CVE-2026 records published in April 2026
This page lists the 5,323 CVE-2026 records published in April 2026, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 13 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2026 list filters these records by severity or signal.
- Critical
- 56510.6% of these records
- Listed in CISA KEV
- 130.2% of these records
- Reported exploited
- 120.2% of these records
- Detection signal
- 791.5% of these records
- Exploit code
- 1803.4% of these records
- Actionable vendor fix
- 3,95874.4% of these records
Figures as of 2026-10-24 13:48 UTC. Records published in April 2026 have had from about six months to about seven months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2026-42800 | ASR Lapwing_Linux deference after null check in ims_client sip | 7.4CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-42799 | ASR Kestrel out-of-bounds read in ulp | 7.4CNA v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-42798 | little cms color engine integer overflow | 4.0CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-42512 | FreeBSD remotely triggerable out-of-bounds heap write in dhclient | 8.1CISA ADP v3.1 | 1.8% | 2026-04-30 | Fix |
| CVE-2026-42511 | FreeBSD remote code execution via malicious DHCP options | 8.1CISA ADP v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-41882 | JetBrains IntelliJ IDEA link following | 7.4CNA v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-41263 | Traefik: BasicAuth middleware: Timing side-channel | 6.3CNA v4.0 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-41226 | Ricoh Multiple laser printers and MFPs which implement Web Image Monitor open redirect | 5.1CNA v4.0 | 0.4% | 2026-04-30 | |
| CVE-2026-41174 | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding | 4.8CNA v4.0 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-41016 | Apache Airflow Providers SMTP STARTTLS connection improper certificate validation | 5.9CISA ADP v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-40951 | Memory corruption in Secure Access Windows clients | 6.8CNA v4.0 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-40950 | Buffer overflow in the Secure Access server | 7.1CNA v4.0 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-40949 | Absolute Software Secure Access buffer overflow in Windows clients | 6.8CNA v4.0 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-40912 | Traefik: StripPrefixRegex auth bypass via Path/RawPath desync | 7.8CNA v4.0 | 0.7% | 2026-04-30 | Fix |
| CVE-2026-40904 | Chartbrew dataset and data request routes improper access control | 8.1CNA v3.1 | 0.4% | 2026-04-30 | |
| CVE-2026-40687 | Exim missing resource initialization | 9.1v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-40686 | Exim out-of-bounds read | 5.3v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-40685 | Exim incorrect behavior | 9.8v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-40684 | Exim incorrect behavior | 7.5v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-40603 | Chartbrew: Incorrect Access Control in /API/project/dashboard/:brewName via same-team override | 6.5CNA v3.1 | 0.4% | 2026-04-30 | |
| CVE-2026-40601 | Chartbrew: Missing authorization in /API/chart/:chart_id/query via team-level refresh toggle | 7.5CNA v3.1 | 0.5% | 2026-04-30 | |
| CVE-2026-40600 | Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id | 8.1CNA v3.1 | 0.4% | 2026-04-30 | |
| CVE-2026-40595 | Chartbrew public chart and export routes improper access control | 7.5CNA v3.1 | 0.5% | 2026-04-30 | |
| CVE-2026-39858 | Traefik: Forwarded alias spoofing top pre-auth decision bypass | 7.8CNA v4.0 | 0.6% | 2026-04-30 | Fix |
| CVE-2026-39457 | FreeBSD stack overflow via select file descriptor set overflow | 7.8CISA ADP v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-38940 | RafyMrX TOKO-ONLINE-ROTI v.1.0 cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2026-04-30 | |
| CVE-2026-38939 | andrewtch88 mvc-ecommerce v.1.0 cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2026-04-30 | |
| CVE-2026-36960 | U-SPEED N300 Router cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2026-04-30 | |
| CVE-2026-36959 | U-speed N300 missing brute-force protection | 7.5CISA ADP v3.1 | 0.5% | 2026-04-30 | |
| CVE-2026-36958 | U-speed N300 A denial of service | 7.5CISA ADP v3.1 | 0.5% | 2026-04-30 | |
| CVE-2026-36957 | Dbitnet Dbit N300 T1 Pro deadlock | 7.5CISA ADP v3.1 | 0.5% | 2026-04-30 | |
| CVE-2026-36956 | Dbitnet Dbit N300 T1 Pro web management interface of the cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2026-04-30 | |
| CVE-2026-36767 | Shopizer has a path traversal issue | 10.0CISA ADP v3.1 | 0.6% | 2026-04-30 | |
| CVE-2026-36766 | Shopizer is vulnerable to cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-04-30 | |
| CVE-2026-36765 | /designer/loadReport endpoint of SpringBlade v4.8.0 An XML external entity injection | 8.8CISA ADP v3.1 | 0.6% | 2026-04-30 | |
| CVE-2026-36764 | /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 server-side request forgery | 5.0CISA ADP v3.1 | 0.3% | 2026-04-30 | |
| CVE-2026-36763 | /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-04-30 | |
| CVE-2026-36762 | JeeSite file upload path traversal | 8.8CISA ADP v3.1 | 0.7% | 2026-04-30 | |
| CVE-2026-36761 | /msg/msgInner/save endpoint of JeeSite v5.15.1 stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-04-30 | |
| CVE-2026-36760 | JeeSite chunked file upload path traversal | 9.6CISA ADP v3.1 | 0.6% | 2026-04-30 | |
| CVE-2026-36759 | halo theme upgrade endpoint server-side request forgery | 6.5CISA ADP v3.1 | 0.4% | 2026-04-30 | |
| CVE-2026-36758 | /themes/-/install-from-uri endpoint of halo v2.22.14 server-side request forgery | 4.3CISA ADP v3.1 | 0.3% | 2026-04-30 | |
| CVE-2026-36757 | halo plugin upgrade endpoint server-side request forgery | 4.3CISA ADP v3.1 | 0.3% | 2026-04-30 | |
| CVE-2026-36756 | /plugins/-/install-from-uri endpoint of halo v2.22.14 server-side request forgery | 5.4CISA ADP v3.1 | 0.2% | 2026-04-30 | |
| CVE-2026-36340 | Krayin CRM allows a remote attacker to execute arbitrary code via compose email function | 8.1CISA ADP v3.1 | 0.8% | 2026-04-30 | Fix |
| CVE-2026-35547 | FreeBSD heap overflow in libnv | 8.1CISA ADP v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-35514 | Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew | 6.5CNA v3.1 | 0.4% | 2026-04-30 | |
| CVE-2026-35051 | Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth | 7.8CNA v4.0 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-33845 | GnuTLS: GnuTLS: Denial of service via dtls zero-length fragment | 9.1NVD v3.1 | 0.9% | 2026-04-30 | Fix |
| CVE-2026-33452 | Absolute Software Secure Access buffer overflow in Windows clients | 5.9CNA v4.0 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-33451 | Absolute Software Secure Access arbitrary read/write vulnerability in Windows clients | 8.5CNA v4.0 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-33450 | Out-of-bounds read in Secure Access MacOS clients | 2.3CNA v4.0 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-33449 | Absolute Software Secure Access message handler buffer overflow in clients | 2.3CNA v4.0 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-33448 | Absolute Software Secure Access format string vulnerability in MacOS clients | 4.8CNA v4.0 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-33447 | Absolute Software Secure Access message parsing function of the buffer overflow | 2.3CNA v4.0 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-33446 | Absolute Software Secure Access buffer overflow in client authentication prior to | 2.3CNA v4.0 | 0.5% | 2026-04-30 | Fix |
| CVE-2026-32148 | Lockfile checksums not verified in Hex allows dependency integrity bypass | 8.9CNA v4.0 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-31787 | Linux kernel Xen privcmd driver double free | 7.8v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-31786 | Linux kernel Xen hypervisor build ID interface out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-31693 | Linux kernel CIFS request replay vulnerability | 7.8CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-31692 | Linux kernel rtnetlink peer namespace check vulnerability | 5.5v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-28909 | Apple macOS insufficiently protected credentials | 6.5CISA ADP v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-28532 | FRRouting integer overflow in OSPF TLV parser functions | 6.0CNA v4.0 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-22070 | ColorOS Assistant path traversal | 7.1CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-7551 | HKUDS OpenHarness remote command execution via /bridge Slash command | 8.7CNA v4.0 | 1.0% | 2026-04-30 | |
| CVE-2026-7510 | OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization | 5.3CNA v4.0 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-7508 | Bootstrap CMS Page Creation show.blade.php code injection | 5.3CNA v4.0 | 0.4% | 2026-04-30 | |
| CVE-2026-7506 | SourceCodester Hotel Management System check SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-30 | |
| CVE-2026-7505 | nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization | 6.9CNA v4.0 | 0.5% | 2026-04-30 | Fix |
| CVE-2026-7503 | code-projects for Plugin cstecgi.cgi setWiFiMultipleConfig buffer overflow | 8.7CNA v4.0 | 0.8% | 2026-04-30 | |
| CVE-2026-7502 | LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization | 5.3CNA v4.0 | 0.4% | 2026-04-30 | |
| CVE-2026-7501 | LinkStackOrg LinkStack UserController.php editPage cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-04-30 | |
| CVE-2026-7500 | Keycloak has a forced browsing issue | 5.4CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-7470 | Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow | 8.7CNA v4.0 | 1.0% | 2026-04-30 | |
| CVE-2026-7469 | Tenda 4G300 DelFil sub_425A28 command injection | 5.3CNA v4.0 | 3.2% | 2026-04-30 | |
| CVE-2026-7468 | 1024-lab smart-admin Demo Site index.html access control | 6.9CNA v4.0 | 0.5% | 2026-04-30 | |
| CVE-2026-7461 | OS command injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials | 7.5CNA v4.0 | 0.8% | 2026-04-30 | Fix |
| CVE-2026-7447 | SourceCodester Pet Grooming Management Software update_customer.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-30 | |
| CVE-2026-7446 | VetCoders mcp-server-semgrep MCP index.ts create_rule os command injection | 6.9CNA v4.0 | 2.2% | 2026-04-30 | Fix |
| CVE-2026-7445 | ZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal | 5.3CNA v4.0 | 0.4% | 2026-04-30 | |
| CVE-2026-7435 | SSCMS SQL injection via stl:sqlContent queryString | 8.6CNA v4.0 | 0.8% | 2026-04-30 | |
| CVE-2026-7429 | SSCMS reflected cross-site scripting via STL Processing | 2.1CNA v4.0 | 0.3% | 2026-04-30 | |
| CVE-2026-7402 | Improper Rate Limiting in MeWare Software's PDKS | 8.1CNA v3.1 | 0.5% | 2026-04-30 | Fix |
| CVE-2026-7399 | IDOR in MeWare Software's PDKS | 8.1CNA v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-7382 | Information disclosure in MeWare Software's PDKS | 6.5CNA v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-7379 | Missing release of memory after effective lifetime in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-7378 | Heap-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-7376 | Null pointer dereference in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-7375 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-7270 | FreeBSD local privilege escalation via execve | 7.8CISA ADP v3.1 | 0.2% | 2026-04-30 | Exploit codeFix |
| CVE-2026-7246 | Pallets Click contains a command injection via Unsanitized Filename Click.edit | 7.2CISA ADP v3.1 | 0.9% | 2026-04-30 | Fix |
| CVE-2026-7164 | FreeBSD pf can overflow the stack parsing crafted SCTP packets | 7.5CISA ADP v3.1 | 0.5% | 2026-04-30 | Fix |
| CVE-2026-7163 | Red Hat multicluster engine for Kubernetes cleartext storage of sensitive information | 6.1CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6870 | Access of uninitialized pointer in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6869 | Improperly controlled sequential memory allocation in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6868 | Stack-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-6867 | Improperly controlled sequential memory allocation in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6543 | IBM authenticated remote code execution vulnerability in Langflow Code Validation endpoint | 8.8CNA v3.1 | 0.7% | 2026-04-30 | Fix |
| CVE-2026-6542 | IBM Langflow monitor API insecure direct object reference | 6.5CNA v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-6539 | Notepad++ format string injection via nativeLang.xml | 4.6CNA v4.0 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6538 | Stack-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6537 | Stack-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6536 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6535 | Improperly controlled sequential memory allocation in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6534 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6533 | Improperly controlled sequential memory allocation in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6532 | Buffer over-read in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6531 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6530 | Heap-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6529 | Heap-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6528 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6527 | Uncontrolled recursion in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6526 | Null pointer dereference in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6524 | Access of uninitialized pointer in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6523 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6522 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-6521 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6520 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-6519 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-6498 | Rustaurius Five Star Restaurant Reservations payment verification vulnerability | 5.3CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-6389 | IBM Turbonomic prometurbo agent privilege escalation | 8.8CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-5657 | Double free in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-5656 | Improper limitation of a pathname to a restricted directory (path traversal) in Wireshark | 7.0CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-5655 | Wireshark SDP protocol dissector crash | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-5654 | Stack-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-5653 | Heap-based buffer overflow in Wireshark | 5.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-5409 | Uncontrolled recursion in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-5408 | Uncontrolled recursion in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-5407 | Loop with unreachable exit condition (infinite loop) in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-5406 | Uncontrolled recursion in Wireshark | 5.5CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-5405 | Heap-based buffer overflow in Wireshark | 7.8CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-5403 | Heap-based buffer overflow in Wireshark | 7.8CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-5402 | Heap-based buffer overflow in Wireshark | 8.8CNA v3.1 | 0.7% | 2026-04-30 | Fix |
