CVE-2026 records published in April 2026

This page lists the 5,323 CVE-2026 records published in April 2026, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 13 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2026 list filters these records by severity or signal.

Critical
56510.6% of these records
Listed in CISA KEV
130.2% of these records
Reported exploited
120.2% of these records
Detection signal
791.5% of these records
Exploit code
1803.4% of these records
Actionable vendor fix
3,95874.4% of these records

Figures as of 2026-10-24 13:48 UTC. Records published in April 2026 have had from about six months to about seven months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.

CVE-2026 records published in April 2026, newest first: records 1 to 1,000 of 5,323
CVE Summary CVSS EPSS Published Signals
CVE-2026-42800ASR Lapwing_Linux deference after null check in ims_client sip7.4CNA v3.10.3%2026-04-30Fix
CVE-2026-42799ASR Kestrel out-of-bounds read in ulp7.4CNA v3.10.4%2026-04-30Fix
CVE-2026-42798little cms color engine integer overflow4.0CNA v3.10.2%2026-04-30Fix
CVE-2026-42512FreeBSD remotely triggerable out-of-bounds heap write in dhclient8.1CISA ADP v3.11.8%2026-04-30Fix
CVE-2026-42511FreeBSD remote code execution via malicious DHCP options8.1CISA ADP v3.10.4%2026-04-30Fix
CVE-2026-41882JetBrains IntelliJ IDEA link following7.4CNA v3.10.4%2026-04-30Fix
CVE-2026-41263Traefik: BasicAuth middleware: Timing side-channel6.3CNA v4.00.4%2026-04-30Fix
CVE-2026-41226Ricoh Multiple laser printers and MFPs which implement Web Image Monitor open redirect5.1CNA v4.00.4%2026-04-30
CVE-2026-41174Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding4.8CNA v4.00.3%2026-04-30Fix
CVE-2026-41016Apache Airflow Providers SMTP STARTTLS connection improper certificate validation5.9CISA ADP v3.10.3%2026-04-30Fix
CVE-2026-40951Memory corruption in Secure Access Windows clients6.8CNA v4.00.1%2026-04-30Fix
CVE-2026-40950Buffer overflow in the Secure Access server7.1CNA v4.00.4%2026-04-30Fix
CVE-2026-40949Absolute Software Secure Access buffer overflow in Windows clients6.8CNA v4.00.1%2026-04-30Fix
CVE-2026-40912Traefik: StripPrefixRegex auth bypass via Path/RawPath desync7.8CNA v4.00.7%2026-04-30Fix
CVE-2026-40904Chartbrew dataset and data request routes improper access control8.1CNA v3.10.4%2026-04-30
CVE-2026-40687Exim missing resource initialization9.1v3.10.4%2026-04-30Fix
CVE-2026-40686Exim out-of-bounds read5.3v3.10.2%2026-04-30Fix
CVE-2026-40685Exim incorrect behavior9.8v3.10.3%2026-04-30Fix
CVE-2026-40684Exim incorrect behavior7.5v3.10.4%2026-04-30Fix
CVE-2026-40603Chartbrew: Incorrect Access Control in /API/project/dashboard/:brewName via same-team override6.5CNA v3.10.4%2026-04-30
CVE-2026-40601Chartbrew: Missing authorization in /API/chart/:chart_id/query via team-level refresh toggle7.5CNA v3.10.5%2026-04-30
CVE-2026-40600Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id8.1CNA v3.10.4%2026-04-30
CVE-2026-40595Chartbrew public chart and export routes improper access control7.5CNA v3.10.5%2026-04-30
CVE-2026-39858Traefik: Forwarded alias spoofing top pre-auth decision bypass7.8CNA v4.00.6%2026-04-30Fix
CVE-2026-39457FreeBSD stack overflow via select file descriptor set overflow7.8CISA ADP v3.10.2%2026-04-30Fix
CVE-2026-38940RafyMrX TOKO-ONLINE-ROTI v.1.0 cross-site scripting6.1CISA ADP v3.10.4%2026-04-30
CVE-2026-38939andrewtch88 mvc-ecommerce v.1.0 cross-site scripting6.1CISA ADP v3.10.4%2026-04-30
CVE-2026-36960U-SPEED N300 Router cross-site request forgery8.8CISA ADP v3.10.2%2026-04-30
CVE-2026-36959U-speed N300 missing brute-force protection7.5CISA ADP v3.10.5%2026-04-30
CVE-2026-36958U-speed N300 A denial of service7.5CISA ADP v3.10.5%2026-04-30
CVE-2026-36957Dbitnet Dbit N300 T1 Pro deadlock7.5CISA ADP v3.10.5%2026-04-30
CVE-2026-36956Dbitnet Dbit N300 T1 Pro web management interface of the cross-site request forgery8.8CISA ADP v3.10.2%2026-04-30
CVE-2026-36767Shopizer has a path traversal issue10.0CISA ADP v3.10.6%2026-04-30
CVE-2026-36766Shopizer is vulnerable to cross-site scripting5.4CISA ADP v3.10.2%2026-04-30
CVE-2026-36765/designer/loadReport endpoint of SpringBlade v4.8.0 An XML external entity injection8.8CISA ADP v3.10.6%2026-04-30
CVE-2026-36764/ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 server-side request forgery5.0CISA ADP v3.10.3%2026-04-30
CVE-2026-36763/api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 stored cross-site scripting6.1CISA ADP v3.10.3%2026-04-30
CVE-2026-36762JeeSite file upload path traversal8.8CISA ADP v3.10.7%2026-04-30
CVE-2026-36761/msg/msgInner/save endpoint of JeeSite v5.15.1 stored cross-site scripting6.1CISA ADP v3.10.3%2026-04-30
CVE-2026-36760JeeSite chunked file upload path traversal9.6CISA ADP v3.10.6%2026-04-30
CVE-2026-36759halo theme upgrade endpoint server-side request forgery6.5CISA ADP v3.10.4%2026-04-30
CVE-2026-36758/themes/-/install-from-uri endpoint of halo v2.22.14 server-side request forgery4.3CISA ADP v3.10.3%2026-04-30
CVE-2026-36757halo plugin upgrade endpoint server-side request forgery4.3CISA ADP v3.10.3%2026-04-30
CVE-2026-36756/plugins/-/install-from-uri endpoint of halo v2.22.14 server-side request forgery5.4CISA ADP v3.10.2%2026-04-30
CVE-2026-36340Krayin CRM allows a remote attacker to execute arbitrary code via compose email function8.1CISA ADP v3.10.8%2026-04-30Fix
CVE-2026-35547FreeBSD heap overflow in libnv8.1CISA ADP v3.10.4%2026-04-30Fix
CVE-2026-35514Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew6.5CNA v3.10.4%2026-04-30
CVE-2026-35051Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth7.8CNA v4.00.3%2026-04-30Fix
CVE-2026-33845GnuTLS: GnuTLS: Denial of service via dtls zero-length fragment9.1NVD v3.10.9%2026-04-30Fix
CVE-2026-33452Absolute Software Secure Access buffer overflow in Windows clients5.9CNA v4.00.1%2026-04-30Fix
CVE-2026-33451Absolute Software Secure Access arbitrary read/write vulnerability in Windows clients8.5CNA v4.00.2%2026-04-30Fix
CVE-2026-33450Out-of-bounds read in Secure Access MacOS clients2.3CNA v4.00.3%2026-04-30Fix
CVE-2026-33449Absolute Software Secure Access message handler buffer overflow in clients2.3CNA v4.00.4%2026-04-30Fix
CVE-2026-33448Absolute Software Secure Access format string vulnerability in MacOS clients4.8CNA v4.00.1%2026-04-30Fix
CVE-2026-33447Absolute Software Secure Access message parsing function of the buffer overflow2.3CNA v4.00.4%2026-04-30Fix
CVE-2026-33446Absolute Software Secure Access buffer overflow in client authentication prior to2.3CNA v4.00.5%2026-04-30Fix
CVE-2026-32148Lockfile checksums not verified in Hex allows dependency integrity bypass8.9CNA v4.00.3%2026-04-30Fix
CVE-2026-31787Linux kernel Xen privcmd driver double free7.8v3.10.2%2026-04-30Fix
CVE-2026-31786Linux kernel Xen hypervisor build ID interface out-of-bounds write7.8CNA v3.10.2%2026-04-30Fix
CVE-2026-31693Linux kernel CIFS request replay vulnerability7.8CNA v3.10.2%2026-04-30Fix
CVE-2026-31692Linux kernel rtnetlink peer namespace check vulnerability5.5v3.10.1%2026-04-30Fix
CVE-2026-28909Apple macOS insufficiently protected credentials6.5CISA ADP v3.10.3%2026-04-30Fix
CVE-2026-28532FRRouting integer overflow in OSPF TLV parser functions6.0CNA v4.00.4%2026-04-30Fix
CVE-2026-22070ColorOS Assistant path traversal7.1CNA v3.10.2%2026-04-30Fix
CVE-2026-7551HKUDS OpenHarness remote command execution via /bridge Slash command8.7CNA v4.01.0%2026-04-30
CVE-2026-7510OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization5.3CNA v4.00.4%2026-04-30Fix
CVE-2026-7508Bootstrap CMS Page Creation show.blade.php code injection5.3CNA v4.00.4%2026-04-30
CVE-2026-7506SourceCodester Hotel Management System check SQL injection6.9CNA v4.00.4%2026-04-30
CVE-2026-7505nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization6.9CNA v4.00.5%2026-04-30Fix
CVE-2026-7503code-projects for Plugin cstecgi.cgi setWiFiMultipleConfig buffer overflow8.7CNA v4.00.8%2026-04-30
CVE-2026-7502LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization5.3CNA v4.00.4%2026-04-30
CVE-2026-7501LinkStackOrg LinkStack UserController.php editPage cross-site scripting5.1CNA v4.00.3%2026-04-30
CVE-2026-7500Keycloak has a forced browsing issue5.4CNA v3.10.3%2026-04-30Fix
CVE-2026-7470Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow8.7CNA v4.01.0%2026-04-30
CVE-2026-7469Tenda 4G300 DelFil sub_425A28 command injection5.3CNA v4.03.2%2026-04-30
CVE-2026-74681024-lab smart-admin Demo Site index.html access control6.9CNA v4.00.5%2026-04-30
CVE-2026-7461OS command injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials7.5CNA v4.00.8%2026-04-30Fix
CVE-2026-7447SourceCodester Pet Grooming Management Software update_customer.php SQL injection5.3CNA v4.00.3%2026-04-30
CVE-2026-7446VetCoders mcp-server-semgrep MCP index.ts create_rule os command injection6.9CNA v4.02.2%2026-04-30Fix
CVE-2026-7445ZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal5.3CNA v4.00.4%2026-04-30
CVE-2026-7435SSCMS SQL injection via stl:sqlContent queryString8.6CNA v4.00.8%2026-04-30
CVE-2026-7429SSCMS reflected cross-site scripting via STL Processing2.1CNA v4.00.3%2026-04-30
CVE-2026-7402Improper Rate Limiting in MeWare Software's PDKS8.1CNA v3.10.5%2026-04-30Fix
CVE-2026-7399IDOR in MeWare Software's PDKS8.1CNA v3.10.4%2026-04-30Fix
CVE-2026-7382Information disclosure in MeWare Software's PDKS6.5CNA v3.10.4%2026-04-30Fix
CVE-2026-7379Missing release of memory after effective lifetime in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-7378Heap-based buffer overflow in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-7376Null pointer dereference in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-7375Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-7270FreeBSD local privilege escalation via execve7.8CISA ADP v3.10.2%2026-04-30Exploit codeFix
CVE-2026-7246Pallets Click contains a command injection via Unsanitized Filename Click.edit7.2CISA ADP v3.10.9%2026-04-30Fix
CVE-2026-7164FreeBSD pf can overflow the stack parsing crafted SCTP packets7.5CISA ADP v3.10.5%2026-04-30Fix
CVE-2026-7163Red Hat multicluster engine for Kubernetes cleartext storage of sensitive information6.1CNA v3.10.2%2026-04-30Fix
CVE-2026-6870Access of uninitialized pointer in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6869Improperly controlled sequential memory allocation in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6868Stack-based buffer overflow in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-6867Improperly controlled sequential memory allocation in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6543IBM authenticated remote code execution vulnerability in Langflow Code Validation endpoint8.8CNA v3.10.7%2026-04-30Fix
CVE-2026-6542IBM Langflow monitor API insecure direct object reference6.5CNA v3.10.4%2026-04-30Fix
CVE-2026-6539Notepad++ format string injection via nativeLang.xml4.6CNA v4.00.2%2026-04-30Fix
CVE-2026-6538Stack-based buffer overflow in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6537Stack-based buffer overflow in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6536Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6535Improperly controlled sequential memory allocation in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6534Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6533Improperly controlled sequential memory allocation in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6532Buffer over-read in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6531Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6530Heap-based buffer overflow in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6529Heap-based buffer overflow in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6528Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6527Uncontrolled recursion in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6526Null pointer dereference in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6524Access of uninitialized pointer in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6523Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6522Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-6521Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-6520Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-6519Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-6498Rustaurius Five Star Restaurant Reservations payment verification vulnerability5.3CNA v3.10.2%2026-04-30Fix
CVE-2026-6389IBM Turbonomic prometurbo agent privilege escalation8.8CNA v3.10.1%2026-04-30Fix
CVE-2026-5657Double free in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-5656Improper limitation of a pathname to a restricted directory (path traversal) in Wireshark7.0CNA v3.10.2%2026-04-30Fix
