CVE & Exploit Intelligence Database

CVE-2026-3638 5.9 MEDIUM

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.

CWE-862 Mar 09, 2026

CVE-2025-70033 5.4 MEDIUM

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.

CWE-79 Mar 09, 2026

CVE-2025-70060 5.4 MEDIUM

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.

Mar 09, 2026

CVE-2025-70040 5.3 MEDIUM

An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2. This allows an attacker to obtain sensitive information.

CWE-532 Mar 09, 2026

CVE-2026-2919 4.3 MEDIUM

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability affects Focus for iOS < 148.2.

CWE-451 Mar 09, 2026

CVE-2026-21736 4.4 MEDIUM

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory. This is caused by improper handling of the memory protections for the user-mode wrapped memory resource.

CWE-280 Mar 09, 2026

CVE-2026-3817 5.3 MEDIUM EPSS 0.00

A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patient-search.php. The manipulation results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used.

CWE-266 Mar 09, 2026

CVE-2026-3816 4.3 MEDIUM 2 Writeups EPSS 0.00

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.

CWE-404 Mar 09, 2026

CVE-2026-25604 5.4 MEDIUM EPSS 0.00

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.  This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

CWE-346 Mar 09, 2026

CVE-2026-3813 6.3 MEDIUM EPSS 0.00

A vulnerability was identified in opencc JFlow up to 5badc00db382d7cb82dad231e6a866b18e0addfe. Affected by this vulnerability is the function Calculate of the file src/main/java/bp/wf/httphandler/WF_CCForm.java. Such manipulation leads to injection. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CWE-74 Mar 09, 2026

CVE-2026-3812 4.3 MEDIUM EPSS 0.00

A vulnerability was determined in itsourcecode Payroll Management System 1.0. Affected is an unknown function of the file /manage_employee_allowances.php. This manipulation of the argument ID causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CWE-94 Mar 09, 2026

CVE-2025-41763 6.5 MEDIUM EPSS 0.00

A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.

CWE-497 Mar 09, 2026

CVE-2025-41762 6.2 MEDIUM EPSS 0.00

An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.

CWE-328 Mar 09, 2026

CVE-2025-41760 4.9 MEDIUM EPSS 0.00

An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.

CWE-636 Mar 09, 2026

CVE-2025-41759 4.9 MEDIUM EPSS 0.00

An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all.

CWE-636 Mar 09, 2026

CVE-2025-41755 6.5 MEDIUM EPSS 0.00

A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accepts a parameter specifying the log file to open (e.g., /tmp/weblog{some_number}), but this parameter is not properly validated, allowing an attacker to modify it to reference any file and retrieve its contents.

CWE-22 Mar 09, 2026

CVE-2025-41754 6.5 MEDIUM EPSS 0.00

A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.

CWE-1242 Mar 09, 2026

CVE-2026-3806 6.3 MEDIUM 1 Writeup EPSS 0.00

A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php. This manipulation of the argument q causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CWE-89 Mar 09, 2026

CVE-2026-3822 6.5 MEDIUM EPSS 0.00

Taipower APP developed by Taipower has an Improper Certificate Validation vulnerability. When establishing an HTTPS connection with the server, the application fails to verify the server-side TLS/SSL certificate. This flaw allows an unauthenticated remote attackers to exploit the vulnerability to perform a Man-in-the-Middle (MITM) attack to read and tamper with network packets.

CWE-295 Mar 09, 2026

CVE-2026-3800 6.3 MEDIUM 1 Writeup EPSS 0.00

A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controller.php?action=add. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CWE-284 Mar 09, 2026