CVE-2025-47386 - Use After Free in Automotive Audio
CVE ID : CVE-2025-47386
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-47386
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-59600 - Buffer Over-read in Graphics
CVE ID : CVE-2025-59600
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when adding user-supplied data without checking available buffer space.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-59600
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when adding user-supplied data without checking available buffer space.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-59603 - Out-of-bounds Write in Computer Vision
CVE ID : CVE-2025-59603
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when processing invalid user address with nonstandard buffer address.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-59603
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when processing invalid user address with nonstandard buffer address.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-64427 - ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)
CVE ID : CVE-2025-64427
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP addresses (e.g., 127.0.0.1, localhost, or private network ranges). This allows the attacker to interact with internal HTTP/HTTPS services that are not intended to be exposed externally or to local users. No known patch is publicly available.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-64427
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP addresses (e.g., 127.0.0.1, localhost, or private network ranges). This allows the attacker to interact with internal HTTP/HTTPS services that are not intended to be exposed externally or to local users. No known patch is publicly available.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-70252 - Tenda AC6 Stack Overflow Vulnerability
CVE ID : CVE-2025-70252
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-70252
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21385 - Integer Overflow or Wraparound in Graphics
CVE ID : CVE-2026-21385
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory corruption while using alignments for memory allocation.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-21385
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory corruption while using alignments for memory allocation.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-23865 - Freetype Integer Overflow Out-of-Bounds Read Vulnerability
CVE ID : CVE-2026-23865
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-23865
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-24105 - Tenda AC15 Command Injection Vulnerability
CVE ID : CVE-2026-24105
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-24105
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-26700 - Sourcecodester Personnel Property Equipment System SQL Injection Vulnerability
CVE ID : CVE-2026-26700
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-26700
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-26708 - Sourcecodester Pharmacy Point of Sale System SQL Injection Vulnerability
CVE ID : CVE-2026-26708
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-26708
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28286 - ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
CVE ID : CVE-2026-28286
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28286
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28357 - NocoDB: Stored Cross-Site Scripting via Formula Cell
CVE ID : CVE-2026-28357
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28357
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28358 - NocoDB: User Enumeration via Password Reset Endpoint
CVE ID : CVE-2026-28358
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
Severity: 2.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28358
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
Severity: 2.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28359 - NocoDB: Stored Cross-Site Scripting via Rich Text Field
CVE ID : CVE-2026-28359
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28359
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28360 - NocoDB: Plaintext Storage of Shared View Passwords
CVE ID : CVE-2026-28360
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.
Severity: 2.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28360
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.
Severity: 2.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28361 - NocoDB: Missing Ownership Validation in MCP Token Operations
CVE ID : CVE-2026-28361
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in version 0.301.3.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28361
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in version 0.301.3.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28396 - NocoDB: Refresh Tokens Not Revoked on Password Reset
CVE ID : CVE-2026-28396
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28396
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28397 - NocoDB: Stored Cross-Site Scripting via Comments
CVE ID : CVE-2026-28397
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28397
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28398 - NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells
CVE ID : CVE-2026-28398
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28398
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28399 - NocoDB: SQL Injection via DATEADD Formula
CVE ID : CVE-2026-28399
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28399
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28401 - NocoDB: Stored Cross-Site Scripting via Rich Text Cells
CVE ID : CVE-2026-28401
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28401
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...