Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.3 MEDIUM
CVE-2026-32565 — WordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebberZone Contextual Related Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/…

Remote | Authorization
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
5.4 MEDIUM
CVE-2026-1217 — Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbit…

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions…

Remote | Authorization
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
8.8 HIGH
CVE-2026-22730 — CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability…

Remote | Injection
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
8.6 HIGH
CVE-2026-22729 — CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-contro…

Remote | Injection
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
7.1 HIGH
CVE-2026-22323 — Cross‑Site Request Forgery in Link Aggregation Configuration

A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by lu…

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
7.1 HIGH
CVE-2026-22322 — Stored Cross‑Site Scripting in Link Aggregation Name Handling

A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScrip…

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
5.3 MEDIUM
CVE-2026-22321 — Stack-Based Buffer Overflow in CLI Login Username Handling over CLI

A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thr…

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
6.5 MEDIUM
CVE-2026-22320 — Stack-Based Buffer Overflow in TFTP File-Transfer Command Handling over CLI

A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversize…

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
4.9 MEDIUM
CVE-2026-22319 — Stack-Based Buffer Overflow in File Install Parameter Handling

A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fixed-size stack buffer within an internal…

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
4.9 MEDIUM
CVE-2026-22318 — Stack-Based Buffer Overflow in File Transfer Parameter Handling

A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameters, causing memory corruption in an inter…

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
7.2 HIGH
CVE-2026-22317 — Command Injection Vulnerability in Root CA Certificate Transfer Workflow

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution…

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
6.5 MEDIUM
CVE-2026-22316 — Buffer Overflow using TFTP Filename

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack.

Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
2.4 LOW
CVE-2025-31703 — Dahua NVR/XVR Unauthorized Physical Access Privilege Escalation

A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's …

| Authentication
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
6.1 MEDIUM
CVE-2026-3512 — Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter

The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up to and including 0.1. This is due to insufficient input san…

Remote | Cross-Site Scripting
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
7.0 HIGH
CVE-2026-32608 — Glances has a Command Injection via Process Names in Action Command Templates

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. Thes…

glances | Injection
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
5.9 MEDIUM
CVE-2025-15363 — Get Use APIs < 2.0.10 - Contributor+ Stored XSS

The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configu…

Remote | Cross-Site Scripting
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
7.6 HIGH
CVE-2026-32606 — IncusOS has a LUKS encryption bypass due to insufficient TPM policy

IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physi…

| Authentication
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
8.7 HIGH
CVE-2026-32596 — Glances exposes the REST API without authentication

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensi…

glances | Remote | Authentication
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
8.7 HIGH
CVE-2026-32268 — Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets th…

Remote | Information Disclosure
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
5.8 MEDIUM
CVE-2026-4366 — Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in…

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows a…

Remote | Server-Side Request Forgery
Mar 18, 2026 Mar 18, 2026
Mar 18, 2026
Mar 18, 2026
Showing 20 of 5415 Results