2026 CVEs (page 368)
Page 368 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33228 | Critical | 9.8 | 2026-03-20 | flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as di… |
CVE-2026-33226 | High | 8.7 | 2026-03-20 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview… |
CVE-2026-33221 | Medium | 5.3 | 2026-03-20 | Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Conten… |
CVE-2026-33210 | Critical | 9.1 | 2026-03-20 | Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can… |
CVE-2026-33209 | Medium | 6.1 | 2026-03-20 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the r… |
CVE-2026-33204 | High | 7.5 | 2026-03-20 | SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header… |
CVE-2026-33203 | High | 7.5 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specifi… |
CVE-2026-33194 | Medium | 6.8 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach th… |
CVE-2026-33186 | Critical | 9.1 | 2026-03-20 | gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2… |
CVE-2026-33180 | High | 7.5 | 2026-03-20 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP r… |
CVE-2026-32810 | Medium | 5.5 | 2026-03-20 | Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its confi… |
CVE-2026-32733 | Medium | 6.5 | 2026-03-20 | Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from in… |
CVE-2026-32663 | High | 7.3 | 2026-03-20 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-31926 | Medium | 6.5 | 2026-03-20 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-31904 | High | 7.5 | 2026-03-20 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-31903 | High | 7.5 | 2026-03-20 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-29796 | Critical | 9.4 | 2026-03-20 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-28204 | Medium | 6.5 | 2026-03-20 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-27649 | High | 7.3 | 2026-03-20 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-25192 | Critical | 9.4 | 2026-03-20 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-22163 | High | 7.8 | 2026-03-20 | Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows subversion of the GPU… |
CVE-2026-21732 | Critical | 9.6 | 2026-03-20 | A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader co… |
CVE-2026-4507 | Medium | 6.3 | 2026-03-20 | A vulnerability was determined in Mindinventory MindSQL up to 0.2.1. The affected element is the function ask_db of the file mindsql/core/mindsql_core.py. Exec… |
CVE-2026-4506 | Medium | 6.3 | 2026-03-20 | A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask_db of the file mindsql/core/mindsql_core.py. Performing a manipula… |
CVE-2026-3584 | Critical | 9.8 | 2026-03-20 | The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is… |
CVE-2026-33177 | Medium | 4.3 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create tax… |
CVE-2026-33172 | High | 8.7 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads a… |
CVE-2026-33171 | Medium | 4.3 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitr… |
CVE-2026-33166 | High | 8.6 | 2026-03-20 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to… |
CVE-2026-32887 | High | 7.4 | 2026-03-20 | Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when usin… |
CVE-2026-2378 | High | 7.4 | 2026-03-20 | ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing… |
CVE-2026-23536 | High | 7.5 | 2026-03-20 | A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessi… |
CVE-2026-33179 | Medium | 5.5 | 2026-03-20 | libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse_uri… |
CVE-2026-33165 | Medium | 5.5 | 2026-03-20 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confir… |
CVE-2026-33164 | High | 7.5 | 2026-03-20 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_… |
CVE-2026-33156 | High | 7.8 | 2026-03-20 | ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable exe… |
CVE-2026-33155 | High | 7.5 | 2026-03-20 | DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnp… |
CVE-2026-33154 | High | 7.5 | 2026-03-20 | dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe… |
CVE-2026-33151 | High | 7.5 | 2026-03-20 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Soc… |
CVE-2026-33150 | High | 7.8 | 2026-03-20 | libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsyst… |
CVE-2026-33147 | High | 7.3 | 2026-03-20 | GMT is an open source collection of command-line tools for manipulating geographic and Cartesian data sets. In versions from 6.6.0 and prior, a stack-based buf… |
CVE-2026-33144 | Medium | 5.8 | 2026-03-20 | GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vul… |
CVE-2026-33143 | High | 7.5 | 2026-03-20 | OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler (/notification/whatsapp/webhoo… |
CVE-2026-33142 | High | 8.1 | 2026-03-20 | OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggrega… |
CVE-2026-4505 | Medium | 6.3 | 2026-03-20 | A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-ser… |
CVE-2026-4504 | High | 7.3 | 2026-03-20 | A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix… |
CVE-2026-4500 | Medium | 6.3 | 2026-03-20 | A vulnerability was identified in bagofwords1 bagofwords up to 0.0.297. This impacts the function generate_df of the file backend/app/ai/code_execution/code_ex… |
CVE-2026-4499 | High | 7.3 | 2026-03-20 | A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os c… |
CVE-2026-4438 | Medium | 5.4 | 2026-03-20 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version… |
CVE-2026-4437 | High | 7.5 | 2026-03-20 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version… |
CVE-2026-33140 | Medium | 6.1 | 2026-03-20 | PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are aff… |
CVE-2026-33139 | High | 7.8 | 2026-03-20 | PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are aff… |
