cve.li

Recent

CVE-2026-4393CWE-352

Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030

Published 2026-03-26 by drupal

CVE-2026-4933CWE-863

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029

Published 2026-03-26 by drupal

CVE-2026-3573CWE-863

AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

Published 2026-03-26 by drupal

CVE-2026-0965CWE-73

Libssh: libssh: denial of service via improper configuration file handling

Published 2026-03-26 by redhat

CVE-2026-0967CWE-1333

Libssh: libssh: denial of service via inefficient regular expression processing

Published 2026-03-26 by redhat

CVE-2026-0968CWE-476

Libssh: libssh: denial of service due to malformed sftp message

Published 2026-03-26 by redhat

CVE-2026-0964CWE-22

Libssh: improper sanitation of paths received from scp servers

Published 2026-03-26 by redhat

CVE-2026-0966CWE-124

Libssh: buffer underflow in ssh_get_hexa() on invalid input

Published 2026-03-26 by redhat

CVE-2026-21724

Missing Protected-field Authorization in Provisioning Contact Points API

Published 2026-03-26 by GRAFANA

CVE-2026-33375

Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

Published 2026-03-26 by GRAFANA

CVE-2026-33644CWE-918

Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs

Published 2026-03-26 by GitHub_M

CVE-2026-3532CWE-178

OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

Published 2026-03-26 by drupal

CVE-2026-3531CWE-288

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026

Published 2026-03-26 by drupal

CVE-2026-3530CWE-918

OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

Published 2026-03-26 by drupal

CVE-2026-3529CWE-79

Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

Published 2026-03-26 by drupal

CVE-2026-3528CWE-79

Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023

Published 2026-03-26 by drupal

CVE-2026-3527CWE-306

AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

Published 2026-03-26 by drupal

CVE-2026-3526CWE-863

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021

Published 2026-03-26 by drupal

CVE-2026-3525CWE-863

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

Published 2026-03-26 by drupal

CVE-2026-2100CWE-824

P11-kit: p11-kit: null dereference via c_derivekey with specific null parameters

Published 2026-03-26 by redhat

CVE-2026-33537CWE-918

Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

Published 2026-03-26 by GitHub_M

CVE-2026-2239CWE-170

Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

Published 2026-03-26 by redhat

CVE-2026-2272CWE-190

Gimp: gimp: memory corruption due to integer overflow in ico file handling

Published 2026-03-26 by redhat

CVE-2026-2271CWE-190

Gimp: gimp: denial of service via crafted psp image file

Published 2026-03-26 by redhat

CVE-2026-33536CWE-787CWE-121

ImageMagick has an Out-of-bounds Write via InterpretImageFilename

Published 2026-03-26 by GitHub_M

CVE-2026-33535CWE-787

ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

Published 2026-03-26 by GitHub_M

CVE-2026-33532CWE-674

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Published 2026-03-26 by GitHub_M

