CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection 23.03.2026 10
CVE-2026-33351 AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass 23.03.2026 9.1
CVE-2026-33352 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) 23.03.2026 9.8
CVE-2025-41008 SQL Injection in Sinturno 23.03.2026 9.3
CVE-2025-41007 SQL Injection in Cuantis 23.03.2026 9.3
CVE-2026-32968 Unauthenticated RCE in com_mb24sysapi 23.03.2026 9.8
CVE-2026-4585 Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection 23.03.2026 9.3
CVE-2026-3587 Hidden CLI Function Allows Root Access 23.03.2026 10
CVE-2026-4599 23.03.2026 9.3
CVE-2026-4600 23.03.2026 9.1
CVE-2026-4601 23.03.2026 9.4
CVE-2026-4567 Tenda A15 UploadCfg stack-based overflow 23.03.2026 9.3
CVE-2026-4606 GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege 23.03.2026 10
CVE-2019-25614 Free Float FTP 1.0 STOR Command Remote Buffer Overflow 23.03.2026 9.3
CVE-2019-25568 Memu Play 6.0.7 Privilege Escalation via Insecure File Permissions 21.03.2026 9.3
CVE-2026-24060 Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information 20.03.2026 9.1
CVE-2026-29796 IGL-Technologies eParking.fi Missing Authentication for Critical Function 23.03.2026 9.3
CVE-2026-25192 CTEK Chargeportal Missing Authentication for Critical Function 23.03.2026 9.3
CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path 20.03.2026 9.1
CVE-2026-3584 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process 20.03.2026 9.8
CVE-2026-22898 QVR Pro 20.03.2026 9.3
CVE-2026-22172 OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections 20.03.2026 9.4
CVE-2026-33134 WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter 20.03.2026 9.3
CVE-2026-33135 WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter 20.03.2026 9.3
CVE-2026-33136 WeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameter 20.03.2026 9.3
CVE-2026-33075 FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml 20.03.2026 9.4
CVE-2026-33057 Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py 20.03.2026 9.8
CVE-2026-33054 Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion 20.03.2026 10
CVE-2026-4478 Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification 20.03.2026 9.2
CVE-2026-33017 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint 21.03.2026 9.3
CVE-2026-33024 AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator 20.03.2026 9.3
CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service 20.03.2026 9.9
CVE-2026-32940 SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) 20.03.2026 9.3
CVE-2026-4038 Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call 20.03.2026 9.8
CVE-2026-21992 20.03.2026 9.8
CVE-2026-32890 Anchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config 20.03.2026 9.7
CVE-2026-32891 Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS 20.03.2026 9.1
CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion 20.03.2026 9.1
CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API 20.03.2026 9.8
CVE-2026-32985 Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution 20.03.2026 9.3
CVE-2026-32760 File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin 19.03.2026 10
CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written 21.03.2026 9.1
CVE-2026-29103 SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass 20.03.2026 9.1
CVE-2026-32038 OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter 20.03.2026 9.3
CVE-2026-30872 OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup 20.03.2026 9.5
CVE-2026-30871 OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query 20.03.2026 9.5
CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) 20.03.2026 9.3
CVE-2026-32194 Microsoft Bing Images Remote Code Execution Vulnerability 21.03.2026 9.8
CVE-2026-32169 Azure Cloud Shell Elevation of Privilege Vulnerability 21.03.2026 10
CVE-2026-32191 Microsoft Bing Images Remote Code Execution Vulnerability 21.03.2026 9.8
CVE-2026-30924 qui CORS Misconfiguration: Arbitrary Origins Trusted 20.03.2026 9
CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC 19.03.2026 9.1
CVE-2026-30836 Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) 19.03.2026 10
CVE-2026-32238 OpenEMR has Remote Code Execution in backup functionality 20.03.2026 9.1
CVE-2026-32865 OPEXUS eComplaint and eCase insecure password reset 19.03.2026 9.2
CVE-2026-22557 19.03.2026 10
CVE-2026-27065 WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability 19.03.2026 9.8
CVE-2026-27067 WordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability 19.03.2026 9.1
