Archive
2 March 2026
Vulnerabilities first published on this day (UTC), newest first.
229 results · Feed
-
Medium 6.9
Path Traversal on TP-Link Deco BE25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0:…
-
High 7.5CVE-2026-3180 Public exploit
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient …
-
High 8.8
Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview
The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it possible for a…
-
High 7.8
Integer Overflow or Wraparound in Graphics
Memory corruption while using alignments for memory allocation.
KEV Mar 3, 2026 -
High 7.8
Out-of-bounds Write in Computer Vision
Memory Corruption when processing invalid user address with nonstandard buffer address.
-
High 7.8
Buffer Over-read in Graphics
Memory Corruption when adding user-supplied data without checking available buffer space.
-
High 7.8
Use After Free in Automotive Audio
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
-
High 7.8
Improper Access Control for Register Interface in SCE-Mink
Memory Corruption when accessing trusted execution environment without proper privilege check.
-
Medium 6.5
Reachable Assertion in FW
Transient DOS when MAC configures config id greater than supported maximum value.
-
High 7.2
Missing Cryptographic Step in Data Modem
Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
-
High 7.8
Use After Free in Automotive Audio
Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.
-
High 7.8
Use After Free in Automotive Audio
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
-
High 7.1
Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.
-
High 7.8
Use After Free in Automotive Audio
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
-
High 7.8
Use After Free in Automotive Audio
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
-
High 7.8
Use After Free in Automotive Audio
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
-
High 7.8
Out-of-bounds Write in Automotive
Memory Corruption when accessing buffers with invalid length during TA invocation.
-
Medium 6.5
Reachable Assertion in Modem
Transient DOS when an LTE RLC packet with invalid TB is received by UE.
-
High 7.1
ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP add…
-
High 8.6CVE-2026-28286 Public exploit
ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when…
-
Medium 5.3
NocoDB: Stored Cross-Site Scripting via Rich Text Cells
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.
-
Medium 6.2
NocoDB: SQL Injection via DATEADD Formula
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
-
Medium 5.3
NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS. This issue has been patched in version 0.301.3.
-
Medium 5.3
NocoDB: Stored Cross-Site Scripting via Comments
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This issue has been patched in version 0.301.3.
-
Medium 4.9
NocoDB: Refresh Tokens Not Revoked on Password Reset
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim re…
-
Medium 4.9
NocoDB: Missing Ownership Validation in MCP Token Operations
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was k…
-
Low 2.7
NocoDB: Plaintext Storage of Shared View Passwords
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.
-
Medium 5.3
NocoDB: Stored Cross-Site Scripting via Rich Text Field
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been pat…
-
Low 2.7CVE-2026-28358 Scanner template
NocoDB: User Enumeration via Password Reset Endpoint
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
-
Medium 5.3
NocoDB: Stored Cross-Site Scripting via Formula Cell
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTM…
-
Medium 5.3
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.1…
-
Medium 6.9
Chamilo: HTML injection via open parameter
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched …
-
High 7.0
Chamilo: PHAR deserialization bypass
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modi…
-
High 7.7
Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)
Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.
-
Medium 5.1
Chamilo: Reflected XSS via page parameter
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitization of the page parameter in the session/add_users_to_session.php endpoint. This issue has been patch…
-
Medium 5.1
Chamilo: Reflected XSS via keyword_inactive parameter
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/user_list.php endpoint. The keyword_inactive parameter is not properly sanitized, allowing attackers to inject malici…
-
Medium 5.1
Chamilo: Reflected XSS via keyword_active parameter
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to improper sanitization of the keyword_active parameter in admin/user_list.php. This issue has been patched in version 1.11.3…
-
Medium 4.8
Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name
Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privi…
-
High 7.1
Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass
Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint.…
-
High 8.8
Chamilo: Stored XSS Vulnerability via CSV User Import
Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name",…