CVE-2026-32287

Infinite loop in github.com/antchfx/xpath

Published 2026-03-26 by Go

CVE-2026-32286

Denial of service in github.com/jackc/pgproto3/v2

Published 2026-03-26 by Go

CVE-2026-32285

Denial of service in github.com/buger/jsonparser

Published 2026-03-26 by Go

CVE-2026-32284

Denial of service in github.com/shamaton/msgpack

Published 2026-03-26 by Go

CVE-2026-33531CWE-89

InvenTree has Path Traversal In Report Templates

Published 2026-03-26 by GitHub_M

CVE-2026-33530CWE-202

InvenTree Vulnerable to ORM Filter Injection

Published 2026-03-26 by GitHub_M

CVE-2026-33632CWE-862

ClearanceKit: opfilter policy bypass via exchangedata and clone operations

Published 2026-03-26 by GitHub_M

CVE-2026-2436CWE-825

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

Published 2026-03-26 by redhat

CVE-2026-33631CWE-862

ClearanceKit: opfilter policy bypass via non-open file operations

Published 2026-03-26 by GitHub_M

CVE-2021-4474CWE-552

Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access

Published 2026-03-26 by VulnCheck

CVE-2026-33529CWE-22

Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

Published 2026-03-26 by GitHub_M

CVE-2026-33528CWE-22

GoDoxy has a Path Traversal Vulnerability in its File API

Published 2026-03-26 by GitHub_M

CVE-2026-33525CWE-79

Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting

Published 2026-03-26 by GitHub_M

CVE-2023-7338CWE-78

Ruckus Unleashed Authenticated RCE in Gateway Mode

Published 2026-03-26 by VulnCheck

CVE-2026-3121CWE-266

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

Published 2026-03-26 by redhat

CVE-2026-3190CWE-280

Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

Published 2026-03-26 by redhat

CVE-2026-33152CWE-307

Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication

Published 2026-03-26 by GitHub_M

CVE-2026-33153CWE-89

Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic

Published 2026-03-26 by GitHub_M

CVE-2026-33148CWE-74

URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key

Published 2026-03-26 by GitHub_M

CVE-2026-29055CWE-1230

Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII

Published 2026-03-26 by GitHub_M

CVE-2026-4923CWE-1333

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Published 2026-03-26 by openjs

CVE-2026-26213CWE-78

thingino-firmware api.cgi Unauthenticated Command Injection in Captive Portal

Published 2026-03-26 by VulnCheck

CVE-2026-4926CWE-400CWE-1333

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Published 2026-03-26 by openjs

CVE-2026-28503CWE-639

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

Published 2026-03-26 by GitHub_M

CVE-2026-33149CWE-644

Tandoor Recipes Vulnerable to Host Header Injection

Published 2026-03-26 by GitHub_M

CVE-2026-33506CWE-87CWE-601

DOM-Based XSS in Ory Polis Login Page

Published 2026-03-26 by GitHub_M

CVE-2026-33491CWE-121CWE-787

Zen-C has Stack-Based Buffer Overflow in Identifier Mangling

Published 2026-03-26 by GitHub_M

CVE-2026-33505CWE-89

Ory Keto has a SQL injection via forged pagination tokens

Published 2026-03-26 by GitHub_M

CVE-2026-33504CWE-89

Ory Hydra has a SQL injection via forged pagination tokens

Published 2026-03-26 by GitHub_M

CVE-2026-33503CWE-89

Ory Kratos has a SQL injection via forged pagination tokens

Published 2026-03-26 by GitHub_M

CVE-2026-33496CWE-1289CWE-305

Ory Oathkeeper has an authentication bypass by cache key confusion

Published 2026-03-26 by GitHub_M

CVE-2026-32857CWE-918

Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation

Published 2026-03-26 by VulnCheck

CVE-2026-33495CWE-862

Ory Oathkeeper has an authentication bypass by usage of untrusted header

Published 2026-03-26 by GitHub_M

CVE-2026-33494CWE-23

Ory Oathkeeper has a path traversal authorization bypass

Published 2026-03-26 by GitHub_M

CVE-2026-33732CWE-706

srvx is vulnerable to middleware bypass via absolute URI in request line

Published 2026-03-26 by GitHub_M

CVE-2026-33490CWE-706

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Published 2026-03-26 by GitHub_M

CVE-2026-33487CWE-347CWE-682

goxmldsig has validateSignature Loop Variable Capture Signature Bypass

Published 2026-03-26 by GitHub_M

CVE-2026-33486CWE-918

Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents

Published 2026-03-26 by GitHub_M

CVE-2026-33481CWE-460

Syft improper temporary file cleanup

Published 2026-03-26 by GitHub_M

CVE-2026-33477CWE-863

FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content

Published 2026-03-26 by GitHub_M

CVE-2026-33470CWE-862CWE-863

Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp

Published 2026-03-26 by GitHub_M

CVE-2026-33469CWE-863

Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw

Published 2026-03-26 by GitHub_M

CVE-2026-33468CWE-89

Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

Published 2026-03-26 by GitHub_M

CVE-2026-33442CWE-89

Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.

