2026 CVEs (page 387)
Page 387 of 446 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3728 | High | 8.8 | 2026-03-08 | A vulnerability was determined in Tenda F453 1.0.0.3/1.If. This issue affects the function fromSetCfm of the file /goform/setcfm. This manipulation of the argu… |
CVE-2026-3727 | High | 8.8 | 2026-03-08 | A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function sub_3C6C0 of the file /goform/QuickIndex. The manipulation of the argu… |
CVE-2026-3726 | High | 8.8 | 2026-03-08 | A vulnerability has been found in Tenda F453 1.0.0.3. This affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipula… |
CVE-2026-3725 | Medium | 6.3 | 2026-03-08 | A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/… |
CVE-2026-3724 | Medium | 6.3 | 2026-03-08 | A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. This impacts an unknown function of the file /checkin.php… |
CVE-2026-3723 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. Th… |
CVE-2026-3721 | Low | 3.5 | 2026-03-08 | A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab… |
CVE-2026-3720 | Low | 3.5 | 2026-03-08 | A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views… |
CVE-2026-3719 | Medium | 5.3 | 2026-03-08 | A vulnerability was identified in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This issue affects some unknown processing of the file /Syste… |
CVE-2026-3716 | Low | 2.4 | 2026-03-08 | A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. Executing a man… |
CVE-2026-3715 | High | 8.8 | 2026-03-08 | A vulnerability was found in Wavlink WL-WN579X3-C 231124. This affects the function sub_40139C of the file /cgi-bin/firewall.cgi. Performing a manipulation of… |
CVE-2026-3714 | Medium | 4.7 | 2026-03-08 | A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the compone… |
CVE-2026-3713 | Medium | 5.3 | 2026-03-08 | A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the… |
CVE-2026-3711 | Medium | 4.7 | 2026-03-08 | A vulnerability was detected in code-projects Simple Flight Ticket Booking System 1.0. Affected is an unknown function of the file /Adminupdate.php. The manipu… |
CVE-2026-3710 | Medium | 4.7 | 2026-03-08 | A security vulnerability has been detected in code-projects Simple Flight Ticket Booking System 1.0. This impacts an unknown function of the file /Adminadd.php… |
CVE-2026-3709 | High | 7.3 | 2026-03-08 | A weakness has been identified in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /register.php. Executing… |
CVE-2026-3708 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. The impacted element is an unknown function of the file /login.ph… |
CVE-2026-3707 | Medium | 5.3 | 2026-03-08 | A vulnerability was identified in MrNanko webp4j up to 1.3.x. The affected element is the function DecodeGifFromMemory of the file src/main/c/gif_decoder.c. Su… |
CVE-2026-3706 | Low | 3.7 | 2026-03-08 | A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. T… |
CVE-2026-3705 | High | 7.3 | 2026-03-08 | A vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0. This issue affects some unknown processing of the file /Adminsearch.php. Th… |
CVE-2026-3703 | Critical | 9.8 | 2026-03-08 | A flaw has been found in Wavlink NU516U1 251208. This affects the function sub_401A10 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument… |
CVE-2026-3702 | Medium | 4.3 | 2026-03-08 | A vulnerability was detected in SourceCodester Loan Management System 1.0. Affected by this issue is some unknown functionality of the file /index.php. Perform… |
CVE-2026-3701 | High | 8.8 | 2026-03-08 | A security vulnerability has been detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function Edit_BasicSSID_5G of the file /goform/… |
CVE-2026-3704 | Medium | 4.7 | 2026-03-08 | A vulnerability has been found in Wavlink NU516U1 251208. This vulnerability affects the function sub_405B2C of the file /cgi-bin/firewall.cgi of the component… |
CVE-2026-3700 | High | 8.8 | 2026-03-08 | A weakness has been identified in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigDnsFilterGlobal. This manipu… |
CVE-2026-3699 | High | 8.8 | 2026-03-08 | A security flaw has been discovered in UTT HiPER 810G up to 1.7.7-171114. This impacts the function strcpy of the file /goform/formRemoteControl. The manipulat… |
CVE-2026-3698 | High | 8.8 | 2026-03-08 | A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. This affects the function strcpy of the file /goform/NTP. The manipulation leads to buffer… |
CVE-2026-3697 | Medium | 6.3 | 2026-03-08 | A vulnerability was determined in Planet ICG-2510 1.0_20250811. The impacted element is the function sub_40C8E4 of the file /usr/sbin/httpd of the component La… |
CVE-2026-30910 | High | 7.5 | 2026-03-08 | Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex funct… |
