CVE-2026 list

CVE-2026 records published in April 2026

Page three of six: records 2,001 to 3,000 of the 5,323 published in April 2026, newest first. The first page carries the figures for April 2026.

CVE-2026 records published in April 2026, newest first: records 2,001 to 3,000 of 5,323
CVE Summary CVSS EPSS Published Signals
CVE-2026-6592ComfyUI userdata endpoint user_manager.py getuserdata cross-site scripting5.1CNA v4.00.4%2026-04-20
CVE-2026-6591ComfyUI LoadImage Node folder_paths.py folder_paths.get_annotated_filepath path traversal5.3CNA v4.00.5%2026-04-20
CVE-2026-6590ComfyUI Model Preview endpoint model_manager.py get_model_preview path traversal5.3CNA v4.00.5%2026-04-20
CVE-2026-6589ComfyUI server.py create_origin_only_middleware cross-site request forgery5.3CNA v4.00.2%2026-04-20
CVE-2026-6588serge-chat serge Model API endpoint model.py delete_model missing authentication6.9CNA v4.00.7%2026-04-20
CVE-2026-6587vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery5.3CNA v4.00.4%2026-04-20
CVE-2026-6586TransformerOptimus SuperAGI Budget endpoint budget.py update_budget authorization5.3CNA v4.00.4%2026-04-20
CVE-2026-6585TransformerOptimus SuperAGI organisation update endpoint authorization bypass5.3CNA v4.00.4%2026-04-20
CVE-2026-6584TransformerOptimus SuperAGI User Update endpoint user.py update_user authorization5.3CNA v4.00.4%2026-04-20
CVE-2026-6550Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python5.7CNA v4.00.1%2026-04-20Fix
CVE-2026-6369Exposed Session Token in canonical-livepatch client snap5.7CNA v4.00.2%2026-04-20Fix
CVE-2026-6257Vvveb CMS remote code execution via Media Management9.2CNA v4.00.9%2026-04-20
CVE-2026-6249Vvveb CMS remote code execution via Media upload8.7CNA v4.00.8%2026-04-20
CVE-2026-6248wpForo Forum WordPress plugin arbitrary file deletion8.1CNA v3.10.9%2026-04-20Fix
CVE-2026-6066Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center7.1CNA v3.10.1%2026-04-20Fix
CVE-2026-6060OTRS possible DoS via SQL Box4.5CNA v3.10.3%2026-04-20
CVE-2026-5967TeamT5｜ThreatSonar Anti-Ransomware privilege escalation8.7CNA v4.00.7%2026-04-20Fix
CVE-2026-5966TeamT5｜ThreatSonar Anti-Ransomware arbitrary file deletion7.2CNA v4.00.6%2026-04-20
CVE-2026-5964Digiwin｜EasyFlow .NET SQL injection9.3CNA v4.00.7%2026-04-20Fix
CVE-2026-5963Digiwin｜EasyFlow .NET SQL injection9.3CNA v4.00.7%2026-04-20Fix
CVE-2026-5958Race condition in GNU Sed2.1CNA v4.00.1%2026-04-20Fix
CVE-2026-5928The GNU C Library glibc potential buffer under-read in ungetwc7.5CISA ADP v3.10.5%2026-04-20Fix
CVE-2026-5760SGLang reranking endpoint code injection9.8CISA ADP v3.11.1%2026-04-20Exploit code
CVE-2026-5721wpDataTables WordPress plugin stored cross-site scripting4.7CNA v3.10.2%2026-04-20Fix
CVE-2026-5478Everest Forms WordPress plugin unauthenticated arbitrary file read and deletion8.1CNA v3.11.0%2026-04-20Fix
CVE-2026-5450The GNU C Library glibc scanf %mc off-by-one heap buffer overflow9.8CISA ADP v3.10.7%2026-04-20Fix
CVE-2026-4852Image Source Control Lite WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-20Fix
CVE-2026-4048Progress Software LoadMaster UI OS command injection8.4CNA v3.14.2%2026-04-20Fix
CVE-2026-3519Progress Software LoadMaster API OS command injection8.4CNA v3.14.2%2026-04-20Fix
CVE-2026-3518Progress Software LoadMaster API OS command injection8.4CNA v3.14.2%2026-04-20Fix
CVE-2026-3517Progress Software LoadMaster API OS command injection8.4CNA v3.14.2%2026-04-20Fix
CVE-2026-3219pip doesn't reject concatenated ZIP and tar archives4.6CNA v4.00.2%2026-04-20Fix
CVE-2026-0930wolfSSL wolfSSH potential wolfSSHd buffer out-of-bounds read on Windows Handling Terminal Resize2.3CNA v4.00.2%2026-04-20Fix
CVE-2026-6583TransformerOptimus SuperAGI API Key Management endpoint api_key.py edit_api_key authorization5.3CNA v4.00.4%2026-04-19
CVE-2026-6582TransformerOptimus SuperAGI vector database management endpoint missing authentication6.9CNA v4.00.7%2026-04-19
CVE-2026-6581H3C Magic B1 aspForm SetMobileAPInfoById buffer overflow8.7CNA v4.00.8%2026-04-19
CVE-2026-6580liangliangyy DjangoBlog Amap API Call views.py hard-coded key6.9CNA v4.00.5%2026-04-19
CVE-2026-6579liangliangyy DjangoBlog Clean endpoint views.py missing authentication6.9CNA v4.00.7%2026-04-19
CVE-2026-6578liangliangyy DjangoBlog setting settings.py hard-coded credentials6.3CNA v4.00.4%2026-04-19
CVE-2026-6577liangliangyy DjangoBlog logtracks endpoint views.py missing authentication6.9CNA v4.00.7%2026-04-19
CVE-2026-6576liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection5.3CNA v4.02.4%2026-04-19
CVE-2026-6574osuuu LightPicture API upload endpoint lp.sql hard-coded credentials6.9CNA v4.00.5%2026-04-19
CVE-2026-6573PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery5.3CNA v4.00.3%2026-04-19
CVE-2026-6572Collabora KodExplorer fileUpload endpoint share.class.php improper authorization6.3CNA v4.00.4%2026-04-19
CVE-2026-6571kodcloud KodExplorer systemRole.class.php roleGroupAction authorization5.3CNA v4.00.4%2026-04-19
CVE-2026-6570kodcloud KodExplorer systemMember.class.php initInstall authorization5.1CNA v4.00.4%2026-04-19
CVE-2026-6569kodcloud KodExplorer fileGet endpoint share.class.php improper authentication6.9CNA v4.00.7%2026-04-19
CVE-2026-6568kodcloud KodExplorer Public Share share.class.php initShareOld path traversal6.9CNA v4.00.7%2026-04-19
CVE-2026-6564EMQ EMQX Enterprise Session Handling improper authorization5.3CNA v4.00.4%2026-04-19
CVE-2026-6563H3C Magic B1 aspForm SetAPWifiorLedInfoById buffer overflow8.7CNA v4.00.8%2026-04-19
CVE-2026-6562dameng100 muucmf index.html getListByPage SQL injection6.9CNA v4.00.4%2026-04-19
CVE-2026-6561EyouCMS Index.php edit_adminlogo unrestricted upload5.1CNA v4.00.4%2026-04-19
CVE-2026-6560H3C Magic B0 aspForm Edit_BasicSSID buffer overflow8.7CNA v4.00.8%2026-04-19
CVE-2026-6559Wavlink WL-WN579A3 login.cgi sub_401F80 cross-site scripting5.3CNA v4.00.4%2026-04-19Fix
CVE-2026-0868EMC Scheduling Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-19Fix
CVE-2026-41254little cms color engine incorrect behavior order7.5v3.10.4%2026-04-18Fix
CVE-2026-41253iTerm2 inclusion of untrusted functionality7.8v3.10.2%2026-04-18
CVE-2026-41242protobufjs has an arbitrary code execution issue9.4CNA v4.01.0%2026-04-18Exploit codeFix
CVE-2026-40948Apache Airflow Providers Keycloak: OAuth login CSRF Missing State parameter in Keycloak Auth Manager5.4CISA ADP v3.10.4%2026-04-18Fix
CVE-2026-40593ChurchCRM: Stored XSS in UserEditor.php via Login Name field4.8CNA v3.10.2%2026-04-18Fix
CVE-2026-40582ChurchCRM public user login endpoint authentication bypass9.1CNA v4.00.7%2026-04-18Fix
CVE-2026-40581ChurchCRM: Cross-site request forgery (CSRF) in SelectDelete.php leading to Permanent Data Deletion8.1CNA v3.10.2%2026-04-18Fix
CVE-2026-40572NovumOS has arbitrary Memory Mapping via Syscall 15 (MemoryMapRange)9.0CNA v3.10.2%2026-04-18Fix
CVE-2026-40494SAIL has heap buffer overflow in TGA RLE decoder raw packet path missing bounds check9.8CNA v3.10.6%2026-04-18Fix
CVE-2026-40493SAIL has heap buffer overflow in PSD decoder bpp mismatch in LAB 16-bit mode9.8CNA v3.10.6%2026-04-18Fix
CVE-2026-40492HappySeaFox SAIL XWD decoder out-of-bounds write9.8CNA v3.10.6%2026-04-18Fix
CVE-2026-40491gdown affected by arbitrary file write via path traversal in gdown.extractall6.5CNA v3.10.8%2026-04-18Fix
CVE-2026-40490AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects6.8CNA v3.10.5%2026-04-18Fix
CVE-2026-40489editorconfig-core-c ec_glob stack-based buffer overflow8.6CNA v4.00.2%2026-04-18Fix
CVE-2026-40487Postiz has unrestricted file upload via MIME type spoofing that leads to stored XSS8.9CNA v3.10.3%2026-04-18Exploit codeFix
CVE-2026-40485ChurchCRM: Username Enumeration via Differential Response in Public Login API5.3CNA v3.10.4%2026-04-18Fix
CVE-2026-40484ChurchCRM: Authenticated remote code execution9.1CNA v3.11.0%2026-04-18Fix
CVE-2026-40483ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment field5.4CNA v3.10.3%2026-04-18Fix
CVE-2026-40482ChurchCRM financial service SQL injection7.1CNA v4.00.4%2026-04-18Fix
CVE-2026-40480ChurchCRM person API endpoint insecure direct object reference7.1CNA v4.00.4%2026-04-18Fix
CVE-2026-40350Movary user management API incorrect authorization8.8CNA v3.10.6%2026-04-18Fix
CVE-2026-40349Movary user settings API vulnerability8.8CNA v3.10.6%2026-04-18Fix
CVE-2026-40348Movary has authenticated SSRF7.7CNA v3.10.5%2026-04-18Fix
CVE-2026-40347Python-Multipart affected by denial of service via large multipart preamble or epilogue data5.3CNA v3.10.4%2026-04-18Fix
CVE-2026-40346NocoBase has SSRF in Workflow HTTP request and Custom request plugins6.4CNA v4.00.4%2026-04-18Fix
CVE-2026-40341libgphoto2 has an OOB read in ptp_unpack_EOS_FocusInfoEx3.5CNA v3.10.2%2026-04-18Fix
CVE-2026-40340libgphoto2 has OOB read in ptp_unpack_OI in ptp-pack.c via malicious PTP ObjectInfo response6.1CNA v3.10.3%2026-04-18Fix
CVE-2026-40339libgphoto2 has OOB read in ptp_unpack_Sony_DPD FormFlag parsing in ptp-pack.c5.2CNA v3.10.2%2026-04-18Fix
CVE-2026-40338libgphoto2 has OOB read in ptp_unpack_Sony_DPD enumeration count parsing in ptp-pack.c5.2CNA v3.10.2%2026-04-18Fix
CVE-2026-40337camelot-os sentry-kernel sentry kernel has incomplete ownership check for IRQ line manipulation5.1CNA v3.10.2%2026-04-18Fix