CVE-2026-33126 | Medium | 5.0 | 2026-03-20 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary… |
CVE-2026-4497 | High | 7.3 | 2026-03-20 | A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-4496 | Medium | 5.3 | 2026-03-20 | A vulnerability was found in sigmade Git-MCP-Server up to 785aa159f262a02d5791a5d8a8e13c507ac42880. Affected by this vulnerability is the function child_proces… |
CVE-2026-33010 | High | 8.1 | 2026-03-20 | mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true)… |
CVE-2026-32710 | High | 8.5 | 2026-03-20 | MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a… |
CVE-2026-32318 | High | 7.6 | 2026-03-20 | Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability a… |
CVE-2026-32317 | High | 7.6 | 2026-03-20 | Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerabil… |
CVE-2026-32310 | Medium | 4.1 | 2026-03-20 | Cryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its integrity… |
CVE-2026-32309 | High | 7.5 | 2026-03-20 | Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, the Hub-based unlock flow explicitly supports hub+http and consumes Hu… |
CVE-2026-4495 | Low | 3.5 | 2026-03-20 | A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiCon… |
CVE-2026-4494 | Low | 3.5 | 2026-03-20 | A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController… |
CVE-2026-4493 | High | 8.8 | 2026-03-20 | A vulnerability was determined in Tenda A18 Pro 02.03.02.28. The impacted element is the function sub_423B50 of the file /goform/setMacFilterCfg of the compone… |
CVE-2026-4492 | High | 8.8 | 2026-03-20 | A vulnerability was found in Tenda A18 Pro 02.03.02.28. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a m… |
CVE-2026-32844 | Medium | 6.1 | 2026-03-20 | XinLiangCoder php_api_doc through commit 1ce5bbf contains a reflected cross-site scripting vulnerability in list_method.php that allows remote attackers to exe… |
CVE-2026-32303 | High | 7.6 | 2026-03-20 | Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the… |
CVE-2026-31836 | High | 8.1 | 2026-03-20 | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful… |
CVE-2026-30580 | Medium | 4.3 | 2026-03-20 | File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read ar… |
CVE-2026-30579 | Medium | 6.5 | 2026-03-20 | File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a file with a crafted f… |
CVE-2026-30578 | Medium | 6.5 | 2026-03-20 | File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invoke arbitrary javas… |
CVE-2026-4491 | High | 8.8 | 2026-03-20 | A vulnerability has been found in Tenda A18 Pro 02.03.02.28. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of t… |
CVE-2026-4490 | High | 8.8 | 2026-03-20 | A flaw has been found in Tenda A18 Pro 02.03.02.28. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. This manipulation causes st… |
CVE-2026-29828 | Medium | 6.1 | 2026-03-20 | DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc. |
CVE-2026-22902 | Medium | 6.7 | 2026-03-20 | A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2026-22901 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2026-22900 | Critical | 9.8 | 2026-03-20 | A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthor… |
CVE-2026-22898 | Critical | 9.8 | 2026-03-20 | A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to ga… |
CVE-2026-22897 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary command… |
CVE-2026-22895 | Medium | 4.8 | 2026-03-20 | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploi… |
CVE-2026-4489 | High | 8.8 | 2026-03-20 | A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wifi_set of the file /goform/fast_setting_… |
CVE-2026-4488 | High | 8.8 | 2026-03-20 | A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected is the function strcpy of the file /goform/setSysAdm. Such manipulation… |
CVE-2026-32989 | High | 8.8 | 2026-03-20 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests… |
CVE-2026-32986 | Medium | 6.1 | 2026-03-20 | Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improp… |
CVE-2026-4519 | Low | 3.3 | 2026-03-20 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior reject… |
CVE-2026-4487 | High | 8.8 | 2026-03-20 | A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation c… |
CVE-2026-33312 | Medium | 5.4 | 2026-03-20 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/ba… |
CVE-2026-29794 | Medium | 5.3 | 2026-03-20 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass th… |
CVE-2026-22172 | Critical | 9.9 | 2026-03-20 | OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authentic… |
CVE-2026-4486 | High | 8.8 | 2026-03-20 | A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPassword of the file /goform/formEasySetPassword of the component Web Se… |
CVE-2026-4485 | Medium | 6.3 | 2026-03-20 | A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/search_student.php… |
CVE-2026-33372 | Medium | 5.4 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper… |
CVE-2026-33371 | Medium | 4.3 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS… |
CVE-2026-33370 | Medium | 6.1 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature d… |
CVE-2026-33369 | Medium | 4.3 | 2026-03-20 | Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation. The application… |
CVE-2026-33368 | Medium | 6.1 | 2026-03-20 | Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). T… |
CVE-2026-31382 | Medium | 6.1 | 2026-03-20 | The error_description parameter is vulnerable to Reflected XSS. An attacker can bypass the domain's WAF using a Safari-specific onpagereveal payload. |
CVE-2026-31381 | Medium | 5.3 | 2026-03-20 | An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL. |
CVE-2026-4434 | High | 8.1 | 2026-03-20 | Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS cer… |
CVE-2026-33136 | Critical | 9.3 | 2026-03-20 | WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos… |