CVE-2026-3696 | High | 7.3 | 2026-03-08 | A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-3695 | Medium | 6.5 | 2026-03-08 | A vulnerability has been found in SourceCodester Modern Image Gallery App 1.0. Impacted is an unknown function of the file /delete.php. Such manipulation of th… |
CVE-2026-3693 | High | 7.3 | 2026-03-08 | A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function get_user_info/update_user_info of the file /src/backend/agentchat… |
CVE-2026-30909 | Critical | 9.8 | 2026-03-08 | Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not che… |
CVE-2026-3683 | Medium | 6.3 | 2026-03-08 | A vulnerability was detected in bufanyun HotGo up to 2.0. This issue affects the function ImageTransferStorage of the file /server/internal/logic/common/upload… |
CVE-2026-3682 | Medium | 6.3 | 2026-03-08 | A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. This vulnerability affects the function Execute of the file /internal/service/ff… |
CVE-2026-3681 | Medium | 6.3 | 2026-03-07 | A weakness has been identified in welovemedia FFmate up to 2.0.15. This affects the function fireWebhook of the file /internal/service/webhook/webhook.go. Exec… |
CVE-2026-3680 | Medium | 6.3 | 2026-03-07 | A security flaw has been discovered in RyuzakiShinji biome-mcp-server up to 1.0.0. Affected by this issue is some unknown functionality of the file biome-mcp-s… |
CVE-2026-3679 | High | 8.8 | 2026-03-07 | A vulnerability was identified in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex. Such manip… |
CVE-2026-3678 | High | 8.8 | 2026-03-07 | A vulnerability was determined in Tenda FH451 1.0.0.9. Affected is the function sub_3C434 of the file /goform/AdvSetWan. This manipulation of the argument wanm… |
CVE-2026-3677 | High | 8.8 | 2026-03-07 | A vulnerability was found in Tenda FH451 1.0.0.9. This impacts the function fromSetCfm of the file /goform/setcfm. The manipulation of the argument funcname/fu… |
CVE-2026-3675 | Medium | 5.3 | 2026-03-07 | A vulnerability was determined in Freedom Factory dGEN1 up to 20260221. Affected by this issue is the function FakeAppReceiver of the component org.ethosmobile… |
CVE-2026-3674 | Medium | 5.3 | 2026-03-07 | A vulnerability was found in Freedom Factory dGEN1 up to 20260221. Affected by this vulnerability is the function FakeAppProvider of the component org.ethosmob… |
CVE-2026-3672 | Medium | 6.3 | 2026-03-07 | A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such ma… |
CVE-2026-3671 | Low | 3.3 | 2026-03-07 | A flaw has been found in Freedom Factory dGEN1 up to 20260221. Affected by this vulnerability is the function TokenBalanceContentProvider of the component org… |
CVE-2026-3670 | Medium | 5.3 | 2026-03-07 | A vulnerability was detected in Freedom Factory dGEN1 up to 20260221. Affected is an unknown function of the component com.dgen.alarm. Performing a manipulatio… |
CVE-2026-3669 | Medium | 5.3 | 2026-03-07 | A security vulnerability has been detected in Freedom Factory dGEN1 up to 20260221. This impacts the function AlarmService of the component com.dgen.alarm. Suc… |
CVE-2026-2671 | Low | 3.1 | 2026-03-07 | A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energ… |
CVE-2026-30863 | Critical | 9.8 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google… |
CVE-2026-30861 | Critical | 9.9 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenti… |
CVE-2026-30860 | Critical | 9.9 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vul… |
CVE-2026-30859 | Medium | 5.3 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerabi… |
CVE-2026-30858 | Medium | 6.5 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in t… |
CVE-2026-30857 | Medium | 5.3 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypas… |
CVE-2026-30856 | Medium | 5.9 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool na… |
CVE-2026-30855 | High | 8.8 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant… |
CVE-2026-30854 | Medium | 5.3 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alph… |
CVE-2026-30852 | High | 7.5 | 2026-03-07 | Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-exp… |
CVE-2026-30851 | High | 8.1 | 2026-03-07 | Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-… |
CVE-2026-30850 | Medium | 5.9 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file met… |
CVE-2026-30848 | Low | 3.7 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRou… |
CVE-2026-29196 | Medium | 4.3 | 2026-03-07 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard con… |
CVE-2026-29195 | Medium | 6.5 | 2026-03-07 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role u… |
CVE-2026-3668 | Low | 3.1 | 2026-03-07 | A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul… |