CVE-2026-40336libgphoto2 has memory leak in ptp_unpack_Sony_DPD secondary enumeration list in ptp-pack.c2.4CNA v3.10.2%2026-04-18Fix
CVE-2026-40335libgphoto2 has OOB read in ptp_unpack_DPV UINT128/INT128 handling in ptp-pack.c5.2CNA v3.10.2%2026-04-18Fix
CVE-2026-40334libgphoto2 missing null termination in ptp_unpack_Canon_FE filename buffer in ptp-pack.c3.5CNA v3.10.2%2026-04-18Fix
CVE-2026-40333libgphoto2 PTP EOS image format unpacking out-of-bounds read6.1CNA v3.10.3%2026-04-18Fix
CVE-2026-40324ChilliCream graphql-platform Hot Chocolate's Utf8GraphQLParser has stack overflow9.1CNA v3.11.0%2026-04-18Fix
CVE-2026-40323SP1 V6 Recursion Circuit Row-Count Binding Gap8.9CNA v4.00.2%2026-04-18Fix
CVE-2026-40317NovumOS has privilege escalation in the Syscall interface9.4CNA v3.10.2%2026-04-18Fix
CVE-2026-35582Emissary has an OS command injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix8.8CNA v3.11.1%2026-04-18Fix
CVE-2026-35465freedomofpress securedrop-client SecureDrop client has path injection in read_gzip_header_filename7.5CNA v3.10.5%2026-04-18Fix
CVE-2026-32690Apache Airflow: Nested Variable Secret Values Bypass Redaction via max_depth=13.7CISA ADP v3.10.7%2026-04-18Fix
CVE-2026-32228Apache Airflow asset materialization permission incorrect authorization7.5CISA ADP v3.10.7%2026-04-18Fix
CVE-2026-30912Apache Airflow: Exposing stack trace in case of constraint error7.5CISA ADP v3.10.8%2026-04-18Fix
CVE-2026-30898Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf8.8CISA ADP v3.11.0%2026-04-18Fix
CVE-2026-25917Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow)7.2CISA ADP v3.11.1%2026-04-18Fix
CVE-2026-6518CMP WordPress plugin arbitrary file upload8.8CNA v3.11.0%2026-04-18Fix
CVE-2026-6048Flipbox Addon for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-18Fix
CVE-2026-4801Page Builder Gutenberg Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-18Fix
CVE-2026-2986Contextual Related Posts WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-18Fix
CVE-2026-2505Categories Images WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2026-04-18Fix
CVE-2026-2262Easy Appointments WordPress plugin unauthenticated sensitive information exposure via REST API7.5CNA v3.12.4%2026-04-18NucleiFix
CVE-2026-1838Hostel WordPress plugin reflected cross-site scripting via shortcode_id parameter6.1CNA v3.10.3%2026-04-18Fix
CVE-2026-1559Youzify WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-18Fix
CVE-2026-0894Content Blocks (Custom Post Widget) WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-18Fix
CVE-2026-41153JetBrains Junie command injection5.8CNA v3.10.4%2026-04-17Fix
CVE-2026-40922SiYuan: Incomplete sanitization of bazaar README allows stored XSS5.3CNA v4.00.4%2026-04-17Fix
CVE-2026-40527radare2 command injection via DWARF Parameter Names8.5CNA v4.01.5%2026-04-17Fix
CVE-2026-40525OpenViking authentication bypass via VikingBot OpenAPI9.1CNA v4.00.8%2026-04-17Fix
CVE-2026-40518ByteDance DeerFlow path traversal and arbitrary file write via Bootstrap Mode9.1v3.10.5%2026-04-17
CVE-2026-40516OpenHarness SSRF via web_fetch and web_search6.3NVD v3.10.3%2026-04-17
CVE-2026-40515OpenHarness permission bypass via grep and glob root argument5.5NVD v3.10.4%2026-04-17
CVE-2026-40486Kimai user preferences API mass assignment4.3CNA v3.10.3%2026-04-17Fix
CVE-2026-40481monetr Stripe webhook endpoint resource exhaustion8.2CNA v4.00.6%2026-04-17Fix
CVE-2026-40479Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member widget5.4CNA v3.10.2%2026-04-17Fix
CVE-2026-40478Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf9.1CNA v3.11.2%2026-04-17Reported exploitedFix
CVE-2026-40477Improper restriction of the scope of accessible objects in Thymeleaf expressions9.1CNA v3.10.9%2026-04-17Fix
CVE-2026-40476graphql-php is affected by a denial of service6.9CNA v4.00.7%2026-04-17Fix
CVE-2026-40474Wger has broken access control in the Global Gym Configuration Update endpoint7.6CNA v3.10.4%2026-04-17Fix
CVE-2026-40461Anviz Products missing authentication for critical function7.5CNA v3.10.5%2026-04-17
CVE-2026-40459LDAP injection in PAC4J8.8v3.10.7%2026-04-17Fix
CVE-2026-40458Cross-site request forgery in PAC4J6.5NVD v3.10.2%2026-04-17Fix
CVE-2026-40434Anviz CrossChex Standard improper verification of source of a communication channel8.1CNA v3.10.4%2026-04-17
CVE-2026-40353Wger: Stored XSS via Unescaped License Attribution fields5.1CNA v4.00.2%2026-04-17Fix
CVE-2026-40352FastGPT: NoSQL injection in updatePasswordByOld leads to account takeover8.8CNA v3.10.5%2026-04-17Fix
CVE-2026-40351FastGPT: NoSQL injection in loginByPassword leads to authentication bypass9.8CNA v3.10.6%2026-04-17Fix
CVE-2026-40342Firebird: Path traversal + arbitrary file write leads to remote code execution10.0CNA v3.10.8%2026-04-17Fix
CVE-2026-40321dnnsoftware Dnn.Platform DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload8.1CNA v3.10.4%2026-04-17Fix
CVE-2026-40320Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck5.4CNA v4.00.2%2026-04-17Fix
CVE-2026-40319Giskard has a regular expression denial of service (ReDoS) in RegexMatching Check1.0CNA v4.00.2%2026-04-17Fix
CVE-2026-40306dnnsoftware Dnn.Platform DNN has same HostGUID for all new installs6.9CNA v4.00.3%2026-04-17Fix
CVE-2026-40305dnnsoftware Dnn.Platform DNN has Force Friend Request Acceptance4.3CNA v3.10.3%2026-04-17Fix
CVE-2026-40304NetFoundry zrok frontend unaccess API vulnerability5.3CNA v3.10.4%2026-04-17Fix
CVE-2026-40303zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing7.5CNA v3.10.6%2026-04-17Fix
CVE-2026-40302zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering6.1CNA v3.10.3%2026-04-17Fix
CVE-2026-40301DOMSanitizer SVG style tag sanitizer vulnerability4.7CNA v3.10.4%2026-04-17Fix
CVE-2026-40299next-intl has an open redirect6.9CNA v4.00.5%2026-04-17Fix
CVE-2026-40293OpenFGA Playground Preshared key exposure6.5CNA v3.10.5%2026-04-17Fix
CVE-2026-40286WeGIA has cross-site scripting in Controle de Contribuição7.5CNA v3.10.4%2026-04-17Fix
CVE-2026-40285WeGIA has SQL injection via Session Variable Override in DespachoControle.php8.8CNA v3.10.4%2026-04-17Fix
CVE-2026-40284WeGIA has stored XSS in listar_despachos.php6.8CNA v3.10.4%2026-04-17Fix
CVE-2026-40283WeGIA has stored XSS in profile_paciente.php6.8CNA v3.10.3%2026-04-17Fix
CVE-2026-40282WeGIA has stored XSS in intercorrencia_visualizar.php6.4CNA v4.00.4%2026-04-17Fix
CVE-2026-40265enchant97 note-mark note Mark has broken access control on Asset Download5.9CNA v3.10.5%2026-04-17Fix
CVE-2026-40263enchant97 note-mark note Mark: Username Enumeration via login endpoint timing side-channel3.7CNA v3.10.3%2026-04-17Fix
CVE-2026-40262enchant97 note-mark Note Mark has stored XSS via Unrestricted Asset upload8.7CNA v3.10.4%2026-04-17Fix
CVE-2026-40260pypdf XMP metadata parser XML entity expansion6.9CNA v4.00.5%2026-04-17Fix
CVE-2026-40258gramps-project gramps-web-api Gramps Web API has Zip Slip path traversal in Media Archive Import9.1CNA v3.10.6%2026-04-17Fix
CVE-2026-40196HomeBox has Unauthorized API Access via Retained defaultGroup ID after Group Access Revocation8.1CNA v3.10.4%2026-04-17Fix
CVE-2026-40155Auth0 Next.js SDK has Improper Proxy Cache Lookup5.4CNA v3.10.3%2026-04-17Fix
CVE-2026-40066Anviz Products download of code without integrity check8.8CNA v3.10.5%2026-04-17
CVE-2026-40002ZTE Red Magic 11 Pro service interface access control improper privilege management5.0CNA v3.10.1%2026-04-17Fix
CVE-2026-37749CodeAstro Simple Attendance Management System index.php login SQL injection9.8CISA ADP v3.10.8%2026-04-17Exploit code
CVE-2026-35682Anviz CX2 Lite command injection8.8CNA v3.13.6%2026-04-17
CVE-2026-35603Anthropic Claude Code system-wide configuration loading privilege escalation5.4CNA v4.00.2%2026-04-17Fix
CVE-2026-35546Anviz Products missing authentication for critical function9.8CNA v3.10.8%2026-04-17
CVE-2026-35512xrdp EGFX channel heap-based buffer overflow8.7CNA v4.01.0%2026-04-17Fix
CVE-2026-35496CubeCart path traversal5.1CNA v4.00.4%2026-04-17Fix
CVE-2026-35402neo4j-contrib mcp-neo4j mcp-neo4j-cypher: SSRF and Data Modification2.3CNA v4.00.4%2026-04-17Fix
CVE-2026-35215Firebird: DoS via malicious slice descriptor in slice packet7.5CNA v3.10.7%2026-04-17Fix
CVE-2026-35153Dell PowerProtect Data Domain argument injection6.7CNA v3.10.2%2026-04-17Fix
CVE-2026-35074Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2026-04-17Fix
CVE-2026-35073Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2026-04-17Fix
CVE-2026-35072Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2026-04-17Fix
CVE-2026-35061Anviz Products missing authorization5.3CNA v3.10.5%2026-04-17
CVE-2026-34232Firebird: DoS via `op_response` packet from client7.5CNA v3.10.7%2026-04-17Fix
CVE-2026-34018CubeCart An SQL injection9.8v3.10.3%2026-04-17Fix
CVE-2026-33689neutrinolabs xrdp dynamic channel parser out-of-bounds read8.7CNA v4.00.9%2026-04-17Fix
CVE-2026-33569Anviz Products cleartext transmission of sensitive information6.5CNA v3.10.3%2026-04-17
CVE-2026-33516neutrinolabs xrdp RDP capability exchange parser out-of-bounds read7.7CNA v4.00.7%2026-04-17Fix
CVE-2026-33436Stirling-PDF: Reflected XSS through crafted filename in file upload functionality3.1CNA v3.10.2%2026-04-17Fix
CVE-2026-33392JetBrains YouTrack server-side template injection7.2CNA v3.10.5%2026-04-17Fix
