CVEs published March 2, 2026

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions.

U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted…

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote…

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a…

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php.

code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php.

code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php.

code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php.

code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php.

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php.

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php.

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php.

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php.

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php.

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php.

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.

code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php.

code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php.

code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi.

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi.

A remote authentication bypass vulnerability  exists in HPE AutoPass License Server (APLS).

This could lead to remote code execution with no additional execution privileges needed.

A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system.

On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters.

A security flaw has been discovered in Tenda AC15 up to 15.13.07.13.

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'.

NocoDB is software for building databases as spreadsheets.

There is a one-click remote code execution vulnerability.

This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

The application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths.

Improper privilege dropping allows local privilege escalation via command re-execution.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

An out-of-bounds read was found.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause…

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command.

Memory corruption while using alignments for memory allocation.

This could lead to local escalation of privilege with User execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

The `DirectorServer` WebSocket server (`ws://127.0.0.1:<httpPort+1>`) accepts connections from any origin without validating the HTTP `Origin` header during the WebSocket handshake.

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all…

An out-of-bounds read was found in Exiv2.

This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

A flaw has been found in itsourcecode University Management System 1.0.

A security vulnerability has been detected in itsourcecode University Management System 1.0.

A weakness has been identified in itsourcecode Society Management System 1.0.

A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5.

A vulnerability was found in projectworlds Online Art Gallery Shop 1.0.

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege with System execution privileges needed.

The `DirectorServer` WebSocket server imposes no limit on concurrent connections.

NocoDB is software for building databases as spreadsheets.

A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, and including, 2.1.30 due to insufficient input sanitization and…

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

NocoDB is software for building databases as spreadsheets.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed.

There is an Open Redirect vulnerability located at the /redirect-proxy endpoint.

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.

NocoDB is software for building databases as spreadsheets.

NocoDB is software for building databases as spreadsheets.

NocoDB is software for building databases as spreadsheets.

NocoDB is software for building databases as spreadsheets.

NocoDB is software for building databases as spreadsheets.

NocoDB is software for building databases as spreadsheets.

NocoDB is software for building databases as spreadsheets.

An uncaught exception was found in Exiv2.

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in…

A flaw has been found in thinkgem JeeSite up to 5.15.1.

code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php.

code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=.

A vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses.

This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed.

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to…

This could lead to local denial of service if a malicious actor has already obtained the System privilege.

This could lead to local denial of service if a malicious actor has already obtained the System privilege.

This could lead to local denial of service if a malicious actor has already obtained the System privilege.

This could lead to local denial of service if a malicious actor has already obtained the System privilege.

This could lead to local information disclosure if a malicious actor has already obtained the System privilege.

This could lead to local information disclosure if a malicious actor has already obtained the System privilege.

A vulnerability was detected in itsourcecode University Management System 1.0.

A vulnerability was identified in Open Babel up to 3.1.1.

This could lead to local information disclosure with no additional execution privileges needed.

An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory accesses related to SME.

A vulnerability was determined in YosysHQ yosys up to 0.62.

A vulnerability has been found in thinkgem JeeSite up to 5.15.1.

A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0.

A vulnerability was detected in PHPGurukul Student Record Management System 1.0.

A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0.