| CVE-2026-5401 | Uncontrolled recursion in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-5299 | Uncontrolled recursion in Wireshark | 5.5CNA v3.1 | 0.1% | 2026-04-30 | Fix |
| CVE-2026-5174 | Improper access control vulnerability in Progress MOVEit Automation | 7.7CNA v3.1 | 0.5% | 2026-04-30 | Fix |
| CVE-2026-5080 | Dancer::Session::Abstract versions for Perl generates session ids insecurely | 5.9CISA ADP v3.1 | 0.5% | 2026-04-30 | Fix |
| CVE-2026-4670 | Improper authentication vulnerability in Progress MOVEit Automation | 9.8CNA v3.1 | 0.6% | 2026-04-30 | Fix |
| CVE-2026-4503 | IBM Langflow Desktop image download endpoint insecure direct object reference | 7.5CNA v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-4502 | IBM arbitrary file write and remote code execution vulnerability in Langflow v2 API | 6.5CNA v3.1 | 0.4% | 2026-04-30 | Fix |
| CVE-2026-3833 | GnuTLS: GnuTLS: Policy bypass due to case-sensitive nameconstraints comparison | 7.4NVD v3.1 | 0.9% | 2026-04-30 | Fix |
| CVE-2026-3832 | GnuTLS logic flaw | 3.7CNA v3.1 | 0.9% | 2026-04-30 | Fix |
| CVE-2026-3346 | IBM stored cross-site scripting (XSS) in Langflow Markdown Rendering via rehypeRaw | 6.4CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-3345 | IBM Langflow Desktop file upload API path traversal | 6.5CNA v3.1 | 0.6% | 2026-04-30 | Fix |
| CVE-2026-3340 | IBM server-side request forgery (SSRF) in Langflow URL component | 6.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-2892 | Otter Blocks WordPress plugin improper authorization to unauthenticated Purchase verification bypass | 7.5CNA v3.1 | 0.5% | 2026-04-30 | Fix |
| CVE-2026-2311 | IBM i is affected by a privilege escalation vulnerability in Web Administration GUI [] | 6.4CNA v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-1577 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.3% | 2026-04-30 | Fix |
| CVE-2026-1493 | Cross-site scripting in LEX Baza Dokumentów | 5.4v3.1 | 0.2% | 2026-04-30 | Fix |
| CVE-2026-42652 | User Registration WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42648 | Spectra WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42646 | TaxoPress WordPress plugin SQL injection | 7.6CNA v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-42645 | Barcode Scanner with Inventory and Order Manager WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2026-04-29 | Fix |
| CVE-2026-42644 | BetterDocs WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42643 | Image Widget WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-42642 | GiveWP WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42641 | Share This Image WordPress plugin server side request forgery (SSRF) | 5.4CNA v3.1 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-42615 | CyberChef has a cross-site scripting issue | 7.2CNA v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-42525 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect | 4.3CISA ADP v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42524 | Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file | 8.0CISA ADP v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-42523 | Jenkins GitHub Plugin has an XSS | 9.0CISA ADP v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-42522 | Jenkins GitHub Branch Source Plugin missing authorization | 4.3CISA ADP v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42521 | Jenkins Matrix Authorization Strategy Plugin deserialization of untrusted data | 6.5CISA ADP v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-42520 | Jenkins Credentials Binding Plugin has a path traversal | 7.5CISA ADP v3.1 | 0.6% | 2026-04-29 | Fix |
| CVE-2026-42519 | Jenkins Script Security Plugin A missing authorization | 4.3CISA ADP v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42518 | Information disclosure vulnerability in e-Sushrut HMIS | 8.7CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-42517 | CDAC-Noida e-Sushrut HMIS insecure direct object reference | 7.1CNA v4.0 | 0.4% | 2026-04-29 | |
| CVE-2026-42516 | Broken access control vulnerability in e-Sushrut HMIS | 7.1CNA v4.0 | 0.4% | 2026-04-29 | |
| CVE-2026-42515 | Insecure direct object reference (IDOR) vulnerability in e-Sushrut HMIS | 7.1CNA v4.0 | 0.4% | 2026-04-29 | |
| CVE-2026-42514 | Sensitive data exposure vulnerability in e-Sushrut HMIS | 8.8CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-42513 | Authentication bypass vulnerability in e-Sushrut HMIS | 8.8CNA v4.0 | 0.8% | 2026-04-29 | |
| CVE-2026-42412 | WP User Frontend WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42377 | SureForms Pro WordPress plugin broken access control | 7.3CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-42249 | Remote code execution in Ollama via Update Mechanism | 9.8v3.1 | 1.0% | 2026-04-29 | MetasploitExploit codeKCV |
| CVE-2026-42248 | Missing signature verification for Updates in Ollama | 9.8v3.1 | 0.7% | 2026-04-29 | MetasploitExploit codeKCV |
| CVE-2026-42198 | PostgreSQL JDBC Driver SCRAM authentication denial of service | 7.5CNA v3.1 | 4.1% | 2026-04-29 | Fix |
| CVE-2026-41952 | Acronis DeviceLock DLP write-what-where condition | 7.8CNA v3.0 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) missing authentication for critical function | 9.3CNA v4.0 | 98.5% | 2026-04-29 | KEVNucleiMetasploitExploit codeFix |
| CVE-2026-41499 | Wazuh: Multiple Heap-based null write Buffer Underflows in parse_uname_string | 6.5CNA v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-41220 | Acronis DeviceLock DLP out-of-bounds write | 7.8CNA v3.0 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-40560 | Starman versions for Perl allows HTTP request smuggling via Improper Header Precedence | 7.5CISA ADP v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-40230 | Helpy stored XSS in knowledgebase Doc body rendering | 5.4v3.1 | 0.3% | 2026-04-29 | |
| CVE-2026-40229 | Helpy stored XSS in post author display via PostsHelper | 5.4v3.1 | 0.3% | 2026-04-29 | |
| CVE-2026-38993 | Cockpit is vulnerable to directory traversal | 6.5CISA ADP v3.1 | 1.0% | 2026-04-29 | Fix |
| CVE-2026-38992 | Cockpit is vulnerable to arbitrary code execution | 9.8CISA ADP v3.1 | 0.7% | 2026-04-29 | Fix |
| CVE-2026-38991 | Cockpit vulnerable to unrestricted upload of file with dangerous type | 8.8CISA ADP v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-37555 | libsndfile integer overflow | 7.5CISA ADP v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-36841 | TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function. | 9.8CISA ADP v3.1 | 1.8% | 2026-04-29 | |
| CVE-2026-36837 | TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function. | 7.5CISA ADP v3.1 | 0.5% | 2026-04-29 | |
| CVE-2026-35155 | Dell iDRAC10 insufficiently protected credentials | 7.1CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-34965 | Cockpit CMS authenticated remote code execution via Collections | 8.7CNA v4.0 | 1.3% | 2026-04-29 | |
| CVE-2026-30893 | Wazuh cluster sync file extraction path traversal | 9.0CNA v3.1 | 0.6% | 2026-04-29 | Fix |
| CVE-2026-30769 | Entechtaiwan Tvicport improper privilege management | 7.8CISA ADP v3.1 | 0.1% | 2026-04-29 | |
| CVE-2026-28221 | Wazuh wazuh-remoted stack-based buffer overflow | 6.5CNA v3.1 | 0.6% | 2026-04-29 | Fix |
| CVE-2026-27105 | Dell/Alienware Purchased Apps link following | 6.3CNA v3.1 | 0.1% | 2026-04-29 | Fix |
| CVE-2026-26206 | Wazuh: API brute-force protection bypass via race condition in login attempt tracking | 6.5CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-26204 | Wazuh: Heap-based null write buffer underflow in GetAlertData | 4.4CNA v3.1 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-26015 | Unauthenticated RCE in DocsGPT MCP STDIO Configuration | 10.0CNA v4.0 | 1.5% | 2026-04-29 | Fix |
| CVE-2026-25852 | Acronis DeviceLock DLP uncontrolled search path | 6.7CNA v3.0 | 0.1% | 2026-04-29 | Fix |
| CVE-2026-23773 | Dell Disk Library for mainframe DLm8700 server-side request forgery | 4.3CNA v3.1 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-22745 | VMware Spring Framework denial of service in static resource handling on Windows platforms | 5.3CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-22741 | Static resource cache poisoning in Spring MVC and WebFlux | 3.1CNA v3.1 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-22740 | Spring Framework DoS with Multipart Temp files in WebFlux | 6.5CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-21023 | Samsung Mobile Devices PackageManagerService insufficient verification of data authenticity | 6.9CNA v4.0 | 0.1% | 2026-04-29 | Fix |
| CVE-2026-7466 | AgentFlow arbitrary Python Pipeline Execution via pipeline_path | 7.7CNA v4.0 | 0.6% | 2026-04-29 | |
| CVE-2026-7443 | BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection | 6.9CNA v4.0 | 2.1% | 2026-04-29 | |
| CVE-2026-7439 | AgentFlow Local Web API Content-Type Validation Bypass | 4.8CNA v4.0 | 0.1% | 2026-04-29 | |
| CVE-2026-7426 | Amazon FreeRTOS-Plus-TCP IPv6 router advertisement processing out-of-bounds write | 6.1CNA v4.0 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-7425 | Out-of-bounds read in Router Advertisement option parser in FreeRTOS-Plus-TCP | 6.0CNA v4.0 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-7424 | Integer underflow in DHCPv6 Sub-Option parser in FreeRTOS-Plus-TCP | 7.2CNA v4.0 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-7423 | Integer underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP | 6.0CNA v4.0 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-7422 | MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing | 7.1CNA v4.0 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-7420 | UTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow | 8.7CNA v4.0 | 0.8% | 2026-04-29 | |
| CVE-2026-7419 | UTT HiPER 1250GW formTaskEdit_ap strcpy buffer overflow | 8.7CNA v4.0 | 0.8% | 2026-04-29 | |
| CVE-2026-7418 | UTT HiPER 1250GW NTP strcpy buffer overflow | 8.7CNA v4.0 | 0.8% | 2026-04-29 | |
| CVE-2026-7417 | Algovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-29 | |
| CVE-2026-7416 | PolarVista xcode-mcp-server MCP index.ts run_tests os command injection | 6.9CNA v4.0 | 2.1% | 2026-04-29 | |
| CVE-2026-7410 | SourceCodester Pizzafy Ecommerce System ajax.php add_to_cart SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-7409 | SourceCodester Pizzafy Ecommerce System ajax.php save_user SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-7408 | SourceCodester Pizzafy Ecommerce System ajax.php save_menu SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-7407 | SourceCodester Pizzafy Ecommerce System setting ajax.php save_settings SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-7404 | getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-29 | |
| CVE-2026-7403 | geldata gel-mcp server.py fetch_rule path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-29 | |
| CVE-2026-7401 | SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site scripting | 5.3CNA v4.0 | 0.4% | 2026-04-29 | |
| CVE-2026-7400 | geekgod382 filesystem-mcp-server read/write file tools path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-29 | Fix |
| CVE-2026-7398 | florensiawidjaja BioinfoMCP upload endpoint app.py upload path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-29 | |
| CVE-2026-7397 | NousResearch hermes-agent file_tools.py _check_sensitive_path symlink | 4.8CNA v4.0 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-7396 | NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal | 6.9CNA v4.0 | 0.7% | 2026-04-29 | |
| CVE-2026-7394 | SourceCodester Pizzafy Ecommerce System GET parameter view_order.php SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-7393 | SourceCodester Pizzafy Ecommerce System file extension handler unrestricted file upload | 5.1CNA v4.0 | 0.4% | 2026-04-29 | |
| CVE-2026-7392 | SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-29 | Exploit code |
| CVE-2026-7391 | SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-7390 | SourceCodester Pharmacy Sales and Inventory System customer page cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-04-29 | |
| CVE-2026-7389 | EyouCMS common.php GetSortData SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-29 | |
| CVE-2026-7388 | EyouCMS template File FilemanagerLogic.php editFile code injection | 5.1CNA v4.0 | 0.4% | 2026-04-29 | |
| CVE-2026-7386 | fatbobman mail-mcp-bridge mail_mcp_server.py path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-29 | Fix |
| CVE-2026-7384 | ezequiroga mcp-bases research_server.py search_papers path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-29 | |
| CVE-2026-7381 | Plack::Middleware::XSendfile versions for Perl can allow client-controlled path rewriting | 9.1CISA ADP v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-7111 | HMBRAND Text::CSV_XS use-after-free | 8.4CISA ADP v3.1 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-6915 | MongoDB Server Flaw in the updateUser command may allow Unauthorized Configuration Change | 5.3CNA v4.0 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-6914 | MongoDB Server MD5 checksum creation may cause availability loss | 7.1CNA v4.0 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-6849 | OS command injection in TUBITAK BILGEM's Pardus OS My Computer | 8.8CNA v3.1 | 1.4% | 2026-04-29 | Fix |
| CVE-2026-5712 | IdentityIQ Role Editor incorrect authorization | 8.0CNA v3.1 | 0.3% | 2026-04-29 | Fix |
| CVE-2026-5166 | Path traversal in TUBITAK BILGEM's Pardus Software Center | 9.6CNA v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-5161 | Improper authentication in TUBITAK BILGEM's Pardus About | 8.8CNA v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-5141 | Improper access control in TUBITAK BILGEM's Pardus Software Center | 8.8CNA v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-5140 | Authorization bypass in TUBITAK BILGEM's Pardus Update | 8.8CNA v3.1 | 0.6% | 2026-04-29 | Fix |
