Skip to content
OpenAdvisories

Archive

29 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /29 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-5101

    Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection

    A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploi…

    Toto Link A3300R
  • Medium 6.5
    GHSA-7fqq-q52p-2jjg

    OpenCC has an Out-of-bounds read when processing truncated UTF-8 input

    ### Summary OpenCC versions before 1.2.0 contain two `CWE-125: Out-of-bounds Read` issues caused by length validation failures in UTF-8 processing. When handling malformed or truncated UTF-8 input, OpenCC trusted derived length values without enforcing the in…

    opencc opencc npm PyPI
  • Medium 4.8
    GHSA-7rx3-28cr-v5wh

    Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry

    ## Summary The prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric `__lookupSetter__`. This omission is only exploitable when the…

    handlebars npm
  • Medium 6.2
    CVE-2026-33574

    OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download

    OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path …

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-32923

    OpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement

    OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allowlist checks. Non-allowlisted guild members can trigger reaction events accepted as trusted system ev…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.1
    CVE-2026-32919

    OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands

    OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash commands to reset targ…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.7
    CVE-2026-5041

    code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection

    A vulnerability was identified in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is the function fwrite of the file admin/pageMail.php. The manipulation of the argument mailSubject/mailMessage leads to command injection. The atta…

    code-projects Chamber of Commerce Membership Management System
  • Medium 4.3
    CVE-2026-5031

    BichitroGan ISP Billing Software Endpoint users-view resource injection

    A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifie…

    BichitroGan ISP Billing Software
  • Medium 6.3
    CVE-2026-5030

    Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection

    A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument host_time leads to command injection. …

    Toto Link NR1800X
  • Medium 5.3
    CVE-2026-5023

    DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection

    A vulnerability has been found in DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6. This vulnerability affects the function getCodebase/getRemoteCodebase/saveCodebase of the file src/tools/codebase.ts of the component RepoMix Command …

    DeDeveloper23 codebase-mcp
  • Medium 6.4
    CVE-2026-2602

    Twentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'

    The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticat…

    twentig Twentig Supercharged Block Editor – Blocks, Patterns, Starter Sites, Portfolio Web / CMS
  • Medium 6.3
    CVE-2026-5020

    Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection

    A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument NoticeUrl results in command inje…

    Toto Link A3600R