CVE-2026-33337Firebird has a buffer overflow when parsing corrupted slice packets7.5CNA v3.10.8%2026-04-17Fix
CVE-2026-33145neutrinolabs xrdp xrdp-sesman AlternateShell handling OS command injection6.3CNA v3.10.6%2026-04-17Fix
CVE-2026-33093Anviz Products missing authorization5.3CNA v3.10.4%2026-04-17
CVE-2026-32650Anviz CrossChex Standard TDS7 PreLogin negotiation vulnerability7.5CNA v3.10.3%2026-04-17
CVE-2026-32648Anviz Products missing authorization5.3CNA v3.10.4%2026-04-17
CVE-2026-32624xrdp logon processing heap-based buffer overflow6.3CNA v4.00.5%2026-04-17Fix
CVE-2026-32623xrdp NeutrinoRDP module heap-based buffer overflow7.7CNA v4.00.8%2026-04-17Fix
CVE-2026-32324Anviz CX7 Firmware use of hard-coded cryptographic key7.7CNA v3.10.1%2026-04-17
CVE-2026-32107xrdp sesexec privilege drop privilege escalation8.8CNA v3.10.2%2026-04-17Fix
CVE-2026-32105xrdp MAC signature verification improper integrity check validation9.3CNA v4.00.2%2026-04-17Fix
CVE-2026-31927Anviz CX7 Firmware relative path traversal4.9CNA v3.10.5%2026-04-17
CVE-2026-31317Craftql vulnerable to server-side request forgery7.5CISA ADP v3.10.6%2026-04-17
CVE-2026-29013libcoap out-of-bounds read in OSCORE CBOR Unwrap Handling9.8v3.10.5%2026-04-17Fix
CVE-2026-28263Dell PowerProtect Data Domain cross-site scripting5.9CNA v3.10.2%2026-04-17Fix
CVE-2026-28224Firebird null pointer dereference via CryptCallback causes DOS8.2CNA v3.10.7%2026-04-17Fix
CVE-2026-28214Firebird server hangs when using specific clumplet on batch creation6.0CNA v4.00.6%2026-04-17Fix
CVE-2026-28212Firebird has potential server crash via null pointer dereference when processing op_slice packet7.5CNA v3.10.8%2026-04-17Fix
CVE-2026-27890Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments8.2CNA v3.10.7%2026-04-17Fix
CVE-2026-23853Dell PowerProtect Data Domain weak credentials8.4CNA v3.10.2%2026-04-17Fix
CVE-2026-23779Dell PowerProtect Data Domain command injection6.7CNA v3.10.5%2026-04-17Fix
CVE-2026-23778Dell PowerProtect Data Domain command injection7.2CNA v3.11.1%2026-04-17Fix
CVE-2026-23777Dell PowerProtect Data Domain information disclosure4.3CNA v3.10.3%2026-04-17Fix
CVE-2026-23776Dell PowerProtect Data Domain improper certificate validation7.2CNA v3.10.2%2026-04-17Fix
CVE-2026-23775Dell PowerProtect Data Domain appliances sensitive information in log files7.6CNA v3.10.3%2026-04-17Fix
CVE-2026-23500Dolibarr: OS command injection (RCE) via MAIN_ODT_AS_PDF configuration9.4CNA v4.00.9%2026-04-17Exploit codeFix
CVE-2026-22734Cloud Foundry UAA SAML Signature Bypass8.6CNA v3.10.4%2026-04-17
CVE-2026-21733Imagination Technologies Graphics DDK GPU memory protection flags vulnerability7.3CISA ADP v3.10.1%2026-04-17Fix
CVE-2026-21719CubeCart An OS command injection8.6CNA v4.01.2%2026-04-17Fix
CVE-2026-21709Veeam Backup and Replication command injection6.7CISA ADP v3.10.2%2026-04-17Fix
CVE-2026-6507dnsmasq DHCP BOOTREPLY processing out-of-bounds write7.5CNA v3.10.6%2026-04-17Fix
CVE-2026-6497prasathmani TinyFileManager file upload filemanager.php server-side request forgery5.3CNA v4.00.3%2026-04-17
CVE-2026-6496prasathmani TinyFileManager POST parameter filemanager.php path traversal5.3CNA v4.00.5%2026-04-17
CVE-2026-6494Red Hat Ansible Automation Platform MCP server log injection5.3CNA v3.10.4%2026-04-17
CVE-2026-6493lukevella rallly Reset Password reset-password-form.tsx cross-site scripting5.1CNA v4.00.4%2026-04-17Fix
CVE-2026-6492arnobt78 Hotel Booking Management System Health Check endpoint detailed information disclosure6.9CNA v4.00.5%2026-04-17
CVE-2026-6491libvips nip2 vips7compat.c im_minpos_vec heap-based overflow4.8CNA v4.00.2%2026-04-17
CVE-2026-6490QueryMine sms GET request parameter deletecourse.php SQL injection6.9CNA v4.00.4%2026-04-17
CVE-2026-6489QueryMine sms Background Management addteacher.php unrestricted upload5.3CNA v4.00.3%2026-04-17
CVE-2026-6488QueryMine sms GET request parameter editcourse.php SQL injection5.3CNA v4.00.3%2026-04-17
CVE-2026-6487Qihui jtbc5 CMS Code endpoint manage.php path traversal5.3CNA v4.00.5%2026-04-17
CVE-2026-6486classroombookings User Display Name layout.php read cross-site scripting5.1CNA v4.00.4%2026-04-17Fix
CVE-2026-6483Wavlink WL-WN530H4 internet.cgi snprintf os command injection8.6CNA v4.03.2%2026-04-17Emerging ThreatsFix
CVE-2026-6482Local privilege escalation via OpenSSL configuration file in Insight Agent8.5CNA v4.00.2%2026-04-17Fix
CVE-2026-6451CMS für Motorrad Werkstätten WordPress plugin cross-site request forgery4.3CNA v3.10.3%2026-04-17
CVE-2026-6443Essentialplugin plugins (various Versions) Injected backdoor9.8CNA v3.10.6%2026-04-17Fix
CVE-2026-6441Canto WordPress plugin missing authorization authenticated arbitrary setting modification4.3CNA v3.10.4%2026-04-17Fix
CVE-2026-6439VideoZen WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-04-17
CVE-2026-6437AWS EFS CSI Driver Mount option injection6.9CNA v4.00.7%2026-04-17Fix
CVE-2026-6421Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path7.3CNA v4.00.2%2026-04-17Exploit codeFix
CVE-2026-6284Horner Automation Cscape and XL4, XL7 PLC weak password requirements9.3CNA v4.00.5%2026-04-17Fix
CVE-2026-6080Tutor LMS WordPress plugin authenticated (Admin+) SQL injection via date parameter6.5CNA v3.10.5%2026-04-17Fix
CVE-2026-5807Vault vulnerable to denial of service via Unauthenticated Root Token Generation/Rekey Operations7.5CNA v3.10.9%2026-04-17Fix
CVE-2026-5797ExpressTech Quiz and Survey Master quiz answer rendering vulnerability5.3CNA v3.10.7%2026-04-17Fix
CVE-2026-5720miniupnpd integer underflow SOAPAction Header Parsing9.1v3.11.1%2026-04-17Fix
CVE-2026-5718Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin arbitrary file upload8.1CNA v3.13.5%2026-04-17NucleiExploit codeFix
CVE-2026-5710Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin path traversal7.5CNA v3.10.6%2026-04-17Fix
CVE-2026-5502Themeum Tutor LMS course content order update missing authorization5.3CNA v3.10.4%2026-04-17Fix
CVE-2026-5427Kubio AI Page Builder WordPress plugin missing authorization authenticated limited file upload5.3CNA v3.10.5%2026-04-17Fix
CVE-2026-5234LatePoint WordPress plugin insecure direct object reference5.3CNA v3.10.6%2026-04-17Fix
CVE-2026-5231WP Statistics WordPress plugin unauthenticated stored cross-site scripting via utm_source parameter7.2CNA v3.10.4%2026-04-17Fix
CVE-2026-5162Royal Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-17Fix
CVE-2026-5131Server-side request forgery in GREENmod6.9CNA v4.00.5%2026-04-17Fix
CVE-2026-5052Vault vulnerable to server-side request forgery in ACME Challenge Validation5.3CNA v3.10.4%2026-04-17Fix
CVE-2026-4853JetBackup WordPress plugin arbitrary directory deletion via path traversal in fileName parameter4.9CNA v3.10.6%2026-04-17Fix
CVE-2026-4817MasterStudy LMS WordPress plugin time-based blind SQL injection6.5CNA v3.10.6%2026-04-17Fix
CVE-2026-4666wpForo Forum WordPress plugin missing authorization authenticated arbitrary Forum post modification6.5CNA v3.10.5%2026-04-17Fix
CVE-2026-4659Unlimited Elements For Elementor WordPress plugin arbitrary file read7.5CNA v3.10.7%2026-04-17Fix
CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough header7.5CNA v3.10.6%2026-04-17Fix
CVE-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass denial of service8.1CNA v3.10.5%2026-04-17Fix
CVE-2026-3488WP Statistics WordPress plugin missing authorization6.5CNA v3.10.4%2026-04-17Fix
CVE-2026-3464WP Customer Area WordPress plugin arbitrary file read/Deletion8.8CNA v3.11.2%2026-04-17Fix
CVE-2026-3330Form Maker by 10Web WordPress plugin SQL injection4.9CNA v3.10.5%2026-04-17Fix
CVE-2026-2434Pz-LinkCard WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-17
CVE-2026-41113sagredo qmail OS command injection8.1CNA v3.11.0%2026-04-16Fix
CVE-2026-41082OCaml opam path traversal7.8v3.10.2%2026-04-16Fix
CVE-2026-41080libexpat insufficient entropy7.5CISA ADP v3.10.4%2026-04-16Fix
CVE-2026-41035Samba rsync improper length parameter handling7.8v3.10.4%2026-04-16Fix
CVE-2026-41034Ascensio ONLYOFFICE DocumentServer out-of-bounds read5.0CNA v3.10.3%2026-04-16Fix
CVE-2026-41030Ascensio ONLYOFFICE DesktopEditors incorrect resource transfer6.2CNA v3.10.2%2026-04-16Fix
CVE-2026-41015radare2 OS command injection7.4CNA v3.11.0%2026-04-16Fix
CVE-2026-40962FFmpeg integer overflow9.8v3.10.1%2026-04-16Fix
CVE-2026-40960Luanti incorrect control flow8.1CNA v3.10.2%2026-04-16Fix
CVE-2026-40959Luanti inclusion of untrusted functionality9.3CNA v3.10.2%2026-04-16Fix
CVE-2026-40947Yubico libfido2 untrusted search path2.9CNA v3.10.1%2026-04-16Fix
CVE-2026-40901DataEase: Quartz deserialization → remote code execution7.5CNA v4.00.8%2026-04-16Exploit codeKCVFix
CVE-2026-40900DataEase has SQL injection via Stacked Queries8.7CNA v4.00.5%2026-04-16KCVFix
CVE-2026-40899DataEase has an arbitrary file read8.3CNA v4.00.4%2026-04-16Fix
CVE-2026-40505MuPDF mutool ANSI injection via Metadata4.8CNA v4.00.2%2026-04-16Fix
CVE-2026-40504Creolabs Gravity heap buffer overflow via gravity_vm_exec9.3CNA v4.00.9%2026-04-16Fix
CVE-2026-40503OpenHarness path traversal information disclosure via /memory show7.1CNA v4.00.5%2026-04-16
CVE-2026-40502OpenHarness Remote Administrative command injection via Gateway handler8.7CNA v4.02.1%2026-04-16
