Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,382 results · page 11 of 28
Mar 28, 2026A vulnerability was determined in elecV2 elecV2P up to 3.8.3.CVE-2026-5015 · Other software · elecV2 · reported by VulDBLow 2.1
A vulnerability was determined in elecV2 elecV2P up to 3.8.3. The impacted element is an unknown function of the file /logs of the component Endpoint. This manipulation of the argument filename causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- elecV2P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2026A vulnerability was determined in Wavlink WL-WN579X3-C 231124.CVE-2026-5004 · Other software · Wavlink · reported by VulDBHigh 7.4
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This impacts the function sub_4019FC of the file /cgi-bin/firewall.cgi of the component UPNP Handler. Executing a manipulation of the argument UpnpEnabled can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WL-WN579X3-C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2026A vulnerability was determined in wandb OpenUI up to 1.0.CVE-2026-4995 · Other software · wandb · reported by VulDBLow 2
A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Mar 27, 2026A vulnerability was determined in Tenda AC6 15.03.05.16.CVE-2026-4960 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- AC6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Mar 26, 2026A vulnerability was determined in Tenda AC5 15.03.06.47.CVE-2026-4906 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- AC5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Mar 26, 2026A vulnerability was determined in dameng100 muucmf 1.9.5.20260309.CVE-2026-4848 · Other software · dameng100 · reported by VulDBLow 2.1
A vulnerability was determined in dameng100 muucmf 1.9.5.20260309. This affects an unknown function of the file /admin/extend/list.html. Executing a manipulation of the argument Name can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- muucmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthinhneee.github.iovuldb.com
Mar 23, 2026A vulnerability was determined in kalcaddle kodbox 1.64.CVE-2026-4588 · Other software · kalcaddle · reported by VulDBLow 2.9
A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of the file /workspace/source-code/app/controller/explorer/shareOut.class.php of the component Site-level API key Handler. This manipulation of the argument sk causes use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026A vulnerability was determined in Tenda F453 1.0.0.3.CVE-2026-4552 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters Handler. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026A vulnerability was determined in Wavlink WL-WN578W2 221110.CVE-2026-4544 · Other software · Wavlink · reported by VulDBLow 1.9
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login_page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WL-WN578W2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017.CVE-2026-4537 · Other software · Cudy · reported by VulDBLow 2
A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading the affected component is advised. The vendor explains, that "some other customer has reported this to us before. And we have fixed this."
- Product
- TR1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026A vulnerability was determined in trueleaf ApiFlow 0.9.7.CVE-2026-4528 · Other software · trueleaf · reported by VulDBMedium 5.5
A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/proxy/http_proxy.service.ts of the component URL Validation Handler. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- ApiFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in Mindinventory MindSQL up to 0.2.1.CVE-2026-4507 · Other software · Mindinventory · reported by VulDBLow 2.1
A vulnerability was determined in Mindinventory MindSQL up to 0.2.1. The affected element is the function ask_db of the file mindsql/core/mindsql_core.py. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MindSQL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in D-Link DIR-820LW 2.03.CVE-2026-4499 · Network & remote access · D-Link · reported by VulDBMedium 5.5
A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-820LW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227.CVE-2026-4497 · Other software · Totolink · reported by VulDBMedium 5.5
A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- WA300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in Tenda A18 Pro 02.03.02.28.CVE-2026-4493 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda A18 Pro 02.03.02.28. The impacted element is the function sub_423B50 of the file /goform/setMacFilterCfg of the component MAC Filtering Configuration Endpoint. Executing a manipulation of the argument deviceList can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- A18 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306.CVE-2026-4487 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 1200GW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200.CVE-2026-4477 · Other software · Yi Technology · reported by VulDBLow 1.3
A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA/WPS. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can only be done within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- YI Home Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in Comfast CF-AC100 2.6.0.8.CVE-2026-4468 · Other software · Comfast · reported by VulDBLow 2
A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=update_interface_png. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-AC100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041CVE-2025-67114 · Other software · reported by MITRECritical 9.8
Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers to derive valid administrative/root credentials from the device's MAC address, enabling authentication bypass and full device access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfcc.reportfreedomfi.com
Mar 17, 2026A vulnerability was determined in Duende IdentityServer4 up to 4.1.2.CVE-2026-4349 · Other software · Duende · reported by VulDBMedium 6.3
A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- IdentityServer4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114.CVE-2026-4318 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formApLbConfig. This manipulation of the argument loadBalanceNameOld causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 810G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433.CVE-2026-4284 · Other software · taoofagi · reported by VulDBLow 2
