Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,599 results · page 177 of 772
Mar 16, 2026YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.CVE-2026-4177 · Other software · TODDR · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
- Product
- YAML::Syck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Mar 16, 2026A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting CVE-2025-69902 · Other software · reported by MITRECritical 9.8
A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasec.ahnlab.comgithub.com
Mar 16, 2026Chamilo LMS is a learning management system.CVE-2026-28430 · Other software · chamilo · reported by GitHubCritical 9.3
Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code executCVE-2025-69809 · Other software · P2r3 · reported by MITRECritical 9.8
A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execution via a crafted packet.
- Product
- Bareiron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of ServiCVE-2025-69808 · Other software · P2r3 · reported by MITRECritical 9.1
An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Service (DoS) via supplying a crafted packet.
- Product
- Bareiron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Authlib is a Python library which builds OAuth and OpenID Connect servers.CVE-2026-27962 · Other software · authlib · reported by GitHubCritical 9.1
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.
- Product
- authlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms.CVE-2026-23489 · Other software · pluginsGLPI · reported by GitHubCritical 9.1
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
- Product
- fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into applCVE-2025-62319 · Other software · HCL · reported by psirt@hcl.comCritical 9.8
Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Mar 16, 2026AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.CVE-2026-32626 · Other software · Mintplex-Labs · reported by GitHubCritical 9.6
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS due to insecure Electron configuration. This works with default settings and requires no user interaction beyond normal chat usage. The custom markdown-it image renderer in frontend/src/utils/chat/markdown.js interpolates token.content directly into the alt attribute without HTML entity escaping. The PromptReply component renders this output via dangerouslySetInnerHTML without DOMPurify sanitization — unlike HistoricalMessage which correctly applies DOMPurify.sanitize().
- Product
- anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Apollo Federation is an architecture for declaratively composing APIs into a unified graph.CVE-2026-32621 · Other software · @apollo · reported by GitHubCritical 9.9
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.
- Product
- federation-internals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability.CVE-2025-15060 · Other software · claude-hovercraft · reported by zdi-disclosures@trendmicro.comCritical 9.8
claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of claude-hovercraft. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the executeClaudeCode method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27785.
- Product
- claude-hovercraft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious contCVE-2017-20224 · Other software · Telesquare · reported by VulnCheckCritical 9.3
Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious content by exploiting enabled WebDAV HTTP methods. Attackers can use PUT, DELETE, MKCOL, MOVE, COPY, and PROPPATCH methods to upload executable code, delete files, or manipulate server content for remote code execution or denial of service.
- Product
- SDT-CS3B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comvulncheck.com
Mar 16, 2026Telesquare SKT LTE Router SDT-CS3B1 firmware version 1.2.0 contains an insecure direct object reference vulnerability that allows attackers to bypass authorizatCVE-2017-20223 · Other software · Telesquare · reported by VulnCheckCritical 9.3
Telesquare SKT LTE Router SDT-CS3B1 firmware version 1.2.0 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access resources by manipulating user-supplied input parameters. Attackers can directly reference objects in the system to retrieve sensitive information and access functionalities without proper access controls.
- Product
- SDT-CS3B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Mar 16, 2026ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial charaCVE-2016-20030 · Other software · ZKTeco Inc. · reported by VulnCheckCritical 9.3
ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.
- Product
- ZKTeco ZKBioSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.compacketstormsecurity.com
Mar 16, 2026ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager applicatiCVE-2016-20026 · Other software · ZKTeco Inc. · reported by VulnCheckCritical 9.3
ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.
- Product
- ZKTeco ZKBioSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Mar 16, 2026ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable fileCVE-2016-20024 · Other software · ZKTeco Inc. · reported by VulnCheckCritical 9.3
ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable files. Attackers can exploit world-writable permissions on the ZKTimeNet3.0 directory and its contents to replace executable files with malicious binaries for privilege escalation.
- Product
- ZKTeco ZKTime.Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Mar 13, 2026Pix for WooCommerce: Arbitrary file uploadsCVE-2026-3891 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Pix for WooCommerce
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Pix for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2026telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check wCVE-2026-32746 · Other software · GNU · reported by MITRECritical 9.8
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
- Product
- inetutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.gnu.orgopenwall.com
Mar 13, 2026Modal Dialog: Improper Control of Generation of Code ('Code Injection')CVE-2026-32367 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.
- Product
- Modal Dialog
- Affected
- up to 3.5.16
- What to do
- Affects up to 3.5.16. Update Modal Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-32306 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.CVE-2026-32304 · Other software · locutusjs · reported by GitHubCritical 9.8
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
- Product
- locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Centrifugo is an open-source scalable real-time messaging server.CVE-2026-32301 · Other software · centrifugal · reported by GitHubCritical 9.3
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0.