CVE-2026-40322SiYuan: Mermaid `javascript:` Link injection leads to stored XSS and Electron RCE9.1CNA v3.10.5%2026-04-16Fix
CVE-2026-40318SiYuan: Publish Reader path traversal Delete via `removeUnusedAttributeView`8.5CNA v3.10.4%2026-04-16Fix
CVE-2026-40308My Calendar: Unauthenticated information disclosure (IDOR) via Multisite switch_to_blog8.8CNA v4.01.1%2026-04-16NucleiFix
CVE-2026-40259SiYuan: Publish Reader can Arbitrarily Delete attribute view files via removeUnusedAttributeView API8.1CNA v3.10.5%2026-04-16Fix
CVE-2026-40255@adonisjs/http-server has an open redirect6.1CNA v3.10.3%2026-04-16Fix
CVE-2026-40253openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c6.8CNA v3.10.2%2026-04-16Fix
CVE-2026-40249free5GC UDR policy data subscription handler vulnerability6.9CNA v4.00.4%2026-04-16
CVE-2026-40248free5GC UDR traffic influence subscriptions API improper authorization8.7CNA v4.00.5%2026-04-16
CVE-2026-40247free5GC UDR traffic influence subscriptions API improper authorization8.7CNA v4.00.5%2026-04-16
CVE-2026-40246free5GC UDR traffic influence subscriptions API improper authorization8.7CNA v4.00.5%2026-04-16
CVE-2026-40245free5GC UDR subscription notification API information disclosure7.5CNA v3.10.6%2026-04-16
CVE-2026-40193Maddy Mail Server: LDAP Filter injection via Unsanitized Username8.2CNA v3.10.5%2026-04-16Fix
CVE-2026-40170ngtcp2 has a qlog transport parameter serialization stack buffer overflow7.5CNA v3.11.0%2026-04-16Fix
CVE-2026-40118Arcserve UDP Console incorrectly specified destination5.1CNA v4.00.2%2026-04-16
CVE-2026-39313MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service8.7CNA v4.00.6%2026-04-16Fix
CVE-2026-37347SourceCodester Payroll Management and Information System view_employee.php SQL injection9.1CISA ADP v3.10.4%2026-04-16
CVE-2026-37346SourceCodester Payroll Management and Information System view_account.php SQL injection4.7CISA ADP v3.10.3%2026-04-16
CVE-2026-37345SourceCodester Vehicle Parking Area Management System manage_park.php SQL injection9.8CISA ADP v3.10.5%2026-04-16
CVE-2026-37344SourceCodester Vehicle Parking Area Management System manage_location.php SQL injection7.2CISA ADP v3.10.4%2026-04-16
CVE-2026-37343SourceCodester Vehicle Parking Area Management System manage_user.php SQL injection7.2CISA ADP v3.10.4%2026-04-16
CVE-2026-37342SourceCodester Vehicle Parking Area Management System view_parked_details.php SQL injection7.2CISA ADP v3.10.4%2026-04-16
CVE-2026-37341SourceCodester Vehicle Parking Area Management System manage_category.php SQL injection7.2CISA ADP v3.10.4%2026-04-16
CVE-2026-37340SourceCodester Simple Music Cloud Community System edit_music.php SQL injection9.8CISA ADP v3.10.5%2026-04-16
CVE-2026-37339SourceCodester Simple Music Cloud Community System view_genre.php SQL injection9.8CISA ADP v3.10.5%2026-04-16
CVE-2026-37338SourceCodester Simple Music Cloud Community System view_user.php SQL injection9.4CISA ADP v3.10.4%2026-04-16
CVE-2026-37337SourceCodester Simple Music Cloud Community System view_playlist.php SQL injection7.3CISA ADP v3.10.3%2026-04-16
CVE-2026-37336SourceCodester Simple Music Cloud Community System view_music.php SQL injection7.3CISA ADP v3.10.3%2026-04-16
CVE-2026-37100Yamaha SR-B30A Bluetooth Low Energy control interface improper access control6.5CISA ADP v3.10.3%2026-04-16
CVE-2026-35469SpdyStream: DOS on CRI8.7CNA v4.00.8%2026-04-16Fix
CVE-2026-34164Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService4.9CNA v3.10.5%2026-04-16Fix
CVE-2026-33804@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option7.4CNA v3.10.5%2026-04-16Fix
CVE-2026-33472Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority scheme confusion ( bypass)4.8CNA v3.10.1%2026-04-16Fix
CVE-2026-33207DataEase SQL injection8.6CNA v4.00.5%2026-04-16Fix
CVE-2026-33122DataEase has SQL injection via Datasource Management8.6CNA v4.00.5%2026-04-16Fix
CVE-2026-33121DataEase has SQL injection via Datasource Save Flow8.7CNA v4.00.5%2026-04-16Fix
CVE-2026-33084DataEase has SQL injection through its getFieldEnumObj endpoint8.7CNA v4.00.5%2026-04-16Fix
CVE-2026-33083DataEase has SQL injection in Order by Clause8.7CNA v4.00.5%2026-04-16Fix
CVE-2026-33082DataEase: SQL injection in v2 Dataset Export8.7CNA v4.00.5%2026-04-16Fix
CVE-2026-31987Apache Airflow: JWT token appearing in logs7.5CISA ADP v3.10.8%2026-04-16Fix
CVE-2026-31843goodoneuz pay-uz /payment/api/editable/update endpoint remote code execution10.0CNA v4.01.2%2026-04-16Fix
CVE-2026-30656fio A null pointer dereference7.5CISA ADP v3.10.5%2026-04-16Fix
CVE-2026-30459Thedaylightstudio Fuel CMS weak password recovery7.1CISA ADP v3.10.3%2026-04-16
CVE-2026-27820Buffer overflow in Zlib::GzipReader ungetc via large input leads to memory corruption1.7CNA v4.00.8%2026-04-16Fix
CVE-2026-24749Silverstripe Assets module has a DBFile::getURL permission bypass5.3CNA v3.10.4%2026-04-16Fix
CVE-2026-23772Dell Storage Manager improper privilege management7.3CNA v3.10.1%2026-04-16Fix
CVE-2026-22619Eaton IPP Software uncontrolled search path7.8CNA v3.10.3%2026-04-16Fix
CVE-2026-22618Eaton IPP Software improperly implemented security check5.9CNA v3.10.2%2026-04-16Fix
CVE-2026-22617Eaton IPP Software sensitive cookie without the Secure attribute5.7CNA v3.10.2%2026-04-16Fix
CVE-2026-22616Eaton IPP Software missing brute-force protection6.5CNA v3.10.3%2026-04-16Fix
CVE-2026-22615Eaton Intelligent Power Protector one of the Eaton improper input validation6.0CNA v3.10.3%2026-04-16Fix
CVE-2026-6442Improper Command Detection Logic allows RCE in Cortex Code Command-Line interface8.3CNA v3.10.5%2026-04-16Fix
CVE-2026-6414@fastify/static vulnerable to route guard bypass via encoded path separators5.9CNA v3.10.4%2026-04-16Fix
CVE-2026-6410@fastify/static vulnerable to path traversal in directory listing5.3CNA v3.10.5%2026-04-16Fix
CVE-2026-6409protocolbuffers Protobuf-php protobuf: Denial of service issue7.1CNA v4.00.4%2026-04-16Fix
CVE-2026-6351Openfind｜MailGates/MailAudit CRLF injection8.7CNA v4.00.6%2026-04-16Fix
CVE-2026-6350Openfind｜MailGates/MailAudit stack-based buffer overflow9.3CNA v4.01.0%2026-04-16Fix
CVE-2026-6349HGiga｜iSherlock OS command injection9.3CNA v4.02.6%2026-04-16Fix
CVE-2026-6348Simopro Technology｜WinMatrix missing authentication9.3CNA v4.00.2%2026-04-16Fix
CVE-2026-6270@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes9.1CNA v3.10.6%2026-04-16Fix
CVE-2026-5785Zoho ManageEngine PAM360 SQL injection8.1CNA v3.12.6%2026-04-16Fix
CVE-2026-5426KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value9.1CISA ADP v3.10.8%2026-04-16Reported exploitedExploit codeFix
CVE-2026-5363TP-Link Systems Archer C7 v5 and inadequate encryption strength5.4CNA v4.00.1%2026-04-16
CVE-2026-5070Vantage WordPress theme stored cross-site scripting6.4CNA v3.10.3%2026-04-16Fix
CVE-2026-5050Payment Gateway for Redsys and WooCommerce Lite WordPress plugin improper signature verification7.5CNA v3.10.3%2026-04-16Fix
CVE-2026-4880Barcode Scanner (+Mobile App) WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.8%2026-04-16Fix
CVE-2026-4160Fluent Forms WordPress plugin insecure direct object reference5.3CNA v3.10.3%2026-04-16Fix
CVE-2026-4032CodeColorer WordPress plugin unauthenticated stored cross-site scripting6.1CNA v3.10.3%2026-04-16Fix
CVE-2026-3995OPEN-BRAIN WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-04-16
CVE-2026-3885WP Shortcodes Plugin Shortcodes Ultimate WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-16Fix
CVE-2026-3878WP Docs WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-16Fix
CVE-2026-3876Prismatic WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-04-16Fix
CVE-2026-3875BetterDocs WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-16Fix
CVE-2026-3861LY LINE client UI misrepresentation7.1CNA v4.00.3%2026-04-16
CVE-2026-3773Accessibility Suite by Ability, Inc WordPress plugin SQL injection6.5CNA v3.10.4%2026-04-16
CVE-2026-3614AcyMailing - missing authorization to Authenticated (Subscriber+) privilege escalation8.8CNA v3.10.6%2026-04-16Fix
CVE-2026-3599Riaxe Product Customizer WordPress plugin unauthenticated SQL injection7.5CNA v3.10.6%2026-04-16
CVE-2026-3596Riaxe Product Customizer WordPress plugin privilege escalation9.8CNA v3.10.8%2026-04-16
CVE-2026-3595Riaxe Product Customizer WordPress plugin authorization bypass5.3CNA v3.10.6%2026-04-16
CVE-2026-3581Basic Google Maps Placemarks WordPress plugin authorization bypass5.3CNA v3.10.4%2026-04-16Fix
CVE-2026-3551Custom New User Notification WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-04-16
CVE-2026-3489DirectoryPress WordPress plugin SQL injection7.5CNA v3.10.5%2026-04-16Fix
CVE-2026-3428ASUS Member Center(华硕大厅) update modules download without integrity check5.4CNA v4.00.1%2026-04-16Fix
CVE-2026-3369Better Find and Replace AI-Powered Suggestions WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2026-04-16Fix
CVE-2026-3355Customer Reviews for WooCommerce WordPress plugin reflected cross-site scripting via crsearch6.1CNA v3.10.3%2026-04-16Fix
CVE-2026-3324Zoho ManageEngine Log360 authentication bypass8.2CNA v3.12.1%2026-04-16Fix
CVE-2026-3299WP YouTube Lyte WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-16Fix
CVE-2026-3155OneSignal WordPress plugin authorization bypass3.1CNA v3.10.3%2026-04-16Fix