| CVE-2026-4019 | Complianz WordPress plugin unauthorized data access | 5.3CNA v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-3325 | SQL injection in MegaCMS by CRM Sistemas de Fidelización | 10.0CNA v4.0 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-2902 | WP Meteor Website Speed Optimization Addon WordPress plugin stored cross-site scripting | 6.1CNA v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-2810 | Netskope Client endpoint DLP driver out-of-bounds read | 6.8CNA v4.0 | 0.2% | 2026-04-29 | Fix |
| CVE-2026-1858 | wget2 improper certificate validation | 4.8CNA v3.1 | 0.2% | 2026-04-29 | |
| CVE-2026-0206 | SonicWall SonicOS post-authentication stack-based buffer overflow | 4.9CISA ADP v3.1 | 0.5% | 2026-04-29 | Fix |
| CVE-2026-0205 | SonicWall SonicOS post-authentication path traversal | 6.8CISA ADP v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-0204 | SonicWall SonicOS missing authentication | 8.0CISA ADP v3.1 | 0.4% | 2026-04-29 | Fix |
| CVE-2026-42510 | OpenStack Ironic is vulnerable to inclusion of functionality from untrusted control sphere | 7.2v3.1 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-42432 | OpenClaw Command Escalation via Node Pairing Reconnect Bypass | 7.3CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-42431 | OpenClaw Persistent Profile Mutation via node.invoke(browser.proxy) Bypass | 7.6CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-42430 | OpenClaw Strict Browser SSRF Bypass via Playwright Redirect Handling | 4.8CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-42429 | OpenClaw privilege escalation via Gateway Plugin HTTP Authentication | 6.0CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-42428 | OpenClaw Missing Integrity Verification in Package Downloads | 7.5CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-42427 | OpenClaw remote code execution via Build Tool Environment variable injection | 5.8CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-42426 | OpenClaw improper authorization in node.pair.approve via operator.write Scope | 8.7CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-42424 | OpenClaw Local File Exfiltration via Shared Reply MEDIA Paths | 5.0v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-42423 | OpenClaw strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback | 7.7CNA v4.0 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-42422 | OpenClaw Role Bypass in device.token.rotate function | 7.7CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-42421 | OpenClaw WebSocket Session Persistence via Shared Gateway Token Rotation | 2.3CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-42420 | OpenClaw Improper Base64 Decoding Size Validation | 6.5v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-42167 | ProFTPD SQL injection | 8.1CNA v3.1 | 7.3% | 2026-04-28 | Reported exploitedNucleiEmerging ThreatsExploit codeFix |
| CVE-2026-41916 | OpenClaw Stale Authentication State via Config Reload | 2.3CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41915 | OpenClaw Git Environment variable injection via Unfiltered Exec Environment | 6.1v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41914 | OpenClaw server-side request forgery in QQ Bot Media Fetch Paths | 5.1CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41913 | OpenClaw Rate-Limit Bypass via Concurrent Async Authentication Attempts | 6.3CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41912 | OpenClaw server-side request forgery Policy Bypass via Interaction-Triggered Navigation | 4.8CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41911 | OpenClaw Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image | 6.0CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-41910 | OpenClaw Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes | 2.3CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41873 | Pony Mail: Admin account takeover via request smuggling | 9.8v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41649 | Outline document share creation insecure direct object reference | 7.7CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41636 | Apache Thrift: Node.js skip recursion | 8.7CNA v4.0 | 0.7% | 2026-04-28 | Fix |
| CVE-2026-41607 | Apache Thrift: C++ JSON OOB read | 6.5CISA ADP v3.1 | 0.9% | 2026-04-28 | Fix |
| CVE-2026-41606 | Apache Thrift: C_glib dispatch stack overflow | 5.3CISA ADP v3.1 | 1.1% | 2026-04-28 | Fix |
| CVE-2026-41605 | Apache Thrift: Swift Compact protocol integer overflow | 7.3CISA ADP v3.1 | 1.3% | 2026-04-28 | Fix |
| CVE-2026-41604 | Apache Thrift: Swift Range crash in skip | 8.2CISA ADP v3.1 | 1.2% | 2026-04-28 | Fix |
| CVE-2026-41602 | Apache Thrift: Go TFramedTransport uint32 overflow | 7.5CISA ADP v3.1 | 1.4% | 2026-04-28 | Fix |
| CVE-2026-41526 | KDE KCoreAddons escape sequence injection | 7.8v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41525 | KDE Dolphin incorrect resource transfer | 6.5CNA v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41446 | WattBox 800 and 820 Series RCE via Diagnostic endpoints | 9.2CNA v4.0 | 0.8% | 2026-04-28 | Fix |
| CVE-2026-41408 | OpenClaw Disk Exhaustion via Media Download Bypass | 6.5v3.1 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-41407 | OpenClaw timing side channel in Shared-Secret Comparison | 5.3v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41406 | OpenClaw Sender Allowlist Bypass via Thread History and Quoted messages | 2.3CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41405 | OpenClaw resource exhaustion via Unauthenticated MS Teams Webhook Body Parsing | 8.7CNA v4.0 | 0.9% | 2026-04-28 | Fix |
| CVE-2026-41404 | OpenClaw Operator Admin privilege escalation via Trusted-Proxy Authentication | 7.7CNA v4.0 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-41403 | OpenClaw Access Control Bypass via Proxied Remote Request Misclassification | 4.0v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41402 | OpenClaw Webhook Replay Cache Cross-Target messageId Scope Bypass | 5.4v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41400 | OpenClaw resource consumption via Oversized WebSocket Frames in voice-call | 7.5v3.1 | 0.8% | 2026-04-28 | Fix |
| CVE-2026-41399 | OpenClaw denial of service via Unbounded Pre-auth WebSocket Upgrades | 8.7CNA v4.0 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-41398 | OpenClaw Unauthorized agent Request Dispatch via Untrusted Local-Network pages in iOS A2UI Bridge | 2.1CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41397 | OpenClaw sandbox escape via Unrestricted File Sync and Symlink Traversal | 9.6v3.1 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-41396 | OpenClaw Environment Variable Override of Plugin Trust Root | 7.8v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41395 | OpenClaw Webhook Replay via Query Parameter Reordering in Plivo V3 | 8.2CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41394 | OpenClaw Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes | 8.8CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-41393 | OpenClaw arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery | 4.8v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41392 | OpenClaw Exec Allowlist Bypass via Shell Init-File options | 7.3v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41391 | OpenClaw Environment Variable Bypass in Package Index URL Handling | 6.1v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41390 | OpenClaw Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper | 7.0CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41388 | OpenClaw Configuration Rehydration via Empty-Array Revocation Handling | 6.3CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41387 | OpenClaw Supply Chain Redirection via Incomplete Host Environment Sanitization | 8.5CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41386 | OpenClaw privilege escalation via Unbound Bootstrap Setup Codes | 9.8v3.1 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-41385 | OpenClaw Nostr Private key exposure via config.get Redaction Bypass | 7.1CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41384 | OpenClaw Environment variable injection via Workspace Config in CLI Backend | 8.5CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41383 | OpenClaw arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths | 6.1CNA v4.0 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-41382 | OpenClaw Discord Voice Ingress authorization bypass via Channel and Role Validation Gaps | 2.3CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41381 | OpenClaw Access Control Bypass in Discord Voice Manager via Channel Allowlist | 2.3CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41380 | OpenClaw arbitrary Execution Allowlist via Wrapper Carrier Executables | 7.0CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41379 | OpenClaw privilege escalation via chat.send to Admin-Class Talk Voice Config | 7.1CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41378 | OpenClaw privilege escalation to remote code execution via Unrestricted node.event Agent Dispatch | 7.7CNA v4.0 | 0.8% | 2026-04-28 | Fix |
| CVE-2026-41377 | OpenClaw Fail-Open Security Scan Bypass in Plugin Installation | 5.1CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41376 | OpenClaw Matrix Thread Context Allowlist Bypass via Sender Validation | 6.5v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41375 | OpenClaw authorization bypass in /phone arm and /phone disarm endpoints | 7.1CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-41374 | OpenClaw resource consumption via Discord Audio Preflight before Member Authorization | 6.9CNA v4.0 | 0.7% | 2026-04-28 | Fix |
| CVE-2026-41373 | OpenClaw Compiler Binary Substitution via Environment Variable Override in Host Execution Policy | 5.8CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-41372 | OpenClaw Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery | 6.9CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41371 | OpenClaw privilege escalation via chat.send Reset command | 8.4CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41370 | OpenClaw path traversal via Inbound Channel Attachment Path in ACP Dispatch | 7.1CNA v4.0 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-41369 | OpenClaw Insufficient Environment Variable Sanitization in Host Execution | 7.1CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-41368 | OpenClaw Environment Variable Disclosure via jq $ENV Filter Bypass | 7.1CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-41367 | OpenClaw Policy Enforcement Bypass in Discord Component Interactions | 5.3CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41366 | OpenClaw arbitrary host File Read via appendLocalMediaParentRoots Self-Whitelisting | 6.0CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41365 | OpenClaw Sender Allowlist Bypass via Graph API Thread History | 5.3CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-41364 | OpenClaw arbitrary file write via symlink following in SSH Sandbox Tar upload | 7.2CNA v4.0 | 0.7% | 2026-04-28 | Fix |
| CVE-2026-41363 | OpenClaw arbitrary file read via Feishu upload_image parameter | 6.5v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-41362 | OpenClaw Webhook Replay Dedupe Cache Event Suppression via Shared Authentication | 2.3CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-40980 | Spring AI vulnerable to OOM by attacker-controlled PDF | 6.5CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-40979 | Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory | 6.1CNA v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-40978 | Spring AI has SQL injection in CosmosDBVectorStore.doDelete | 8.8CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-40977 | Spring Boot's PID file write follows symlinks at predictable default path | 4.7CNA v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-40974 | Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification | 5.0CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-40973 | Spring Boot accepts predictable temp directory without ownership verification | 7.0CNA v3.1 | 0.1% | 2026-04-28 | Fix |
| CVE-2026-40972 | Spring Boot DevTools remote secret comparison is vulnerable to timing attacks | 7.5CNA v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-40969 | Spring gRPC AuthenticationException message reflected to remote client | 3.7CNA v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-40968 | Spring gRPC SecurityContext leaks across requests on authorization failure | 4.3CNA v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-40967 | Spring AI has a VectorStore FilterExpression Converter injection | 8.6CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-40966 | VMware Spring AI VectorStoreChatMemoryAdvisor conversation memory improper access control | 5.9CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-40552 | Remote code execution in multiple BinSoft products | 4.7CNA v4.0 | 0.5% | 2026-04-28 | |
| CVE-2026-40551 | BinSoft mpGabinet client-side authentication | 8.4CNA v4.0 | 0.2% | 2026-04-28 | KCV |
| CVE-2026-40550 | Privilege escalation in multiple BinSoft products | 6.9CNA v4.0 | 0.2% | 2026-04-28 | KCV |
| CVE-2026-40356 | MIT Kerberos 5 integer underflow | 7.5v3.1 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-40355 | MIT Kerberos 5 null pointer dereference | 7.5NVD v3.1 | 0.8% | 2026-04-28 | Fix |
| CVE-2026-38949 | HTMLy version cross-site scripting | 8.9CISA ADP v3.1 | 0.4% | 2026-04-28 | |
| CVE-2026-38948 | FUEL CMS v1.5.2 and cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2026-04-28 | |
| CVE-2026-38651 | Netmaker does not verify JWT signatures for host tokens | 8.2CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-37750 | School Management System by mahmoudai1 reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2026-04-28 | Exploit code |
| CVE-2026-33467 | Elastic Package Registry has improper verification of cryptographic signature | 5.9CNA v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-32649 | Milesight Cameras OS command injection | 7.3CNA v4.0 | 1.5% | 2026-04-28 | Fix |
| CVE-2026-32644 | Milesight Cameras use of hard-coded cryptographic key | 9.2CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-27785 | Milesight Cameras use of hard-coded credentials | 7.7CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-27760 | OpenCATS PHP code injection via installer AJAX endpoint | 9.2CNA v4.0 | 3.4% | 2026-04-28 | NucleiMetasploitEmerging ThreatsExploit code |
| CVE-2026-24231 | NVIDIA NemoClaw server-side request forgery | 6.3CNA v3.1 | 0.1% | 2026-04-28 | Fix |