CVE-2026-5655Wireshark SDP protocol dissector crash5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-5654Stack-based buffer overflow in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-5653Heap-based buffer overflow in Wireshark5.5CNA v3.10.3%2026-04-30Fix
CVE-2026-5409Uncontrolled recursion in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-5408Uncontrolled recursion in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-5407Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-5406Uncontrolled recursion in Wireshark5.5CNA v3.10.2%2026-04-30Fix
CVE-2026-5405Heap-based buffer overflow in Wireshark7.8CNA v3.10.2%2026-04-30Fix
CVE-2026-5403Heap-based buffer overflow in Wireshark7.8CNA v3.10.2%2026-04-30Fix
CVE-2026-5402Heap-based buffer overflow in Wireshark8.8CNA v3.10.7%2026-04-30Fix
CVE-2026-5401Uncontrolled recursion in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-5299Uncontrolled recursion in Wireshark5.5CNA v3.10.1%2026-04-30Fix
CVE-2026-5174Improper access control vulnerability in Progress MOVEit Automation7.7CNA v3.10.5%2026-04-30Fix
CVE-2026-5080Dancer::Session::Abstract versions for Perl generates session ids insecurely5.9CISA ADP v3.10.5%2026-04-30Fix
CVE-2026-4670Improper authentication vulnerability in Progress MOVEit Automation9.8CNA v3.10.6%2026-04-30Fix
CVE-2026-4503IBM Langflow Desktop image download endpoint insecure direct object reference7.5CNA v3.10.4%2026-04-30Fix
CVE-2026-4502IBM arbitrary file write and remote code execution vulnerability in Langflow v2 API6.5CNA v3.10.4%2026-04-30Fix
CVE-2026-3833GnuTLS: GnuTLS: Policy bypass due to case-sensitive nameconstraints comparison7.4NVD v3.10.9%2026-04-30Fix
CVE-2026-3832GnuTLS logic flaw3.7CNA v3.10.9%2026-04-30Fix
CVE-2026-3346IBM stored cross-site scripting (XSS) in Langflow Markdown Rendering via rehypeRaw6.4CNA v3.10.3%2026-04-30Fix
CVE-2026-3345IBM Langflow Desktop file upload API path traversal6.5CNA v3.10.6%2026-04-30Fix
CVE-2026-3340IBM server-side request forgery (SSRF) in Langflow URL component6.5CNA v3.10.3%2026-04-30Fix
CVE-2026-2892Otter Blocks WordPress plugin improper authorization to unauthenticated Purchase verification bypass7.5CNA v3.10.5%2026-04-30Fix
CVE-2026-2311IBM i is affected by a privilege escalation vulnerability in Web Administration GUI []6.4CNA v3.10.2%2026-04-30Fix
CVE-2026-1577IBM Db2 denial of service6.5CNA v3.10.3%2026-04-30Fix
CVE-2026-1493Cross-site scripting in LEX Baza Dokumentów5.4v3.10.2%2026-04-30Fix
CVE-2026-42652User Registration WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-04-29Fix
CVE-2026-42648Spectra WordPress plugin broken access control4.3CNA v3.10.3%2026-04-29Fix
CVE-2026-42646TaxoPress WordPress plugin SQL injection7.6CNA v3.10.4%2026-04-29Fix
CVE-2026-42645Barcode Scanner with Inventory and Order Manager WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-04-29Fix
CVE-2026-42644BetterDocs WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-04-29Fix
CVE-2026-42643Image Widget WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-04-29Fix
CVE-2026-42642GiveWP WordPress plugin broken access control5.3CNA v3.10.3%2026-04-29Fix
CVE-2026-42641Share This Image WordPress plugin server side request forgery (SSRF)5.4CNA v3.10.2%2026-04-29Fix
CVE-2026-42615CyberChef has a cross-site scripting issue7.2CNA v3.10.4%2026-04-29Fix
CVE-2026-42525Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect4.3CISA ADP v3.10.3%2026-04-29Fix
CVE-2026-42524Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file8.0CISA ADP v3.10.5%2026-04-29Fix
CVE-2026-42523Jenkins GitHub Plugin has an XSS9.0CISA ADP v3.10.5%2026-04-29Fix
CVE-2026-42522Jenkins GitHub Branch Source Plugin missing authorization4.3CISA ADP v3.10.3%2026-04-29Fix
CVE-2026-42521Jenkins Matrix Authorization Strategy Plugin deserialization of untrusted data6.5CISA ADP v3.10.4%2026-04-29Fix
CVE-2026-42520Jenkins Credentials Binding Plugin has a path traversal7.5CISA ADP v3.10.6%2026-04-29Fix
CVE-2026-42519Jenkins Script Security Plugin A missing authorization4.3CISA ADP v3.10.3%2026-04-29Fix
CVE-2026-42518Information disclosure vulnerability in e-Sushrut HMIS8.7CNA v4.00.3%2026-04-29
CVE-2026-42517CDAC-Noida e-Sushrut HMIS insecure direct object reference7.1CNA v4.00.4%2026-04-29
CVE-2026-42516Broken access control vulnerability in e-Sushrut HMIS7.1CNA v4.00.4%2026-04-29
CVE-2026-42515Insecure direct object reference (IDOR) vulnerability in e-Sushrut HMIS7.1CNA v4.00.4%2026-04-29
CVE-2026-42514Sensitive data exposure vulnerability in e-Sushrut HMIS8.8CNA v4.00.3%2026-04-29
CVE-2026-42513Authentication bypass vulnerability in e-Sushrut HMIS8.8CNA v4.00.8%2026-04-29
CVE-2026-42412WP User Frontend WordPress plugin broken access control6.5CNA v3.10.3%2026-04-29Fix
CVE-2026-42377SureForms Pro WordPress plugin broken access control7.3CNA v3.10.3%2026-04-29Fix
CVE-2026-42249Remote code execution in Ollama via Update Mechanism9.8v3.11.0%2026-04-29MetasploitExploit codeKCV
CVE-2026-42248Missing signature verification for Updates in Ollama9.8v3.10.7%2026-04-29MetasploitExploit codeKCV
CVE-2026-42198PostgreSQL JDBC Driver SCRAM authentication denial of service7.5CNA v3.14.1%2026-04-29Fix
CVE-2026-41952Acronis DeviceLock DLP write-what-where condition7.8CNA v3.00.2%2026-04-29Fix
CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) missing authentication for critical function9.3CNA v4.098.5%2026-04-29KEVNucleiMetasploitExploit codeFix
CVE-2026-41499Wazuh: Multiple Heap-based null write Buffer Underflows in parse_uname_string6.5CNA v3.10.4%2026-04-29Fix
CVE-2026-41220Acronis DeviceLock DLP out-of-bounds write7.8CNA v3.00.2%2026-04-29Fix
CVE-2026-40560Starman versions for Perl allows HTTP request smuggling via Improper Header Precedence7.5CISA ADP v3.10.5%2026-04-29Fix
CVE-2026-40230Helpy stored XSS in knowledgebase Doc body rendering5.4v3.10.3%2026-04-29
CVE-2026-40229Helpy stored XSS in post author display via PostsHelper5.4v3.10.3%2026-04-29
CVE-2026-38993Cockpit is vulnerable to directory traversal6.5CISA ADP v3.11.0%2026-04-29Fix
CVE-2026-38992Cockpit is vulnerable to arbitrary code execution9.8CISA ADP v3.10.7%2026-04-29Fix
CVE-2026-38991Cockpit vulnerable to unrestricted upload of file with dangerous type8.8CISA ADP v3.10.5%2026-04-29Fix
CVE-2026-37555libsndfile integer overflow7.5CISA ADP v3.10.5%2026-04-29Fix
CVE-2026-36841TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function.9.8CISA ADP v3.11.8%2026-04-29
CVE-2026-36837TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function.7.5CISA ADP v3.10.5%2026-04-29
CVE-2026-35155Dell iDRAC10 insufficiently protected credentials7.1CNA v3.10.3%2026-04-29Fix
CVE-2026-34965Cockpit CMS authenticated remote code execution via Collections8.7CNA v4.01.3%2026-04-29
CVE-2026-30893Wazuh cluster sync file extraction path traversal9.0CNA v3.10.6%2026-04-29Fix
CVE-2026-30769Entechtaiwan Tvicport improper privilege management7.8CISA ADP v3.10.1%2026-04-29
CVE-2026-28221Wazuh wazuh-remoted stack-based buffer overflow6.5CNA v3.10.6%2026-04-29Fix
CVE-2026-27105Dell/Alienware Purchased Apps link following6.3CNA v3.10.1%2026-04-29Fix
CVE-2026-26206Wazuh: API brute-force protection bypass via race condition in login attempt tracking6.5CNA v3.10.3%2026-04-29Fix
CVE-2026-26204Wazuh: Heap-based null write buffer underflow in GetAlertData4.4CNA v3.10.2%2026-04-29Fix
CVE-2026-26015Unauthenticated RCE in DocsGPT MCP STDIO Configuration10.0CNA v4.01.5%2026-04-29Fix
CVE-2026-25852Acronis DeviceLock DLP uncontrolled search path6.7CNA v3.00.1%2026-04-29Fix
CVE-2026-23773Dell Disk Library for mainframe DLm8700 server-side request forgery4.3CNA v3.10.2%2026-04-29Fix
CVE-2026-22745VMware Spring Framework denial of service in static resource handling on Windows platforms5.3CNA v3.10.3%2026-04-29Fix
CVE-2026-22741Static resource cache poisoning in Spring MVC and WebFlux3.1CNA v3.10.2%2026-04-29Fix
CVE-2026-22740Spring Framework DoS with Multipart Temp files in WebFlux6.5CNA v3.10.3%2026-04-29Fix
CVE-2026-21023Samsung Mobile Devices PackageManagerService insufficient verification of data authenticity6.9CNA v4.00.1%2026-04-29Fix
CVE-2026-7466AgentFlow arbitrary Python Pipeline Execution via pipeline_path7.7CNA v4.00.6%2026-04-29
CVE-2026-7443BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection6.9CNA v4.02.1%2026-04-29
CVE-2026-7439AgentFlow Local Web API Content-Type Validation Bypass4.8CNA v4.00.1%2026-04-29
CVE-2026-7426Amazon FreeRTOS-Plus-TCP IPv6 router advertisement processing out-of-bounds write6.1CNA v4.00.4%2026-04-29Fix
CVE-2026-7425Out-of-bounds read in Router Advertisement option parser in FreeRTOS-Plus-TCP6.0CNA v4.00.4%2026-04-29Fix
CVE-2026-7424Integer underflow in DHCPv6 Sub-Option parser in FreeRTOS-Plus-TCP7.2CNA v4.00.4%2026-04-29Fix
CVE-2026-7423Integer underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP6.0CNA v4.00.4%2026-04-29Fix
CVE-2026-7422MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing7.1CNA v4.00.3%2026-04-29Fix
CVE-2026-7420UTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow8.7CNA v4.00.8%2026-04-29
CVE-2026-7419UTT HiPER 1250GW formTaskEdit_ap strcpy buffer overflow8.7CNA v4.00.8%2026-04-29
CVE-2026-7418UTT HiPER 1250GW NTP strcpy buffer overflow8.7CNA v4.00.8%2026-04-29
CVE-2026-7417Algovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery6.9CNA v4.00.5%2026-04-29
CVE-2026-7416PolarVista xcode-mcp-server MCP index.ts run_tests os command injection6.9CNA v4.02.1%2026-04-29
CVE-2026-7410SourceCodester Pizzafy Ecommerce System ajax.php add_to_cart SQL injection5.3CNA v4.00.3%2026-04-29
CVE-2026-7409SourceCodester Pizzafy Ecommerce System ajax.php save_user SQL injection5.1CNA v4.00.3%2026-04-29
CVE-2026-7408SourceCodester Pizzafy Ecommerce System ajax.php save_menu SQL injection5.1CNA v4.00.3%2026-04-29
CVE-2026-7407SourceCodester Pizzafy Ecommerce System setting ajax.php save_settings SQL injection5.1CNA v4.00.3%2026-04-29
CVE-2026-7404getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal6.9CNA v4.00.6%2026-04-29
CVE-2026-7403geldata gel-mcp server.py fetch_rule path traversal6.9CNA v4.00.6%2026-04-29
CVE-2026-7401SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site scripting5.3CNA v4.00.4%2026-04-29
CVE-2026-7400geekgod382 filesystem-mcp-server read/write file tools path traversal6.9CNA v4.00.6%2026-04-29Fix
CVE-2026-7398florensiawidjaja BioinfoMCP upload endpoint app.py upload path traversal6.9CNA v4.00.6%2026-04-29
CVE-2026-7397NousResearch hermes-agent file_tools.py _check_sensitive_path symlink4.8CNA v4.00.2%2026-04-29Fix
CVE-2026-7396NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal6.9CNA v4.00.7%2026-04-29
CVE-2026-7394SourceCodester Pizzafy Ecommerce System GET parameter view_order.php SQL injection5.1CNA v4.00.3%2026-04-29
CVE-2026-7393SourceCodester Pizzafy Ecommerce System file extension handler unrestricted file upload5.1CNA v4.00.4%2026-04-29
CVE-2026-7392SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier SQL injection5.3CNA v4.00.3%2026-04-29Exploit code
CVE-2026-7391SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier SQL injection5.3CNA v4.00.3%2026-04-29
CVE-2026-7390SourceCodester Pharmacy Sales and Inventory System customer page cross-site scripting5.1CNA v4.00.3%2026-04-29
CVE-2026-7389EyouCMS common.php GetSortData SQL injection6.9CNA v4.00.4%2026-04-29
CVE-2026-7388EyouCMS template File FilemanagerLogic.php editFile code injection5.1CNA v4.00.4%2026-04-29
CVE-2026-7386fatbobman mail-mcp-bridge mail_mcp_server.py path traversal6.9CNA v4.00.6%2026-04-29Fix
CVE-2026-7384ezequiroga mcp-bases research_server.py search_papers path traversal6.9CNA v4.00.6%2026-04-29
CVE-2026-7381Plack::Middleware::XSendfile versions for Perl can allow client-controlled path rewriting9.1CISA ADP v3.10.5%2026-04-29Fix
CVE-2026-7111HMBRAND Text::CSV_XS use-after-free8.4CISA ADP v3.10.2%2026-04-29Fix
CVE-2026-6915MongoDB Server Flaw in the updateUser command may allow Unauthorized Configuration Change5.3CNA v4.00.3%2026-04-29Fix
CVE-2026-6914MongoDB Server MD5 checksum creation may cause availability loss7.1CNA v4.00.4%2026-04-29Fix
CVE-2026-6849OS command injection in TUBITAK BILGEM's Pardus OS My Computer8.8CNA v3.11.4%2026-04-29Fix
CVE-2026-5712IdentityIQ Role Editor incorrect authorization8.0CNA v3.10.3%2026-04-29Fix
CVE-2026-5166Path traversal in TUBITAK BILGEM's Pardus Software Center9.6CNA v3.10.5%2026-04-29Fix
CVE-2026-5161Improper authentication in TUBITAK BILGEM's Pardus About8.8CNA v3.10.5%2026-04-29Fix
CVE-2026-5141Improper access control in TUBITAK BILGEM's Pardus Software Center8.8CNA v3.10.4%2026-04-29Fix
CVE-2026-5140Authorization bypass in TUBITAK BILGEM's Pardus Update8.8CNA v3.10.6%2026-04-29Fix
CVE-2026-4019Complianz WordPress plugin unauthorized data access5.3CNA v3.10.4%2026-04-29Fix
CVE-2026-3325SQL injection in MegaCMS by CRM Sistemas de Fidelización10.0CNA v4.00.5%2026-04-29Fix
CVE-2026-2902WP Meteor Website Speed Optimization Addon WordPress plugin stored cross-site scripting6.1CNA v3.10.4%2026-04-29Fix