CVE-2025-60233 WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability 19.03.2026 9.8
CVE-2025-60237 WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability 19.03.2026 9.8
CVE-2026-27413 WordPress Profile Builder Pro plugin <= 3.13.9 - SQL Injection vulnerability 19.03.2026 9.3
CVE-2026-27540 WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability 19.03.2026 9
CVE-2026-27542 WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability 19.03.2026 9.8
CVE-2026-32731 ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction 19.03.2026 10
CVE-2026-32698 OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution 19.03.2026 9.1
CVE-2026-32703 OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy 19.03.2026 9.1
CVE-2026-25873 OmniGen2-RL Reward Server Unsafe Deserialization RCE 19.03.2026 9.3
CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` 18.03.2026 9.1
CVE-2026-2991 KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token 18.03.2026 9.8
CVE-2026-25449 WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability 18.03.2026 9.8
CVE-2026-30884 mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key 18.03.2026 9.6
CVE-2026-31938 jsPDF has HTML Injection in New Window paths 18.03.2026 9.6
CVE-2026-21994 18.03.2026 9.8
CVE-2026-32841 Edimax GS-5008PL <= 1.00.54 Global Authentication State Across All Clients 18.03.2026 9.2
CVE-2026-25769 Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization 18.03.2026 9.1
CVE-2026-25770 Wazuh has Privilege Escalation to Root via Cluster Protocol File Write 18.03.2026 9.1
CVE-2026-25534 Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames 17.03.2026 9.1
CVE-2026-32292 GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting 17.03.2026 9.3
CVE-2026-32295 JetKVM insufficient login rate limiting 17.03.2026 9.3
CVE-2026-32297 Angeet ES3 KVM unauthenticated arbitrary file write 17.03.2026 9.3
CVE-2026-3564 ScreenConnect Instance Level Cryptographic Material Exposure 18.03.2026 9
CVE-2026-4312 DrangSoft｜GCB/FCB Audit Software - Missing Authentication 17.03.2026 9.3
CVE-2026-28430 Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php 17.03.2026 9.3

Latest Updates

CVE Title Updated Score
CVE-2024-51222 23.03.2026
CVE-2024-51223 23.03.2026
CVE-2024-51224 23.03.2026
CVE-2024-51225 23.03.2026
CVE-2024-51226 23.03.2026
CVE-2026-33488 AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin 23.03.2026 7.4
CVE-2026-33492 AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration 23.03.2026 7.3
CVE-2026-4591 kalcaddle kodbox fileThumb Endpoint app.php checkBin os command injection 23.03.2026
CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor 23.03.2026
CVE-2026-4590 kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery 23.03.2026
CVE-2026-33354 AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` 23.03.2026 7.6
CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection 23.03.2026 10
CVE-2026-33479 AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin 23.03.2026 8.8
CVE-2026-33480 AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy 23.03.2026 8.6
CVE-2026-33482 AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() 23.03.2026 8.1
CVE-2026-33483 AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php 23.03.2026 7.5
CVE-2026-33485 AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter 23.03.2026 7.5
CVE-2019-25620 Tree Studio 2.17 Denial of Service via Malformed Input 23.03.2026
CVE-2019-25621 Pixel Studio 2.17 Denial of Service via Malformed Input 23.03.2026
CVE-2019-25622 Paint Studio 2.17 Denial of Service via Malformed Input 23.03.2026
CVE-2019-25623 Luminance Studio 2.17 Denial of Service via Malformed Input 23.03.2026
CVE-2019-25624 Liquid Studio 2.17 Denial of Service via Malformed Input 23.03.2026
CVE-2019-25625 Blob Studio 2.17 Denial of Service via Malformed Input 23.03.2026
CVE-2026-33297 AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php 23.03.2026
CVE-2026-33351 AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass 23.03.2026 9.1
CVE-2026-33352 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) 23.03.2026 9.8
CVE-2026-3635 Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function 23.03.2026 6.1
CVE-2026-4589 kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery 23.03.2026
CVE-2026-4645 Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions 23.03.2026
CVE-2026-4647 Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library 23.03.2026
CVE-2025-41008 SQL Injection in Sinturno 23.03.2026