| CVE-2026-24222 | NVIDIA NemoClaw system information disclosure | 8.6CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-24204 | NVIDIA FLARE SDK improper input validation | 6.5CNA v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-24186 | NVIDIA FLARE SDK deserialization of untrusted data | 8.8CNA v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-24178 | NVIDIA NVFlare Dashboard: Authorization bypass | 9.8CNA v3.1 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-20766 | Milesight Cameras heap-based buffer overflow | 8.6CNA v4.0 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7363 | Google Chrome Canvas use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7361 | Google Chrome iOS use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7360 | Google Chrome improper input validation | 3.1CISA ADP v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-7359 | Google Chrome ANGLE use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7358 | Google Chrome Animation use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7357 | Google Chrome GPU use-after-free | 7.5CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7356 | Google Chrome Navigation use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7355 | Google Chrome Media use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7354 | Google Chrome Angle out-of-bounds read | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7353 | Google Chrome Skia heap-based buffer overflow | 8.3CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7352 | Google Chrome Media use-after-free | 8.3CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7351 | Google Chrome race condition | 3.1CISA ADP v3.1 | 0.1% | 2026-04-28 | Fix |
| CVE-2026-7350 | Google Chrome WebMIDI use-after-free | 8.3CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7349 | Google Chrome Cast use-after-free | 7.5CISA ADP v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-7348 | Google Chrome Codecs use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7347 | Google Chrome Chromoting use-after-free | 8.1CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7346 | Google Chrome Tint inappropriate implementation | 8.1CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7345 | Google Chrome sandbox escape | 8.3CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7344 | Google Chrome Accessibility use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7343 | Google Chrome Views use-after-free | 7.5CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7342 | Google Chrome WebView use-after-free | 8.8CISA ADP v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-7341 | Google Chrome WebRTC use-after-free | 8.8CISA ADP v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-7340 | Google Chrome ANGLE integer overflow | 4.3CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7339 | Google Chrome WebRTC heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7338 | Google Chrome Cast use-after-free | 7.5CISA ADP v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-7337 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7336 | Google Chrome WebRTC use-after-free | 8.8CISA ADP v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-7335 | Google Chrome media use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7334 | Google Chrome Views use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7333 | Google Chrome GPU use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-7324 | Memory safety bugs fixed in Thunderbird | 7.3CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7323 | Memory safety bugs fixed in Thunderbird ESR and Thunderbird | 7.3CISA ADP v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-7322 | Memory safety bugs fixed in Thunderbird ESR and Thunderbird | 7.3CISA ADP v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-7321 | Mozilla Firefox and Thunderbird WebRTC networking buffer overflow | 9.6CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7320 | Mozilla Firefox and Thunderbird Audio/Video component out-of-bounds read | 7.5CISA ADP v3.1 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-7319 | elinsky execution-system-mcp add_action tool server.py _get_context_file_path path traversal | 6.9CNA v4.0 | 0.8% | 2026-04-28 | |
| CVE-2026-7318 | elie mcp-project research_server.py search_papers path traversal | 5.1CNA v4.0 | 0.2% | 2026-04-28 | |
| CVE-2026-7317 | Grav CMS Cache Value FileCache.php doGet deserialization | 2.3CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-7316 | eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection | 6.9CNA v4.0 | 2.1% | 2026-04-28 | |
| CVE-2026-7315 | eiceblue spire-pdf-mcp-server PDF file server.py get_pdf_path path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7314 | eiceblue spire-doc-mcp-server base.py get_doc_path path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7309 | Openshift-controller-manager: Openshift Container Platform: Information disclosure | 4.3CNA v3.1 | 0.3% | 2026-04-28 | |
| CVE-2026-7306 | Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key | 6.3CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7305 | Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery | 5.3CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7303 | Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection | 6.3CNA v4.0 | 0.7% | 2026-04-28 | Fix |
| CVE-2026-7297 | SourceCodester Pizzafy Ecommerce System ajax.php save_user cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7296 | SourceCodester Pizzafy Ecommerce System ajax.php save_order cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7295 | SourceCodester Pizzafy Ecommerce System ajax.php save_menu cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7294 | SourceCodester Pizzafy Ecommerce System index.php save_settings cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7293 | SourceCodester Pizzafy Ecommerce System ajax.php delete_category SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7292 | O2OA NodeAgent NodeAgent.java syncFile improper authorization | 6.3CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7291 | O2OA URL Fetching FileAction.java FileAction server-side request forgery | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7290 | JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7289 | D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow | 8.7CNA v4.0 | 1.2% | 2026-04-28 | |
| CVE-2026-7288 | D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow | 8.7CNA v4.0 | 1.2% | 2026-04-28 | |
| CVE-2026-7283 | SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7282 | SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7281 | SourceCodester Pharmacy Sales and Inventory System index.php supplier cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7280 | eMPIA Technology|AVACAST unquoted service path | 8.4CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-7279 | eMPIA Technology|AVACAST DLL hijacking | 8.5CNA v4.0 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-7272 | WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7271 | DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal | 6.9CNA v4.0 | 0.7% | 2026-04-28 | |
| CVE-2026-7269 | SourceCodester Pharmacy Sales and Inventory System index.php cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7268 | SourceCodester Pizzafy Ecommerce System ajax.php save_category SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7267 | SourceCodester Pizzafy Ecommerce System view_prod.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7266 | SourceCodester Pizzafy Ecommerce System ajax.php save_order SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7265 | SourceCodester Pizzafy Ecommerce System index.php category SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7264 | SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7248 | D-Link DI-8100 CGI endpoint tgfile.htm tgfile_htm buffer overflow | 9.4v3.1 | 3.8% | 2026-04-28 | |
| CVE-2026-7247 | D-Link DI-8100 file extension file_exten.asp file_exten_asp buffer overflow | 8.6CNA v4.0 | 1.2% | 2026-04-28 | |
| CVE-2026-7244 | Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7243 | Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7242 | Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7241 | Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7240 | Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7238 | code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload | 5.1CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7237 | AgiFlow scaffold-mcp write-to-file tool index.ts path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | Fix |
| CVE-2026-7235 | ErlichLiu claude-agent-sdk-master route.ts path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7234 | BrowserOperator browser-operator-core server.js startsWith path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7233 | Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds | 6.1v3.1 | 0.2% | 2026-04-28 | |
| CVE-2026-7230 | SourceCodester Safety Anger Pad cross-site scripting | 5.3CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7229 | code-projects Coaching Management System POST reply.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7228 | SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7227 | SourceCodester Pizzafy Ecommerce System ajax.php login SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7226 | SourceCodester Pizzafy Ecommerce System ajax.php login2 SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7225 | SourceCodester Pizzafy Ecommerce System ajax.php delete_menu SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7224 | SourceCodester Pizzafy Ecommerce System ajax.php delete_cart SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7223 | BigSweetPotatoStudio HyperChat has a server-side request forgery issue | 6.9CNA v4.0 | 0.5% | 2026-04-28 | |
| CVE-2026-7222 | code-projects Coaching Management System Complaint form complaint.php cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-7221 | TencentCloudBase CloudBase-MCP open-url API endpoint server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-7220 | jackwrichards FastlyMCP fastly_cli tool fastly-mcp.mjs os command injection | 6.9CNA v4.0 | 2.1% | 2026-04-28 | |
| CVE-2026-7219 | Totolink N300RT formIpQoS buffer overflow | 8.6CNA v4.0 | 0.8% | 2026-04-28 | |
| CVE-2026-7218 | Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow | 8.6CNA v4.0 | 0.8% | 2026-04-28 | |
| CVE-2026-7217 | Deepractice PromptX Document file index.ts read_pdf absolute path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7216 | donchelo processing-claude-mcp-bridge create_sketch tool processing_server.py path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7215 | egtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection | 6.9CNA v4.0 | 2.1% | 2026-04-28 | |
| CVE-2026-7214 | eghuzefa engineer-your-data server.py file_inf path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7213 | ef10007 MLOps_MCP save_file tool fastmcp_server.py path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7212 | edvardlindelof notes-mcp notes_mcp.py path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7211 | dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection | 6.9CNA v4.0 | 2.1% | 2026-04-28 | |
| CVE-2026-7206 | dubydu sqlite-mcp entry.py extract_to_json SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7205 | duartium papers-mcp-server main.py search_papers path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-28 | |
| CVE-2026-7204 | Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7203 | Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7202 | Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-28 | |
| CVE-2026-7200 | SourceCodester Pharmacy Sales and Inventory System index.php cross-site scripting | 5.3CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7199 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-28 | |
| CVE-2026-7196 | CodeAstro Online Classroom guestdetails SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-28 | |
| CVE-2026-6809 | Social Post Embed WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-6807 | NSA GRASSMARLIN improper restriction of XML external entity reference | 5.5CNA v3.1 | 0.1% | 2026-04-28 | Exploit code |
| CVE-2026-6725 | WPC Smart Messages for WooCommerce WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-6706 | Devolutions Server vault documentation feature improper access control | 6.5CISA ADP v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-6551 | Timeline Blocks for Gutenberg WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-6238 | The GNU C Library glibc buffer overread in ns_printrrf with corrupted RDATA field | 6.5CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-5944 | Cisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access | 6.7CNA v4.0 | 0.9% | 2026-04-28 | Fix |
| CVE-2026-5794 | Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout | 4.9CNA v4.0 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-5781 | MphRx Minerva user update endpoint privilege escalation | 8.8v3.1 | 0.4% | 2026-04-28 | |
| CVE-2026-5780 | MphRx Minerva MphRx's insecure direct object reference | 8.1v3.1 | 0.4% | 2026-04-28 | |
| CVE-2026-5779 | MphRx Minerva MphRx's insecure direct object reference | 8.8NVD v3.1 | 0.5% | 2026-04-28 | |
| CVE-2026-5435 | The GNU C Library glibc potential buffer overflow in ns_sprintrrf TSIG handling path | 7.3CISA ADP v3.1 | 0.4% | 2026-04-28 | Fix |
| CVE-2026-5306 | The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled | 5.4CISA ADP v3.1 | 0.2% | 2026-04-28 | Fix |
| CVE-2026-4911 | Booking Package WordPress plugin unauthenticated Price manipulation via amount parameter | 5.3CNA v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-4805 | Woostify WordPress theme stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-04-28 | Fix |
| CVE-2026-3893 | Carlson Software VASCO-B GNSS Receiver missing authentication for critical function | 9.4CNA v3.1 | 0.7% | 2026-04-28 | Fix |
| CVE-2026-3323 | VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices | 7.5CNA v3.1 | 0.5% | 2026-04-28 | Fix |
| CVE-2026-1460 | Zyxel EX3301-T0 firmware command injection | 7.2CNA v3.1 | 1.2% | 2026-04-28 | Fix |
| CVE-2026-0711 | Zyxel DX3300-T0 firmware EasyMesh-related APIs command injection | 6.8CNA v3.1 | 0.8% | 2026-04-28 | Fix |
| CVE-2026-42410 | TheGem theme Elements (for Elementor) WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-42379 | Templately WordPress plugin sensitive data exposure | 7.7CNA v3.1 | 0.4% | 2026-04-27 | Fix |
| CVE-2026-42371 | uriparser numeric truncation | 5.1v3.1 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-42363 | GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability | 9.3CNA v3.1 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-41635 | Apache Mina vulnerable to deserialization of untrusted data | 9.8CNA v3.1 | 0.8% | 2026-04-27 | Fix |
| CVE-2026-41467 | ProjeQtor stored XSS via checkValidFileName | 5.1CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-41466 | ProjeQtor stored XSS via checkValidHtmlText | 5.1CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-41465 | ProjeQtor path traversal via dynamicDialog.php | 7.1CNA v4.0 | 0.8% | 2026-04-27 | |
| CVE-2026-41464 | ProjeQtor missing authorization via objectDetail.php | 7.1CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-41463 | ProjeQtor ZipSlip path traversal via uploadPlugin.php | 8.7CNA v4.0 | 1.6% | 2026-04-27 | |