CVE-2026-2810Netskope Client endpoint DLP driver out-of-bounds read6.8CNA v4.00.2%2026-04-29Fix
CVE-2026-1858wget2 improper certificate validation4.8CNA v3.10.2%2026-04-29
CVE-2026-0206SonicWall SonicOS post-authentication stack-based buffer overflow4.9CISA ADP v3.10.5%2026-04-29Fix
CVE-2026-0205SonicWall SonicOS post-authentication path traversal6.8CISA ADP v3.10.4%2026-04-29Fix
CVE-2026-0204SonicWall SonicOS missing authentication8.0CISA ADP v3.10.4%2026-04-29Fix
CVE-2026-42510OpenStack Ironic is vulnerable to inclusion of functionality from untrusted control sphere7.2v3.10.6%2026-04-28Fix
CVE-2026-42432OpenClaw Command Escalation via Node Pairing Reconnect Bypass7.3CNA v4.00.2%2026-04-28Fix
CVE-2026-42431OpenClaw Persistent Profile Mutation via node.invoke(browser.proxy) Bypass7.6CNA v4.00.5%2026-04-28Fix
CVE-2026-42430OpenClaw Strict Browser SSRF Bypass via Playwright Redirect Handling4.8CNA v4.00.3%2026-04-28Fix
CVE-2026-42429OpenClaw privilege escalation via Gateway Plugin HTTP Authentication6.0CNA v4.00.4%2026-04-28Fix
CVE-2026-42428OpenClaw Missing Integrity Verification in Package Downloads7.5CNA v4.00.2%2026-04-28Fix
CVE-2026-42427OpenClaw remote code execution via Build Tool Environment variable injection5.8CNA v4.00.3%2026-04-28Fix
CVE-2026-42426OpenClaw improper authorization in node.pair.approve via operator.write Scope8.7CNA v4.00.5%2026-04-28Fix
CVE-2026-42424OpenClaw Local File Exfiltration via Shared Reply MEDIA Paths5.0v3.10.3%2026-04-28Fix
CVE-2026-42423OpenClaw strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback7.7CNA v4.00.6%2026-04-28Fix
CVE-2026-42422OpenClaw Role Bypass in device.token.rotate function7.7CNA v4.00.5%2026-04-28Fix
CVE-2026-42421OpenClaw WebSocket Session Persistence via Shared Gateway Token Rotation2.3CNA v4.00.3%2026-04-28Fix
CVE-2026-42420OpenClaw Improper Base64 Decoding Size Validation6.5v3.10.5%2026-04-28Fix
CVE-2026-42167ProFTPD SQL injection8.1CNA v3.17.3%2026-04-28Reported exploitedNucleiEmerging ThreatsExploit codeFix
CVE-2026-41916OpenClaw Stale Authentication State via Config Reload2.3CNA v4.00.4%2026-04-28Fix
CVE-2026-41915OpenClaw Git Environment variable injection via Unfiltered Exec Environment6.1v3.10.2%2026-04-28Fix
CVE-2026-41914OpenClaw server-side request forgery in QQ Bot Media Fetch Paths5.1CNA v4.00.4%2026-04-28Fix
CVE-2026-41913OpenClaw Rate-Limit Bypass via Concurrent Async Authentication Attempts6.3CNA v4.00.3%2026-04-28Fix
CVE-2026-41912OpenClaw server-side request forgery Policy Bypass via Interaction-Triggered Navigation4.8CNA v4.00.4%2026-04-28Fix
CVE-2026-41911OpenClaw Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image6.0CNA v4.00.5%2026-04-28Fix
CVE-2026-41910OpenClaw Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes2.3CNA v4.00.4%2026-04-28Fix
CVE-2026-41873Pony Mail: Admin account takeover via request smuggling9.8v3.10.4%2026-04-28Fix
CVE-2026-41649Outline document share creation insecure direct object reference7.7CNA v3.10.4%2026-04-28Fix
CVE-2026-41636Apache Thrift: Node.js skip recursion8.7CNA v4.00.7%2026-04-28Fix
CVE-2026-41607Apache Thrift: C++ JSON OOB read6.5CISA ADP v3.10.9%2026-04-28Fix
CVE-2026-41606Apache Thrift: C_glib dispatch stack overflow5.3CISA ADP v3.11.1%2026-04-28Fix
CVE-2026-41605Apache Thrift: Swift Compact protocol integer overflow7.3CISA ADP v3.11.3%2026-04-28Fix
CVE-2026-41604Apache Thrift: Swift Range crash in skip8.2CISA ADP v3.11.2%2026-04-28Fix
CVE-2026-41602Apache Thrift: Go TFramedTransport uint32 overflow7.5CISA ADP v3.11.4%2026-04-28Fix
CVE-2026-41526KDE KCoreAddons escape sequence injection7.8v3.10.2%2026-04-28Fix
CVE-2026-41525KDE Dolphin incorrect resource transfer6.5CNA v3.10.2%2026-04-28Fix
CVE-2026-41446WattBox 800 and 820 Series RCE via Diagnostic endpoints9.2CNA v4.00.8%2026-04-28Fix
CVE-2026-41408OpenClaw Disk Exhaustion via Media Download Bypass6.5v3.10.6%2026-04-28Fix
CVE-2026-41407OpenClaw timing side channel in Shared-Secret Comparison5.3v3.10.4%2026-04-28Fix
CVE-2026-41406OpenClaw Sender Allowlist Bypass via Thread History and Quoted messages2.3CNA v4.00.4%2026-04-28Fix
CVE-2026-41405OpenClaw resource exhaustion via Unauthenticated MS Teams Webhook Body Parsing8.7CNA v4.00.9%2026-04-28Fix
CVE-2026-41404OpenClaw Operator Admin privilege escalation via Trusted-Proxy Authentication7.7CNA v4.00.6%2026-04-28Fix
CVE-2026-41403OpenClaw Access Control Bypass via Proxied Remote Request Misclassification4.0v3.10.4%2026-04-28Fix
CVE-2026-41402OpenClaw Webhook Replay Cache Cross-Target messageId Scope Bypass5.4v3.10.4%2026-04-28Fix
CVE-2026-41400OpenClaw resource consumption via Oversized WebSocket Frames in voice-call7.5v3.10.8%2026-04-28Fix
CVE-2026-41399OpenClaw denial of service via Unbounded Pre-auth WebSocket Upgrades8.7CNA v4.00.6%2026-04-28Fix
CVE-2026-41398OpenClaw Unauthorized agent Request Dispatch via Untrusted Local-Network pages in iOS A2UI Bridge2.1CNA v4.00.2%2026-04-28Fix
CVE-2026-41397OpenClaw sandbox escape via Unrestricted File Sync and Symlink Traversal9.6v3.10.6%2026-04-28Fix
CVE-2026-41396OpenClaw Environment Variable Override of Plugin Trust Root7.8v3.10.2%2026-04-28Fix
CVE-2026-41395OpenClaw Webhook Replay via Query Parameter Reordering in Plivo V38.2CNA v4.00.3%2026-04-28Fix
CVE-2026-41394OpenClaw Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes8.8CNA v4.00.5%2026-04-28Fix
CVE-2026-41393OpenClaw arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery4.8v3.10.2%2026-04-28Fix
CVE-2026-41392OpenClaw Exec Allowlist Bypass via Shell Init-File options7.3v3.10.2%2026-04-28Fix
CVE-2026-41391OpenClaw Environment Variable Bypass in Package Index URL Handling6.1v3.10.2%2026-04-28Fix
CVE-2026-41390OpenClaw Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper7.0CNA v4.00.2%2026-04-28Fix
CVE-2026-41388OpenClaw Configuration Rehydration via Empty-Array Revocation Handling6.3CNA v4.00.4%2026-04-28Fix
CVE-2026-41387OpenClaw Supply Chain Redirection via Incomplete Host Environment Sanitization8.5CNA v4.00.4%2026-04-28Fix
CVE-2026-41386OpenClaw privilege escalation via Unbound Bootstrap Setup Codes9.8v3.10.6%2026-04-28Fix
CVE-2026-41385OpenClaw Nostr Private key exposure via config.get Redaction Bypass7.1CNA v4.00.3%2026-04-28Fix
CVE-2026-41384OpenClaw Environment variable injection via Workspace Config in CLI Backend8.5CNA v4.00.2%2026-04-28Fix
CVE-2026-41383OpenClaw arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths6.1CNA v4.00.6%2026-04-28Fix
CVE-2026-41382OpenClaw Discord Voice Ingress authorization bypass via Channel and Role Validation Gaps2.3CNA v4.00.3%2026-04-28Fix
CVE-2026-41381OpenClaw Access Control Bypass in Discord Voice Manager via Channel Allowlist2.3CNA v4.00.3%2026-04-28Fix
CVE-2026-41380OpenClaw arbitrary Execution Allowlist via Wrapper Carrier Executables7.0CNA v4.00.2%2026-04-28Fix
CVE-2026-41379OpenClaw privilege escalation via chat.send to Admin-Class Talk Voice Config7.1CNA v4.00.3%2026-04-28Fix
CVE-2026-41378OpenClaw privilege escalation to remote code execution via Unrestricted node.event Agent Dispatch7.7CNA v4.00.8%2026-04-28Fix
CVE-2026-41377OpenClaw Fail-Open Security Scan Bypass in Plugin Installation5.1CNA v4.00.3%2026-04-28Fix
CVE-2026-41376OpenClaw Matrix Thread Context Allowlist Bypass via Sender Validation6.5v3.10.3%2026-04-28Fix
CVE-2026-41375OpenClaw authorization bypass in /phone arm and /phone disarm endpoints7.1CNA v4.00.5%2026-04-28Fix
CVE-2026-41374OpenClaw resource consumption via Discord Audio Preflight before Member Authorization6.9CNA v4.00.7%2026-04-28Fix
CVE-2026-41373OpenClaw Compiler Binary Substitution via Environment Variable Override in Host Execution Policy5.8CNA v4.00.2%2026-04-28Fix
CVE-2026-41372OpenClaw Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery6.9CNA v4.00.4%2026-04-28Fix
CVE-2026-41371OpenClaw privilege escalation via chat.send Reset command8.4CNA v4.00.4%2026-04-28Fix
CVE-2026-41370OpenClaw path traversal via Inbound Channel Attachment Path in ACP Dispatch7.1CNA v4.00.6%2026-04-28Fix
CVE-2026-41369OpenClaw Insufficient Environment Variable Sanitization in Host Execution7.1CNA v4.00.5%2026-04-28Fix
CVE-2026-41368OpenClaw Environment Variable Disclosure via jq $ENV Filter Bypass7.1CNA v4.00.4%2026-04-28Fix
CVE-2026-41367OpenClaw Policy Enforcement Bypass in Discord Component Interactions5.3CNA v4.00.3%2026-04-28Fix
CVE-2026-41366OpenClaw arbitrary host File Read via appendLocalMediaParentRoots Self-Whitelisting6.0CNA v4.00.3%2026-04-28Fix
CVE-2026-41365OpenClaw Sender Allowlist Bypass via Graph API Thread History5.3CNA v4.00.3%2026-04-28Fix
CVE-2026-41364OpenClaw arbitrary file write via symlink following in SSH Sandbox Tar upload7.2CNA v4.00.7%2026-04-28Fix
CVE-2026-41363OpenClaw arbitrary file read via Feishu upload_image parameter6.5v3.10.5%2026-04-28Fix
CVE-2026-41362OpenClaw Webhook Replay Dedupe Cache Event Suppression via Shared Authentication2.3CNA v4.00.5%2026-04-28Fix
CVE-2026-40980Spring AI vulnerable to OOM by attacker-controlled PDF6.5CNA v3.10.4%2026-04-28Fix
CVE-2026-40979Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory6.1CNA v3.10.2%2026-04-28Fix
CVE-2026-40978Spring AI has SQL injection in CosmosDBVectorStore.doDelete8.8CNA v3.10.4%2026-04-28Fix
CVE-2026-40977Spring Boot's PID file write follows symlinks at predictable default path4.7CNA v3.10.2%2026-04-28Fix
CVE-2026-40974Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification5.0CNA v3.10.4%2026-04-28Fix
CVE-2026-40973Spring Boot accepts predictable temp directory without ownership verification7.0CNA v3.10.1%2026-04-28Fix
CVE-2026-40972Spring Boot DevTools remote secret comparison is vulnerable to timing attacks7.5CNA v3.10.3%2026-04-28Fix
CVE-2026-40969Spring gRPC AuthenticationException message reflected to remote client3.7CNA v3.10.3%2026-04-28Fix
CVE-2026-40968Spring gRPC SecurityContext leaks across requests on authorization failure4.3CNA v3.10.3%2026-04-28Fix
CVE-2026-40967Spring AI has a VectorStore FilterExpression Converter injection8.6CNA v3.10.4%2026-04-28Fix
CVE-2026-40966VMware Spring AI VectorStoreChatMemoryAdvisor conversation memory improper access control5.9CNA v3.10.4%2026-04-28Fix
CVE-2026-40552Remote code execution in multiple BinSoft products4.7CNA v4.00.5%2026-04-28
CVE-2026-40551BinSoft mpGabinet client-side authentication8.4CNA v4.00.2%2026-04-28KCV
CVE-2026-40550Privilege escalation in multiple BinSoft products6.9CNA v4.00.2%2026-04-28KCV
CVE-2026-40356MIT Kerberos 5 integer underflow7.5v3.10.6%2026-04-28Fix
CVE-2026-40355MIT Kerberos 5 null pointer dereference7.5NVD v3.10.8%2026-04-28Fix
CVE-2026-38949HTMLy version cross-site scripting8.9CISA ADP v3.10.4%2026-04-28
CVE-2026-38948FUEL CMS v1.5.2 and cross-site scripting5.4CISA ADP v3.10.3%2026-04-28
CVE-2026-38651Netmaker does not verify JWT signatures for host tokens8.2CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-37750School Management System by mahmoudai1 reflected cross-site scripting6.1CISA ADP v3.10.4%2026-04-28Exploit code
CVE-2026-33467Elastic Package Registry has improper verification of cryptographic signature5.9CNA v3.10.2%2026-04-28Fix
CVE-2026-32649Milesight Cameras OS command injection7.3CNA v4.01.5%2026-04-28Fix
CVE-2026-32644Milesight Cameras use of hard-coded cryptographic key9.2CNA v4.00.4%2026-04-28Fix
CVE-2026-27785Milesight Cameras use of hard-coded credentials7.7CNA v4.00.3%2026-04-28Fix
CVE-2026-27760OpenCATS PHP code injection via installer AJAX endpoint9.2CNA v4.03.4%2026-04-28NucleiMetasploitEmerging ThreatsExploit code
CVE-2026-24231NVIDIA NemoClaw server-side request forgery6.3CNA v3.10.1%2026-04-28Fix
CVE-2026-24222NVIDIA NemoClaw system information disclosure8.6CNA v3.10.4%2026-04-28Fix
CVE-2026-24204NVIDIA FLARE SDK improper input validation6.5CNA v3.10.4%2026-04-28Fix
CVE-2026-24186NVIDIA FLARE SDK deserialization of untrusted data8.8CNA v3.10.5%2026-04-28Fix
CVE-2026-24178NVIDIA NVFlare Dashboard: Authorization bypass9.8CNA v3.10.6%2026-04-28Fix
CVE-2026-20766Milesight Cameras heap-based buffer overflow8.6CNA v4.00.3%2026-04-28Fix
CVE-2026-7363Google Chrome Canvas use-after-free8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7361Google Chrome iOS use-after-free8.8CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7360Google Chrome improper input validation3.1CISA ADP v3.10.2%2026-04-28Fix
CVE-2026-7359Google Chrome ANGLE use-after-free8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7358Google Chrome Animation use-after-free8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7357Google Chrome GPU use-after-free7.5CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7356Google Chrome Navigation use-after-free8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7355Google Chrome Media use-after-free8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7354Google Chrome Angle out-of-bounds read8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7353Google Chrome Skia heap-based buffer overflow8.3CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7352Google Chrome Media use-after-free8.3CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7351Google Chrome race condition3.1CISA ADP v3.10.1%2026-04-28Fix