CVE-2026-2840Email Encoder Protect Email Addresses and Phone Numbers WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-16Fix
CVE-2026-2336Microchip IStaX Weak webstax_auth Cookie Authentication allows privilege escalation8.7CNA v4.00.2%2026-04-16Fix
CVE-2026-1880ASUS DriverHub incorrect permission assignment5.4CNA v4.00.1%2026-04-16Exploit code
CVE-2026-1620Livemesh Addons by Elementor WordPress plugin local file inclusion8.8CNA v3.10.8%2026-04-16
CVE-2026-1572Livemesh Addons for Elementor WordPress plugin unauthorized access6.4CNA v3.10.3%2026-04-16
CVE-2026-0718Post Grid Gutenberg Blocks for News WordPress plugin unauthorized access5.3CNA v3.10.3%2026-04-16Fix
CVE-2026-40919Gimp: Gimp: Denial of service via specially crafted seattle filmworks file5.5NVD v3.10.3%2026-04-15Fix
CVE-2026-40918Gimp: Gimp: Denial of service via crafted pvr image file5.5CNA v3.10.3%2026-04-15Fix
CVE-2026-40917Gimp: Gimp: Application crashes or information disclosure via crafted icns image files7.1NVD v3.10.2%2026-04-15Fix
CVE-2026-40916Gimp: Gimp: Denial of service due to stack buffer overflow in tim image loader5.5NVD v3.10.2%2026-04-15Fix
CVE-2026-40915Gimp: Gimp: Heap buffer overflow due to integer overflow in fits image loader7.8NVD v3.10.4%2026-04-15Fix
CVE-2026-40786MyRewards WordPress plugin broken access control4.3CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-40784FluentBoards WordPress plugin insecure direct object references (IDOR)8.1CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-40778Majestic Support WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-40764Contact Form by WPForms WordPress plugin cross-site request forgery (CSRF)8.1CISA ADP v3.10.1%2026-04-15Fix
CVE-2026-40763Royal Elementor Addons WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-40745Element Pack Elementor Addons WordPress plugin SQL injection7.6CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-40744Beaver Builder WordPress plugin SQL injection8.5CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-40742Nelio AB Testing WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-40740Tutor LMS WordPress plugin broken access control5.4CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-40737COMPE WordPress plugin insecure direct object references (IDOR)5.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-40734Categories Images WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-40730ThemeGrill Demo Importer WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-407293D viewer Embed 3D Models WordPress plugin broken access control4.3CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-40728Magazine Blocks WordPress plugin broken access control4.3CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-40719MaraDNS incorrect control flow7.5CNA v3.10.5%2026-04-15
CVE-2026-40499radare2 command injection via PDB parser print_gvars7.8v3.11.7%2026-04-15Fix
CVE-2026-40316OWASP Blt has RCE in Github Actions via untrusted Django model execution in workflow8.8CNA v3.10.6%2026-04-15
CVE-2026-40261Composer has command injection via Malicious Perforce Reference8.8CNA v3.11.9%2026-04-15Exploit codeFix
CVE-2026-40256Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision5.0CNA v3.10.4%2026-04-15Fix
CVE-2026-40192Pillow is vulnerable to a FITS GZIP decompression bomb8.7CNA v4.00.9%2026-04-15Fix
CVE-2026-40186ApostropheCMS: Sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements6.1CNA v3.10.3%2026-04-15Fix
CVE-2026-40179Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3CNA v4.00.3%2026-04-15Exploit codeFix
CVE-2026-40176Composer is vulnerable to command injection via Malicious Perforce Repository7.8CNA v3.11.0%2026-04-15Exploit codeFix
CVE-2026-40173Dgraph: Unauthenticated pprof endpoint leaks admin auth token9.4CNA v3.10.6%2026-04-15Fix
CVE-2026-40105XWiki has reflected cross-site scripting (XSS) in its page history compare functionality6.5CNA v4.00.8%2026-04-15NucleiFix
CVE-2026-40104XWiki's REST APIs can list all pages/spaces, leading to unavailability6.9CNA v4.00.7%2026-04-15Fix
CVE-2026-40096immich shared album metadata tag open redirect5.1CNA v4.00.2%2026-04-15Fix
CVE-2026-40091SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs6.0CNA v3.10.2%2026-04-15Fix
CVE-2026-40090Zarf has a path traversal via Malicious Package Metadata.Name arbitrary file write7.1CNA v3.10.4%2026-04-15Fix
CVE-2026-39984Sigstore Timestamp Authority has improper certificate validation in verifier5.5CNA v3.10.1%2026-04-15Fix
CVE-2026-39971Serendipity: Host header injection leads to SMTP header injection via unvalidated HTTP_HOST7.2CNA v3.10.3%2026-04-15Fix
CVE-2026-39963s9y Serendipity login cookie handling host header injection6.9CNA v3.10.3%2026-04-15Fix
CVE-2026-39884Flux159 mcp-server-kubernetes MCP Server Kubernetes has argument injection in its port_forward tool8.3CNA v3.10.4%2026-04-15Fix
CVE-2026-39857apostrophecms apostrophe information disclosure5.3CNA v3.10.4%2026-04-15Fix
CVE-2026-39845Weblate: SSRF via the webhook add-on using unprotected fetch_url4.1CNA v3.10.3%2026-04-15Fix
CVE-2026-39842OpenRemote is vulnerable to Expression injection10.0CNA v3.10.9%2026-04-15Exploit codeFix
CVE-2026-39350Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots5.4CNA v3.10.2%2026-04-15Fix
CVE-2026-35569ApostropheCMS: Stored XSS in SEO fields leads to Authenticated API data exposure in ApostropheCMS8.7CNA v3.10.4%2026-04-15Fix
CVE-2026-34632Photoshop Installer uncontrolled search path element8.6CNA v3.10.3%2026-04-15
CVE-2026-34393Weblate: Privilege escalation in the user API endpoint8.8CNA v3.10.5%2026-04-15Fix
CVE-2026-34244Weblate: SSRF via Project-Level Machinery Configuration5.0CNA v3.10.3%2026-04-15Fix
CVE-2026-34242Weblate: Arbitrary file read via Symlink7.7CNA v3.10.5%2026-04-15Fix
CVE-2026-33889ApostropheCMS: Stored XSS5.4CNA v3.10.3%2026-04-15Fix
CVE-2026-33888ApostropheCMS: PublicApiProjection Bypass via `project` Query Builder in Piece-Type REST API5.3CNA v3.10.5%2026-04-15Fix
CVE-2026-33877ApostropheCMS: User Enumeration via timing side channel in Password Reset endpoint3.7CNA v3.10.3%2026-04-15Fix
CVE-2026-33808@fastify/express vulnerable to middleware authentication bypass9.1CNA v4.00.6%2026-04-15Fix
CVE-2026-33807@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes9.1CNA v3.10.5%2026-04-15Fix
CVE-2026-33806fastify vulnerable to Body Schema Validation Bypass via leading Space in Content-Type header7.5CNA v3.10.5%2026-04-15Fix
CVE-2026-33805@fastify/Reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers9.0CNA v4.00.6%2026-04-15Fix
CVE-2026-33667OpenProject: 2FA OTP Verification Missing Rate Limiting7.4CNA v3.10.4%2026-04-15Fix
CVE-2026-33440Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads5.0CNA v3.10.3%2026-04-15Fix
CVE-2026-33435Weblate: Remote code execution during backup restoration8.1CNA v3.10.9%2026-04-15Fix
CVE-2026-33220Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository6.8CNA v3.10.4%2026-04-15Fix
CVE-2026-33214Weblate has improper access control for the translation memory API4.3CNA v3.10.3%2026-04-15Fix
CVE-2026-33212Weblate: Improper access control for pending tasks in API3.1CNA v3.10.3%2026-04-15Fix
CVE-2026-32631Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers7.4CNA v3.10.5%2026-04-15Fix
CVE-2026-30996SAC-NFe download.php path traversal7.5CISA ADP v3.11.0%2026-04-15
CVE-2026-30995Slah CMS vereador_ver.php endpoint SQL injection8.6CISA ADP v3.10.4%2026-04-15
CVE-2026-30994Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active session credentials.7.5CISA ADP v3.10.4%2026-04-15
CVE-2026-30993Slah CMS session function in config.php remote code execution9.8CISA ADP v3.10.9%2026-04-15
CVE-2026-30778SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information7.5CISA ADP v3.10.6%2026-04-15Fix
CVE-2026-30625Upsonic: Remote code execution vulnerability in its MCP server/task creation functionality9.8CISA ADP v3.11.2%2026-04-15Fix
CVE-2026-30624Agent Zero command injection8.6CISA ADP v3.10.6%2026-04-15
CVE-2026-30617LangChain-ChatChat MCP STDIO server configuration command injection8.6CISA ADP v3.10.7%2026-04-15
CVE-2026-30616Jaaz MCP STDIO command handling command injection7.3CISA ADP v3.10.6%2026-04-15
CVE-2026-30615Windsurf A prompt injection8.0CISA ADP v3.10.3%2026-04-15
CVE-2026-30461Thedaylightstudio Fuel CMS command injection8.3CISA ADP v3.10.7%2026-04-15
CVE-2026-30364CentSDR Thread1 function stack-based buffer overflow7.5CISA ADP v3.10.5%2026-04-15
CVE-2026-28741Mattermost CSRF Protection Bypass allows Updating a User's Authentication method6.8CNA v3.10.2%2026-04-15Fix
CVE-2026-27769Mattermost connected Workspaces: Malicious remote server can manipulate arbitrary user's status2.7CNA v3.10.3%2026-04-15Fix
CVE-2026-26291GROWI stored cross-site scripting4.8CNA v4.00.2%2026-04-15
CVE-2026-25219Apache Airflow: Sensitive Azure Service Bus connection string exposed to users with view access6.5CISA ADP v3.10.6%2026-04-15Fix
CVE-2026-22676Barracuda RMM privilege escalation via Insecure Directory Permissions8.5CNA v4.00.1%2026-04-15Fix
CVE-2026-21727Grafana Correlations: Cross-Tenant data disclosure and Permanent Deletion via Legacy org_id=0 Record3.3CNA v3.10.2%2026-04-15Fix
CVE-2026-21726Loki path traversal Bypass5.3CNA v3.10.4%2026-04-15Fix