A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the file - yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/PPTUtil.java of the component PPT File Handler. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- easegen-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfx4tqqfvdw4.feishu.cnvuldb.com
Mar 16, 2026A vulnerability was determined in CityData CityChat up to 0.12.6 on Android.CVE-2026-4251 · Other software · CityData · reported by VulDBLow 1.1
A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter_assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CityChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in Open5GS up to 2.7.6.CVE-2026-4240 · Other software · Open5gs · reported by VulDBMedium 5.5
A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb of the component CCA Handler. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.7 is sufficient to fix this issue. Patch name: 80eb484a6ab32968e755e628b70d1a9c64f012ec. Upgrading the affected component is recommended.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0.CVE-2026-4232 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /rest/user/getAuthorityByUserId. Executing a manipulation of the argument userId can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in SSCMS up to 7.4.0.CVE-2026-4222 · Other software · reported by VulDBLow 2
A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-CVE-2026-4207 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_device/cgi_sms_test/cgi_firmware_upload/cgi_ntp_time of the file /cgi-bin/system_mgr.cgi. Executing a manipulation can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- DNS-120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0.CVE-2026-4198 · Other software · hypermodel-labs · reported by VulDBLow 1.9
A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index.ts. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: f7d992c830c5f2ec5749852e66c0195e3ed7fe30. Applying a patch is the recommended action to fix this issue. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-server-auto-commit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in UEditor up to 1.4.3.2.CVE-2026-4186 · Other software · reported by VulDBLow 2
A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
Mar 16, 2026A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2.CVE-2026-4175 · Other software · Aureus · reported by VulDBMedium 5.1
A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in Belkin F9K1122 1.00.33.CVE-2026-4167 · Other software · Belkin · reported by VulDBHigh 7.4
A vulnerability was determined in Belkin F9K1122 1.00.33. This affects the function formReboot of the file /goform/formReboot. This manipulation of the argument webpage causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1122
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A vulnerability was determined in OpenClaw 2026.2.19-2.CVE-2026-4039 · Other software · Openclaw · reported by VulDBMedium 5.3
A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1 is able to resolve this issue. This patch is called 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c. It is recommended to upgrade the affected component.
- Product
- Openclaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A vulnerability was determined in rxi fe up to ed4cda96bd582cbb08520964ba627efb40f3dd91.CVE-2026-4012 · Other software · rxi · reported by VulDBLow 1.9
A vulnerability was determined in rxi fe up to ed4cda96bd582cbb08520964ba627efb40f3dd91. The impacted element is the function read_ of the file src/fe.c. This manipulation with the input 1 causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- fe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026A vulnerability was determined in Tenda W3 1.0.0.3(2204).CVE-2026-3973 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda W3 1.0.0.3(2204). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component POST Parameter Handler. This manipulation of the argument ping1/ping2 causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- W3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3.CVE-2026-3961 · Other software · zyddnys · reported by VulDBLow 2.1
A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to_pil_image of the file manga-image-translator-main/server/request_extraction.py of the component Translate Endpoints. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- manga-image-translator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026A vulnerability was determined in strukturag libheif up to 1.21.2.CVE-2026-3949 · Other software · strukturag · reported by VulDBLow 1.9
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026A vulnerability was determined in Tenda i3 1.0.0.6(2204).CVE-2026-3802 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda i3 1.0.0.6(2204). Affected by this issue is the function formexeCommand of the file /goform/exeCommand. Executing a manipulation of the argument cmdinput can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- i3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2026A vulnerability was determined in Tenda F453 1.0.0.3/1.If.CVE-2026-3728 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3/1.If. This issue affects the function fromSetCfm of the file /goform/setcfm. This manipulation of the argument funcname/funcpara1 causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2026A vulnerability was determined in Wavlink WL-WN579X3-C 231124.CVE-2026-3716 · Other software · Wavlink · reported by VulDBLow 1.9
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. Executing a manipulation of the argument Hostname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 20260226 is able to resolve this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- WL-WN579X3-C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.wavlink.comgithub.com
Mar 8, 2026A vulnerability was determined in mkj Dropbear up to 2025.89.CVE-2026-3706 · Other software · mkj · reported by VulDBLow 1.7
A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch. The project maintainer explains: "Signature Malleability is not exploitable in SSH protocol. (...) [A] PoC doesn't exist for SSH implementation, but rather it's against the internal API."
