CVEs published March 12, 2026
77,396 CVEs in 2026
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration.
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image…
A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication).
There is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass.
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without…
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function.
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function.
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type,…
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function.
The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack.
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
A security vulnerability has been detected in Tenda i12 1.0.0.6(2204).
A weakness has been identified in Tenda i12 1.0.0.6(2204).
A security flaw has been discovered in Tenda i12 1.0.0.6(2204).
A flaw has been found in Tenda W3 1.0.0.3(2204).
A vulnerability was detected in Tenda W3 1.0.0.3(2204).
A vulnerability was detected in D-Link DIR-513 1.10.
A weakness has been identified in Tenda W3 1.0.0.3(2204).
A security flaw has been discovered in Tenda W3 1.0.0.3(2204).
A vulnerability was identified in Tenda W3 1.0.0.3(2204).
A vulnerability was determined in Tenda W3 1.0.0.3(2204).
A vulnerability was found in Tenda W3 1.0.0.3(2204).
A vulnerability has been found in Tenda i3 1.0.0.6(2204).
A flaw has been found in Tenda i3 1.0.0.6(2204).
A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3.
By controlling the IniFile parameter, an attacker can force the JDBC driver to load an attacker-controlled configuration file.
The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization.
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function.
A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.
soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts.
The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes.
The TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory.
The generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values.
A security vulnerability was identified where Firebase and Web3Forms API keys were exposed.
A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190.
Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends.
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another.
Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface.
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization.
The gguf_init_from_file_impl() in gguf.cpp is vulnerable to an Integer overflow, leading to an undersized heap allocation.
The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true).
A vulnerability allowing a low-privileged user to extract saved SSH credentials.
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6.
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.
Black writes a cache file, the name of which is computed from various formatting options.
A Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true.
Flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON.
1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously…
A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.
A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal…
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.
Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations.
A path traversal vulnerability exists in the TinaCMS development server's media upload handler.
A security flaw has been discovered in itsourcecode Cafe Reservation System 1.0.
A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0.
A vulnerability has been found in itsourcecode Online Doctor Appointment System 1.0.
A vulnerability was detected in FeMiner wms up to 1.0.
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication.
ImageMagick is free and open-source software used for editing and manipulating digital images.
The OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured.
The XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity processing.
The OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to.
When using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer.
A negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead.
The search tool allows LLMs to search for tools using natural language.
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length).
A vulnerability was determined in OpenClaw 2026.2.19-2.
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0.
A weakness has been identified in CodeGenieApp serverless-express up to 4.17.1.
A security vulnerability has been detected in projectsend up to r1945.
A vulnerability has been found in AutohomeCorp frostmourne up to 1.0.
A flaw has been found in Alfresco Activiti up to 7.19/8.8.0.
A vulnerability was detected in 648540858 wvp-GB28181-pro up to 2.7.4-20260107.
A security vulnerability has been detected in whyour qinglong up to 2.20.1.
TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations.
Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded.
The TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction.
UseHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags.
The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output…
A vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in…
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions…
The experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass.
When interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers.
A flaw was found in Libsoup.
In a situation where the ring-buffer of a gadget is – incidentally or maliciously – already full, the gadget will silently drop events.
The static resource upload interface allows SVG uploads.
An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM.
A security vulnerability has been detected in GPAC 26.03-DEV.
A weakness has been identified in GPAC 26.03-DEV.
A vulnerability was detected in rui314 mold up to 2.40.4.
A flaw has been found in quickjs-ng quickjs up to 0.12.1.
Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as…
The GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group.
This vulnerability is fixed in 7.8.1 and 6.10.15.
This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7.
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses.
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP…
Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response.
A security vulnerability has been detected in itsourcecode Payroll Management System 1.0.
A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0.
A vulnerability was determined in itsourcecode University Management System 1.0.
A flaw was found in mod_proxy_cluster.
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all…
The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized…
A vulnerability was detected in projectsend up to r1945.
A flaw has been found in projectsend up to r1945.
A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1.
A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1.
A vulnerability was identified in OpenClaw up to 2026.2.17.
A vulnerability was determined in rxi fe up to ed4cda96bd582cbb08520964ba627efb40f3dd91.
A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce.
A vulnerability has been found in jarikomppa soloud up to 20200207.
A flaw was found in Keycloak.
The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive.