichitroGan ISP Billing Software
- 1
- CASIANO GRID::Machine
- 1
- code-projects Chamber of Commerce Membership Management Sys…
- 1
- D-Link DIR-513
- 1
- DeDeveloper23 codebase-mcp
- 1
Critical 7
- CVE-2026-4176Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::ZlibSHAY perl
- CVE-2026-32987OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device PairingOpenClaw
- CVE-2026-32978OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script RunnersOpenClaw
- CVE-2026-32922OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotateOpenClaw
- CVE-2026-32918OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status ToolOpenClaw
- CVE-2026-32915OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control SurfaceOpenClaw
- CVE-2026-4851GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserializationCASIANO GRID::Machine
High 22
- CVE-2026-2370Improper Handling of Parameters in GitLabGitLab
- CVE-2026-4946NSA Ghidra Auto-Analysis Annotation Command ExecutionNSA Ghidra
- CVE-2026-0558Unauthenticated File Upload in parisneo/lollmsparisneo/lollms · lollms
- CVE-2026-0560Server-Side Request Forgery (SSRF) in parisneo/lollmsparisneo/lollms · lollms
- CVE-2026-0562Insecure Direct Object Reference (IDOR) in parisneo/lollmsparisneo/lollms · lollms
- CVE-2026-34005In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters Xiongmai DVR/NVR devices
- CVE-2026-5046Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflowTenda FH1201
- CVE-2026-5045Tenda FH1201 Parameter WrlclientSet stack-based overflowTenda FH1201
- CVE-2026-33575OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup CodesOpenClaw
- CVE-2026-33573OpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC ParametersOpenClaw
- CVE-2026-32980OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook RequestOpenClaw
- CVE-2026-32979OpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host ApprovalOpenClaw
- CVE-2026-32974OpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification TokenOpenClaw
- CVE-2026-32973OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path NormalizationOpenClaw
- CVE-2026-32972OpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.requestOpenClaw
- CVE-2026-32914OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug EndpointsOpenClaw
- CVE-2026-5044Belkin F9K1122 Setting formSetSystemSettings stack-based overflowBelkin F9K1122
- CVE-2026-5043Belkin F9K1122 Parameter formSetPassword stack-based overflowBelkin F9K1122
- CVE-2026-5042Belkin F9K1122 Parameter formCrossBandSwitch stack-based overflowBelkin F9K1122
- CVE-2026-5036Tenda 4G06 Endpoint DhcpListClient fromDhcpListClient stack-based overflowTenda 4G06
- CVE-2026-5024D-Link DIR-513 formSetEmail stack-based overflowD-Link DIR-513
- CVE-2026-5021Tenda F453 httpd PPTPUserSetting fromPPTPUserSetting stack-based overflowTenda F453
Medium, low and unrated 18
- CVE-2026-5101Totolink A3300R Parameter cstecgi.cgi setLanCfg command injectionTotolink A3300R
- CVE-2026-23400rust_binder: call set_notification_done() without proc lockLinux
- CVE-2026-33574OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills DownloadOpenClaw
- CVE-2026-33572OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript FilesOpenClaw
- CVE-2026-32975OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser AllowlistOpenClaw
- CVE-2026-32924OpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in FeishuOpenClaw
- CVE-2026-32923OpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist EnforcementOpenClaw
- CVE-2026-32919OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash CommandsOpenClaw
- CVE-2026-5041code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injectioncode-projects Chamber of Commerce Membership Management Sys…
- CVE-2026-5037mxml mxmlIndexNew mxml-index.c index_sort stack-based overflowmxml
- CVE-2026-5035code-projects Accounting System Parameter view_work.php sql injectioncode-projects Accounting System
- CVE-2026-5034code-projects Accounting System Parameter edit_costumer.php sql injectioncode-projects Accounting System
- CVE-2026-5033code-projects Accounting System Parameter view_costumer.php sql injectioncode-projects Accounting System
- CVE-2026-5031BichitroGan ISP Billing Software Endpoint users-view resource injectionBichitroGan ISP Billing Software
- CVE-2026-5030Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injectionTotolink NR1800X
- CVE-2026-5023DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injectionDeDeveloper23 codebase-mcp
- CVE-2026-2602Twentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'Twentig Supercharged Block Editor – Blocks, Patterns, Start…
- CVE-2026-5020Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injectionTotolink A3600R