CVE-2026-20205Sensitive information disclosure in ''_internal'' index in Splunk MCP Server app7.2CNA v3.10.3%2026-04-15Fix
CVE-2026-20204Improper Handling and Insufficient Isolation of Specific Temporary files in Splunk Enterprise7.1CNA v3.13.1%2026-04-15Fix
CVE-2026-20203Improper access control in Data Model Acceleration in Splunk Enterprise4.3CNA v3.10.2%2026-04-15Fix
CVE-2026-20202Improper input validation during User Account Creation in Splunk Enterprise6.6CNA v3.10.2%2026-04-15Fix
CVE-2026-20186Cisco Identity Services Engine multiple Authenticated remote code execution9.9CNA v3.15.6%2026-04-15Fix
CVE-2026-20184Cisco Webex Meetings single sign-on integration with Control Hub improper certificate validation9.8CNA v3.10.5%2026-04-15Fix
CVE-2026-20180Cisco Identity Services Engine multiple remote code execution9.9CNA v3.16.0%2026-04-15Fix
CVE-2026-20170Cisco Webex Contact Center cross-site scripting6.1CNA v3.10.2%2026-04-15Fix
CVE-2026-20161Cisco ThousandEyes Enterprise Agent arbitrary file overwrite5.5CNA v3.10.1%2026-04-15Fix
CVE-2026-20152Cisco Secure Web Appliance Authentication Service Traffic Bypass vulnerability5.3CNA v3.10.3%2026-04-15Fix
CVE-2026-20148Cisco Identity Services Engine path traversal4.9CNA v3.16.5%2026-04-15Fix
CVE-2026-20147Cisco Identity Services Engine remote code execution9.9CNA v3.110.4%2026-04-15Fix
CVE-2026-20136Cisco Identity Services Engine Authenticated privilege escalation6.0CNA v3.10.5%2026-04-15Fix
CVE-2026-20132Cisco Identity Services Engine multiple cross-site scripting4.8CNA v3.10.2%2026-04-15Fix
CVE-2026-20081Cisco Unity Connection arbitrary file download6.5CNA v3.10.4%2026-04-15Fix
CVE-2026-20078Cisco Unity Connection arbitrary file download6.5CNA v3.10.4%2026-04-15Fix
CVE-2026-20061Cisco Unity Connection SQL injection4.3CNA v3.10.2%2026-04-15Fix
CVE-2026-20060Cisco Unity Connection open redirect4.7CNA v3.10.2%2026-04-15Fix
CVE-2026-20059Cisco Unity Connection reflected cross-site scripting6.1CNA v3.10.2%2026-04-15Fix
CVE-2026-6388Red Hat OpenShift GitOps ArgoCD Image Updater namespace validation privilege escalation9.1CNA v3.10.4%2026-04-15
CVE-2026-6385Red Hat Lightspeed Core ffmpeg: Ffmpeg: Denial of service and potential arbitrary code execution6.5CNA v3.10.6%2026-04-15
CVE-2026-6384Gimp: Gimp: Arbitrary code execution or denial of service7.8NVD v3.10.3%2026-04-15Fix
CVE-2026-6383Red Hat OpenShift Virtualization KubeVirt RBAC evaluation improper authorization5.4CNA v3.10.3%2026-04-15Fix
CVE-2026-6372Accept Cryptocurrencies with Plisio WordPress plugin Payment bypass vulnerability7.5CNA v3.10.3%2026-04-15
CVE-2026-6370Mini Ajax Cart for WooCommerce WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-04-15Fix
CVE-2026-6364Google Chrome Skia out-of-bounds read6.5CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-6363Google Chrome V8 type confusion8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6362Google Chrome Codecs use-after-free4.3CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-6361Google Chrome PDFium heap-based buffer overflow8.3CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6360Google Chrome FileSystem use-after-free8.8CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6359Google Chrome Video use-after-free8.8CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6358Google Chrome XR use-after-free8.8CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6328XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets8.3CNA v4.00.2%2026-04-15Fix
CVE-2026-6319Google Chrome Payments use-after-free7.5CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6318Google Chrome Codecs use-after-free8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6317Google Chrome Cast use-after-free8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6316Google Chrome forms use-after-free8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6315Google Chrome Permissions use-after-free8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6314Google Chrome GPU out-of-bounds write8.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6313Google Chrome CORS insufficient policy enforcement3.1CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-6312Google Chrome Passwords insufficient policy enforcement3.1CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-6311Google Chrome uninitialized variable use8.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6310Google Chrome Dawn use-after-free8.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6309Google Chrome Viz use-after-free8.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6308Google Chrome Media out-of-bounds read7.5CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6307Google Chrome Turbofan type confusion8.8CISA ADP v3.10.5%2026-04-15Exploit codeFix
CVE-2026-6306Google Chrome PDFium heap-based buffer overflow8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6305Google Chrome PDFium heap-based buffer overflow8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6304Google Chrome Graphite use-after-free8.3CISA ADP v3.10.3%2026-04-15Fix
CVE-2026-6303Google Chrome Codecs use-after-free8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6302Google Chrome Video use-after-free8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6301Google Chrome Turbofan type confusion8.8CISA ADP v3.10.5%2026-04-15Fix
CVE-2026-6300Google Chrome CSS use-after-free8.8CISA ADP v3.10.4%2026-04-15Exploit codeFix
CVE-2026-6299Google Chrome Prerender use-after-free8.8CISA ADP v3.10.4%2026-04-15Fix
CVE-2026-6298Google Chrome Skia heap-based buffer overflow4.3CISA ADP v3.10.5%2026-04-15Fix
CVE-2026-6297Google Chrome Proxy use-after-free8.3CISA ADP v3.10.2%2026-04-15Fix
CVE-2026-6296Google Chrome ANGLE heap-based buffer overflow9.6CISA ADP v3.10.6%2026-04-15Fix
CVE-2026-6293Inquiry Form to Posts or Pages WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-04-15
CVE-2026-6290Velociraptor Query Plugin Misapplies Permissions to Orgs8.0CNA v3.10.4%2026-04-15Fix
CVE-2026-6245Sssd: Out-of-bounds read in the sssd5.5CNA v3.10.1%2026-04-15Fix
CVE-2026-5758Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution6.5CISA ADP v3.10.7%2026-04-15Fix
CVE-2026-5717VI: Include Post By WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-15
CVE-2026-5694Quick Interest Slider WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-04-15Fix
CVE-2026-5617Login as User WordPress plugin privilege escalation8.8CNA v3.10.5%2026-04-15
CVE-2026-5598Bouncy Castle has covert timing channel8.9CNA v4.01.0%2026-04-15Fix
CVE-2026-5588Legion of the Bouncy Castle BC-JAVA weak cryptographic algorithm6.3CNA v4.00.7%2026-04-15Fix
CVE-2026-5397OMRON SOCIAL SOLUTIONS PowerAttendant Standard Edition uncontrolled search path7.8CNA v3.10.1%2026-04-15
CVE-2026-5387AVEVA Pipeline Simulation missing authorization9.3CNA v4.00.5%2026-04-15Fix
CVE-2026-5189Nexus Repository 3 hard-coded credential in Internal Database component9.2CNA v4.00.6%2026-04-15Fix
CVE-2026-5160Goldmark vulnerable to cross-site scripting (XSS)5.1CNA v4.00.3%2026-04-15Fix
CVE-2026-5088Apache::API::Password versions for Perl can generate insecure random values for salts7.5CISA ADP v3.10.6%2026-04-15Fix
CVE-2026-4949Paid Membership Plugin WordPress plugin missing authorization4.3CNA v3.10.4%2026-04-15Fix
CVE-2026-4857SailPoint IdentityIQ Debug UI incorrect authorization8.4CNA v3.10.4%2026-04-15Fix
CVE-2026-4812Advanced Custom Fields (ACF) WordPress plugin missing authorization5.3CNA v3.10.9%2026-04-15Fix
CVE-2026-4682Certain HP DeskJet All in One Devices potential remote code execution and potential buffer overflow8.7CNA v4.00.3%2026-04-15Fix
CVE-2026-4667HP System Optimizer escalation of privilege7.3CNA v4.00.1%2026-04-15Fix
CVE-2026-4145Lenovo Software Fix argument injection8.5CNA v4.00.2%2026-04-15Fix
CVE-2026-4135Lenovo Software Fix link following5.2CNA v4.00.2%2026-04-15Fix
CVE-2026-4134Lenovo Software Fix uncontrolled search path7.0CNA v4.00.2%2026-04-15Fix
CVE-2026-4091OPEN-BRAIN WordPress plugin cross-site request forgery6.1CNA v3.10.2%2026-04-15
CVE-2026-4011Power Charts WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-15
CVE-2026-4005Coachific Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-15
CVE-2026-4002Petje.af WordPress plugin cross-site request forgery to account deletion4.3CNA v3.10.2%2026-04-15
CVE-2026-3998WM JqMath WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-15
CVE-2026-3659WP Circliful WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-15
CVE-2026-3649Katalogportal PDF Sync WordPress plugin missing authorization5.3CNA v3.10.4%2026-04-15
CVE-2026-3643Accessibly WordPress plugin missing authorization unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-04-15
CVE-2026-3642e-shot WordPress plugin missing authorization authenticated form settings modification5.3CNA v3.10.4%2026-04-15
CVE-2026-3590Mattermost race condition in Guest Magic Link Authentication allows Token Reuse6.5CNA v3.10.2%2026-04-15Fix
CVE-2026-3505Bouncy Castle uncontrolled resource consumption8.7CNA v4.00.9%2026-04-15Fix
CVE-2026-3461Visa Acceptance Solutions WordPress plugin unauthenticated authentication bypass via Billing email9.8CNA v3.10.8%2026-04-15
CVE-2026-2834Token of Trust Age Verification and Identity Verification plugin stored cross-site scripting7.2CNA v3.10.4%2026-04-15Fix