| CVE-2026-41462 | ProjeQtor unauthenticated SQL injection via Login | 9.3CNA v4.0 | 0.7% | 2026-04-27 | Exploit code |
| CVE-2026-41409 | Apache Mina: Deserialization of untrusted data | 9.8CNA v3.1 | 0.8% | 2026-04-27 | Fix |
| CVE-2026-41081 | Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure | 6.5CISA ADP v3.1 | 0.4% | 2026-04-27 | Fix |
| CVE-2026-40976 | Spring Boot missing authorization | 9.1CNA v3.1 | 0.5% | 2026-04-27 | Fix |
| CVE-2026-40975 | Spring Boot's random value property source uses a weak PRNG unsuitable for secrets | 4.8CNA v3.1 | 0.4% | 2026-04-27 | Fix |
| CVE-2026-40971 | Spring Boot improper certificate validation | 5.0CNA v3.1 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-40970 | Spring Boot improper certificate validation | 5.0CNA v3.1 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-40860 | Apache Camel JMS ObjectMessage binding deserialization of untrusted data | 9.8CISA ADP v3.1 | 1.5% | 2026-04-27 | Exploit codeFix |
| CVE-2026-40858 | Apache Camel: Camel-Infinispan: Unsafe deserialization in Remote Aggregation Repository | 8.8CISA ADP v3.1 | 1.2% | 2026-04-27 | Exploit codeFix |
| CVE-2026-40557 | Apache Storm Prometheus Reporter vulnerable to improper certificate validation | 4.8CISA ADP v3.1 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-40514 | SmarterTools SmarterMail file and email sharing tokens weak random number generator | 9.1v3.1 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-40473 | Apache Camel Mina: Unsafe deserialization in MinaConverter.toObjectInput via TCP/UDP | 8.8CISA ADP v3.1 | 1.1% | 2026-04-27 | Exploit codeFix |
| CVE-2026-40453 | Apache Camel JMS, CoAP and Google Pub/Sub header filters header injection | 9.9CISA ADP v3.1 | 1.9% | 2026-04-27 | Exploit codeFix |
| CVE-2026-40048 | Apache Camel PQC: Unsafe deserialization from FileBasedKeyLifecycleManager | 7.8CISA ADP v3.1 | 0.5% | 2026-04-27 | Exploit codeFix |
| CVE-2026-40022 | Apache Camel vulnerable to authentication bypass using an alternate path or channel | 8.2CISA ADP v3.1 | 1.0% | 2026-04-27 | Exploit codeFix |
| CVE-2026-38936 | A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter | 6.1CISA ADP v3.1 | 0.3% | 2026-04-27 | |
| CVE-2026-38935 | diskover-community view page doctype parameter reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-04-27 | |
| CVE-2026-38934 | diskoverdata diskover-community v.2.3.5 cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2026-04-27 | Exploit code |
| CVE-2026-35903 | Mercurycom MIPC252W improper authentication | 9.8CISA ADP v3.1 | 0.6% | 2026-04-27 | |
| CVE-2026-35902 | Mercurycom MIPC252W missing brute-force protection | 6.2CISA ADP v3.1 | 0.2% | 2026-04-27 | |
| CVE-2026-35901 | Mercurycom MIPC252W denial of service | 4.4CISA ADP v3.1 | 0.2% | 2026-04-27 | |
| CVE-2026-33566 | Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) LogonTracer injection | 5.1CNA v4.0 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-33454 | Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy allows remote code execution | 9.4CISA ADP v3.1 | 1.0% | 2026-04-27 | Exploit codeFix |
| CVE-2026-33453 | Apache camel-coap allows header injection that can lead to remote code execution | 10.0CISA ADP v3.1 | 7.2% | 2026-04-27 | NucleiExploit codeFix |
| CVE-2026-33277 | JPCERT/CC LogonTracer OS command injection | 8.7CNA v4.0 | 2.3% | 2026-04-27 | Fix |
| CVE-2026-32688 | Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy | 8.7CNA v4.0 | 0.8% | 2026-04-27 | Fix |
| CVE-2026-32655 | Dell Alienware Command Center (AWCC) least privilege violation | 5.3CNA v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-31691 | In the Linux kernel, the following vulnerability has been resolved: igb: remove napi_synchronize() in igb_down() When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9), the XSK buffer pool is destroyed but NAPI polling continues. igb_clean_rx_irq_zc() repeatedly returns the full | 5.5v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-31690 | Linux kernel TH1520 AON firmware driver out-of-bounds write | 7.8v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-31689 | Linux kernel EDAC memory controller allocation null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-31687 | Linux kernel OMAP MPUIO driver deadlock | 5.5v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-31686 | Linux kernel KASAN page table cleanup double free | 7.8v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-31256 | Mercurycom MIPC252W RTSP service of the MERCURY null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2026-04-27 | |
| CVE-2026-31255 | Tenda AC18 command injection | 9.8v3.1 | 1.1% | 2026-04-27 | |
| CVE-2026-30462 | Daylight Studio FuelCMS Blocks module path traversal | 4.3CISA ADP v3.1 | 0.6% | 2026-04-27 | |
| CVE-2026-30352 | leonvanzyl autocoder devserver start endpoint command injection | 9.8CISA ADP v3.1 | 0.9% | 2026-04-27 | |
| CVE-2026-30351 | leonvanzyl autocoder static file handler path traversal | 7.5CISA ADP v3.1 | 0.5% | 2026-04-27 | |
| CVE-2026-30350 | Agent Protocol server items search endpoint denial of service | 7.5CISA ADP v3.1 | 0.5% | 2026-04-27 | |
| CVE-2026-30346 | hunvreus DevPush Google authorize endpoint open redirect | 4.3CISA ADP v3.1 | 0.3% | 2026-04-27 | |
| CVE-2026-29971 | WebFileSys version A reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2026-04-27 | Exploit code |
| CVE-2026-28747 | Milesight Cameras authorization bypass through user-controlled key | 7.3CNA v4.0 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-27172 | Apache Camel-Consul component vulnerable to deserialization of untrusted data | 8.8CISA ADP v3.1 | 1.1% | 2026-04-27 | Exploit codeFix |
| CVE-2026-25908 | Dell Alienware Command Center (AWCC) execution with unnecessary privileges | 6.7CNA v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-22337 | Directorist Social Login WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-22336 | Directorist Booking WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2026-04-27 | Fix |
| CVE-2026-22077 | Sensitive information disclosure vulnerability caused by Trusted Domain Bypass in OPPO Wallet | 5.6CNA v4.0 | 0.1% | 2026-04-27 | |
| CVE-2026-7194 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7191 | Arbitrary code execution via sandbox bypass in the open source solution QnABot on AWS | 8.6CNA v4.0 | 0.7% | 2026-04-27 | Fix |
| CVE-2026-7183 | aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception | 6.9CNA v4.0 | 0.7% | 2026-04-27 | Fix |
| CVE-2026-7179 | OSPG binwalk WinCE Extraction plugin winceextract.py read_null_terminated_string path traversal | 4.8CNA v4.0 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-7178 | ChatGPTNextWeb NextChat Artifacts endpoint route.ts storeUrl server-side request forgery | 6.9CNA v4.0 | 0.6% | 2026-04-27 | |
| CVE-2026-7177 | ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery | 6.9CNA v4.0 | 0.6% | 2026-04-27 | |
| CVE-2026-7160 | Tenda HG3 formTracert command injection | 8.7CNA v4.0 | 4.4% | 2026-04-27 | |
| CVE-2026-7159 | douinc mkdocs-mcp-plugin server.py list_documents path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-27 | |
| CVE-2026-7158 | dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7157 | disler aider-mcp-server aider_ai_code server.py command injection | 6.9CNA v4.0 | 2.1% | 2026-04-27 | |
| CVE-2026-7156 | Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7155 | Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7154 | Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7153 | Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7152 | Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7151 | Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7150 | dh1011 auto-favicon MCP tool server.py generate_favicon_from_url server-side request forgery | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7149 | dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-27 | |
| CVE-2026-7148 | CodeAstro Online Classroom addnewfaculty SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7147 | JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7146 | AlejandroArciniegas mcp-data-vis HTTP request server.js axios server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7145 | mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization | 5.3CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7144 | 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization | 5.3CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7143 | 1000 Projects Portfolio Management System MCA block_status.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7142 | Wooey API endpoint scripts.py add_or_update_script improper authorization | 5.3CNA v4.0 | 0.4% | 2026-04-27 | Fix |
| CVE-2026-7141 | vLLM KV block kv_cache_interface.py has_mamba_layers uninitialized resource | 6.3CNA v4.0 | 0.5% | 2026-04-27 | Fix |
| CVE-2026-7140 | Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7139 | Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7138 | Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7137 | Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7136 | Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7135 | GPAC MP4Box box_code_base.c elng_box_read out-of-bounds | 4.8CNA v4.0 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-7134 | code-projects Online Lot Reservation System edithousepic.php unrestricted upload | 5.1CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7133 | code-projects Online Lot Reservation System activity.php unrestricted upload | 5.1CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7132 | code-projects Online Lot Reservation System download.php readfile path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-27 | |
| CVE-2026-7131 | code-projects Online Lot Reservation System loginuser.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7130 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7129 | SourceCodester Pharmacy Sales and Inventory System index.php cross-site scripting | 5.3CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7128 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7127 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7126 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7125 | Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7124 | Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7123 | Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7122 | Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7121 | Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-27 | |
| CVE-2026-7119 | Tenda HG3 formCountrystr os command injection | 8.7CNA v4.0 | 4.4% | 2026-04-27 | |
| CVE-2026-7118 | code-projects Employee Management System cancel.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7117 | code-projects Employee Management System approve.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7116 | code-projects Employee Management System mark.php cross-site scripting | 5.3CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7115 | code-projects Employee Management System delete.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7114 | code-projects Employee Management System edit.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7113 | NousResearch hermes-agent Webhooks endpoint webhook.py missing authentication | 6.3CNA v4.0 | 0.6% | 2026-04-27 | |
| CVE-2026-7112 | NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication | 6.3CNA v4.0 | 0.6% | 2026-04-27 | |
| CVE-2026-7110 | code-projects Invoice System in Laravel item cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7109 | code-projects Invoice System in Laravel API endpoint item improper authorization | 6.9CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7108 | code-projects Invoice System in Laravel cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2026-04-27 | |
| CVE-2026-7107 | code-projects Invoice System in Laravel company unrestricted upload | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7106 | Highland Software Custom Role Manager WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.6% | 2026-04-27 | Fix |
| CVE-2026-7103 | code-projects Chat System MD5 Hash update_user.php weak hash | 6.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7102 | Tenda F456 httpd WriteFacMac FromWriteFacMac command injection | 8.8v3.1 | 6.5% | 2026-04-27 | |
| CVE-2026-7101 | Tenda F456 httpd WrlclientSet fromWrlclientSet buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7100 | Tenda F456 httpd Natlimit fromNatlimitof buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7099 | Tenda F456 httpd QuickIndex formQuickIndex buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7098 | Tenda F456 httpd DhcpListClient fromDhcpListClient buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7097 | Tenda F456 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7096 | Tenda HG3 formgponConf os command injection | 8.7CNA v4.0 | 4.4% | 2026-04-27 | |
| CVE-2026-7095 | code-projects Employee Management System edit.php cross-site scripting | 5.3CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7094 | ShadowCloneLabs GlutamateMCPServers puppeteer_navigate index.ts server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7093 | code-projects Invoice System in Laravel Invoice endpoint invoice improper authorization | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7092 | code-projects Invoice System in Laravel Profile profile improper authorization | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7091 | code-projects Invoice System in Laravel User Management user improper authorization | 5.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7090 | code-projects Chat System send_message.php cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7089 | code-projects Home Service System Appointment Booking booking.php cross-site scripting | 5.3CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7088 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7087 | SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7086 | HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal | 5.3CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7085 | HBAI-Ltd Toonflow-app downloadApp endpoint downloadApp.ts z.url path traversal | 2.3CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7084 | HBAI-Ltd Toonflow-app getCodeByLink endpoint getCodeByLink.ts fetch server-side request forgery | 5.3CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7083 | likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-27 | |
| CVE-2026-7082 | Tenda F456 httpd WrlExtraSet formWrlExtraSet buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7081 | Tenda F456 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7080 | Tenda F456 httpd PPTPUserSetting fromPPTPUserSetting buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7079 | Tenda F456 httpd AdvSetWan fromAdvSetWan buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7078 | Tenda F456 httpd SetIpBind fromSetIpBind buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-27 | |
