# CVEs published 2026-03-29

47 CVEs were published on March 29, 2026: 7 critical, 22 high. Days are UTC.

- [CVE-2026-2370](https://cve.now/CVE-2026-2370.md): Improper Handling of Parameters in GitLab (CVSS 8.1, GitLab)
- [CVE-2026-5101](https://cve.now/CVE-2026-5101.md): Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection (CVSS 5.3, Totolink A3300R)
- [CVE-2026-4176](https://cve.now/CVE-2026-4176.md): Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib (CVSS 9.8, SHAY perl)
- [CVE-2026-4946](https://cve.now/CVE-2026-4946.md): NSA Ghidra Auto-Analysis Annotation Command Execution (CVSS 8.8, NSA Ghidra)
- [CVE-2026-0558](https://cve.now/CVE-2026-0558.md): Unauthenticated File Upload in parisneo/lollms (CVSS 7.5, parisneo/lollms · lollms)
- [CVE-2026-0560](https://cve.now/CVE-2026-0560.md): Server-Side Request Forgery (SSRF) in parisneo/lollms (CVSS 7.5, parisneo/lollms · lollms)
- [CVE-2026-0562](https://cve.now/CVE-2026-0562.md): Insecure Direct Object Reference (IDOR) in parisneo/lollms (CVSS 8.3, parisneo/lollms · lollms)
- [CVE-2026-34005](https://cve.now/CVE-2026-34005.md): In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters (CVSS 8.8, Xiongmai DVR/NVR devices)
- [CVE-2026-5046](https://cve.now/CVE-2026-5046.md): Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2026-5045](https://cve.now/CVE-2026-5045.md): Tenda FH1201 Parameter WrlclientSet stack-based overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2026-23400](https://cve.now/CVE-2026-23400.md): rust\_binder: call set\_notification\_done() without proc lock (no CVSS, Linux)
- [CVE-2026-33575](https://cve.now/CVE-2026-33575.md): OpenClaw \< 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes (CVSS 8.6, OpenClaw)
- [CVE-2026-33574](https://cve.now/CVE-2026-33574.md): OpenClaw \< 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download (CVSS 5.8, OpenClaw)
- [CVE-2026-33573](https://cve.now/CVE-2026-33573.md): OpenClaw \< 2026.3.11 - Workspace Boundary Bypass via Agent RPC Parameters (CVSS 8.7, OpenClaw)
- [CVE-2026-33572](https://cve.now/CVE-2026-33572.md): OpenClaw \< 2026.2.17 - Insufficient File Permissions in Session Transcript Files (CVSS 6.8, OpenClaw)
- [CVE-2026-32987](https://cve.now/CVE-2026-32987.md): OpenClaw \< 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing (CVSS 9.3, OpenClaw)
- [CVE-2026-32980](https://cve.now/CVE-2026-32980.md): OpenClaw \< 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request (CVSS 8.7, OpenClaw)
- [CVE-2026-32979](https://cve.now/CVE-2026-32979.md): OpenClaw \< 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host Approval (CVSS 7.0, OpenClaw)
- [CVE-2026-32978](https://cve.now/CVE-2026-32978.md): OpenClaw \< 2026.3.11 - Approval Bypass via Unrecognized Script Runners (CVSS 9.4, OpenClaw)
- [CVE-2026-32975](https://cve.now/CVE-2026-32975.md): OpenClaw \< 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist (CVSS 6.9, OpenClaw)
- [CVE-2026-32974](https://cve.now/CVE-2026-32974.md): OpenClaw \< 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token (CVSS 8.8, OpenClaw)
- [CVE-2026-32973](https://cve.now/CVE-2026-32973.md): OpenClaw \< 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization (CVSS 8.8, OpenClaw)
- [CVE-2026-32972](https://cve.now/CVE-2026-32972.md): OpenClaw \< 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.request (CVSS 7.1, OpenClaw)
- [CVE-2026-32924](https://cve.now/CVE-2026-32924.md): OpenClaw \< 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu (CVSS 6.9, OpenClaw)