CVE-2026-7350Google Chrome WebMIDI use-after-free8.3CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7349Google Chrome Cast use-after-free7.5CISA ADP v3.10.2%2026-04-28Fix
CVE-2026-7348Google Chrome Codecs use-after-free8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7347Google Chrome Chromoting use-after-free8.1CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7346Google Chrome Tint inappropriate implementation8.1CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7345Google Chrome sandbox escape8.3CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7344Google Chrome Accessibility use-after-free8.8CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7343Google Chrome Views use-after-free7.5CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7342Google Chrome WebView use-after-free8.8CISA ADP v3.10.5%2026-04-28Fix
CVE-2026-7341Google Chrome WebRTC use-after-free8.8CISA ADP v3.10.5%2026-04-28Fix
CVE-2026-7340Google Chrome ANGLE integer overflow4.3CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7339Google Chrome WebRTC heap-based buffer overflow8.8CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7338Google Chrome Cast use-after-free7.5CISA ADP v3.10.2%2026-04-28Fix
CVE-2026-7337Google Chrome V8 type confusion8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7336Google Chrome WebRTC use-after-free8.8CISA ADP v3.10.5%2026-04-28Fix
CVE-2026-7335Google Chrome media use-after-free8.8CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7334Google Chrome Views use-after-free8.8CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7333Google Chrome GPU use-after-free9.6CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-7324Memory safety bugs fixed in Thunderbird7.3CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7323Memory safety bugs fixed in Thunderbird ESR and Thunderbird7.3CISA ADP v3.10.5%2026-04-28Fix
CVE-2026-7322Memory safety bugs fixed in Thunderbird ESR and Thunderbird7.3CISA ADP v3.10.5%2026-04-28Fix
CVE-2026-7321Mozilla Firefox and Thunderbird WebRTC networking buffer overflow9.6CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-7320Mozilla Firefox and Thunderbird Audio/Video component out-of-bounds read7.5CISA ADP v3.10.6%2026-04-28Fix
CVE-2026-7319elinsky execution-system-mcp add_action tool server.py _get_context_file_path path traversal6.9CNA v4.00.8%2026-04-28
CVE-2026-7318elie mcp-project research_server.py search_papers path traversal5.1CNA v4.00.2%2026-04-28
CVE-2026-7317Grav CMS Cache Value FileCache.php doGet deserialization2.3CNA v4.00.4%2026-04-28Fix
CVE-2026-7316eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection6.9CNA v4.02.1%2026-04-28
CVE-2026-7315eiceblue spire-pdf-mcp-server PDF file server.py get_pdf_path path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7314eiceblue spire-doc-mcp-server base.py get_doc_path path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7309Openshift-controller-manager: Openshift Container Platform: Information disclosure4.3CNA v3.10.3%2026-04-28
CVE-2026-7306Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key6.3CNA v4.00.4%2026-04-28
CVE-2026-7305Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery5.3CNA v4.00.4%2026-04-28
CVE-2026-7303Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection6.3CNA v4.00.7%2026-04-28Fix
CVE-2026-7297SourceCodester Pizzafy Ecommerce System ajax.php save_user cross-site scripting4.8CNA v4.00.4%2026-04-28
CVE-2026-7296SourceCodester Pizzafy Ecommerce System ajax.php save_order cross-site scripting4.8CNA v4.00.4%2026-04-28
CVE-2026-7295SourceCodester Pizzafy Ecommerce System ajax.php save_menu cross-site scripting4.8CNA v4.00.4%2026-04-28
CVE-2026-7294SourceCodester Pizzafy Ecommerce System index.php save_settings cross-site scripting4.8CNA v4.00.4%2026-04-28
CVE-2026-7293SourceCodester Pizzafy Ecommerce System ajax.php delete_category SQL injection5.1CNA v4.00.3%2026-04-28
CVE-2026-7292O2OA NodeAgent NodeAgent.java syncFile improper authorization6.3CNA v4.00.4%2026-04-28
CVE-2026-7291O2OA URL Fetching FileAction.java FileAction server-side request forgery5.3CNA v4.00.3%2026-04-28
CVE-2026-7290JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-7289D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow8.7CNA v4.01.2%2026-04-28
CVE-2026-7288D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow8.7CNA v4.01.2%2026-04-28
CVE-2026-7283SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired SQL injection5.1CNA v4.00.3%2026-04-28
CVE-2026-7282SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired SQL injection5.1CNA v4.00.3%2026-04-28
CVE-2026-7281SourceCodester Pharmacy Sales and Inventory System index.php supplier cross-site scripting4.8CNA v4.00.4%2026-04-28
CVE-2026-7280eMPIA Technology|AVACAST unquoted service path8.4CNA v4.00.2%2026-04-28Fix
CVE-2026-7279eMPIA Technology|AVACAST DLL hijacking8.5CNA v4.00.2%2026-04-28Fix
CVE-2026-7272WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7271DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal6.9CNA v4.00.7%2026-04-28
CVE-2026-7269SourceCodester Pharmacy Sales and Inventory System index.php cross-site scripting4.8CNA v4.00.4%2026-04-28
CVE-2026-7268SourceCodester Pizzafy Ecommerce System ajax.php save_category SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-7267SourceCodester Pizzafy Ecommerce System view_prod.php SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-7266SourceCodester Pizzafy Ecommerce System ajax.php save_order SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-7265SourceCodester Pizzafy Ecommerce System index.php category SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-7264SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-7248D-Link DI-8100 CGI endpoint tgfile.htm tgfile_htm buffer overflow9.4v3.13.8%2026-04-28
CVE-2026-7247D-Link DI-8100 file extension file_exten.asp file_exten_asp buffer overflow8.6CNA v4.01.2%2026-04-28
CVE-2026-7244Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7243Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7242Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7241Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7240Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7238code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload5.1CNA v4.00.4%2026-04-28
CVE-2026-7237AgiFlow scaffold-mcp write-to-file tool index.ts path traversal6.9CNA v4.00.6%2026-04-28Fix
CVE-2026-7235ErlichLiu claude-agent-sdk-master route.ts path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7234BrowserOperator browser-operator-core server.js startsWith path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7233Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds6.1v3.10.2%2026-04-28
CVE-2026-7230SourceCodester Safety Anger Pad cross-site scripting5.3CNA v4.00.4%2026-04-28
CVE-2026-7229code-projects Coaching Management System POST reply.php SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-7228SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count SQL injection6.9CNA v4.00.4%2026-04-28
CVE-2026-7227SourceCodester Pizzafy Ecommerce System ajax.php login SQL injection6.9CNA v4.00.4%2026-04-28
CVE-2026-7226SourceCodester Pizzafy Ecommerce System ajax.php login2 SQL injection6.9CNA v4.00.4%2026-04-28
CVE-2026-7225SourceCodester Pizzafy Ecommerce System ajax.php delete_menu SQL injection6.9CNA v4.00.4%2026-04-28
CVE-2026-7224SourceCodester Pizzafy Ecommerce System ajax.php delete_cart SQL injection6.9CNA v4.00.4%2026-04-28
CVE-2026-7223BigSweetPotatoStudio HyperChat has a server-side request forgery issue6.9CNA v4.00.5%2026-04-28
CVE-2026-7222code-projects Coaching Management System Complaint form complaint.php cross-site scripting5.1CNA v4.00.3%2026-04-28
CVE-2026-7221TencentCloudBase CloudBase-MCP open-url API endpoint server-side request forgery6.9CNA v4.00.5%2026-04-28Fix
CVE-2026-7220jackwrichards FastlyMCP fastly_cli tool fastly-mcp.mjs os command injection6.9CNA v4.02.1%2026-04-28
CVE-2026-7219Totolink N300RT formIpQoS buffer overflow8.6CNA v4.00.8%2026-04-28
CVE-2026-7218Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow8.6CNA v4.00.8%2026-04-28
CVE-2026-7217Deepractice PromptX Document file index.ts read_pdf absolute path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7216donchelo processing-claude-mcp-bridge create_sketch tool processing_server.py path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7215egtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection6.9CNA v4.02.1%2026-04-28
CVE-2026-7214eghuzefa engineer-your-data server.py file_inf path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7213ef10007 MLOps_MCP save_file tool fastmcp_server.py path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7212edvardlindelof notes-mcp notes_mcp.py path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7211dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection6.9CNA v4.02.1%2026-04-28
CVE-2026-7206dubydu sqlite-mcp entry.py extract_to_json SQL injection6.9CNA v4.00.4%2026-04-28
CVE-2026-7205duartium papers-mcp-server main.py search_papers path traversal6.9CNA v4.00.6%2026-04-28
CVE-2026-7204Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7203Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7202Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection9.3CNA v4.03.3%2026-04-28
CVE-2026-7200SourceCodester Pharmacy Sales and Inventory System index.php cross-site scripting5.3CNA v4.00.4%2026-04-28
CVE-2026-7199SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-28
CVE-2026-7196CodeAstro Online Classroom guestdetails SQL injection5.3CNA v4.00.3%2026-04-28
CVE-2026-6809Social Post Embed WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-28Fix
CVE-2026-6807NSA GRASSMARLIN improper restriction of XML external entity reference5.5CNA v3.10.1%2026-04-28Exploit code
CVE-2026-6725WPC Smart Messages for WooCommerce WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-28Fix
CVE-2026-6706Devolutions Server vault documentation feature improper access control6.5CISA ADP v3.10.3%2026-04-28Fix
CVE-2026-6551Timeline Blocks for Gutenberg WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-28Fix
CVE-2026-6238The GNU C Library glibc buffer overread in ns_printrrf with corrupted RDATA field6.5CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-5944Cisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access6.7CNA v4.00.9%2026-04-28Fix
CVE-2026-5794Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout4.9CNA v4.00.4%2026-04-28Fix
CVE-2026-5781MphRx Minerva user update endpoint privilege escalation8.8v3.10.4%2026-04-28
CVE-2026-5780MphRx Minerva MphRx's insecure direct object reference8.1v3.10.4%2026-04-28
CVE-2026-5779MphRx Minerva MphRx's insecure direct object reference8.8NVD v3.10.5%2026-04-28
CVE-2026-5435The GNU C Library glibc potential buffer overflow in ns_sprintrrf TSIG handling path7.3CISA ADP v3.10.4%2026-04-28Fix
CVE-2026-5306The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled5.4CISA ADP v3.10.2%2026-04-28Fix
CVE-2026-4911Booking Package WordPress plugin unauthenticated Price manipulation via amount parameter5.3CNA v3.10.5%2026-04-28Fix
CVE-2026-4805Woostify WordPress theme stored cross-site scripting6.4CNA v3.10.3%2026-04-28Fix
CVE-2026-3893Carlson Software VASCO-B GNSS Receiver missing authentication for critical function9.4CNA v3.10.7%2026-04-28Fix
CVE-2026-3323VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices7.5CNA v3.10.5%2026-04-28Fix
CVE-2026-1460Zyxel EX3301-T0 firmware command injection7.2CNA v3.11.2%2026-04-28Fix
CVE-2026-0711Zyxel DX3300-T0 firmware EasyMesh-related APIs command injection6.8CNA v3.10.8%2026-04-28Fix
CVE-2026-42410TheGem theme Elements (for Elementor) WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-04-27Fix
CVE-2026-42379Templately WordPress plugin sensitive data exposure7.7CNA v3.10.4%2026-04-27Fix
CVE-2026-42371uriparser numeric truncation5.1v3.10.2%2026-04-27Fix
CVE-2026-42363GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability9.3CNA v3.10.3%2026-04-27Fix
CVE-2026-41635Apache Mina vulnerable to deserialization of untrusted data9.8CNA v3.10.8%2026-04-27Fix
CVE-2026-41467ProjeQtor stored XSS via checkValidFileName5.1CNA v4.00.3%2026-04-27
CVE-2026-41466ProjeQtor stored XSS via checkValidHtmlText5.1CNA v4.00.3%2026-04-27
CVE-2026-41465ProjeQtor path traversal via dynamicDialog.php7.1CNA v4.00.8%2026-04-27
CVE-2026-41464ProjeQtor missing authorization via objectDetail.php7.1CNA v4.00.5%2026-04-27
CVE-2026-41463ProjeQtor ZipSlip path traversal via uploadPlugin.php8.7CNA v4.01.6%2026-04-27
