2026 CVEs (page 369)
Page 369 of 448 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33135 | Critical | 9.3 | 2026-03-20 | WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.p… |
CVE-2026-33134 | Critical | 9.3 | 2026-03-20 | WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_… |
CVE-2026-33133 | High | 7.2 | 2026-03-20 | WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives wi… |
CVE-2026-33132 | Medium | 5.3 | 2026-03-20 | ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement durin… |
CVE-2026-33131 | High | 7.4 | 2026-03-20 | H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastUR… |
CVE-2026-32595 | Low | 3.7 | 2026-03-20 | Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that al… |
CVE-2026-32305 | Medium | 5.3 | 2026-03-20 | Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass throug… |
CVE-2026-25792 | Medium | 6.5 | 2026-03-20 | Greenshot is an open source Windows screenshot utility. Versions 1.3.312 and below have untrusted executable search path / binary hijacking vulnerability that… |
CVE-2026-33130 | Medium | 6.5 | 2026-03-20 | Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventSer… |
CVE-2026-33129 | Medium | 5.9 | 2026-03-20 | H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to… |
CVE-2026-33128 | High | 7.5 | 2026-03-20 | H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE… |
CVE-2026-33125 | High | 7.1 | 2026-03-20 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can del… |
CVE-2026-33124 | High | 8.8 | 2026-03-20 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to c… |
CVE-2026-33123 | Medium | 6.5 | 2026-03-20 | pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or… |
CVE-2026-33081 | Medium | 5.8 | 2026-03-20 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the… |
CVE-2026-22324 | High | 8.1 | 2026-03-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania allows PHP Local File… |
CVE-2026-0677 | Medium | 6.3 | 2026-03-20 | Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Object Injection.This issue affects TotalContest Lite… |
CVE-2026-3550 | Medium | 5.3 | 2026-03-20 | The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17. This is due to missing capability check… |
CVE-2026-33192 | Medium | 5.3 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a dow… |
CVE-2026-33080 | High | 7.3 | 2026-03-20 | Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament T… |
CVE-2026-33075 | High | 8.8 | 2026-03-20 | FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and… |
CVE-2026-33072 | High | 8.2 | 2026-03-20 | FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is… |
CVE-2026-33071 | Medium | 4.3 | 2026-03-20 | FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml… |
CVE-2026-33070 | Low | 3.7 | 2026-03-20 | FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint… |
CVE-2026-33069 | High | 7.5 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multip… |
CVE-2026-33068 | High | 8.8 | 2026-03-20 | Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .claude/setting… |
CVE-2026-33067 | Critical | 9.0 | 2026-03-20 | SiYuan is a personal knowledge management system. Versions 3.6.0 and below render package metadata fields (displayName, description) using template literals wi… |
CVE-2026-33066 | Critical | 9.0 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New() without calling SetSanitize(tr… |
CVE-2026-32701 | High | 7.5 | 2026-03-20 | Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. B… |
CVE-2026-2432 | Medium | 4.4 | 2026-03-20 | The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in a… |
CVE-2026-2421 | Medium | 6.5 | 2026-03-20 | The ilGhera Carta Docente for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the 'cert' param… |
CVE-2026-27625 | High | 8.1 | 2026-03-20 | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf en… |
CVE-2026-23278 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements During transaction proces… |
CVE-2026-23277 | Medium | 5.5 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit teql_ma… |
CVE-2026-23276 | Medium | 5.5 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions (iptunnel_xm… |
CVE-2026-23275 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN |… |
CVE-2026-23274 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels IDLETIMER revision 0 rul… |
CVE-2026-23273 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reporte… |
CVE-2026-23272 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally bump set->nelems before insertion In case that the… |
CVE-2026-23271 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __per… |
CVE-2026-33191 | High | 8.6 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection… |
CVE-2026-33065 | Medium | 5.3 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a dow… |
CVE-2026-33064 | High | 7.5 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caus… |
CVE-2026-33061 | Medium | 5.8 | 2026-03-20 | Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241… |
CVE-2026-33060 | Medium | 5.3 | 2026-03-20 | CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accep… |
CVE-2026-33057 | Critical | 9.8 | 2026-03-20 | Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing… |
CVE-2026-33056 | Medium | 6.5 | 2026-03-20 | tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses… |
CVE-2026-33022 | Medium | 6.5 | 2026-03-20 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1… |
CVE-2026-4478 | High | 8.1 | 2026-03-20 | A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This impacts an unknown function of the file home/web/ipc of the compone… |