| CVE-2026-7077 | itsourcecode Courier Management System edit_parcel.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7076 | itsourcecode Courier Management System edit_branch.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7075 | itsourcecode Construction Management System locations.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7074 | itsourcecode Construction Management System execute1.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7073 | itsourcecode Construction Management System execute.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7072 | CodePanda Source canteen_management_system login.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7071 | CodeAstro Online Job Portal user-cvs file information disclosure | 6.9CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7070 | code-projects Inventory Management System Login SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-27 | |
| CVE-2026-7069 | D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflow | 8.6CNA v4.0 | 0.7% | 2026-04-27 | |
| CVE-2026-7068 | D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow | 8.7CNA v4.0 | 1.1% | 2026-04-27 | |
| CVE-2026-7067 | D-Link DIR-822 udhcpd DHCP service dhcpd.c system command injection | 6.9CNA v4.0 | 3.5% | 2026-04-27 | |
| CVE-2026-7066 | choieastsea simple-openstack-mcp server.py exec_openstack os command injection | 6.9CNA v4.0 | 2.1% | 2026-04-27 | |
| CVE-2026-7065 | BidingCC BuildingAI remote upload API server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-27 | |
| CVE-2026-7040 | RRWO Text::Minify::XS heap-based buffer overflow | 7.5CISA ADP v3.1 | 0.7% | 2026-04-27 | Fix |
| CVE-2026-6970 | authd denial of service and local privilege escalation | 7.3CNA v4.0 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-6741 | LatePoint WordPress plugin privilege escalation to Administrator | 8.8CNA v3.1 | 0.6% | 2026-04-27 | Exploit codeFix |
| CVE-2026-6357 | pip self-update functionality can import newly installed modules after wheel installation | 5.3CNA v4.0 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-6265 | Local privilege escalation in Cerberus FTP Server = | 8.8v3.1 | 0.4% | 2026-04-27 | Fix |
| CVE-2026-5943 | Foxit PDF Editor/Reader AcroForm Annotation use-after-free remote code execution | 7.8CNA v3.1 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-5942 | Foxit PDF Editor/Reader AcroForm Signature use-after-free | 5.5CNA v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-5941 | Foxit PDF Editor/Reader AcroForm Signature remote code execution | 7.8CNA v3.1 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-5940 | Foxit PDF Editor/Reader Annotation use-after-free remote code execution | 7.8CNA v3.1 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-5939 | UAF in Foxit PDF Editor/Reader via XFA calculate event | 5.5CNA v3.1 | 0.2% | 2026-04-27 | Fix |
| CVE-2026-5938 | Foxit PDF Editor/Reader infinite loop denial of service | 5.5CNA v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-5937 | Foxit PDF Editor/Reader's insufficient parameter validation leads to denial of service | 5.5CNA v3.1 | 0.1% | 2026-04-27 | Fix |
| CVE-2026-5394 | Pimcore Platform SQL injection in DataObject composite index handling | 7.0CNA v4.0 | 0.6% | 2026-04-27 | Fix |
| CVE-2026-5362 | Pimcore Platform stored XSS in Document Editable Embed rendering | 5.4v3.1 | 0.3% | 2026-04-27 | |
| CVE-2026-3868 | Moxa EDR-8010 Series improper length parameter handling | 8.7CNA v4.0 | 0.5% | 2026-04-27 | Fix |
| CVE-2026-3867 | Moxa EDR-8010 Series information disclosure | 6.0CNA v4.0 | 0.4% | 2026-04-27 | Fix |
| CVE-2026-3087 | Python CPython shutil.unpack_archive doesn't check for Windows absolute paths in ZIPs | 6.0CNA v4.0 | 0.7% | 2026-04-27 | Fix |
| CVE-2026-3008 | Notepad++ format string | 6.6CNA v3.1 | 0.2% | 2026-04-27 | Exploit code |
| CVE-2026-3006 | WinFSP race condition | 7.0CNA v3.1 | 0.1% | 2026-04-27 | |
| CVE-2026-42255 | Technitium DNS Server incorrect behavior | 6.5NVD v3.1 | 0.4% | 2026-04-26 | Fix |
| CVE-2026-42254 | Hickory DNS incorrectly resolved name or reference | 4.0CNA v3.1 | 0.3% | 2026-04-26 | Fix |
| CVE-2026-7064 | AgentDeskAI browser-tools-mcp browser-connector.ts os command injection | 6.9CNA v4.0 | 2.6% | 2026-04-26 | Fix |
| CVE-2026-7063 | code-projects Employee Management System endpoint eprocess.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-26 | |
| CVE-2026-7062 | Intina47 context-sync Git Integration git-integration.ts os command injection | 6.9CNA v4.0 | 2.1% | 2026-04-26 | |
| CVE-2026-7061 | Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection | 6.9CNA v4.0 | 2.1% | 2026-04-26 | |
| CVE-2026-7060 | liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-26 | |
| CVE-2026-7059 | 666ghj MiroFish Query parameter simulation.py get_simulation_posts path traversal | 6.9CNA v4.0 | 0.6% | 2026-04-26 | |
| CVE-2026-7058 | 666ghj MiroFish inter-process communication command injection | 6.9CNA v4.0 | 2.1% | 2026-04-26 | |
| CVE-2026-7057 | Tenda F456 httpd setcfm buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7056 | Tenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7055 | Tenda F456 httpd VirtualSer fromVirtualSer buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7054 | Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7053 | Tenda F456 httpd L7Prot frmL7ProtForm buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7045 | Dynamic-Datasource has an injection | 5.3CNA v4.0 | 0.4% | 2026-04-26 | |
| CVE-2026-7044 | GreenCMS index.php themeadd unrestricted upload | 5.3CNA v4.0 | 0.3% | 2026-04-26 | |
| CVE-2026-7043 | GreenCMS index.php pluginAddLocal unrestricted upload | 5.3CNA v4.0 | 0.3% | 2026-04-26 | |
| CVE-2026-7042 | 666ghj MiroFish REST API endpoint __init__.py create_app missing authentication | 6.9CNA v4.0 | 0.7% | 2026-04-26 | |
| CVE-2026-7041 | 666ghj MiroFish Werkzeug Debugger PIN console information disclosure | 6.3CNA v4.0 | 0.4% | 2026-04-26 | |
| CVE-2026-7039 | tufantunc ssh-mcp index.ts shell.write command injection | 8.5CNA v4.0 | 1.2% | 2026-04-26 | |
| CVE-2026-7038 | tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials | 4.8CNA v4.0 | 0.1% | 2026-04-26 | |
| CVE-2026-7037 | Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection | 9.3CNA v4.0 | 3.3% | 2026-04-26 | |
| CVE-2026-7036 | Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal | 9.8v3.1 | 0.8% | 2026-04-26 | |
| CVE-2026-7035 | Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7034 | Tenda FH1202 httpd WrlExtraSet stack-based overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7033 | Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7032 | Tenda F456 SafeEmailFilter buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7031 | Tenda F456 SafeMacFilter fromSafeMacFilter buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7030 | Tenda F456 RouteStatic fromRouteStatic buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7029 | Tenda F456 addressNat fromaddressNat buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7028 | CodeAstro Online Job Portal All Jobs delete-jobs.php SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-26 | |
| CVE-2026-7027 | D-Link DSL-2740R Wireless Setup Section cross-site scripting | 4.8v3.1 | 0.8% | 2026-04-26 | |
| CVE-2026-7026 | D-Link DGS-3420 System Information settings cross-site scripting | 4.8v3.1 | 1.3% | 2026-04-26 | |
| CVE-2026-7025 | Typecho Ping Back service Endpoint Service.php sendPingHandle server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-04-26 | |
| CVE-2026-7024 | rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal | 5.3CNA v4.0 | 0.5% | 2026-04-26 | |
| CVE-2026-7023 | ByteDance coze-studio databaseTool database_impl.go ExecuteSQL SQL injection | 8.8v3.1 | 0.5% | 2026-04-26 | |
| CVE-2026-7022 | SmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authentication | 6.9CNA v4.0 | 0.7% | 2026-04-26 | |
| CVE-2026-7021 | SmythOS sre Connector service utils.ts information disclosure | 5.1CNA v4.0 | 0.3% | 2026-04-26 | |
| CVE-2026-7020 | Ollama Tensor Model Transfer transfer.go digestToPath path traversal | 6.3CNA v4.0 | 0.9% | 2026-04-26 | Exploit code |
| CVE-2026-7019 | Tenda F456 P2pListFilter fromP2pListFilter buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-26 | |
| CVE-2026-7018 | Datavane Datavines JWT Token TokenManager.java hard-coded key | 6.3CNA v4.0 | 0.4% | 2026-04-26 | |
| CVE-2026-7016 | MaxSite CMS ushki plugin cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-26 | Fix |
| CVE-2026-7015 | MaxSite CMS Guestbook plugin cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-26 | Fix |
| CVE-2026-7014 | MaxSite CMS down_count plugin cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-26 | Fix |
| CVE-2026-7013 | MaxSite CMS mail_send plugin cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-26 | Fix |
| CVE-2026-7012 | MaxSite CMS redirect plugin cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-26 | Fix |
| CVE-2026-7011 | MaxSite CMS Antispam plugin plugin_antispam cross-site scripting | 4.8CNA v4.0 | 0.4% | 2026-04-26 | Fix |
| CVE-2026-31685 | Linux kernel ip6t_eui64 netfilter match vulnerability | 9.4CNA v3.1 | 0.4% | 2026-04-25 | Fix |
| CVE-2026-31684 | Linux kernel act_csum VLAN header parsing vulnerability | 5.5v3.1 | 0.1% | 2026-04-25 | Fix |
| CVE-2026-31683 | Linux kernel batman-adv OGM aggregation vulnerability | 7.8CNA v3.1 | 0.2% | 2026-04-25 | Fix |
| CVE-2026-31682 | Linux kernel bridge neighbor discovery vulnerability | 9.1CNA v3.1 | 0.5% | 2026-04-25 | Fix |
| CVE-2026-31681 | Linux kernel xt_multiport netfilter match vulnerability | 5.5NVD v3.1 | 0.2% | 2026-04-25 | Fix |
| CVE-2026-31680 | Linux kernel IPv6 flowlabel proc interface vulnerability | 7.8CNA v3.1 | 0.1% | 2026-04-25 | Fix |
| CVE-2026-31679 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls | 7.1CNA v3.1 | 0.2% | 2026-04-25 | Fix |
| CVE-2026-31678 | Linux kernel openvswitch time-of-check time-of-use race condition | 7.8CNA v3.1 | 0.1% | 2026-04-25 | Fix |
| CVE-2026-31677 | Linux kernel af_alg receive buffer vulnerability | 5.5NVD v3.1 | 0.1% | 2026-04-25 | Fix |
| CVE-2026-31676 | Linux kernel rxrpc service connection vulnerability | 7.5CNA v3.1 | 0.6% | 2026-04-25 | Fix |
| CVE-2026-31675 | Linux kernel netem packet scheduler out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2026-04-25 | Fix |
| CVE-2026-31674 | Linux kernel ip6t_rt netfilter match vulnerability | 7.1CNA v3.1 | 0.2% | 2026-04-25 | Fix |
| CVE-2026-31673 | Linux kernel AF_UNIX diagnostics interface vulnerability | 7.8CNA v3.1 | 0.1% | 2026-04-25 | Fix |
| CVE-2026-7002 | KLiK SocialMediaWebsite Private message get_message_ajax.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-04-25 | |
| CVE-2026-7001 | Datacom DM4100 Ethernet Configuration cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-7000 | Datacom DM4100 VLAN page cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6999 | BIVOCOM TR321 Wireless setting cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6998 | BDCOM P3310D New RMON Statistics cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6997 | BDCOM P3310D New RMON History cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6996 | BDCOM P3310D rmon event Tab cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6995 | BDCOM P3310D New User index.asp cross-site scripting | 4.8CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6994 | Envoy Query parameter header_mutation.cc params.add injection | 5.3CNA v4.0 | 0.4% | 2026-04-25 | |
| CVE-2026-6993 | go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy | 6.9CNA v4.0 | 0.5% | 2026-04-25 | |
| CVE-2026-6992 | Linksys MR9600 JNAP action run_central2.sh BTRequestGetSmartConnectStatus os command injection | 8.6CNA v4.0 | 8.0% | 2026-04-25 | Exploit code |
| CVE-2026-6991 | colinhacks Zod CUID Data Type regexes.ts SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6990 | projeto-siga novo cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6989 | Tenda F453 Telnet service telnet TendaTelnet command injection | 8.8v3.1 | 6.3% | 2026-04-25 | |
| CVE-2026-6988 | Tenda HG10 Boa service formRouting formRoute buffer overflow | 8.7CNA v4.0 | 1.0% | 2026-04-25 | |
| CVE-2026-6987 | PicoClaw Web Launcher Management Plane restart command injection | 9.8v3.1 | 4.7% | 2026-04-25 | |
| CVE-2026-6986 | Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification | 6.3CNA v4.0 | 0.3% | 2026-04-25 | Fix |
| CVE-2026-6985 | Cesanta Mongoose TCP option net_builtin.c handle_opt infinite loop | 7.5v3.1 | 0.9% | 2026-04-25 | Fix |
| CVE-2026-6984 | AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine | 5.1CNA v4.0 | 0.4% | 2026-04-25 | |
| CVE-2026-6983 | pagekit download server-side request forgery | 5.1CNA v4.0 | 0.4% | 2026-04-25 | |
| CVE-2026-6982 | star7th ShowDoc API Page Sort Endpoint PageController.class.PHP SQL injection | 5.3CNA v4.0 | 0.3% | 2026-04-25 | Fix |
| CVE-2026-6981 | IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgery | 5.3CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6980 | Divyanshu-hash GitPilot-MCP main.py repo_path command injection | 6.9CNA v4.0 | 3.2% | 2026-04-25 | |
| CVE-2026-6979 | devlikeapro WAHA API request media.controller.ts server-side request forgery | 5.3CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6978 | JiZhiCMS addcache.html htmlspecialchars_decode SQL injection | 5.1CNA v4.0 | 0.3% | 2026-04-25 | |
| CVE-2026-6977 | vanna-ai vanna Legacy Flask API improper authorization | 6.9CNA v4.0 | 0.5% | 2026-04-25 | |
| CVE-2026-6951 | simple-git is vulnerable to remote code execution | 9.2CNA v4.0 | 1.0% | 2026-04-25 | Exploit codeFix |
| CVE-2026-42171 | Nullsoft Scriptable Install System uncontrolled search path | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-42095 | KDE Arianna missing authentication | 4.0CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-42044 | Axios: Invisible JSON Response tampering via prototype pollution Gadget in `parseReviver` | 6.5CNA v3.1 | 0.9% | 2026-04-24 | Fix |
| CVE-2026-42043 | Axios: Incomplete Fix for NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (/8) in Axios | 7.2CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-42042 | Axios: XSRF Token Cross-Origin Leakage | 5.4CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-42041 | Axios: Authentication bypass via prototype pollution Gadget in `validateStatus` Merge Strategy | 4.8CNA v3.1 | 0.8% | 2026-04-24 | Fix |
| CVE-2026-42040 | Axios: Null Byte injection via Reverse-Encoding in AxiosURLSearchParams | 3.7CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-42039 | Axios: Unbounded recursion in toFormData causes DoS via deeply nested request data | 6.9CNA v4.0 | 1.0% | 2026-04-24 | Fix |