CVE-2026-41462ProjeQtor unauthenticated SQL injection via Login9.3CNA v4.00.7%2026-04-27Exploit code
CVE-2026-41409Apache Mina: Deserialization of untrusted data9.8CNA v3.10.8%2026-04-27Fix
CVE-2026-41081Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure6.5CISA ADP v3.10.4%2026-04-27Fix
CVE-2026-40976Spring Boot missing authorization9.1CNA v3.10.5%2026-04-27Fix
CVE-2026-40975Spring Boot's random value property source uses a weak PRNG unsuitable for secrets4.8CNA v3.10.4%2026-04-27Fix
CVE-2026-40971Spring Boot improper certificate validation5.0CNA v3.10.3%2026-04-27Fix
CVE-2026-40970Spring Boot improper certificate validation5.0CNA v3.10.2%2026-04-27Fix
CVE-2026-40860Apache Camel JMS ObjectMessage binding deserialization of untrusted data9.8CISA ADP v3.11.5%2026-04-27Exploit codeFix
CVE-2026-40858Apache Camel: Camel-Infinispan: Unsafe deserialization in Remote Aggregation Repository8.8CISA ADP v3.11.2%2026-04-27Exploit codeFix
CVE-2026-40557Apache Storm Prometheus Reporter vulnerable to improper certificate validation4.8CISA ADP v3.10.3%2026-04-27Fix
CVE-2026-40514SmarterTools SmarterMail file and email sharing tokens weak random number generator9.1v3.10.3%2026-04-27Fix
CVE-2026-40473Apache Camel Mina: Unsafe deserialization in MinaConverter.toObjectInput via TCP/UDP8.8CISA ADP v3.11.1%2026-04-27Exploit codeFix
CVE-2026-40453Apache Camel JMS, CoAP and Google Pub/Sub header filters header injection9.9CISA ADP v3.11.9%2026-04-27Exploit codeFix
CVE-2026-40048Apache Camel PQC: Unsafe deserialization from FileBasedKeyLifecycleManager7.8CISA ADP v3.10.5%2026-04-27Exploit codeFix
CVE-2026-40022Apache Camel vulnerable to authentication bypass using an alternate path or channel8.2CISA ADP v3.11.0%2026-04-27Exploit codeFix
CVE-2026-38936A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter6.1CISA ADP v3.10.3%2026-04-27
CVE-2026-38935diskover-community view page doctype parameter reflected cross-site scripting6.1CISA ADP v3.10.3%2026-04-27
CVE-2026-38934diskoverdata diskover-community v.2.3.5 cross-site request forgery8.8CISA ADP v3.10.2%2026-04-27Exploit code
CVE-2026-35903Mercurycom MIPC252W improper authentication9.8CISA ADP v3.10.6%2026-04-27
CVE-2026-35902Mercurycom MIPC252W missing brute-force protection6.2CISA ADP v3.10.2%2026-04-27
CVE-2026-35901Mercurycom MIPC252W denial of service4.4CISA ADP v3.10.2%2026-04-27
CVE-2026-33566Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) LogonTracer injection5.1CNA v4.00.3%2026-04-27Fix
CVE-2026-33454Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy allows remote code execution9.4CISA ADP v3.11.0%2026-04-27Exploit codeFix
CVE-2026-33453Apache camel-coap allows header injection that can lead to remote code execution10.0CISA ADP v3.17.2%2026-04-27NucleiExploit codeFix
CVE-2026-33277JPCERT/CC LogonTracer OS command injection8.7CNA v4.02.3%2026-04-27Fix
CVE-2026-32688Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy8.7CNA v4.00.8%2026-04-27Fix
CVE-2026-32655Dell Alienware Command Center (AWCC) least privilege violation5.3CNA v3.10.1%2026-04-27Fix
CVE-2026-31691In the Linux kernel, the following vulnerability has been resolved: igb: remove napi_synchronize() in igb_down() When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9), the XSK buffer pool is destroyed but NAPI polling continues. igb_clean_rx_irq_zc() repeatedly returns the full5.5v3.10.1%2026-04-27Fix
CVE-2026-31690Linux kernel TH1520 AON firmware driver out-of-bounds write7.8v3.10.1%2026-04-27Fix
CVE-2026-31689Linux kernel EDAC memory controller allocation null pointer dereference5.5v3.10.1%2026-04-27Fix
CVE-2026-31687Linux kernel OMAP MPUIO driver deadlock5.5v3.10.1%2026-04-27Fix
CVE-2026-31686Linux kernel KASAN page table cleanup double free7.8v3.10.1%2026-04-27Fix
CVE-2026-31256Mercurycom MIPC252W RTSP service of the MERCURY null pointer dereference7.5CISA ADP v3.10.5%2026-04-27
CVE-2026-31255Tenda AC18 command injection9.8v3.11.1%2026-04-27
CVE-2026-30462Daylight Studio FuelCMS Blocks module path traversal4.3CISA ADP v3.10.6%2026-04-27
CVE-2026-30352leonvanzyl autocoder devserver start endpoint command injection9.8CISA ADP v3.10.9%2026-04-27
CVE-2026-30351leonvanzyl autocoder static file handler path traversal7.5CISA ADP v3.10.5%2026-04-27
CVE-2026-30350Agent Protocol server items search endpoint denial of service7.5CISA ADP v3.10.5%2026-04-27
CVE-2026-30346hunvreus DevPush Google authorize endpoint open redirect4.3CISA ADP v3.10.3%2026-04-27
CVE-2026-29971WebFileSys version A reflected cross-site scripting6.1CISA ADP v3.10.4%2026-04-27Exploit code
CVE-2026-28747Milesight Cameras authorization bypass through user-controlled key7.3CNA v4.00.3%2026-04-27Fix
CVE-2026-27172Apache Camel-Consul component vulnerable to deserialization of untrusted data8.8CISA ADP v3.11.1%2026-04-27Exploit codeFix
CVE-2026-25908Dell Alienware Command Center (AWCC) execution with unnecessary privileges6.7CNA v3.10.1%2026-04-27Fix
CVE-2026-22337Directorist Social Login WordPress plugin privilege escalation9.8CNA v3.10.3%2026-04-27Fix
CVE-2026-22336Directorist Booking WordPress plugin SQL injection9.3CNA v3.10.3%2026-04-27Fix
CVE-2026-22077Sensitive information disclosure vulnerability caused by Trusted Domain Bypass in OPPO Wallet5.6CNA v4.00.1%2026-04-27
CVE-2026-7194SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7191Arbitrary code execution via sandbox bypass in the open source solution QnABot on AWS8.6CNA v4.00.7%2026-04-27Fix
CVE-2026-7183aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception6.9CNA v4.00.7%2026-04-27Fix
CVE-2026-7179OSPG binwalk WinCE Extraction plugin winceextract.py read_null_terminated_string path traversal4.8CNA v4.00.2%2026-04-27Fix
CVE-2026-7178ChatGPTNextWeb NextChat Artifacts endpoint route.ts storeUrl server-side request forgery6.9CNA v4.00.6%2026-04-27
CVE-2026-7177ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery6.9CNA v4.00.6%2026-04-27
CVE-2026-7160Tenda HG3 formTracert command injection8.7CNA v4.04.4%2026-04-27
CVE-2026-7159douinc mkdocs-mcp-plugin server.py list_documents path traversal6.9CNA v4.00.6%2026-04-27
CVE-2026-7158dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery6.9CNA v4.00.5%2026-04-27
CVE-2026-7157disler aider-mcp-server aider_ai_code server.py command injection6.9CNA v4.02.1%2026-04-27
CVE-2026-7156Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7155Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7154Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7153Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7152Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7151Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7150dh1011 auto-favicon MCP tool server.py generate_favicon_from_url server-side request forgery5.3CNA v4.00.3%2026-04-27
CVE-2026-7149dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal6.9CNA v4.00.6%2026-04-27
CVE-2026-7148CodeAstro Online Classroom addnewfaculty SQL injection5.3CNA v4.00.3%2026-04-27
CVE-2026-7147JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery6.9CNA v4.00.5%2026-04-27
CVE-2026-7146AlejandroArciniegas mcp-data-vis HTTP request server.js axios server-side request forgery6.9CNA v4.00.5%2026-04-27
CVE-2026-7145mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization5.3CNA v4.00.4%2026-04-27
CVE-2026-71441000 Projects Portfolio Management System MCA update_passwd_process.php authorization5.3CNA v4.00.4%2026-04-27
CVE-2026-71431000 Projects Portfolio Management System MCA block_status.php SQL injection5.3CNA v4.00.3%2026-04-27
CVE-2026-7142Wooey API endpoint scripts.py add_or_update_script improper authorization5.3CNA v4.00.4%2026-04-27Fix
CVE-2026-7141vLLM KV block kv_cache_interface.py has_mamba_layers uninitialized resource6.3CNA v4.00.5%2026-04-27Fix
CVE-2026-7140Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7139Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7138Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7137Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7136Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7135GPAC MP4Box box_code_base.c elng_box_read out-of-bounds4.8CNA v4.00.2%2026-04-27Fix
CVE-2026-7134code-projects Online Lot Reservation System edithousepic.php unrestricted upload5.1CNA v4.00.4%2026-04-27
CVE-2026-7133code-projects Online Lot Reservation System activity.php unrestricted upload5.1CNA v4.00.4%2026-04-27
CVE-2026-7132code-projects Online Lot Reservation System download.php readfile path traversal6.9CNA v4.00.6%2026-04-27
CVE-2026-7131code-projects Online Lot Reservation System loginuser.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7130SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7129SourceCodester Pharmacy Sales and Inventory System index.php cross-site scripting5.3CNA v4.00.4%2026-04-27
CVE-2026-7128SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7127SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7126SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7125Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7124Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7123Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7122Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7121Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection9.3CNA v4.03.3%2026-04-27
CVE-2026-7119Tenda HG3 formCountrystr os command injection8.7CNA v4.04.4%2026-04-27
CVE-2026-7118code-projects Employee Management System cancel.php SQL injection5.3CNA v4.00.3%2026-04-27
CVE-2026-7117code-projects Employee Management System approve.php SQL injection5.3CNA v4.00.3%2026-04-27
CVE-2026-7116code-projects Employee Management System mark.php cross-site scripting5.3CNA v4.00.5%2026-04-27
CVE-2026-7115code-projects Employee Management System delete.php SQL injection5.3CNA v4.00.3%2026-04-27
CVE-2026-7114code-projects Employee Management System edit.php SQL injection5.3CNA v4.00.3%2026-04-27
CVE-2026-7113NousResearch hermes-agent Webhooks endpoint webhook.py missing authentication6.3CNA v4.00.6%2026-04-27
CVE-2026-7112NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication6.3CNA v4.00.6%2026-04-27
CVE-2026-7110code-projects Invoice System in Laravel item cross-site scripting5.1CNA v4.00.3%2026-04-27
CVE-2026-7109code-projects Invoice System in Laravel API endpoint item improper authorization6.9CNA v4.00.5%2026-04-27
CVE-2026-7108code-projects Invoice System in Laravel cross-site request forgery5.3CNA v4.00.2%2026-04-27
CVE-2026-7107code-projects Invoice System in Laravel company unrestricted upload5.3CNA v4.00.3%2026-04-27
CVE-2026-7106Highland Software Custom Role Manager WordPress plugin privilege escalation8.8CNA v3.10.6%2026-04-27Fix
CVE-2026-7103code-projects Chat System MD5 Hash update_user.php weak hash6.3CNA v4.00.3%2026-04-27
CVE-2026-7102Tenda F456 httpd WriteFacMac FromWriteFacMac command injection8.8v3.16.5%2026-04-27
CVE-2026-7101Tenda F456 httpd WrlclientSet fromWrlclientSet buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7100Tenda F456 httpd Natlimit fromNatlimitof buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7099Tenda F456 httpd QuickIndex formQuickIndex buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7098Tenda F456 httpd DhcpListClient fromDhcpListClient buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7097Tenda F456 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7096Tenda HG3 formgponConf os command injection8.7CNA v4.04.4%2026-04-27
CVE-2026-7095code-projects Employee Management System edit.php cross-site scripting5.3CNA v4.00.5%2026-04-27
CVE-2026-7094ShadowCloneLabs GlutamateMCPServers puppeteer_navigate index.ts server-side request forgery6.9CNA v4.00.5%2026-04-27
CVE-2026-7093code-projects Invoice System in Laravel Invoice endpoint invoice improper authorization5.3CNA v4.00.3%2026-04-27
CVE-2026-7092code-projects Invoice System in Laravel Profile profile improper authorization5.3CNA v4.00.3%2026-04-27
CVE-2026-7091code-projects Invoice System in Laravel User Management user improper authorization5.3CNA v4.00.3%2026-04-27
CVE-2026-7090code-projects Chat System send_message.php cross-site scripting4.8CNA v4.00.4%2026-04-27
CVE-2026-7089code-projects Home Service System Appointment Booking booking.php cross-site scripting5.3CNA v4.00.4%2026-04-27
CVE-2026-7088SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7087SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7086HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal5.3CNA v4.00.5%2026-04-27
CVE-2026-7085HBAI-Ltd Toonflow-app downloadApp endpoint downloadApp.ts z.url path traversal2.3CNA v4.00.3%2026-04-27
CVE-2026-7084HBAI-Ltd Toonflow-app getCodeByLink endpoint getCodeByLink.ts fetch server-side request forgery5.3CNA v4.00.4%2026-04-27
CVE-2026-7083likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult SQL injection5.1CNA v4.00.3%2026-04-27
