CVEs published March 9, 2026

EHG2408 series switch developed by Atop Technologies has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary…

Delta Electronics COMMGR2 has Stack-based Buffer Overflow vulnerability.

Improper Input Validation vulnerability in Apache IoTDB.

A vulnerability in Apache IoTDB.

A path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the…

The Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request.

An arbitrary file upload vulnerability exists even though file extension restrictions are configured.

A weakness has been identified in UTT HiPER 810G up to 1.7.7-1711.

A security flaw has been discovered in UTT HiPER 810G up to 1.7.7-1711.

A vulnerability was found in Tenda FH1202 1.2.0.14(408).

A vulnerability has been found in Tenda FH1202 1.2.0.14(408).

A flaw has been found in Tenda FH1202 1.2.0.14(408).

A vulnerability was detected in Tenda FH1202 1.2.0.14(408).

A security vulnerability has been detected in Tenda FH1202 1.2.0.14(408).

A security flaw has been discovered in Tenda i3 1.0.0.6(2204).

A vulnerability was identified in Tenda i3 1.0.0.6(2204).

A vulnerability was determined in Tenda i3 1.0.0.6(2204).

A vulnerability was found in Tenda i3 1.0.0.6(2204).

A flaw has been found in Tenda i3 1.0.0.6(2204).

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx.

This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users endpoints.

The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs).

MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability.

Delta Electronics COMMGR2 has Buffer Over-read DoS vulnerability.

A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.

The rtsock_msg_buffer() function serializes routing information into a buffer.

An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn.

Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.

A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths.

A flaw has been found in Tiandy Easy7 CMS Windows 7.17.0.

A vulnerability was identified in doramart DoraCMS 3.0.x.

Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key.

The PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization.

The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client.

Taipower APP for Andorid developed by Taipower has an Improper Certificate Validation vulnerability.

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file.

A vulnerability was identified in opencc JFlow up to 5badc00db382d7cb82dad231e6a866b18e0addfe.

A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0.

A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0.

A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0.

A security flaw has been discovered in doramart DoraCMS 3.0.x.

A vulnerability was determined in SourceCodester Sales and Inventory System 1.0.

A vulnerability was found in SourceCodester Sales and Inventory System 1.0.

A vulnerability has been found in SourceCodester Sales and Inventory System 1.0.

A flaw has been found in SourceCodester Sales and Inventory System 1.0.

A vulnerability was detected in Bytedesk up to 1.3.9.

A security vulnerability has been detected in Bytedesk up to 1.3.9.

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API…

The origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.

A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0.

A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22.

A vulnerability was detected in Comfast CF-AC100 2.6.0.8.

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory.

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4.

A vulnerability was determined in itsourcecode Payroll Management System 1.0.

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to…

A vulnerability has been found in SourceCodester Resort Reservation System 1.0.