Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CVE-2026-121437Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters

Exploitation status: Actively exploited
Fix: Yes
Provider: lepture
Affected product: mistune
Published: 11/03/2026
Severity: High

Details

CVE-2026-121436Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Exploitation status: Not exploited
Fix: Yes
Provider: froxlor
Affected product: froxlor
Published: 11/03/2026
Severity: High

Details

CVE-2026-121435Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

Exploitation status: Not confirmed
Fix: Yes
Provider: froxlor
Affected product: froxlor
Published: 11/03/2026
Severity: Medium

Details

CVE-2026-121434Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

Exploitation status: Not confirmed
Fix: Yes
Provider: froxlor
Affected product: froxlor
Published: 11/03/2026
Severity: Medium

Details

CVE-2026-121433AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

Exploitation status: Actively exploited
Fix: Yes
Provider: AzuraCast
Affected product: AzuraCast
Published: 11/03/2026
Severity: Medium

Details

Vulnerability	Exploitation status	Fix	Provider	Affected product	Published	Severity

`CVE-2026-121437`Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters	Exploitation statusActively exploited	FixYes

`CVE-2026-121434`Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API	Exploitation statusNot confirmed	FixYes	Providerfroxlor	Affected productfroxlor	Published11/03/2026	SeverityMedium

`CVE-2026-121433`AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export	Exploitation statusActively exploited	FixYes	ProviderAzuraCast	Affected productAzuraCast	Published11/03/2026	SeverityMedium

`CVE-2026-121432`AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist	Exploitation statusNot exploited	FixYes	ProviderAzuraCast	Affected productAzuraCast	Published11/03/2026	SeverityMedium

`CVE-2026-121430`AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints	Exploitation statusNot confirmed	FixYes	ProviderAzuraCast	Affected productAzuraCast	Published11/03/2026	SeverityMedium

`CVE-2026-121429`AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()	Exploitation statusActively exploited	FixYes	ProviderAzuraCast	Affected productAzuraCast	Published11/03/2026	SeverityHigh

`CVE-2026-121428`AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone	Exploitation statusNot exploited	FixYes	ProviderAzuraCast	Affected productAzuraCast	Published11/03/2026	SeverityHigh

`CVE-2026-121427`AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config	Exploitation statusNot confirmed	FixYes	ProviderAzuraCast	Affected productAzuraCast	Published11/03/2026	SeverityHigh

`CVE-2026-121426`Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser	Exploitation statusNot confirmed	FixYes	Providernodemailer	Affected productnodemailer	Published11/03/2026	SeverityHigh

`CVE-2026-121425`Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing	Exploitation statusActively exploited	FixYes	Providernodemailer	Affected productnodemailer	Published11/03/2026	SeverityHigh

`CVE-2026-121424`Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments	Exploitation statusNot exploited	FixYes	Providernodemailer	Affected productnodemailer	Published11/03/2026	SeverityHigh

`CVE-2026-121423`SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization	Exploitation statusNot confirmed	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityHigh

`CVE-2026-121422`SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass	Exploitation statusNot confirmed	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityMedium

`CVE-2026-121421`SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass	Exploitation statusActively exploited	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityMedium

`CVE-2026-121420`SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses	Exploitation statusNot exploited	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityMedium

`CVE-2026-121419`SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision	Exploitation statusNot confirmed	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityHigh

`CVE-2026-121418`SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner	Exploitation statusNot confirmed	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityMedium

`CVE-2026-121417`SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends	Exploitation statusActively exploited	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityHigh

`CVE-2026-121416`SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations	Exploitation statusNot exploited	FixYes	Providersurrealdb	Affected productsurrealdb	Published11/03/2026	SeverityHigh

`CVE-2026-121415`Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key	Exploitation statusNot confirmed	FixYes	Providerparse-community	Affected productparse-server	Published11/03/2026	SeverityMedium

`CVE-2026-121414`Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update	Exploitation statusNot confirmed	FixYes	Providerparse-community	Affected productparse-server	Published11/03/2026	SeverityHigh

`CVE-2026-121413`Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession	Exploitation statusNot exploited	FixYes	Providerparse-community	Affected productparse-server	Published11/03/2026	SeverityLow

`CVE-2026-121409`FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token	Exploitation statusActively exploited	FixYes	ProviderFreeRDP	Affected productFreeRDP	Published11/03/2026	SeverityHigh

`CVE-2026-121405`FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control	Exploitation statusActively exploited	FixYes	ProviderFreeRDP	Affected productFreeRDP	Published11/03/2026	SeverityMedium

`CVE-2026-121401`FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet	Exploitation statusActively exploited	FixYes	ProviderFreeRDP	Affected productFreeRDP	Published11/03/2026	SeverityMedium

`CVE-2026-121393`FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion	Exploitation statusActively exploited	FixYes	ProviderFreeRDP	Affected productFreeRDP	Published11/03/2026	SeverityHigh

`CVE-2026-121392`FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate	Exploitation statusNot exploited	FixYes	ProviderFreeRDP	Affected productFreeRDP	Published11/03/2026	SeverityCritical

`CVE-2026-121389`FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging	Exploitation statusActively exploited	FixYes	ProviderFreeRDP	Affected productFreeRDP	Published11/03/2026	SeverityLow

Vulnerability Database

Vulnerabilities

Top 5 providers by vulnerabilities (90 days)

Run an in-depth assessment with complete web risk management

Explore more resources from CyStack

Website security reports

CyStack research

Filters

Cybersecurity knowledge