CVE-2026-2396List View Google Calendar WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-04-15Fix
CVE-2026-1852Product Pricing Table by WooBeWoo WordPress plugin cross-site request forgery6.1CNA v3.10.1%2026-04-15Fix
CVE-2026-1782MetForm Pro WordPress plugin unauthenticated Payment Amount manipulation via mf-calculation5.3CNA v3.10.3%2026-04-15Fix
CVE-2026-1711Adobe Pega Platform stored cross-site scripting4.8CNA v4.00.2%2026-04-15Fix
CVE-2026-1636Lenovo Service Bridge uncontrolled search path5.4CNA v4.00.1%2026-04-15Fix
CVE-2026-1564Adobe Pega Platform HTML injection5.1CNA v4.00.2%2026-04-15Fix
CVE-2026-1555WebStack WordPress theme unauthenticated arbitrary file upload9.8CNA v3.11.0%2026-04-15Exploit code
CVE-2026-1541Avada (Fusion) Builder WordPress plugin sensitive information exposure4.3CNA v3.10.3%2026-04-15Fix
CVE-2026-1509Avada (Fusion) Builder WordPress plugin limited arbitrary WordPress action execution5.4CNA v3.10.3%2026-04-15Fix
CVE-2026-13143D FlipBook WordPress plugin unauthorized access5.3CNA v3.10.9%2026-04-15NucleiFix
CVE-2026-0827Lenovo Diagnostics link following6.9CNA v4.00.2%2026-04-15Exploit codeFix
CVE-2026-0636Legion of the Bouncy Castle BC-JAVA LDAP injection vulnerability in LDAPStoreHelper.java5.5CNA v4.00.5%2026-04-15Fix
CVE-2026-40688Fortinet FortiWeb out-of-bounds write6.7CNA v3.10.9%2026-04-14Fix
CVE-2026-40683OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean7.7CNA v3.10.4%2026-04-14Fix
CVE-2026-40315PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries7.2CNA v4.00.4%2026-04-14Fix
CVE-2026-40313PraisonAI: ArtiPACKED vulnerability via GitHub Actions Credential Persistence9.1CNA v3.10.5%2026-04-14Fix
CVE-2026-40291Chamilo LMS has privilege escalation via API User Role Modification8.8CNA v3.10.4%2026-04-14Fix
CVE-2026-40289PraisonAI browser bridge WebSocket server missing authentication9.1CNA v3.10.5%2026-04-14Fix
CVE-2026-40288PraisonAI: Critical RCE via `type: Job` workflow YAML9.8CNA v3.10.9%2026-04-14Fix
CVE-2026-40287PraisonAI has RCE via Automatic tools.py Import8.4CNA v3.10.2%2026-04-14Fix
CVE-2026-39907Unisys WebPerfect Image Suite NTLMv2 hash leakage via WCF SOAP10.0v3.11.0%2026-04-14
CVE-2026-39906Unisys WebPerfect Image Suite NTLMv2 hash leakage via .NET Remoting10.0v3.10.9%2026-04-14
CVE-2026-39815Fortinet FortiDDoS-F SQL injection7.9CNA v3.10.5%2026-04-14Fix
CVE-2026-39814Fortinet FortiWeb relative path traversal6.2CNA v3.10.2%2026-04-14Fix
CVE-2026-39813Fortinet FortiSandbox path traversal9.1CNA v3.10.7%2026-04-14Reported exploitedEmerging ThreatsExploit codeFix
CVE-2026-39812Fortinet FortiSandbox cross-site scripting4.3CNA v3.10.2%2026-04-14Fix
CVE-2026-39811Fortinet FortiWeb integer overflow4.4CNA v3.10.4%2026-04-14Fix
CVE-2026-39810Fortinet FortiClientEMS hard-coded cryptographic key5.2CNA v3.10.1%2026-04-14Fix
CVE-2026-39809Fortinet FortiClientEMS SQL injection6.2CNA v3.10.2%2026-04-14Fix
CVE-2026-39808Fortinet FortiSandbox OS command injection9.1CNA v3.147.4%2026-04-14KEVNucleiEmerging ThreatsExploit codeFix
CVE-2026-39426MaxKB: Stored XSS via Unsanitized iframe_render Parsing5.1CNA v4.00.2%2026-04-14Fix
CVE-2026-39425MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering5.1CNA v4.00.3%2026-04-14Fix
CVE-2026-39424MaxKB has CSV injection in its Application Chat Export Functionality5.3CNA v4.00.5%2026-04-14Fix
CVE-2026-394231Panel-dev MaxKB stored XSS via eval injection in EchartsRander component6.9CNA v4.00.3%2026-04-14Fix
CVE-2026-39422MaxKB has stored XSS via ChatHeadersMiddleware6.9CNA v4.00.3%2026-04-14Fix
CVE-2026-39421MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect6.3CNA v3.10.5%2026-04-14Fix
CVE-2026-39420MaxKB: Sandbox escape via LD_PRELOAD bypass6.3CNA v3.10.6%2026-04-14Fix
CVE-2026-39419MaxKB: Sandbox result Validation Bypass via Tool Output spoofing3.1CNA v3.10.3%2026-04-14Fix
CVE-2026-39418MaxKB: SSRF via sandbox network hook bypass5.0CNA v3.10.3%2026-04-14Fix
CVE-2026-39417MaxKB: RCE via MCP stdio command injection in workflow engine4.6CNA v3.10.4%2026-04-14Fix
CVE-2026-39399NuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation9.6CNA v3.10.8%2026-04-14
CVE-2026-39387BoidCMS: Local file inclusion (LFI) leads to remote code execution (RCE) via tpl parameter7.2CNA v3.10.8%2026-04-14Exploit codeFix
CVE-2026-38533snipeitapp Snipe-IT improper authorization6.5CISA ADP v3.10.5%2026-04-14
CVE-2026-38532Webkul Krayin CRM has Broken Object-Level Authorization in the /Contact/Persons/PersonController.php8.1CNA v3.10.4%2026-04-14
CVE-2026-38530Webkul Krayin CRM has Broken Object-Level Authorization in the /Controllers/Lead/LeadController.php8.1CNA v3.10.4%2026-04-14
CVE-2026-38529Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php8.8CNA v3.10.8%2026-04-14
CVE-2026-38528Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.7.1CNA v3.10.3%2026-04-14
CVE-2026-38527Webkul Krayin CRM has server-side request forgery (SSRF)8.5CNA v3.10.3%2026-04-14
CVE-2026-38526Webkul Krayin CRM TinyMCE upload endpoint unrestricted file upload9.9CNA v3.12.4%2026-04-14Exploit code
CVE-2026-37980Org.keycloak.forms.login: Keycloak: Keycloak: Arbitrary code execution6.9CNA v3.10.4%2026-04-14Fix
CVE-2026-37602SourceCodester Patient Appointment Scheduler System manage_user.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37601SourceCodester Patient Appointment Scheduler System manage_appointment.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37600SourceCodester Patient Appointment Scheduler System view_details.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37598SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_settings.2.7CISA ADP v3.10.4%2026-04-14
CVE-2026-37597SourceCodester Online Employees Work From Home Attendance System attendance_list.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37596SourceCodester Online Employees Work From Home Attendance System manage_department.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37595SourceCodester Online Employees Work From Home Attendance System manage_employee.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37594SourceCodester Online Employees Work From Home Attendance System view_employee.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37593SourceCodester Online Employees Work From Home Attendance System view_att.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37592SourceCodester Storage Unit Rental Management System manage_pricing.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37591SourceCodester Storage Unit Rental Management System view_details.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37590SourceCodester Storage Unit Rental Management System manage_rent.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-37589SourceCodester Storage Unit Rental Management System manage_storage_unit.php SQL injection2.7CISA ADP v3.10.3%2026-04-14
CVE-2026-35589Nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge ( Fix Update)8.0CNA v3.10.2%2026-04-14Fix
CVE-2026-35196Chamilo LMS has OS command injection via export_all_certificates action8.8CNA v3.12.6%2026-04-14Exploit codeFix
CVE-2026-35034Jellyfin: Potential Application DoS from excessively large SyncPlay group names6.5CNA v3.10.4%2026-04-14Fix
CVE-2026-35033Jellyfin: Potential SSRF + arbitrary file read via stream argument injection9.3CNA v4.00.5%2026-04-14Fix
CVE-2026-35032Jellyfin: Potential SSRF + arbitrary file read via LiveTV M3U tuner8.6CNA v4.00.4%2026-04-14Fix
CVE-2026-35031Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain10.0CNA v3.10.9%2026-04-14Exploit codeFix
CVE-2026-34984External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine7.1CNA v4.00.4%2026-04-14Fix
CVE-2026-34631Adobe InCopy out-of-bounds write7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-34630Adobe Bridge heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-34629Adobe InDesign Desktop heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-34628Adobe InDesign Desktop heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-34627Adobe InDesign Desktop heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-34626Adobe Acrobat Reader improperly controlled modification of object prototype attributes6.3CNA v3.10.6%2026-04-14KCVFix
CVE-2026-34625Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-04-14Fix
CVE-2026-34624Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-04-14Fix
CVE-2026-34623Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-04-14Fix
CVE-2026-34622Adobe Acrobat Reader improperly controlled modification of object prototype attributes8.6CNA v3.10.7%2026-04-14KCVFix
CVE-2026-34619Adobe ColdFusion improper limitation of a pathname to a restricted directory (path traversal)7.7CNA v3.11.1%2026-04-14Fix
CVE-2026-34618Adobe Illustrator out-of-bounds write7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-34617Adobe Connect cross-site scripting (XSS)8.7CNA v3.10.7%2026-04-14Fix
CVE-2026-34615Adobe Connect deserialization of untrusted data9.3CNA v3.11.8%2026-04-14Fix
CVE-2026-34614Adobe Connect cross-site scripting (reflected XSS)6.1CNA v3.10.4%2026-04-14Fix
CVE-2026-34602Chamilo LMS course enrollment API insecure direct object reference7.1CNA v3.10.4%2026-04-14Fix
CVE-2026-34457OAuth2 Proxy: Health Check User-Agent Matching bypasses authentication in auth_request Mode9.1CNA v3.10.7%2026-04-14Fix