CVE-2026-3667 | Medium | 5.3 | 2026-03-07 | A security flaw has been discovered in Freedom Factory dGEN1 up to 20260221. The impacted element is the function FakeAppService of the component org.ethosmobi… |
CVE-2026-3665 | Low | 3.3 | 2026-03-07 | A vulnerability was identified in xlnt-community xlnt up to 1.6.1. The affected element is the function xlnt::detail::xlsx_consumer::read_office_document of th… |
CVE-2026-30838 | Medium | 6.1 | 2026-03-07 | league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII… |
CVE-2026-30834 | High | 7.5 | 2026-03-07 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vu… |
CVE-2026-30832 | Critical | 9.1 | 2026-03-07 | Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to m… |
CVE-2026-29787 | Medium | 5.3 | 2026-03-07 | mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed syste… |
CVE-2026-29786 | Medium | 6.3 | 2026-03-07 | node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory… |
CVE-2026-29784 | High | 7.5 | 2026-03-07 | Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs i… |
CVE-2026-29781 | Medium | 6.5 | 2026-03-07 | Sliver is a command and control framework that uses a custom Wireguard netstack. In versions from 1.7.3 and prior, a vulnerability exists in the Sliver C2 serv… |
CVE-2026-29780 | Medium | 5.5 | 2026-03-07 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to vers… |
CVE-2026-29779 | High | 7.5 | 2026-03-07 | UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config… |
CVE-2026-29778 | High | 7.1 | 2026-03-07 | pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insuff… |
CVE-2026-29771 | Medium | 6.5 | 2026-03-07 | Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall… |
CVE-2026-29194 | High | 8.1 | 2026-03-07 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permit… |
CVE-2026-29190 | Medium | 4.1 | 2026-03-07 | Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup read… |
CVE-2026-29076 | Medium | 5.9 | 2026-03-07 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC… |
CVE-2026-3664 | Low | 3.3 | 2026-03-07 | A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compound_document::read_directory of the file source/… |
CVE-2026-3663 | Low | 3.3 | 2026-03-07 | A vulnerability was found in xlnt-community xlnt up to 1.6.1. This issue affects the function xlnt::detail::compound_document_istreambuf::xsgetn of the file so… |
CVE-2026-29193 | High | 8.2 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login be… |
CVE-2026-29192 | High | 7.7 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allow… |
CVE-2026-29191 | Critical | 9.3 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allow… |
CVE-2026-29186 | High | 7.7 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary cod… |
CVE-2026-29185 | Low | 2.7 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations a… |
CVE-2026-29184 | Low | 2.0 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism t… |
CVE-2026-29067 | High | 8.1 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanis… |
CVE-2026-3662 | Medium | 4.7 | 2026-03-07 | A vulnerability has been found in Wavlink WL-NU516U1 240425. This vulnerability affects the function usb_p910 of the file /cgi-bin/adm.cgi. Such manipulation o… |
CVE-2026-3661 | Medium | 4.7 | 2026-03-07 | A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument m… |
CVE-2026-2219 | High | 7.5 | 2026-03-07 | It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompre… |
CVE-2026-24308 | High | 7.5 | 2026-03-07 | Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information s… |
CVE-2026-24281 | High | 7.4 | 2026-03-07 | Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof… |
CVE-2026-2433 | Medium | 6.1 | 2026-03-07 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessag… |
CVE-2026-2420 | Medium | 4.4 | 2026-03-07 | The LotekMedia Popup Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.6… |
CVE-2026-1825 | Medium | 6.4 | 2026-03-07 | The Show YouTube video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'syv' shortcode in all versions up to, and including… |
CVE-2026-1824 | Medium | 6.4 | 2026-03-07 | The Infomaniak Connect for OpenID plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'endpoint_login' parameter of the infomaniak_connec… |
CVE-2026-1823 | Medium | 6.4 | 2026-03-07 | The Consensus Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's consensus shortcode in all versions up to, and including… |
CVE-2026-1820 | Medium | 6.4 | 2026-03-07 | The Media Library Alt Text Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bvmalt_sc_div_update_alt_text' shortcode… |
CVE-2026-1805 | Medium | 6.4 | 2026-03-07 | The DA Media GigList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's damedia_giglist shortcode in all versions up to, and in… |