- Product
- Dropbear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026A vulnerability was determined in Planet ICG-2510 1.0_20250811.CVE-2026-3697 · Other software · Planet · reported by VulDBLow 2.1
A vulnerability was determined in Planet ICG-2510 1.0_20250811. The impacted element is the function sub_40C8E4 of the file /usr/sbin/httpd of the component Language Package Configuration Handler. Executing a manipulation of the argument Language can lead to stack-based buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ICG-2510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026A vulnerability was determined in Tenda FH451 1.0.0.9.CVE-2026-3678 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda FH451 1.0.0.9. Affected is the function sub_3C434 of the file /goform/AdvSetWan. This manipulation of the argument wanmode/PPPOEPassword causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026A vulnerability was determined in Freedom Factory dGEN1 up to 20260221.CVE-2026-3675 · Other software · Freedom Factory · reported by VulDBLow 1.9
A vulnerability was determined in Freedom Factory dGEN1 up to 20260221. Affected by this issue is the function FakeAppReceiver of the component org.ethosmobile.ethoslauncher. Executing a manipulation can lead to improper authorization. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dGEN1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Mar 7, 2026A vulnerability was determined in xlnt-community xlnt up to 1.6.1.CVE-2026-3664 · Other software · xlnt-community · reported by VulDBLow 1.9
A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compound_document::read_directory of the file source/detail/cryptography/compound_document.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 147. Applying a patch is advised to resolve this issue.
- Product
- xlnt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026A vulnerability was determined in Wavlink WL-NU516U1 V240425.CVE-2026-3612 · Other software · Wavlink · reported by VulDBHigh 7.3
A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argument firmware_url causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
- Product
- WL-NU516U1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026A vulnerability was determined in Tuya App and SDK 24.07.11 on Android.CVE-2026-3465 · Other software · Tuya · reported by VulDBLow 1.3
A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruise_time causes denial of service. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. There is ongoing doubt regarding the real existence of this vulnerability. The vendor disagrees with the conclusion of the finding: "The described vulnerability fails to prove its feasibility or exploitability by attackers. The issue essentially does not constitute a security vulnerability, aligning more closely with abnormal product functionality." These considerations are properly reflected within the CVSS vector.
- Product
- App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing anaCVE-2026-3337 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.2
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
- Product
- AWS-LC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Mar 1, 2026A vulnerability was determined in YosysHQ yosys up to 0.62.CVE-2026-3407 · Other software · YosysHQ · reported by VulDBLow 1.9
A vulnerability was determined in YosysHQ yosys up to 0.62. This affects the function Yosys::RTLIL::Const::set of the file kernel/rtlil.h of the component BLIF File Parser. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Applying a patch is the recommended action to fix this issue. It appears that the issue is not reproducible all the time.
- Product
- yosys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2026A vulnerability was determined in Tenda F453 1.0.0.3.CVE-2026-3398 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a manipulation of the argument wanmode/PPPOEPassword can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2026A vulnerability was determined in Squirrel up to 3.2.CVE-2026-3389 · Other software · Squirrel-lang · reported by VulDBLow 1.9
A vulnerability was determined in Squirrel up to 3.2. This vulnerability affects the function sqstd_rex_newnode in the library sqstdlib/sqstdrex.cpp. Executing a manipulation can lead to null pointer dereference. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Squirrel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.