- [CVE-2026-32923](https://cve.now/CVE-2026-32923.md): OpenClaw \< 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement (CVSS 5.3, OpenClaw)
- [CVE-2026-32922](https://cve.now/CVE-2026-32922.md): OpenClaw \< 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate (CVSS 9.4, OpenClaw)
- [CVE-2026-32919](https://cve.now/CVE-2026-32919.md): OpenClaw \< 2026.3.11 - Unauthorized Session Reset via agent Slash Commands (CVSS 6.9, OpenClaw)
- [CVE-2026-32918](https://cve.now/CVE-2026-32918.md): OpenClaw \< 2026.3.11 - Session Sandbox Escape via session\_status Tool (CVSS 9.2, OpenClaw)
- [CVE-2026-32915](https://cve.now/CVE-2026-32915.md): OpenClaw \< 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surface (CVSS 9.3, OpenClaw)
- [CVE-2026-32914](https://cve.now/CVE-2026-32914.md): OpenClaw \< 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints (CVSS 8.7, OpenClaw)
- [CVE-2026-5044](https://cve.now/CVE-2026-5044.md): Belkin F9K1122 Setting formSetSystemSettings stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2026-5043](https://cve.now/CVE-2026-5043.md): Belkin F9K1122 Parameter formSetPassword stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2026-5042](https://cve.now/CVE-2026-5042.md): Belkin F9K1122 Parameter formCrossBandSwitch stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2026-5041](https://cve.now/CVE-2026-5041.md): code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection (CVSS 5.1, code-projects Chamber of Commerce Membership Management Sys…)
- [CVE-2026-5037](https://cve.now/CVE-2026-5037.md): mxml mxmlIndexNew mxml-index.c index\_sort stack-based overflow (CVSS 4.8, mxml)
- [CVE-2026-5036](https://cve.now/CVE-2026-5036.md): Tenda 4G06 Endpoint DhcpListClient fromDhcpListClient stack-based overflow (CVSS 8.7, Tenda 4G06)
- [CVE-2026-5035](https://cve.now/CVE-2026-5035.md): code-projects Accounting System Parameter view\_work.php sql injection (CVSS 6.9, code-projects Accounting System)
- [CVE-2026-5034](https://cve.now/CVE-2026-5034.md): code-projects Accounting System Parameter edit\_costumer.php sql injection (CVSS 6.9, code-projects Accounting System)
- [CVE-2026-5033](https://cve.now/CVE-2026-5033.md): code-projects Accounting System Parameter view\_costumer.php sql injection (CVSS 6.9, code-projects Accounting System)
- [CVE-2026-5031](https://cve.now/CVE-2026-5031.md): BichitroGan ISP Billing Software Endpoint users-view resource injection (CVSS 5.3, BichitroGan ISP Billing Software)
- [CVE-2026-5030](https://cve.now/CVE-2026-5030.md): Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection (CVSS 5.3, Totolink NR1800X)
- [CVE-2026-5024](https://cve.now/CVE-2026-5024.md): D-Link DIR-513 formSetEmail stack-based overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2026-5023](https://cve.now/CVE-2026-5023.md): DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection (CVSS 4.8, DeDeveloper23 codebase-mcp)
- [CVE-2026-2602](https://cve.now/CVE-2026-2602.md): Twentig \<= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth' (CVSS 6.4, Twentig Supercharged Block Editor – Blocks, Patterns, Start…)
- [CVE-2026-5021](https://cve.now/CVE-2026-5021.md): Tenda F453 httpd PPTPUserSetting fromPPTPUserSetting stack-based overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-5020](https://cve.now/CVE-2026-5020.md): Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection (CVSS 5.3, Totolink A3600R)
- [CVE-2026-4851](https://cve.now/CVE-2026-4851.md): GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization (CVSS 9.8, CASIANO GRID::Machine)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.