CVE-2026-7082Tenda F456 httpd WrlExtraSet formWrlExtraSet buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7081Tenda F456 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7080Tenda F456 httpd PPTPUserSetting fromPPTPUserSetting buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7079Tenda F456 httpd AdvSetWan fromAdvSetWan buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7078Tenda F456 httpd SetIpBind fromSetIpBind buffer overflow8.7CNA v4.01.0%2026-04-27
CVE-2026-7077itsourcecode Courier Management System edit_parcel.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7076itsourcecode Courier Management System edit_branch.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7075itsourcecode Construction Management System locations.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7074itsourcecode Construction Management System execute1.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7073itsourcecode Construction Management System execute.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7072CodePanda Source canteen_management_system login.php SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7071CodeAstro Online Job Portal user-cvs file information disclosure6.9CNA v4.00.5%2026-04-27
CVE-2026-7070code-projects Inventory Management System Login SQL injection6.9CNA v4.00.4%2026-04-27
CVE-2026-7069D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflow8.6CNA v4.00.7%2026-04-27
CVE-2026-7068D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow8.7CNA v4.01.1%2026-04-27
CVE-2026-7067D-Link DIR-822 udhcpd DHCP service dhcpd.c system command injection6.9CNA v4.03.5%2026-04-27
CVE-2026-7066choieastsea simple-openstack-mcp server.py exec_openstack os command injection6.9CNA v4.02.1%2026-04-27
CVE-2026-7065BidingCC BuildingAI remote upload API server-side request forgery6.9CNA v4.00.5%2026-04-27
CVE-2026-7040RRWO Text::Minify::XS heap-based buffer overflow7.5CISA ADP v3.10.7%2026-04-27Fix
CVE-2026-6970authd denial of service and local privilege escalation7.3CNA v4.00.1%2026-04-27Fix
CVE-2026-6741LatePoint WordPress plugin privilege escalation to Administrator8.8CNA v3.10.6%2026-04-27Exploit codeFix
CVE-2026-6357pip self-update functionality can import newly installed modules after wheel installation5.3CNA v4.00.2%2026-04-27Fix
CVE-2026-6265Local privilege escalation in Cerberus FTP Server =8.8v3.10.4%2026-04-27Fix
CVE-2026-5943Foxit PDF Editor/Reader AcroForm Annotation use-after-free remote code execution7.8CNA v3.10.2%2026-04-27Fix
CVE-2026-5942Foxit PDF Editor/Reader AcroForm Signature use-after-free5.5CNA v3.10.1%2026-04-27Fix
CVE-2026-5941Foxit PDF Editor/Reader AcroForm Signature remote code execution7.8CNA v3.10.2%2026-04-27Fix
CVE-2026-5940Foxit PDF Editor/Reader Annotation use-after-free remote code execution7.8CNA v3.10.2%2026-04-27Fix
CVE-2026-5939UAF in Foxit PDF Editor/Reader via XFA calculate event5.5CNA v3.10.2%2026-04-27Fix
CVE-2026-5938Foxit PDF Editor/Reader infinite loop denial of service5.5CNA v3.10.1%2026-04-27Fix
CVE-2026-5937Foxit PDF Editor/Reader's insufficient parameter validation leads to denial of service5.5CNA v3.10.1%2026-04-27Fix
CVE-2026-5394Pimcore Platform SQL injection in DataObject composite index handling7.0CNA v4.00.6%2026-04-27Fix
CVE-2026-5362Pimcore Platform stored XSS in Document Editable Embed rendering5.4v3.10.3%2026-04-27
CVE-2026-3868Moxa EDR-8010 Series improper length parameter handling8.7CNA v4.00.5%2026-04-27Fix
CVE-2026-3867Moxa EDR-8010 Series information disclosure6.0CNA v4.00.4%2026-04-27Fix
CVE-2026-3087Python CPython shutil.unpack_archive doesn't check for Windows absolute paths in ZIPs6.0CNA v4.00.7%2026-04-27Fix
CVE-2026-3008Notepad++ format string6.6CNA v3.10.2%2026-04-27Exploit code
CVE-2026-3006WinFSP race condition7.0CNA v3.10.1%2026-04-27
CVE-2026-42255Technitium DNS Server incorrect behavior6.5NVD v3.10.4%2026-04-26Fix
CVE-2026-42254Hickory DNS incorrectly resolved name or reference4.0CNA v3.10.3%2026-04-26Fix
CVE-2026-7064AgentDeskAI browser-tools-mcp browser-connector.ts os command injection6.9CNA v4.02.6%2026-04-26Fix
CVE-2026-7063code-projects Employee Management System endpoint eprocess.php SQL injection6.9CNA v4.00.4%2026-04-26
CVE-2026-7062Intina47 context-sync Git Integration git-integration.ts os command injection6.9CNA v4.02.1%2026-04-26
CVE-2026-7061Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection6.9CNA v4.02.1%2026-04-26
CVE-2026-7060liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest SQL injection6.9CNA v4.00.4%2026-04-26
CVE-2026-7059666ghj MiroFish Query parameter simulation.py get_simulation_posts path traversal6.9CNA v4.00.6%2026-04-26
CVE-2026-7058666ghj MiroFish inter-process communication command injection6.9CNA v4.02.1%2026-04-26
CVE-2026-7057Tenda F456 httpd setcfm buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7056Tenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7055Tenda F456 httpd VirtualSer fromVirtualSer buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7054Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7053Tenda F456 httpd L7Prot frmL7ProtForm buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7045Dynamic-Datasource has an injection5.3CNA v4.00.4%2026-04-26
CVE-2026-7044GreenCMS index.php themeadd unrestricted upload5.3CNA v4.00.3%2026-04-26
CVE-2026-7043GreenCMS index.php pluginAddLocal unrestricted upload5.3CNA v4.00.3%2026-04-26
CVE-2026-7042666ghj MiroFish REST API endpoint __init__.py create_app missing authentication6.9CNA v4.00.7%2026-04-26
CVE-2026-7041666ghj MiroFish Werkzeug Debugger PIN console information disclosure6.3CNA v4.00.4%2026-04-26
CVE-2026-7039tufantunc ssh-mcp index.ts shell.write command injection8.5CNA v4.01.2%2026-04-26
CVE-2026-7038tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials4.8CNA v4.00.1%2026-04-26
CVE-2026-7037Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection9.3CNA v4.03.3%2026-04-26
CVE-2026-7036Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal9.8v3.10.8%2026-04-26
CVE-2026-7035Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7034Tenda FH1202 httpd WrlExtraSet stack-based overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7033Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7032Tenda F456 SafeEmailFilter buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7031Tenda F456 SafeMacFilter fromSafeMacFilter buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7030Tenda F456 RouteStatic fromRouteStatic buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7029Tenda F456 addressNat fromaddressNat buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7028CodeAstro Online Job Portal All Jobs delete-jobs.php SQL injection5.1CNA v4.00.3%2026-04-26
CVE-2026-7027D-Link DSL-2740R Wireless Setup Section cross-site scripting4.8v3.10.8%2026-04-26
CVE-2026-7026D-Link DGS-3420 System Information settings cross-site scripting4.8v3.11.3%2026-04-26
CVE-2026-7025Typecho Ping Back service Endpoint Service.php sendPingHandle server-side request forgery6.9CNA v4.00.5%2026-04-26
CVE-2026-7024rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal5.3CNA v4.00.5%2026-04-26
CVE-2026-7023ByteDance coze-studio databaseTool database_impl.go ExecuteSQL SQL injection8.8v3.10.5%2026-04-26
CVE-2026-7022SmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authentication6.9CNA v4.00.7%2026-04-26
CVE-2026-7021SmythOS sre Connector service utils.ts information disclosure5.1CNA v4.00.3%2026-04-26
CVE-2026-7020Ollama Tensor Model Transfer transfer.go digestToPath path traversal6.3CNA v4.00.9%2026-04-26Exploit code
CVE-2026-7019Tenda F456 P2pListFilter fromP2pListFilter buffer overflow8.7CNA v4.01.0%2026-04-26
CVE-2026-7018Datavane Datavines JWT Token TokenManager.java hard-coded key6.3CNA v4.00.4%2026-04-26
CVE-2026-7016MaxSite CMS ushki plugin cross-site scripting4.8CNA v4.00.4%2026-04-26Fix
CVE-2026-7015MaxSite CMS Guestbook plugin cross-site scripting4.8CNA v4.00.4%2026-04-26Fix
CVE-2026-7014MaxSite CMS down_count plugin cross-site scripting4.8CNA v4.00.4%2026-04-26Fix
CVE-2026-7013MaxSite CMS mail_send plugin cross-site scripting4.8CNA v4.00.4%2026-04-26Fix
CVE-2026-7012MaxSite CMS redirect plugin cross-site scripting4.8CNA v4.00.4%2026-04-26Fix
CVE-2026-7011MaxSite CMS Antispam plugin plugin_antispam cross-site scripting4.8CNA v4.00.4%2026-04-26Fix
CVE-2026-31685Linux kernel ip6t_eui64 netfilter match vulnerability9.4CNA v3.10.4%2026-04-25Fix
CVE-2026-31684Linux kernel act_csum VLAN header parsing vulnerability5.5v3.10.1%2026-04-25Fix
CVE-2026-31683Linux kernel batman-adv OGM aggregation vulnerability7.8CNA v3.10.2%2026-04-25Fix
CVE-2026-31682Linux kernel bridge neighbor discovery vulnerability9.1CNA v3.10.5%2026-04-25Fix
CVE-2026-31681Linux kernel xt_multiport netfilter match vulnerability5.5NVD v3.10.2%2026-04-25Fix
CVE-2026-31680Linux kernel IPv6 flowlabel proc interface vulnerability7.8CNA v3.10.1%2026-04-25Fix
CVE-2026-31679In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls7.1CNA v3.10.2%2026-04-25Fix
CVE-2026-31678Linux kernel openvswitch time-of-check time-of-use race condition7.8CNA v3.10.1%2026-04-25Fix
CVE-2026-31677Linux kernel af_alg receive buffer vulnerability5.5NVD v3.10.1%2026-04-25Fix
CVE-2026-31676Linux kernel rxrpc service connection vulnerability7.5CNA v3.10.6%2026-04-25Fix
CVE-2026-31675Linux kernel netem packet scheduler out-of-bounds read7.8CNA v3.10.2%2026-04-25Fix
CVE-2026-31674Linux kernel ip6t_rt netfilter match vulnerability7.1CNA v3.10.2%2026-04-25Fix
CVE-2026-31673Linux kernel AF_UNIX diagnostics interface vulnerability7.8CNA v3.10.1%2026-04-25Fix
CVE-2026-7002KLiK SocialMediaWebsite Private message get_message_ajax.php SQL injection6.9CNA v4.00.4%2026-04-25
CVE-2026-7001Datacom DM4100 Ethernet Configuration cross-site scripting4.8CNA v4.00.3%2026-04-25
CVE-2026-7000Datacom DM4100 VLAN page cross-site scripting4.8CNA v4.00.3%2026-04-25
CVE-2026-6999BIVOCOM TR321 Wireless setting cross-site scripting4.8CNA v4.00.3%2026-04-25
CVE-2026-6998BDCOM P3310D New RMON Statistics cross-site scripting4.8CNA v4.00.3%2026-04-25
CVE-2026-6997BDCOM P3310D New RMON History cross-site scripting4.8CNA v4.00.3%2026-04-25
CVE-2026-6996BDCOM P3310D rmon event Tab cross-site scripting4.8CNA v4.00.3%2026-04-25
CVE-2026-6995BDCOM P3310D New User index.asp cross-site scripting4.8CNA v4.00.3%2026-04-25
CVE-2026-6994Envoy Query parameter header_mutation.cc params.add injection5.3CNA v4.00.4%2026-04-25
CVE-2026-6993go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy6.9CNA v4.00.5%2026-04-25
CVE-2026-6992Linksys MR9600 JNAP action run_central2.sh BTRequestGetSmartConnectStatus os command injection8.6CNA v4.08.0%2026-04-25Exploit code
CVE-2026-6991colinhacks Zod CUID Data Type regexes.ts SQL injection5.3CNA v4.00.3%2026-04-25
CVE-2026-6990projeto-siga novo cross-site scripting5.1CNA v4.00.3%2026-04-25
CVE-2026-6989Tenda F453 Telnet service telnet TendaTelnet command injection8.8v3.16.3%2026-04-25
CVE-2026-6988Tenda HG10 Boa service formRouting formRoute buffer overflow8.7CNA v4.01.0%2026-04-25
CVE-2026-6987PicoClaw Web Launcher Management Plane restart command injection9.8v3.14.7%2026-04-25
CVE-2026-6986Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification6.3CNA v4.00.3%2026-04-25Fix
CVE-2026-6985Cesanta Mongoose TCP option net_builtin.c handle_opt infinite loop7.5v3.10.9%2026-04-25Fix
CVE-2026-6984AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine5.1CNA v4.00.4%2026-04-25
CVE-2026-6983pagekit download server-side request forgery5.1CNA v4.00.4%2026-04-25
CVE-2026-6982star7th ShowDoc API Page Sort Endpoint PageController.class.PHP SQL injection5.3CNA v4.00.3%2026-04-25Fix
CVE-2026-6981IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgery5.3CNA v4.00.3%2026-04-25
CVE-2026-6980Divyanshu-hash GitPilot-MCP main.py repo_path command injection6.9CNA v4.03.2%2026-04-25
CVE-2026-6979devlikeapro WAHA API request media.controller.ts server-side request forgery5.3CNA v4.00.3%2026-04-25
CVE-2026-6978JiZhiCMS addcache.html htmlspecialchars_decode SQL injection5.1CNA v4.00.3%2026-04-25
CVE-2026-6977vanna-ai vanna Legacy Flask API improper authorization6.9CNA v4.00.5%2026-04-25
CVE-2026-6951simple-git is vulnerable to remote code execution9.2CNA v4.01.0%2026-04-25Exploit codeFix
CVE-2026-42171Nullsoft Scriptable Install System uncontrolled search path7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-42095KDE Arianna missing authentication4.0CNA v3.10.2%2026-04-24Fix
CVE-2026-42044Axios: Invisible JSON Response tampering via prototype pollution Gadget in `parseReviver`6.5CNA v3.10.9%2026-04-24Fix
CVE-2026-42043Axios: Incomplete Fix for NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (/8) in Axios7.2CNA v3.10.6%2026-04-24Fix
CVE-2026-42042Axios: XSRF Token Cross-Origin Leakage5.4CNA v3.10.3%2026-04-24Fix
CVE-2026-42041Axios: Authentication bypass via prototype pollution Gadget in `validateStatus` Merge Strategy4.8CNA v3.10.8%2026-04-24Fix