CVE-2026-1958 Hard-coded passwords in KlinikaXP 23.03.2026
CVE-2026-4587 HybridAuth SSL Curl.php certificate validation 23.03.2026
CVE-2026-4588 kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key 23.03.2026
CVE-2025-41007 SQL Injection in Cuantis 23.03.2026
CVE-2026-31847 Hidden functionality allows remote Telnet enablement in Nexxt Nebula 300+ 23.03.2026
CVE-2026-31848 Reversible ecos_pw cookie allows administrative authentication in Nexxt Nebula 300+ 23.03.2026
CVE-2026-31849 Missing CSRF protection on state-changing endpoints in Nexxt Nebula 300+ 23.03.2026
CVE-2026-31850 Plaintext storage of credentials in configuration backup in Nexxt Nebula 300+ 23.03.2026
CVE-2026-31851 Lack of rate limiting allows brute-force attacks in Nexxt Nebula 300+ 23.03.2026
CVE-2026-4586 CodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload 23.03.2026
CVE-2026-31846 23.03.2026
CVE-2026-32968 Unauthenticated RCE in com_mb24sysapi 23.03.2026 9.8
CVE-2026-32969 Pre-Auth Blind SQLi in userinfo Endpoint 23.03.2026 7.5
CVE-2026-4584 Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission 23.03.2026
CVE-2026-4585 Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection 23.03.2026
CVE-2026-4633 Keycloak: keycloak: user enumeration via differential error messages 23.03.2026
CVE-2026-28809 XXE in esaml SAML library allows local file read and potential SSRF 23.03.2026
CVE-2026-4583 Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay 23.03.2026
CVE-2026-4581 code-projects Simple Laundry System Parameters checklogin.php sql injection 23.03.2026
CVE-2026-4582 Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication 23.03.2026
CVE-2026-4580 code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection 23.03.2026
CVE-2026-4628 Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control 23.03.2026
CVE-2026-3587 Hidden CLI Function Allows Root Access 23.03.2026 10
CVE-2026-4578 code-projects Exam Form Submission update_s3.php cross site scripting 23.03.2026
CVE-2026-4579 code-projects Simple Laundry System Parameters viewdetail.php sql injection 23.03.2026
CVE-2026-23554 Use after free of paging structures in EPT 23.03.2026
CVE-2026-23555 Xenstored DoS by unprivileged domain 23.03.2026
CVE-2025-13997 King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure 23.03.2026 5.3
CVE-2025-6229 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget` 23.03.2026 6.4
CVE-2026-4577 code-projects Exam Form Submission update_s4.php cross site scripting 23.03.2026
CVE-2026-1969 ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload 23.03.2026
CVE-2025-10679 ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution 23.03.2026 7.3
CVE-2025-10731 ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export 23.03.2026 5.3
CVE-2025-10734 ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure 23.03.2026 5.3
CVE-2026-4573 SourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection 23.03.2026
CVE-2026-4574 SourceCodester Simple E-learning System User Profile Update sql injection 23.03.2026
CVE-2026-4575 code-projects Exam Form Submission update_s2.php cross site scripting 23.03.2026
CVE-2026-4576 code-projects Exam Form Submission update_s5.php cross site scripting 23.03.2026
CVE-2026-4598 23.03.2026 7.5
CVE-2026-4599 23.03.2026 9.1
CVE-2026-4600 23.03.2026 7.4
CVE-2026-4601 23.03.2026 8.7
CVE-2026-4602 23.03.2026 7.5
CVE-2026-4603 23.03.2026 5.9
CVE-2025-10736 ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation 23.03.2026 6.5
CVE-2026-4572 SourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection 23.03.2026
CVE-2026-4570 SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection 23.03.2026
CVE-2026-4571 SourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection 23.03.2026
CVE-2026-4569 SourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection 23.03.2026
CVE-2026-4566 Belkin F9K1122 formWISP5G stack-based overflow 23.03.2026
CVE-2026-4567 Tenda A15 UploadCfg stack-based overflow 23.03.2026
CVE-2026-4568 SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection 23.03.2026
CVE-2026-4606 GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege 23.03.2026
CVE-2026-4565 Tenda AC21 SetNetControlList formSetQosBand buffer overflow 23.03.2026
CVE-2026-4563 MacCMS Member Order Detail User.php order_info authorization 22.03.2026
CVE-2026-4564 yangzongzhuan RuoYi Quartz Job job code injection 23.03.2026
CVE-2026-2580 WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter 23.03.2026 7.5
CVE-2026-4562 MacCMS Timming API Endpoint Timming.php weak authentication 23.03.2026