| CVE-2026-42038 | Axios: No_proxy bypass via IP alias allows SSRF | 6.8CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-42037 | Axios: CRLF injection in multipart/form-data body via unsanitized blob.type in formDataToStream | 5.3CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-42036 | Axios: HTTP adapter streamed responses bypass maxContentLength | 5.3CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-42035 | Axios: Header injection via prototype pollution | 7.4CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-42034 | Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 | 5.3CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-42033 | Axios: Prototype pollution Gadgets Response tampering, Data Exfiltration, and Request Hijacking | 7.4CNA v3.1 | 0.9% | 2026-04-24 | Fix |
| CVE-2026-41907 | uuid v3, v5 and v6 generation out-of-bounds write | 8.1CNA v4.0 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41898 | rust-openssl PSK and cookie callbacks out-of-bounds read | 8.3CNA v4.0 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41894 | SiYuan: Incomplete Fix Bypass for path traversal via Double URL Encoding in `/export/` endpoint | 7.1CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41681 | rust-openssl digest_final function stack-based buffer overflow | 8.1CNA v4.0 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41680 | Marked: OOM denial of service via Infinite Recursion in marked Tokenizer | 8.7CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41678 | rust-openssl has incorrect bounds assertion in aes key wrap | 7.2CNA v4.0 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41677 | rust-openssl PEM password callback out-of-bounds read | 1.7CNA v4.0 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41676 | rust-openssl incorrect buffer size calculation | 7.2CNA v4.0 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41503 | bacnet-stack BACnet Stack: Out-of-bounds read in ReadPropertyMultiple Property Decoder | 8.7CNA v4.0 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-41502 | bacnet-stack BACnet Stack: Off-by-one out-of-bounds read in ReadPropertyMultiple Object ID Decoder | 8.7CNA v4.0 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-41492 | Unauthenticated admin token disclosure leading to authentication bypass via /debug/vars in Dgraph | 9.8CNA v3.1 | 2.5% | 2026-04-24 | NucleiFix |
| CVE-2026-41488 | langchain-ai langchain-openai angchain-openai: Image token counting SSRF protection can be bypassed | 3.1CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-41485 | Kyverno controller denial of service via forEach Mutation panic | 7.7CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-41481 | LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass | 6.5CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41478 | Saltcorn: SQL injection via Unparameterized Sync endpoints (maxLoadedId) | 10.0CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41477 | Deskflow: Local privilege escalation via unauthenticated IPC | 7.8CNA v3.1 | 0.2% | 2026-04-24 | |
| CVE-2026-41476 | Deskflow: Clipboard deserialization global-buffer-overflow | 7.4CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41475 | bacnet-stack BACnet Stack: Out-of-bounds read in WritePropertyMultiple Decoder | 8.7CNA v4.0 | 0.7% | 2026-04-24 | Fix |
| CVE-2026-41473 | CyberPanel Unauthenticated API Access via AI Scanner endpoints | 9.1NVD v3.1 | 1.1% | 2026-04-24 | Fix |
| CVE-2026-41472 | CyberPanel stored XSS via AI Scanner Dashboard | 6.1v3.1 | 0.6% | 2026-04-24 | Exploit codeFix |
| CVE-2026-41433 | OpenTelemetry eBPF Instrumentation Java agent injector path traversal | 8.4CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-41430 | Press vulnerable to reflected XSS on login redirection | 1.3CNA v4.0 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41429 | Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption | 8.8CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41428 | Budibase: Authentication bypass | 9.1CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-41427 | better-auth better Auth OAuth Provider: Unprivileged users can register OAuth clients | 7.1CNA v4.0 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41426 | pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders | 6.1CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41425 | Authlib: Cross-site request forging when using cache | 5.4CNA v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-41421 | SiYuan Desktop Notification XSS leads to Electron RCE | 8.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-41419 | RARgames 4gaBoards 4ga Boards: Import path traversal leads to arbitrary file read | 7.6CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41418 | RARgames 4gaBoards 4ga Boards: User Enumeration via timing side-channel in Authentication endpoint | 5.3CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41416 | PJSIP: Asymmetric ptime integer overflow in Media Stream | 8.1CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41415 | PJSIP: SIP Multipart CID URI Length Underflow | 6.7CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41414 | Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml | 7.4CNA v3.1 | 0.4% | 2026-04-24 | Exploit codeFix |
| CVE-2026-41411 | Vim: Command injection via backtick expansion in tag filenames | 6.6CNA v3.1 | 0.8% | 2026-04-24 | Fix |
| CVE-2026-41328 | Dgraph: Pre-Auth Full Database Exfiltration via DQL injection in NQuad Lang field | 9.1CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41327 | Dgraph: Pre-Auth Full Database Exfiltration via DQL injection in Upsert Condition field | 9.1CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41326 | Kata Containers: CopyFile Policy Subversion via Symlinks | 8.2CNA v4.0 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41325 | Kirby is vulnerable to authorization bypass during page, file and user creation | 7.1CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41324 | basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list | 7.5CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41323 | Kyverno: ServiceAccount token leaked to external servers via apiCall service URL | 8.1CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-41322 | Astro: Cache poisoning due to incorrect error handling when if-match header is malformed | 5.3CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41321 | @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint | 2.2CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41319 | MailKit has STARTTLS Response injection | 6.5CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41318 | Mintplex Labs AnythingLLM chart caption renderer cross-site scripting | 5.4CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41317 | Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation | 6.6CNA v4.0 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-41316 | ERB has an @_init deserialization guard bypass via def_module / def_method / def_class | 8.1CNA v3.1 | 1.3% | 2026-04-24 | Fix |
| CVE-2026-41309 | opensource-socialnetwork Open Source Social Network vulnerable to resource exhaustion | 8.2CNA v3.1 | 0.7% | 2026-04-24 | Fix |
| CVE-2026-41305 | PostCSS CSS stringifier cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41248 | Official Clerk JavaScript SDKs: Middleware-based route protection bypass | 9.1CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41244 | Mojic: Observable timing discrepancy in HMAC Verification | 4.7CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-41140 | Poetry: Path traversal in tar extraction on Python and | 0.6CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-41079 | OpenPrinting CUPS SNMP supply level polling out-of-bounds read | 4.3CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41068 | Kyverno: Cross-Namespace Read Bypasses RBAC Isolation ( Incomplete Fix) | 7.7CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-41067 | Astro define:vars script sanitization cross-site scripting | 6.1CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41066 | lxml iterparse and ETCompatXMLParser parsers XML external entity injection | 7.5CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-41044 | Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE | 8.8CISA ADP v3.1 | 1.2% | 2026-04-24 | Fix |
| CVE-2026-41043 | Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console XSS vulnerability when browsing queues | 6.5CISA ADP v3.1 | 0.7% | 2026-04-24 | Fix |
| CVE-2026-40897 | Math.js: Unsafe object property setter in mathjs | 8.8CNA v3.1 | 0.8% | 2026-04-24 | Exploit codeFix |
| CVE-2026-40690 | Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions | 4.3CISA ADP v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-40630 | SenseLive X3050 authentication bypass using an alternate path or channel | 9.3CNA v4.0 | 0.9% | 2026-04-24 | |
| CVE-2026-40623 | SenseLive X3050 missing authorization | 7.2CNA v4.0 | 0.6% | 2026-04-24 | |
| CVE-2026-40620 | SenseLive X3050 missing authentication for critical function | 9.3CNA v4.0 | 0.8% | 2026-04-24 | |
| CVE-2026-40466 | Apache ActiveMQ vulnerable to improper input validation and code injection | 8.8CISA ADP v3.1 | 4.1% | 2026-04-24 | NucleiFix |
| CVE-2026-40431 | SenseLive X3050 cleartext transmission of sensitive information | 6.9CNA v4.0 | 0.3% | 2026-04-24 | |
| CVE-2026-40254 | FreeRDP: Contains_dotdot off-by-one allows drive channel path traversal via terminal | 4.2CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-40099 | Kirby page creation permission check incorrect authorization | 5.3CNA v4.0 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-39920 | BridgeHead FileStore Apache Axis2 default credentials RCE | 9.3CNA v4.0 | 1.1% | 2026-04-24 | Fix |
| CVE-2026-39462 | SenseLive X3050 insufficiently protected credentials | 9.3CNA v4.0 | 0.7% | 2026-04-24 | |
| CVE-2026-38743 | Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities | 4.3CISA ADP v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-35503 | SenseLive X3050 use of hard-coded credentials | 9.3CNA v4.0 | 0.8% | 2026-04-24 | |
| CVE-2026-35064 | SenseLive X3050 missing authentication for critical function | 8.7CNA v4.0 | 0.6% | 2026-04-24 | |
| CVE-2026-34587 | Kirby has server-side template injection (SSTI) via double template resolution in option rendering | 7.6CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-33666 | Zserio: Integer overflow in BitStreamReader on 32-bit platforms | 7.5CNA v3.1 | 0.5% | 2026-04-24 | |
| CVE-2026-33662 | OP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode | 7.5CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-33524 | Zserio: Integer overflow in BitStreamReader and Unbounded Memory Allocation in deserialization | 7.5CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-33318 | Actual has privilege escalation via change-password endpoint on OpenID-Migrated Servers | 8.8CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-33317 | OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure | 8.7CNA v3.1 | 0.2% | 2026-04-24 | Exploit codeFix |
| CVE-2026-33208 | Roxy-WI vulnerable to authenticated remote code execution | 7.4CNA v4.0 | 0.9% | 2026-04-24 | Fix |
| CVE-2026-33078 | Roxy-WI has SQL injection in haproxy_section_save endpoint via Unsanitized server_ip parameter | 8.9CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-33077 | Roxy-WI has an arbitrary file read | 7.7CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-33076 | Roxy-WI vulnerable to path traversal and arbitrary file writing | 8.9CNA v4.0 | 1.0% | 2026-04-24 | Fix |
| CVE-2026-32952 | go-ntlmssp NTLM challenges can panic on malformed payloads | 5.3CNA v3.1 | 1.5% | 2026-04-24 | Fix |
| CVE-2026-32870 | Kirby has XML injection in its XML creator toolkit | 6.9CNA v4.0 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-31956 | Xibo CMS has Preview and SavedReport IDOR | 4.3CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-31955 | Xibo CMS has authenticated server-side request forgery (SSRF) in Remote DataSet Functionality | 4.9CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-31953 | Xibo CMS has stored XSS via Notification Body with Zero-Click Execution on Login | 6.4CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31952 | Xibo CMS API has SQL injection via DataSet Filter parameter | 7.6CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31672 | Linux kernel rt2x00usb Wi-Fi driver memory leak | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31671 | Linux kernel xfrm_user report builder information disclosure | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31670 | Linux kernel rfkill event queue denial of service | 5.5NVD v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31669 | Linux kernel MPTCP subflow socket lookup use-after-free | 9.8CNA v3.1 | 0.8% | 2026-04-24 | Fix |
| CVE-2026-31668 | Linux kernel seg6 lightweight tunnel vulnerability | 9.8CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31667 | Linux kernel uinput force-feedback core vulnerability | 7.8CNA v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31666 | Linux kernel btrfs extent tree lookup vulnerability | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31665 | Linux kernel nftables conntrack timeout objects use-after-free | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31664 | Linux kernel xfrm policy expire netlink vulnerability | 5.5NVD v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31663 | Linux kernel xfrm transport processing vulnerability | 7.8CNA v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31662 | Linux kernel TIPC group broadcast integer underflow | 7.5CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31661 | Linux kernel brcmsmac Wi-Fi driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31660 | Linux kernel pn533 NFC driver null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31659 | Linux kernel batman-adv translation table vulnerability | 9.8CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31658 | Linux kernel Altera TSE Ethernet driver memory leak | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31657 | Linux kernel batman-adv null pointer dereference | 9.8CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31656 | Linux kernel i915 GT engine heartbeat use-after-free | 7.8CNA v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31655 | Linux kernel imx8mp block controller denial of service | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31654 | Linux kernel mmap region handling memory leak | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31653 | Linux kernel DAMON sysfs interface vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31652 | Linux kernel DAMON statistics interface vulnerability | 7.8v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31651 | Linux kernel vub300 MMC driver null pointer dereference | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31650 | Linux kernel vub300 MMC driver use-after-free | 7.8NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31649 | Linux kernel stmmac Ethernet driver integer underflow | 9.8CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-31648 | Linux kernel filemap crash | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31647 | Linux kernel idpf virtchnl handler improper locking | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31646 | Linux kernel lan966x FDMA driver null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31645 | Linux kernel lan966x FDMA driver memory leak | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31644 | Linux kernel lan966x FDMA driver use-after-free | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31643 | Linux kernel rxrpc RxGK key parsing memory leak | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31642 | Linux kernel rxrpc call list handling infinite loop | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31641 | Linux kernel rxrpc RxGK token loading out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31640 | Linux kernel rxrpc response packet handling memory leak | 7.5CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31639 | Linux kernel rxrpc client call handling vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31638 | Linux kernel rxrpc call reference handling null pointer dereference | 7.5CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31637 | Linux kernel rxrpc rxkad ticket decryption vulnerability | 9.8CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31636 | Linux kernel rxrpc RxGK authenticator parser out-of-bounds read | 9.1CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31635 | Linux kernel rxrpc RESPONSE authenticator validation denial of service | 7.5CNA v3.1 | 0.6% | 2026-04-24 | Reported exploitedExploit codeFix |