CVE-2026-42040Axios: Null Byte injection via Reverse-Encoding in AxiosURLSearchParams3.7CNA v3.10.3%2026-04-24Fix
CVE-2026-42039Axios: Unbounded recursion in toFormData causes DoS via deeply nested request data6.9CNA v4.01.0%2026-04-24Fix
CVE-2026-42038Axios: No_proxy bypass via IP alias allows SSRF6.8CNA v3.10.4%2026-04-24Fix
CVE-2026-42037Axios: CRLF injection in multipart/form-data body via unsanitized blob.type in formDataToStream5.3CNA v3.10.3%2026-04-24Fix
CVE-2026-42036Axios: HTTP adapter streamed responses bypass maxContentLength5.3CNA v3.10.5%2026-04-24Fix
CVE-2026-42035Axios: Header injection via prototype pollution7.4CNA v3.10.4%2026-04-24Fix
CVE-2026-42034Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 05.3CNA v3.10.5%2026-04-24Fix
CVE-2026-42033Axios: Prototype pollution Gadgets Response tampering, Data Exfiltration, and Request Hijacking7.4CNA v3.10.9%2026-04-24Fix
CVE-2026-41907uuid v3, v5 and v6 generation out-of-bounds write8.1CNA v4.00.4%2026-04-24Fix
CVE-2026-41898rust-openssl PSK and cookie callbacks out-of-bounds read8.3CNA v4.00.3%2026-04-24Fix
CVE-2026-41894SiYuan: Incomplete Fix Bypass for path traversal via Double URL Encoding in `/export/` endpoint7.1CNA v4.00.5%2026-04-24Fix
CVE-2026-41681rust-openssl digest_final function stack-based buffer overflow8.1CNA v4.00.4%2026-04-24Fix
CVE-2026-41680Marked: OOM denial of service via Infinite Recursion in marked Tokenizer8.7CNA v4.00.5%2026-04-24Fix
CVE-2026-41678rust-openssl has incorrect bounds assertion in aes key wrap7.2CNA v4.00.3%2026-04-24Fix
CVE-2026-41677rust-openssl PEM password callback out-of-bounds read1.7CNA v4.00.3%2026-04-24Fix
CVE-2026-41676rust-openssl incorrect buffer size calculation7.2CNA v4.00.3%2026-04-24Fix
CVE-2026-41503bacnet-stack BACnet Stack: Out-of-bounds read in ReadPropertyMultiple Property Decoder8.7CNA v4.00.6%2026-04-24Fix
CVE-2026-41502bacnet-stack BACnet Stack: Off-by-one out-of-bounds read in ReadPropertyMultiple Object ID Decoder8.7CNA v4.00.6%2026-04-24Fix
CVE-2026-41492Unauthenticated admin token disclosure leading to authentication bypass via /debug/vars in Dgraph9.8CNA v3.12.5%2026-04-24NucleiFix
CVE-2026-41488langchain-ai langchain-openai angchain-openai: Image token counting SSRF protection can be bypassed3.1CNA v3.10.2%2026-04-24Fix
CVE-2026-41485Kyverno controller denial of service via forEach Mutation panic7.7CNA v3.10.6%2026-04-24Fix
CVE-2026-41481LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass6.5CNA v3.10.4%2026-04-24Fix
CVE-2026-41478Saltcorn: SQL injection via Unparameterized Sync endpoints (maxLoadedId)10.0CNA v3.10.4%2026-04-24Fix
CVE-2026-41477Deskflow: Local privilege escalation via unauthenticated IPC7.8CNA v3.10.2%2026-04-24
CVE-2026-41476Deskflow: Clipboard deserialization global-buffer-overflow7.4CNA v4.00.5%2026-04-24Fix
CVE-2026-41475bacnet-stack BACnet Stack: Out-of-bounds read in WritePropertyMultiple Decoder8.7CNA v4.00.7%2026-04-24Fix
CVE-2026-41473CyberPanel Unauthenticated API Access via AI Scanner endpoints9.1NVD v3.11.1%2026-04-24Fix
CVE-2026-41472CyberPanel stored XSS via AI Scanner Dashboard6.1v3.10.6%2026-04-24Exploit codeFix
CVE-2026-41433OpenTelemetry eBPF Instrumentation Java agent injector path traversal8.4CNA v3.10.2%2026-04-24Fix
CVE-2026-41430Press vulnerable to reflected XSS on login redirection1.3CNA v4.00.3%2026-04-24Fix
CVE-2026-41429Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption8.8CNA v3.10.3%2026-04-24Fix
CVE-2026-41428Budibase: Authentication bypass9.1CNA v3.10.6%2026-04-24Fix
CVE-2026-41427better-auth better Auth OAuth Provider: Unprivileged users can register OAuth clients7.1CNA v4.00.4%2026-04-24Fix
CVE-2026-41426pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders6.1CNA v3.10.3%2026-04-24Fix
CVE-2026-41425Authlib: Cross-site request forging when using cache5.4CNA v3.10.1%2026-04-24Fix
CVE-2026-41421SiYuan Desktop Notification XSS leads to Electron RCE8.8CNA v3.10.2%2026-04-24Fix
CVE-2026-41419RARgames 4gaBoards 4ga Boards: Import path traversal leads to arbitrary file read7.6CNA v3.10.5%2026-04-24Fix
CVE-2026-41418RARgames 4gaBoards 4ga Boards: User Enumeration via timing side-channel in Authentication endpoint5.3CNA v3.10.3%2026-04-24Fix
CVE-2026-41416PJSIP: Asymmetric ptime integer overflow in Media Stream8.1CNA v4.00.5%2026-04-24Fix
CVE-2026-41415PJSIP: SIP Multipart CID URI Length Underflow6.7CNA v4.00.5%2026-04-24Fix
CVE-2026-41414Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml7.4CNA v3.10.4%2026-04-24Exploit codeFix
CVE-2026-41411Vim: Command injection via backtick expansion in tag filenames6.6CNA v3.10.8%2026-04-24Fix
CVE-2026-41328Dgraph: Pre-Auth Full Database Exfiltration via DQL injection in NQuad Lang field9.1CNA v3.10.5%2026-04-24Fix
CVE-2026-41327Dgraph: Pre-Auth Full Database Exfiltration via DQL injection in Upsert Condition field9.1CNA v3.10.5%2026-04-24Fix
CVE-2026-41326Kata Containers: CopyFile Policy Subversion via Symlinks8.2CNA v4.00.4%2026-04-24Fix
CVE-2026-41325Kirby is vulnerable to authorization bypass during page, file and user creation7.1CNA v4.00.5%2026-04-24Fix
CVE-2026-41324basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list7.5CNA v3.10.5%2026-04-24Fix
CVE-2026-41323Kyverno: ServiceAccount token leaked to external servers via apiCall service URL8.1CNA v3.10.6%2026-04-24Fix
CVE-2026-41322Astro: Cache poisoning due to incorrect error handling when if-match header is malformed5.3CNA v3.10.4%2026-04-24Fix
CVE-2026-41321@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint2.2CNA v3.10.3%2026-04-24Fix
CVE-2026-41319MailKit has STARTTLS Response injection6.5CNA v3.10.3%2026-04-24Fix
CVE-2026-41318Mintplex Labs AnythingLLM chart caption renderer cross-site scripting5.4CNA v3.10.3%2026-04-24Fix
CVE-2026-41317Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation6.6CNA v4.00.2%2026-04-24Fix
CVE-2026-41316ERB has an @_init deserialization guard bypass via def_module / def_method / def_class8.1CNA v3.11.3%2026-04-24Fix
CVE-2026-41309opensource-socialnetwork Open Source Social Network vulnerable to resource exhaustion8.2CNA v3.10.7%2026-04-24Fix
CVE-2026-41305PostCSS CSS stringifier cross-site scripting6.1CNA v3.10.3%2026-04-24Fix
CVE-2026-41248Official Clerk JavaScript SDKs: Middleware-based route protection bypass9.1CNA v3.10.5%2026-04-24Fix
CVE-2026-41244Mojic: Observable timing discrepancy in HMAC Verification4.7CNA v3.10.2%2026-04-24Fix
CVE-2026-41140Poetry: Path traversal in tar extraction on Python and0.6CNA v4.00.5%2026-04-24Fix
CVE-2026-41079OpenPrinting CUPS SNMP supply level polling out-of-bounds read4.3CNA v3.10.3%2026-04-24Fix
CVE-2026-41068Kyverno: Cross-Namespace Read Bypasses RBAC Isolation ( Incomplete Fix)7.7CNA v3.10.4%2026-04-24Fix
CVE-2026-41067Astro define:vars script sanitization cross-site scripting6.1CNA v3.10.3%2026-04-24Fix
CVE-2026-41066lxml iterparse and ETCompatXMLParser parsers XML external entity injection7.5CNA v3.10.3%2026-04-24Fix
CVE-2026-41044Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE8.8CISA ADP v3.11.2%2026-04-24Fix
CVE-2026-41043Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console XSS vulnerability when browsing queues6.5CISA ADP v3.10.7%2026-04-24Fix
CVE-2026-40897Math.js: Unsafe object property setter in mathjs8.8CNA v3.10.8%2026-04-24Exploit codeFix
CVE-2026-40690Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions4.3CISA ADP v3.10.6%2026-04-24Fix
CVE-2026-40630SenseLive X3050 authentication bypass using an alternate path or channel9.3CNA v4.00.9%2026-04-24
CVE-2026-40623SenseLive X3050 missing authorization7.2CNA v4.00.6%2026-04-24
CVE-2026-40620SenseLive X3050 missing authentication for critical function9.3CNA v4.00.8%2026-04-24
CVE-2026-40466Apache ActiveMQ vulnerable to improper input validation and code injection8.8CISA ADP v3.14.1%2026-04-24NucleiFix
CVE-2026-40431SenseLive X3050 cleartext transmission of sensitive information6.9CNA v4.00.3%2026-04-24
CVE-2026-40254FreeRDP: Contains_dotdot off-by-one allows drive channel path traversal via terminal4.2CNA v3.10.2%2026-04-24Fix
CVE-2026-40099Kirby page creation permission check incorrect authorization5.3CNA v4.00.4%2026-04-24Fix
CVE-2026-39920BridgeHead FileStore Apache Axis2 default credentials RCE9.3CNA v4.01.1%2026-04-24Fix
CVE-2026-39462SenseLive X3050 insufficiently protected credentials9.3CNA v4.00.7%2026-04-24
CVE-2026-38743Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities4.3CISA ADP v3.10.6%2026-04-24Fix
CVE-2026-35503SenseLive X3050 use of hard-coded credentials9.3CNA v4.00.8%2026-04-24
CVE-2026-35064SenseLive X3050 missing authentication for critical function8.7CNA v4.00.6%2026-04-24
CVE-2026-34587Kirby has server-side template injection (SSTI) via double template resolution in option rendering7.6CNA v4.00.5%2026-04-24Fix
CVE-2026-33666Zserio: Integer overflow in BitStreamReader on 32-bit platforms7.5CNA v3.10.5%2026-04-24
CVE-2026-33662OP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode7.5CNA v3.10.6%2026-04-24Fix
CVE-2026-33524Zserio: Integer overflow in BitStreamReader and Unbounded Memory Allocation in deserialization7.5CNA v3.10.5%2026-04-24Fix
CVE-2026-33318Actual has privilege escalation via change-password endpoint on OpenID-Migrated Servers8.8CNA v3.10.6%2026-04-24Fix
CVE-2026-33317OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure8.7CNA v3.10.2%2026-04-24Exploit codeFix
CVE-2026-33208Roxy-WI vulnerable to authenticated remote code execution7.4CNA v4.00.9%2026-04-24Fix
CVE-2026-33078Roxy-WI has SQL injection in haproxy_section_save endpoint via Unsanitized server_ip parameter8.9CNA v4.00.5%2026-04-24Fix
CVE-2026-33077Roxy-WI has an arbitrary file read7.7CNA v4.00.5%2026-04-24Fix
CVE-2026-33076Roxy-WI vulnerable to path traversal and arbitrary file writing8.9CNA v4.01.0%2026-04-24Fix
CVE-2026-32952go-ntlmssp NTLM challenges can panic on malformed payloads5.3CNA v3.11.5%2026-04-24Fix
CVE-2026-32870Kirby has XML injection in its XML creator toolkit6.9CNA v4.00.5%2026-04-24Fix
CVE-2026-31956Xibo CMS has Preview and SavedReport IDOR4.3CNA v3.10.3%2026-04-24Fix
CVE-2026-31955Xibo CMS has authenticated server-side request forgery (SSRF) in Remote DataSet Functionality4.9CNA v3.10.5%2026-04-24Fix
CVE-2026-31953Xibo CMS has stored XSS via Notification Body with Zero-Click Execution on Login6.4CNA v3.10.2%2026-04-24Fix
CVE-2026-31952Xibo CMS API has SQL injection via DataSet Filter parameter7.6CNA v3.10.4%2026-04-24Fix
CVE-2026-31672Linux kernel rt2x00usb Wi-Fi driver memory leak5.5v3.10.1%2026-04-24Fix
CVE-2026-31671Linux kernel xfrm_user report builder information disclosure5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31670Linux kernel rfkill event queue denial of service5.5NVD v3.10.1%2026-04-24Fix
CVE-2026-31669Linux kernel MPTCP subflow socket lookup use-after-free9.8CNA v3.10.8%2026-04-24Fix
CVE-2026-31668Linux kernel seg6 lightweight tunnel vulnerability9.8CNA v3.10.4%2026-04-24Fix
CVE-2026-31667Linux kernel uinput force-feedback core vulnerability7.8CNA v3.10.1%2026-04-24Fix
CVE-2026-31666Linux kernel btrfs extent tree lookup vulnerability7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31665Linux kernel nftables conntrack timeout objects use-after-free7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31664Linux kernel xfrm policy expire netlink vulnerability5.5NVD v3.10.1%2026-04-24Fix
CVE-2026-31663Linux kernel xfrm transport processing vulnerability7.8CNA v3.10.1%2026-04-24Fix
CVE-2026-31662Linux kernel TIPC group broadcast integer underflow7.5CNA v3.10.4%2026-04-24Fix
CVE-2026-31661Linux kernel brcmsmac Wi-Fi driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31660Linux kernel pn533 NFC driver null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31659Linux kernel batman-adv translation table vulnerability9.8CNA v3.10.4%2026-04-24Fix
CVE-2026-31658Linux kernel Altera TSE Ethernet driver memory leak5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31657Linux kernel batman-adv null pointer dereference9.8CNA v3.10.4%2026-04-24Fix
CVE-2026-31656Linux kernel i915 GT engine heartbeat use-after-free7.8CNA v3.10.1%2026-04-24Fix
CVE-2026-31655Linux kernel imx8mp block controller denial of service5.5v3.10.1%2026-04-24Fix
CVE-2026-31654Linux kernel mmap region handling memory leak5.5v3.10.1%2026-04-24Fix
CVE-2026-31653Linux kernel DAMON sysfs interface vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31652Linux kernel DAMON statistics interface vulnerability7.8v3.10.1%2026-04-24Fix
CVE-2026-31651Linux kernel vub300 MMC driver null pointer dereference5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31650Linux kernel vub300 MMC driver use-after-free7.8NVD v3.10.2%2026-04-24Fix
CVE-2026-31649Linux kernel stmmac Ethernet driver integer underflow9.8CNA v3.10.5%2026-04-24Fix