- Product
- centrifugo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Dagu is a workflow engine with a built-in Web user interface.CVE-2026-31886 · Other software · dagu-org · reported by GitHubCritical 9.1
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segments lexically, so a caller can supply a value such as ".." to redirect the computed directory outside the intended /tmp/<name>/<id> path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to "..", the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll("/tmp") removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.
- Product
- dagu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026FreeRDP is a free implementation of the Remote Desktop Protocol.CVE-2026-31806 · Other software · FreeRDP · reported by GitHubCritical 9.3
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-26954 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer ovCVE-2026-25823 · Other software · reported by MITRECritical 9.8
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer overflow that leads to a Denial of Service, which can also be exploited to achieve Unauthenticated Remote Code Execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmsnetworks.blob.core.windows.nethms-networks.com
Mar 13, 2026HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for CVE-2026-25818 · Other software · reported by MITRECritical 9.1
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmsnetworks.blob.core.windows.nethms-networks.com
Mar 13, 2026the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries: WpDiscuz before 7.6.47 contains an SQL injectionCVE-2026-22193 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
- Product
- the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries
- Fixed in
- 7.6.47
- What to do
- Update the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 12, 2026The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration.CVE-2026-3611 · Other software · Honeywell · reported by ics-cert@hq.dhs.govCritical 10
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
- Product
- IQ4E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Tolgee is an open-source localization platform.CVE-2026-32251 · Other software · tolgee · reported by GitHubCritical 9.3
Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files from the server and make server-side requests to internal services. This vulnerability is fixed in 3.166.3.
- Product
- tolgee-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2026-32248 · Other software · parse-community · reported by GitHubCritical 9.3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable. This vulnerability is fixed in 9.6.0-alpha.12 and 8.6.38.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2026-32242 · Other software · parse-community · reported by GitHubCritical 9.1
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy. Deployments that configure multiple OAuth2 providers via the oauth2: true flag are affected. This vulnerability is fixed in 9.6.0-alpha.11 and 8.6.37.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function.CVE-2026-26793 · Other software · Gl-inet · reported by MITRECritical 9.8
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
- Product
- Ar300m16 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.CVE-2025-70245 · Other software · Dlink · reported by MITRECritical 9.8
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.
- Product
- Dir-513 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comdlink.com.cn
Mar 12, 2026Dataease is an open source data visualization analysis tool.CVE-2026-32140 · Other software · dataease · reported by GitHubCritical 9.3
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the IniFile parameter, an attacker can force the JDBC driver to load an attacker-controlled configuration file. This configuration file can inject dangerous JDBC properties, leading to remote code execution. The Redshift JDBC driver execution flow reaches a method named getJdbcIniFile. The getJdbcIniFile method implements an aggressive automatic configuration file discovery mechanism. If not explicitly restricted, it searches for a file named rsjdbc.ini. In a JDBC URL context, users can explicitly specify the configuration file via URL parameters, which allows arbitrary files on the server to be loaded as JDBC configuration files. Within the Redshift JDBC driver properties, the parameter IniFile is explicitly supported and used to load an external configuration file. This vulnerability is fixed in 2.10.20.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Dataease is an open source data visualization analysis tool.CVE-2026-32137 · Other software · dataease · reported by GitHubCritical 9.3
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentiCVE-2026-28252 · Other software · Trane · reported by ics-cert@hq.dhs.govCritical 9.2
A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.
- Product
- Tracer SC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function.CVE-2026-26795 · Other software · Gl-inet · reported by MITRECritical 9.8
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
- Product
- Ar300m16 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, CVE-2026-26792 · Other software · Gl-inet · reported by MITRECritical 9.8
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input.
- Product
- Ar300m16 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function.CVE-2026-26791 · Other software · Gl-inet · reported by MITRECritical 9.8
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
- Product
- Ar300m16 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Tina is a headless content management system.CVE-2026-28792 · Other software · @tinacms · reported by GitHubCritical 9.6
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
- Product
- cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.CVE-2026-21708 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemoCVE-2026-28384 · Other software · Canonical · reported by security@ubuntu.comCritical 9.4
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscourse.ubuntu.comgithub.com
Mar 12, 2026A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments oCVE-2026-21671 · Other software · Veeam · reported by support@hackerone.comCritical 9.1
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
- Product
- Software Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21669 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21667 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21666 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrCVE-2026-3060 · Other software · SGLang · reported by cret@cert.orgCritical 9.8
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using picCVE-2026-3059 · Other software · SGLang · reported by cret@cert.orgCritical 9.8
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML paCVE-2026-3916 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.