| CVE-2026-31634 | Linux kernel rxrpc server keyring vulnerability | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31633 | Linux kernel rxrpc RxGK response verification integer overflow | 9.8CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-31632 | Linux kernel rxrpc RxGK response verification memory leak | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31631 | Linux kernel rxrpc RxGK authenticator verification out-of-bounds read | 8.2CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31630 | Linux kernel rxrpc procfs interface vulnerability | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31629 | Linux kernel NFC LLCP socket handling use-after-free | 8.8CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31628 | In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under certain circumstances, partial results from previous operations. Those results can be leaked by another, attacker thread. Fix that with a chicken bit. | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31627 | Linux kernel S3C24xx I2C driver vulnerability | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31626 | Linux kernel rtl8723bs Wi-Fi driver vulnerability | 7.1CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31625 | Linux kernel HID ALPS driver null pointer dereference | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31624 | Linux kernel HID report parser vulnerability | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31623 | Linux kernel USB CDC Phonet driver out-of-bounds write | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31622 | Linux kernel NFC-A SDD response handler out-of-bounds write | 8.8CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-31621 | Linux kernel bnge auxiliary device driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31620 | Linux kernel ALSA usx2y US-144MKII driver null pointer dereference | 4.6v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31619 | Linux kernel ALSA fireworks driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31618 | Linux kernel tdfxfb framebuffer driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31617 | Linux kernel USB gadget NCM function driver integer underflow | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31616 | Linux kernel USB gadget Phonet function driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31615 | Linux kernel renesas_usb3 USB gadget driver null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31614 | Linux kernel SMB client WSL extended attribute parsing out-of-bounds read | 7.1v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31613 | Linux kernel SMB client symlink error parsing out-of-bounds read | 8.1CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31612 | Linux kernel ksmbd uninitialized memory use | 7.5CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31611 | Linux kernel ksmbd ACL parsing vulnerability | 8.6CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-31610 | Linux kernel ksmbd SPNEGO authentication memory leak | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31609 | Linux kernel smb client double free | 9.8CNA v3.1 | 0.7% | 2026-04-24 | Fix |
| CVE-2026-31608 | Linux kernel ksmbd SMB Direct transport double free | 9.8CNA v3.1 | 0.7% | 2026-04-24 | Fix |
| CVE-2026-31607 | Linux kernel USB/IP client driver out-of-bounds write | 9.8CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-31606 | Linux kernel USB gadget HID function driver vulnerability | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31605 | Linux kernel udlfb framebuffer driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31604 | Linux kernel rtw88 Wi-Fi driver memory leak | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31603 | Linux kernel sm750fb framebuffer driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31602 | Linux kernel ctxfi sound driver vulnerability | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31601 | Linux kernel xe GPU VFIO driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31600 | Linux kernel arm64 memory management null pointer dereference | 7.5CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31599 | Linux kernel vidtv null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31598 | Linux kernel ocfs2 direct I/O deadlock | 7.5CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31597 | Linux kernel ocfs2 mmap fault handler use-after-free | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31596 | Linux kernel ocfs2 resize ioctl denial of service | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31595 | Linux kernel PCI endpoint NTB driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31594 | Linux kernel PCI endpoint NTB driver vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31593 | Linux kernel KVM SEV-SNP VMSA synchronization denial of service | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31592 | Linux kernel KVM SEV memory region registration null pointer dereference | 5.5NVD v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31591 | Linux kernel SEV crash | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31590 | Linux kernel KVM SEV memory region registration vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31589 | Linux kernel mm use-after-free | 9.8CNA v3.1 | 0.7% | 2026-04-24 | Fix |
| CVE-2026-31588 | Linux kernel KVM x86 MMIO emulation use-after-free | 8.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31587 | Linux kernel qcom q6apm ASoC driver use-after-free | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31586 | Linux kernel blk-cgroup writeback cleanup use-after-free | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31585 | Linux kernel vidtv virtual DVB driver memory leak | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31584 | Linux kernel MediaTek video encoder driver use-after-free | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31583 | Linux kernel em28xx USB driver use-after-free | 7.8NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31582 | Linux kernel powerz USB driver use-after-free | 7.8v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31581 | Linux kernel 6fire USB audio driver use-after-free | 7.8v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31580 | Linux kernel bcache use-after-free | 7.8NVD v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31579 | Linux kernel wireguard device null pointer dereference | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31578 | Linux kernel as102 USB driver use-after-free | 7.8v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31577 | Linux kernel nilfs2 DAT inode shadow map null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31576 | Linux kernel hackrf USB driver use-after-free | 7.8v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31575 | Linux kernel hugetlb fault mutex hashing race condition | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31574 | Linux kernel clockevents subsystem denial of service | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31573 | Linux kernel Verisilicon Hantro VPU driver vulnerability | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31572 | Linux kernel amdisp I2C driver race condition | 4.7v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31571 | Linux kernel i915 NV12 plane unlinking vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31570 | Linux kernel gw out-of-bounds read | 8.8CNA v3.1 | 0.4% | 2026-04-24 | Fix |
| CVE-2026-31569 | Linux kernel LoongArch KVM EIOINTC emulation out-of-bounds read | 7.3CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31568 | Linux kernel s390 secure storage access handling out-of-bounds read | 7.1NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31567 | Linux kernel hibernation GFP mask restore reachable assertion | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31566 | Linux kernel drm/amdgpu use-after-free | 7.8CNA v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31565 | Linux kernel irdma RDMA driver netdev reset deadlock | 5.5NVD v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31564 | Linux kernel KVM LoongArch eiointc emulation vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31563 | Linux kernel macb Ethernet driver Tx completion vulnerability | 7.5CNA v3.1 | 0.8% | 2026-04-24 | Fix |
| CVE-2026-31562 | Linux kernel MediaTek DSI driver probe null pointer dereference | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31561 | Linux kernel x86 FRED CR4 pinned bits handling vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31560 | Linux kernel spi-dw-dma driver vulnerability | 5.5NVD v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31559 | Linux kernel LoongArch device tree parsing null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31558 | Linux kernel KVM LoongArch vCPU lookup out-of-bounds read | 8.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31557 | Linux kernel NVMe target async event handling vulnerability | 7.5CNA v3.1 | 0.5% | 2026-04-24 | Fix |
| CVE-2026-31556 | Linux kernel XFS quota scrub deadlock | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31555 | Linux kernel PI futex lock retry path vulnerability | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31554 | Linux kernel futex requeue use-after-free | 7.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31553 | Linux kernel KVM arm64 address translation emulation vulnerability | 8.8CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31552 | Linux kernel wlcore Wi-Fi driver Tx path infinite loop | 7.5CNA v3.1 | 0.7% | 2026-04-24 | Fix |
| CVE-2026-31551 | Linux kernel mac80211 AQL debugfs interface integer underflow | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31550 | Linux kernel BCM2835 power domain ASB control denial of service | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31549 | Linux kernel cp2615 I2C driver probe null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31548 | Linux kernel cfg80211 peer measurement (PMSR) vulnerability | 7.8CNA v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31547 | Linux kernel Xe GPU driver runtime PM handling vulnerability | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31546 | Linux kernel bonding RLB debug interface null pointer dereference | 5.5NVD v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-31545 | Linux kernel NFC nxp-nci driver reachable assertion | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31544 | Linux kernel SCMI firmware notification handler null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31543 | Linux kernel crash dump key retrieval information disclosure | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31542 | Linux kernel x86 UV platform driver denial of service | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31541 | Linux kernel ftrace trace_marker use-after-free | 7.8v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31540 | Linux kernel i915 GPU driver null pointer dereference | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31539 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between | 7.5CNA v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-31538 | In the Linux kernel, the following vulnerability has been resolved: smb: server: make use of smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between | 7.5CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31537 | In the Linux kernel, the following vulnerability has been resolved: smb: server: make use of smbdirect_socket.send_io.bcredits It turns out that our code will corrupt the stream of reassabled data transfer messages when we trigger an immendiate (empty) send. In order to fix this we'll have a sing | 5.5v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31536 | In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the final request that has IB_SEND_SIGNALED | 9.8CNA v3.1 | 0.6% | 2026-04-24 | Fix |
| CVE-2026-31535 | Linux kernel smb client time-of-check time-of-use race condition | 4.7v3.1 | 0.1% | 2026-04-24 | Fix |
| CVE-2026-31052 | Hostbill checkout authentication flow denial of service | 5.3CISA ADP v3.1 | 0.8% | 2026-04-24 | |
| CVE-2026-31051 | Hostbill Client Balance component denial of service | 3.8CISA ADP v3.1 | 0.6% | 2026-04-24 | |
| CVE-2026-31050 | Hostbill v.2025-11-24 and cross-site scripting | 4.9CISA ADP v3.1 | 0.9% | 2026-04-24 | |
| CVE-2026-30368 | Lightspeed Classroom incorrect authorization | 5.4CNA v3.1 | 0.3% | 2026-04-24 | Exploit code |
| CVE-2026-29197 | Rocket.Chat improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-04-24 | Fix |
| CVE-2026-29051 | melange has path traversal via .PKGINFO in --persist-lint-results | 4.4CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-29050 | melange has path traversal when Resolving External Pipelines via Unvalidated pipeline[].uses | 6.1CNA v3.1 | 0.2% | 2026-04-24 | Fix |
| CVE-2026-27843 | SenseLive X3050 missing authentication for critical function | 9.2CNA v4.0 | 0.8% | 2026-04-24 | |
| CVE-2026-27841 | SenseLive X3050 cross-site request forgery | 8.4CNA v4.0 | 0.2% | 2026-04-24 | |
| CVE-2026-25775 | SenseLive X3050 missing authentication for critical function | 9.3CNA v4.0 | 0.8% | 2026-04-24 | |
| CVE-2026-25720 | SenseLive X3050 insufficient session expiration | 5.4v3.1 | 0.4% | 2026-04-24 |