CVEs published March 22, 2026
77,396 CVEs in 2026
A flaw has been found in Linksys MR9600 2.0.6.206937.
A weakness has been identified in D-Link DIR-513 1.10.
A vulnerability was identified in Tenda F453 1.0.0.3.
A vulnerability was determined in Tenda F453 1.0.0.3.
A vulnerability was found in Tenda F453 1.0.0.3.
A vulnerability has been found in Tenda FH451 1.0.0.9.
A flaw has been found in Tenda FH451 1.0.0.9.
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4.
The `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sanitization.
The HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform.
A vulnerability was detected in projectworlds Online Notes Sharing System 1.0.
A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0.
A weakness has been identified in Flos Freeware Notepad2 4.2.25.
A security flaw has been discovered in Flos Freeware Notepad2 4.2.25.
SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure because of STATUT mishandling.
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` block attribute in all versions up to, and…
A security flaw has been discovered in Tenda F453 1.0.0.3.
A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0.
A vulnerability was found in Wavlink WL-WN578W2 221110.
A vulnerability was detected in code-projects Simple Food Ordering System 1.0.
WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without…
The `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via…
A vulnerability has been found in SSCMS 4.7.0.
WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component.
A vulnerability was identified in PyTorch 2.10.0.
A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0.
A weakness has been identified in Free5GC 4.1.0.
A security flaw has been discovered in apconw Aix-DB up to 1.2.3.
The BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection.
A vulnerability has been found in code-projects Simple Gym Management System up to 1.0.
A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017.
A vulnerability was detected in code-projects Exam Form Submission 1.0.
A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0.
A vulnerability was detected in PuTTY 0.83.
A security flaw has been discovered in pygments up to 2.19.2.
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0.
A flaw has been found in janmojzis tinyssh up to 20250501.
A vulnerability was determined in Wavlink WL-WN578W2 221110.
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).