CVE-2026-4477 | Low | 3.1 | 2026-03-20 | A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA/WPS. Executing a m… |
CVE-2026-4476 | Medium | 6.3 | 2026-03-20 | A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the c… |
CVE-2026-4475 | High | 8.8 | 2026-03-20 | A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the file home/web/ipc. Su… |
CVE-2026-4474 | Low | 2.4 | 2026-03-20 | A flaw has been found in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_single_student_update.php. This mani… |
CVE-2026-33055 | High | 8.1 | 2026-03-20 | tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the ba… |
CVE-2026-33054 | Critical | 10.0 | 2026-03-20 | Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows a… |
CVE-2026-33053 | High | 8.8 | 2026-03-20 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_k… |
CVE-2026-4473 | Medium | 4.7 | 2026-03-20 | A vulnerability was detected in itsourcecode Online Doctor Appointment System 1.0. This issue affects some unknown processing of the file /admin/appointment_ac… |
CVE-2026-33051 | Medium | 5.4 | 2026-03-20 | Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the crea… |
CVE-2026-33043 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthentica… |
CVE-2026-33041 | Medium | 5.3 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to… |
CVE-2026-33040 | High | 7.5 | 2026-03-20 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts atta… |
CVE-2026-33039 | High | 8.6 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal… |
CVE-2026-33038 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfigura… |
CVE-2026-33037 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the… |
CVE-2026-33036 | High | 7.5 | 2026-03-20 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vul… |
CVE-2026-32768 | Critical | 9.9 | 2026-03-20 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a ma… |
CVE-2026-4472 | Medium | 6.3 | 2026-03-20 | A security vulnerability has been detected in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /admin/… |
CVE-2026-4471 | Medium | 4.7 | 2026-03-20 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admin_edit_employee.php… |
CVE-2026-4470 | Medium | 4.7 | 2026-03-20 | A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2026-4469 | Medium | 4.7 | 2026-03-20 | A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-33035 | Medium | 6.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticated attackers to execu… |
CVE-2026-33025 | High | 8.8 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'… |
CVE-2026-33024 | Critical | 9.1 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getIm… |
CVE-2026-33017 | Critical | 9.8 | 2026-03-20 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow end… |
CVE-2026-33013 | High | 7.5 | 2026-03-20 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 an… |
CVE-2026-33012 | High | 7.5 | 2026-03-20 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 u… |
CVE-2026-33011 | High | 7.5 | 2026-03-20 | Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify… |
CVE-2026-32954 | High | 7.1 | 2026-03-20 | ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and… |
CVE-2026-32953 | Medium | 4.6 | 2026-03-20 | Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out… |
CVE-2026-32950 | High | 8.8 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in t… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-32947 | Medium | 4.9 | 2026-03-20 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability a… |
CVE-2026-4468 | Medium | 4.7 | 2026-03-20 | A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=update_interfac… |
CVE-2026-4136 | Medium | 4.3 | 2026-03-20 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due t… |
CVE-2026-4038 | Critical | 9.8 | 2026-03-20 | The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'a… |
CVE-2026-32946 | Low | 2.7 | 2026-03-20 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass o… |
CVE-2026-32945 | Critical | 9.8 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DN… |
CVE-2026-32942 | High | 8.1 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE… |
CVE-2026-32941 | Medium | 6.5 | 2026-03-20 | Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM (Out-of-Memory) vulnerability in… |
CVE-2026-32940 | Critical | 9.3 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:imag… |
CVE-2026-32939 | High | 8.1 | 2026-03-20 | DataEase is an open source data visualization analysis tool. Versions 2.10.19 and below have inconsistent Locale handling between the JDBC URL validation logic… |
CVE-2026-32938 | Critical | 9.9 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file… |
CVE-2026-32114 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDO… |
CVE-2026-4467 | Medium | 4.7 | 2026-03-20 | A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=wireless_device_dis… |
CVE-2026-33063 | High | 7.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All de… |
CVE-2026-33062 | High | 7.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All… |
CVE-2026-32937 | Medium | 6.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF `nchf-convergedchargin… |
CVE-2026-32935 | Medium | 5.9 | 2026-03-20 | phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable t… |
CVE-2026-32933 | High | 7.5 | 2026-03-20 | AutoMapper is a convention-based object-object mapper in .NET. Versions prior to 15.1.1 and 16.1.1 are vulnerable to a Denial of Service (DoS) attack. When map… |
CVE-2026-32891 | Critical | 9.0 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contai… |