Published 2026-03-26 by GitHub_M

CVE-2026-34071CWE-79

Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export

Published 2026-03-26 by GitHub_M

CVE-2026-33438CWE-770

Stirling-PDF vulnerable to DoS via add-watermark

Published 2026-03-26 by GitHub_M

CVE-2026-33430CWE-732

Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions

Published 2026-03-26 by GitHub_M

CVE-2026-33636CWE-125CWE-787

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

Published 2026-03-26 by GitHub_M

CVE-2026-33416CWE-416

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

Published 2026-03-26 by GitHub_M

CVE-2026-33402CWE-79

SAK-52311: Sakai site-manage group titles can contain XSS content

Published 2026-03-26 by GitHub_M

CVE-2026-33015CWE-863

EVerest has RemoteStop Bypass via BCB Toggle Session Restart

Published 2026-03-26 by GitHub_M

CVE-2026-33014CWE-863

EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop

Published 2026-03-26 by GitHub_M

CVE-2026-33009CWE-362

EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio

Published 2026-03-26 by GitHub_M

CVE-2026-29044CWE-863

EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted

Published 2026-03-26 by GitHub_M

CVE-2026-32846CWE-22

OpenClaw Media Parsing Path Traversal to Arbitrary File Read

Published 2026-03-26 by VulnCheck

CVE-2026-27828CWE-416

EVerest: ISO15118 session_setup use-after-free can crash EVSE process

Published 2026-03-26 by GitHub_M

CVE-2026-27816CWE-787

EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state

Published 2026-03-26 by GitHub_M

CVE-2026-27815CWE-787

EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state

Published 2026-03-26 by GitHub_M

CVE-2026-3112CWE-22

Arbitrary File Read via Advanced Logging Support Packet

Published 2026-03-26 by Mattermost

CVE-2026-3109CWE-754

Missing timestamp validation in Zoom webhook handler

Published 2026-03-26 by Mattermost

CVE-2026-27814CWE-362

EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition

Published 2026-03-26 by GitHub_M

CVE-2026-27813CWE-416

EVerest has use-after-free in auth timeout timer via race condition

Published 2026-03-26 by GitHub_M

CVE-2026-3115CWE-863

Guest users can view group member IDs without respecting view restrictions

Published 2026-03-26 by Mattermost

CVE-2026-3114CWE-409

Zip Bomb Denial of Service via Unrestricted Archive Decompression

Published 2026-03-26 by Mattermost

CVE-2026-26074CWE-362

EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race

Published 2026-03-26 by GitHub_M

CVE-2026-3116CWE-400

Improper Input Validation in Zoom Plugin Webhook Handler

Published 2026-03-26 by Mattermost

CVE-2026-3113CWE-732

mmctl export download command doesn’t restrict permissions to created file to file owner

Published 2026-03-26 by Mattermost

CVE-2026-3108CWE-150

Terminal Escape Injection in mmctl Report Posts Command

Published 2026-03-26 by Mattermost

CVE-2026-4867CWE-1333

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Published 2026-03-26 by openjs

CVE-2026-26073CWE-122

EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue

Published 2026-03-26 by GitHub_M

CVE-2026-4897CWE-770

Polkit: polkit: denial of service via unbounded input processing through standard input

Published 2026-03-26 by redhat

CVE-2026-26072CWE-362

EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map

Published 2026-03-26 by GitHub_M

CVE-2026-26071CWE-362CWE-416

EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free

Published 2026-03-26 by GitHub_M

CVE-2026-26070CWE-362

EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash

Published 2026-03-26 by GitHub_M

CVE-2026-26008CWE-125

EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes

Published 2026-03-26 by GitHub_M

CVE-2026-23995CWE-121

EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ

Published 2026-03-26 by GitHub_M

CVE-2026-22790CWE-121

EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload

Published 2026-03-26 by GitHub_M

CVE-2026-28298CWE-79

SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

Published 2026-03-26 by SolarWinds

CVE-2026-27664CWE-787

Published 2026-03-26 by siemens

CVE-2026-27663CWE-770

Published 2026-03-26 by siemens

CVE-2026-28297CWE-79

SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

Published 2026-03-26 by SolarWinds

CVE-2026-22593CWE-193

EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing

Published 2026-03-26 by GitHub_M

CVE-2026-33397CWE-601

Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass

Published 2026-03-26 by GitHub_M

Load more ↓