CVE-2026-31648Linux kernel filemap crash7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31647Linux kernel idpf virtchnl handler improper locking5.5v3.10.1%2026-04-24Fix
CVE-2026-31646Linux kernel lan966x FDMA driver null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31645Linux kernel lan966x FDMA driver memory leak5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31644Linux kernel lan966x FDMA driver use-after-free7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31643Linux kernel rxrpc RxGK key parsing memory leak5.5v3.10.1%2026-04-24Fix
CVE-2026-31642Linux kernel rxrpc call list handling infinite loop5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31641Linux kernel rxrpc RxGK token loading out-of-bounds write7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31640Linux kernel rxrpc response packet handling memory leak7.5CNA v3.10.6%2026-04-24Fix
CVE-2026-31639Linux kernel rxrpc client call handling vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31638Linux kernel rxrpc call reference handling null pointer dereference7.5CNA v3.10.6%2026-04-24Fix
CVE-2026-31637Linux kernel rxrpc rxkad ticket decryption vulnerability9.8CNA v3.10.6%2026-04-24Fix
CVE-2026-31636Linux kernel rxrpc RxGK authenticator parser out-of-bounds read9.1CNA v3.10.6%2026-04-24Fix
CVE-2026-31635Linux kernel rxrpc RESPONSE authenticator validation denial of service7.5CNA v3.10.6%2026-04-24Reported exploitedExploit codeFix
CVE-2026-31634Linux kernel rxrpc server keyring vulnerability5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31633Linux kernel rxrpc RxGK response verification integer overflow9.8CNA v3.10.5%2026-04-24Fix
CVE-2026-31632Linux kernel rxrpc RxGK response verification memory leak5.5v3.10.1%2026-04-24Fix
CVE-2026-31631Linux kernel rxrpc RxGK authenticator verification out-of-bounds read8.2CNA v3.10.6%2026-04-24Fix
CVE-2026-31630Linux kernel rxrpc procfs interface vulnerability7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31629Linux kernel NFC LLCP socket handling use-after-free8.8CNA v3.10.4%2026-04-24Fix
CVE-2026-31628In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under certain circumstances, partial results from previous operations. Those results can be leaked by another, attacker thread. Fix that with a chicken bit.5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31627Linux kernel S3C24xx I2C driver vulnerability7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31626Linux kernel rtl8723bs Wi-Fi driver vulnerability7.1CNA v3.10.4%2026-04-24Fix
CVE-2026-31625Linux kernel HID ALPS driver null pointer dereference5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31624Linux kernel HID report parser vulnerability5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31623Linux kernel USB CDC Phonet driver out-of-bounds write5.5v3.10.1%2026-04-24Fix
CVE-2026-31622Linux kernel NFC-A SDD response handler out-of-bounds write8.8CNA v3.10.5%2026-04-24Fix
CVE-2026-31621Linux kernel bnge auxiliary device driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31620Linux kernel ALSA usx2y US-144MKII driver null pointer dereference4.6v3.10.2%2026-04-24Fix
CVE-2026-31619Linux kernel ALSA fireworks driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31618Linux kernel tdfxfb framebuffer driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31617Linux kernel USB gadget NCM function driver integer underflow5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31616Linux kernel USB gadget Phonet function driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31615Linux kernel renesas_usb3 USB gadget driver null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31614Linux kernel SMB client WSL extended attribute parsing out-of-bounds read7.1v3.10.1%2026-04-24Fix
CVE-2026-31613Linux kernel SMB client symlink error parsing out-of-bounds read8.1CNA v3.10.4%2026-04-24Fix
CVE-2026-31612Linux kernel ksmbd uninitialized memory use7.5CNA v3.10.6%2026-04-24Fix
CVE-2026-31611Linux kernel ksmbd ACL parsing vulnerability8.6CNA v3.10.5%2026-04-24Fix
CVE-2026-31610Linux kernel ksmbd SPNEGO authentication memory leak5.5v3.10.1%2026-04-24Fix
CVE-2026-31609Linux kernel smb client double free9.8CNA v3.10.7%2026-04-24Fix
CVE-2026-31608Linux kernel ksmbd SMB Direct transport double free9.8CNA v3.10.7%2026-04-24Fix
CVE-2026-31607Linux kernel USB/IP client driver out-of-bounds write9.8CNA v3.10.3%2026-04-24Fix
CVE-2026-31606Linux kernel USB gadget HID function driver vulnerability5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31605Linux kernel udlfb framebuffer driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31604Linux kernel rtw88 Wi-Fi driver memory leak5.5v3.10.1%2026-04-24Fix
CVE-2026-31603Linux kernel sm750fb framebuffer driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31602Linux kernel ctxfi sound driver vulnerability7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31601Linux kernel xe GPU VFIO driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31600Linux kernel arm64 memory management null pointer dereference7.5CNA v3.10.4%2026-04-24Fix
CVE-2026-31599Linux kernel vidtv null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31598Linux kernel ocfs2 direct I/O deadlock7.5CNA v3.10.4%2026-04-24Fix
CVE-2026-31597Linux kernel ocfs2 mmap fault handler use-after-free7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31596Linux kernel ocfs2 resize ioctl denial of service5.5v3.10.1%2026-04-24Fix
CVE-2026-31595Linux kernel PCI endpoint NTB driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31594Linux kernel PCI endpoint NTB driver vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31593Linux kernel KVM SEV-SNP VMSA synchronization denial of service5.5v3.10.1%2026-04-24Fix
CVE-2026-31592Linux kernel KVM SEV memory region registration null pointer dereference5.5NVD v3.10.1%2026-04-24Fix
CVE-2026-31591Linux kernel SEV crash5.5v3.10.1%2026-04-24Fix
CVE-2026-31590Linux kernel KVM SEV memory region registration vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31589Linux kernel mm use-after-free9.8CNA v3.10.7%2026-04-24Fix
CVE-2026-31588Linux kernel KVM x86 MMIO emulation use-after-free8.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31587Linux kernel qcom q6apm ASoC driver use-after-free7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31586Linux kernel blk-cgroup writeback cleanup use-after-free7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31585Linux kernel vidtv virtual DVB driver memory leak5.5v3.10.1%2026-04-24Fix
CVE-2026-31584Linux kernel MediaTek video encoder driver use-after-free7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31583Linux kernel em28xx USB driver use-after-free7.8NVD v3.10.2%2026-04-24Fix
CVE-2026-31582Linux kernel powerz USB driver use-after-free7.8v3.10.1%2026-04-24Fix
CVE-2026-31581Linux kernel 6fire USB audio driver use-after-free7.8v3.10.1%2026-04-24Fix
CVE-2026-31580Linux kernel bcache use-after-free7.8NVD v3.10.1%2026-04-24Fix
CVE-2026-31579Linux kernel wireguard device null pointer dereference5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31578Linux kernel as102 USB driver use-after-free7.8v3.10.1%2026-04-24Fix
CVE-2026-31577Linux kernel nilfs2 DAT inode shadow map null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31576Linux kernel hackrf USB driver use-after-free7.8v3.10.1%2026-04-24Fix
CVE-2026-31575Linux kernel hugetlb fault mutex hashing race condition5.5v3.10.1%2026-04-24Fix
CVE-2026-31574Linux kernel clockevents subsystem denial of service5.5v3.10.1%2026-04-24Fix
CVE-2026-31573Linux kernel Verisilicon Hantro VPU driver vulnerability5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31572Linux kernel amdisp I2C driver race condition4.7v3.10.1%2026-04-24Fix
CVE-2026-31571Linux kernel i915 NV12 plane unlinking vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31570Linux kernel gw out-of-bounds read8.8CNA v3.10.4%2026-04-24Fix
CVE-2026-31569Linux kernel LoongArch KVM EIOINTC emulation out-of-bounds read7.3CNA v3.10.2%2026-04-24Fix
CVE-2026-31568Linux kernel s390 secure storage access handling out-of-bounds read7.1NVD v3.10.2%2026-04-24Fix
CVE-2026-31567Linux kernel hibernation GFP mask restore reachable assertion5.5v3.10.1%2026-04-24Fix
CVE-2026-31566Linux kernel drm/amdgpu use-after-free7.8CNA v3.10.1%2026-04-24Fix
CVE-2026-31565Linux kernel irdma RDMA driver netdev reset deadlock5.5NVD v3.10.1%2026-04-24Fix
CVE-2026-31564Linux kernel KVM LoongArch eiointc emulation vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31563Linux kernel macb Ethernet driver Tx completion vulnerability7.5CNA v3.10.8%2026-04-24Fix
CVE-2026-31562Linux kernel MediaTek DSI driver probe null pointer dereference5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31561Linux kernel x86 FRED CR4 pinned bits handling vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31560Linux kernel spi-dw-dma driver vulnerability5.5NVD v3.10.1%2026-04-24Fix
CVE-2026-31559Linux kernel LoongArch device tree parsing null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31558Linux kernel KVM LoongArch vCPU lookup out-of-bounds read8.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31557Linux kernel NVMe target async event handling vulnerability7.5CNA v3.10.5%2026-04-24Fix
CVE-2026-31556Linux kernel XFS quota scrub deadlock5.5v3.10.1%2026-04-24Fix
CVE-2026-31555Linux kernel PI futex lock retry path vulnerability5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31554Linux kernel futex requeue use-after-free7.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31553Linux kernel KVM arm64 address translation emulation vulnerability8.8CNA v3.10.2%2026-04-24Fix
CVE-2026-31552Linux kernel wlcore Wi-Fi driver Tx path infinite loop7.5CNA v3.10.7%2026-04-24Fix
CVE-2026-31551Linux kernel mac80211 AQL debugfs interface integer underflow5.5v3.10.1%2026-04-24Fix
CVE-2026-31550Linux kernel BCM2835 power domain ASB control denial of service5.5v3.10.1%2026-04-24Fix
CVE-2026-31549Linux kernel cp2615 I2C driver probe null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31548Linux kernel cfg80211 peer measurement (PMSR) vulnerability7.8CNA v3.10.1%2026-04-24Fix
CVE-2026-31547Linux kernel Xe GPU driver runtime PM handling vulnerability5.5v3.10.1%2026-04-24Fix
CVE-2026-31546Linux kernel bonding RLB debug interface null pointer dereference5.5NVD v3.10.2%2026-04-24Fix
CVE-2026-31545Linux kernel NFC nxp-nci driver reachable assertion5.5v3.10.1%2026-04-24Fix
CVE-2026-31544Linux kernel SCMI firmware notification handler null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31543Linux kernel crash dump key retrieval information disclosure5.5v3.10.1%2026-04-24Fix
CVE-2026-31542Linux kernel x86 UV platform driver denial of service5.5v3.10.1%2026-04-24Fix
CVE-2026-31541Linux kernel ftrace trace_marker use-after-free7.8v3.10.1%2026-04-24Fix
CVE-2026-31540Linux kernel i915 GPU driver null pointer dereference5.5v3.10.1%2026-04-24Fix
CVE-2026-31539In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between7.5CNA v3.10.3%2026-04-24Fix
CVE-2026-31538In the Linux kernel, the following vulnerability has been resolved: smb: server: make use of smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between7.5CNA v3.10.6%2026-04-24Fix
CVE-2026-31537In the Linux kernel, the following vulnerability has been resolved: smb: server: make use of smbdirect_socket.send_io.bcredits It turns out that our code will corrupt the stream of reassabled data transfer messages when we trigger an immendiate (empty) send. In order to fix this we'll have a sing5.5v3.10.1%2026-04-24Fix
CVE-2026-31536In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the final request that has IB_SEND_SIGNALED9.8CNA v3.10.6%2026-04-24Fix
CVE-2026-31535Linux kernel smb client time-of-check time-of-use race condition4.7v3.10.1%2026-04-24Fix
CVE-2026-31052Hostbill checkout authentication flow denial of service5.3CISA ADP v3.10.8%2026-04-24
CVE-2026-31051Hostbill Client Balance component denial of service3.8CISA ADP v3.10.6%2026-04-24
CVE-2026-31050Hostbill v.2025-11-24 and cross-site scripting4.9CISA ADP v3.10.9%2026-04-24
CVE-2026-30368Lightspeed Classroom incorrect authorization5.4CNA v3.10.3%2026-04-24Exploit code
CVE-2026-29197Rocket.Chat improper access control4.3CISA ADP v3.10.3%2026-04-24Fix
CVE-2026-29051melange has path traversal via .PKGINFO in --persist-lint-results4.4CNA v3.10.2%2026-04-24Fix
CVE-2026-29050melange has path traversal when Resolving External Pipelines via Unvalidated pipeline[].uses6.1CNA v3.10.2%2026-04-24Fix
CVE-2026-27843SenseLive X3050 missing authentication for critical function9.2CNA v4.00.8%2026-04-24
CVE-2026-27841SenseLive X3050 cross-site request forgery8.4CNA v4.00.2%2026-04-24
CVE-2026-25775SenseLive X3050 missing authentication for critical function9.3CNA v4.00.8%2026-04-24
CVE-2026-25720SenseLive X3050 insufficient session expiration5.4v3.10.4%2026-04-24