CVE-2026-34454OAuth2 Proxy: Session cookie not cleared when rendering sign-in page3.5CNA v3.10.2%2026-04-14Fix
CVE-2026-34370Chamilo LMS: IDOR in the Notebook module allows an attacker to view other users' private notes6.5CNA v3.10.4%2026-04-14Fix
CVE-2026-34264Information disclosure vulnerability in SAP Human Capital Management for SAP S/4hana6.5CNA v3.10.4%2026-04-14Fix
CVE-2026-34262Information disclosure vulnerability in SAP HANA Cockpit and HANA Database Explorer5.0CNA v3.10.3%2026-04-14Fix
CVE-2026-34261Missing authorization check in SAP Business Analytics and SAP Content Management6.5CNA v3.10.4%2026-04-14Fix
CVE-2026-34257Open redirect vulnerability in SAP NetWeaver Application Server ABAP6.1CNA v3.10.3%2026-04-14Fix
CVE-2026-34256Missing authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)7.1CNA v3.10.3%2026-04-14Fix
CVE-2026-34225open-webui open WebUI has blind server side request forgery in its Image Edit Functionality4.3CNA v3.10.3%2026-04-14
CVE-2026-34213Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation5.4CNA v3.10.3%2026-04-14Exploit codeFix
CVE-2026-34212Docmost page content has stored XSS via unsanitized attachment URLs5.4CNA v3.10.2%2026-04-14Fix
CVE-2026-34161Chamilo LMS: Stored XSS5.1CNA v4.00.3%2026-04-14Fix
CVE-2026-34160Chamilo LMS: Unauthenticated SSRF8.6CNA v3.10.6%2026-04-14Exploit codeFix
CVE-2026-34069nimiq core-rs-albatross nimiq-consensus panics via RequestMacroChain micro-block locator5.3CNA v3.10.5%2026-04-14Fix
CVE-2026-33948jq CLI JSON input parsing improper input validation2.9CNA v4.00.3%2026-04-14Fix
CVE-2026-33929Apache PDFBox Examples: Path traversal in PDFBox ExtractEmbeddedFiles Example Code4.3CISA ADP v3.11.0%2026-04-14Fix
CVE-2026-33892Siemens Industrial Edge Management Pro V1 authentication bypass5.1CNA v4.00.4%2026-04-14Fix
CVE-2026-33829Microsoft Windows Snipping tool spoofing4.3CNA v3.13.5%2026-04-14Exploit codeFix
CVE-2026-33827Microsoft Windows TCP/IP remote code execution8.1CNA v3.10.5%2026-04-14Exploit codeFix
CVE-2026-33826Microsoft Windows Active Directory remote code execution8.0CNA v3.10.5%2026-04-14Exploit codeFix
CVE-2026-33825Microsoft Defender insufficient granularity of access control7.8CNA v3.10.4%2026-04-14KEVExploit codeFix
CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions double free9.8CNA v3.11.6%2026-04-14KEVEmerging ThreatsExploit codeFix
CVE-2026-33822Microsoft Word information disclosure6.1CNA v3.10.5%2026-04-14Fix
CVE-2026-33715Chamilo LMS has unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action7.2CNA v3.10.4%2026-04-14Exploit codeFix
CVE-2026-33714Chamilo LMS has authenticated SQL injection in statistics.ajax.php users_active action ( RC2)7.1CNA v4.00.5%2026-04-14Fix
CVE-2026-33414PowerShell command injection in Podman HyperV Machine4.0CNA v4.00.7%2026-04-14Fix
CVE-2026-33193Docmost vulnerable to stored XSS via MIME type spoofing4.6CNA v3.10.2%2026-04-14Fix
CVE-2026-33146Docmost's Public Share Search exposes Metadata of Restricted Children4.3CNA v3.10.3%2026-04-14Exploit codeFix
CVE-2026-33120Microsoft SQL Server remote code execution8.8CNA v3.10.9%2026-04-14Fix
CVE-2026-33116Microsoft .NET, .NET Framework, and Visual Studio denial of service7.5CNA v3.12.4%2026-04-14Fix
CVE-2026-33115Microsoft Word remote code execution8.4CNA v3.10.4%2026-04-14Fix
CVE-2026-33114Microsoft Word remote code execution8.4CNA v3.10.4%2026-04-14Fix
CVE-2026-33104Microsoft Windows win32k elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-33103Microsoft Dynamics 365 (on-premises) information disclosure5.5CNA v3.10.4%2026-04-14Fix
CVE-2026-33101Microsoft Windows Print Spooler elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-33100Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-33099Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-33098Microsoft Windows Container Isolation FS Filter driver elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-33096Microsoft Windows HTTP.sys denial of service7.5CNA v3.11.2%2026-04-14Fix
CVE-2026-33095Microsoft Word remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-33023libsixel GdkPixbuf image loader use-after-free7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-33021libsixel frame resize handling use-after-free7.3CNA v3.10.2%2026-04-14Fix
CVE-2026-33020libsixel palettized image conversion heap-based buffer overflow7.1CNA v3.10.2%2026-04-14Fix
CVE-2026-33019libsixel img2sixel crop option out-of-bounds read7.1CNA v3.10.2%2026-04-14Fix
CVE-2026-33018libsixel GIF loader use-after-free7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-32226NET Framework denial of service5.9CNA v3.10.7%2026-04-14Fix
CVE-2026-32225Microsoft Windows Shell security feature bypass8.8CNA v3.10.8%2026-04-14Fix
CVE-2026-32224Microsoft Windows Server Update Service (WSUS) elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-32223Microsoft Windows USB Printing Stack (usbprint.sys) elevation of privilege6.8CNA v3.10.6%2026-04-14Exploit codeFix
CVE-2026-32222Microsoft Windows Win32k elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32221Microsoft Windows Graphics component remote code execution8.4CNA v3.10.4%2026-04-14Fix
CVE-2026-32220Microsoft Windows UEFI Secure Boot security feature bypass4.4CNA v3.10.3%2026-04-14Fix
CVE-2026-32219Microsoft Brokering File System elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-32218Microsoft Windows Kernel information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-32217Microsoft Windows Kernel information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-32216Microsoft Windows Redirected Drive Buffering System denial of service5.5CNA v3.10.4%2026-04-14Fix
CVE-2026-32215Microsoft Windows Kernel information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-32214Microsoft Windows Universal Plug and Play (upnp.dll) information disclosure5.5CNA v3.10.4%2026-04-14Fix
CVE-2026-32212Microsoft Windows Universal Plug and Play (upnp.dll) information disclosure5.5CNA v3.10.4%2026-04-14Fix
CVE-2026-32203Microsoft .NET and Visual Studio denial of service7.5CNA v3.12.4%2026-04-14Fix
CVE-2026-32202Microsoft Windows protection mechanism failure4.3CNA v3.14.9%2026-04-14KEVExploit codeFix
CVE-2026-32201Microsoft SharePoint Server improper input validation6.5CNA v3.143.4%2026-04-14KEVExploit codeFix
CVE-2026-32200Microsoft PowerPoint remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-32199Microsoft Excel remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-32198Microsoft Excel remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-32197Microsoft Excel remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-32196Microsoft Windows Admin Center spoofing6.1CNA v3.10.4%2026-04-14Fix
CVE-2026-32195Microsoft Windows Kernel elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-32192Microsoft Azure Monitor Agent elevation of privilege7.8CNA v3.12.5%2026-04-14Fix
CVE-2026-32190Microsoft Office remote code execution8.4CNA v3.10.4%2026-04-14Fix
CVE-2026-32189Microsoft Excel remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-32188Microsoft Excel information disclosure7.1CNA v3.10.5%2026-04-14Fix
CVE-2026-32184Microsoft High Performance Compute (HPC) Pack elevation of privilege7.8CNA v3.12.5%2026-04-14Fix
CVE-2026-32183Microsoft Windows Snipping tool remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-32181Microsoft Windows connected User Experiences and Telemetry service denial of service5.5CNA v3.10.4%2026-04-14Fix
CVE-2026-32178Microsoft .NET spoofing7.5CNA v3.12.1%2026-04-14Fix
CVE-2026-32176SQL server elevation of privilege6.7CNA v3.10.3%2026-04-14Fix
CVE-2026-32171Microsoft Azure Logic Apps elevation of privilege8.8CNA v3.10.8%2026-04-14Fix
CVE-2026-32168Microsoft Azure Monitor Agent elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32167SQL server elevation of privilege6.7CNA v3.10.3%2026-04-14Fix
CVE-2026-32165Microsoft Windows User Interface Core elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-32164Microsoft Windows User Interface Core elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-32163Microsoft Windows User Interface Core elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-32162Microsoft Windows COM elevation of privilege8.4CNA v3.10.2%2026-04-14Fix
CVE-2026-32160Microsoft Windows Push Notifications elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-32159Microsoft Windows Push Notifications elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-32158Microsoft Windows Push Notifications elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-32157Microsoft Remote Desktop client remote code execution8.8CNA v3.10.8%2026-04-14Fix
CVE-2026-32156Microsoft Windows UPnP device host remote code execution7.4CNA v3.10.3%2026-04-14Fix
CVE-2026-32155Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32154Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32153Microsoft Windows Speech Runtime elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32152Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32151Microsoft Windows Shell information disclosure6.5CNA v3.11.0%2026-04-14Fix
CVE-2026-32150Microsoft Windows Function Discovery service (fdwsd.dll) elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-32149Microsoft Windows Hyper-V remote code execution7.3CNA v3.10.4%2026-04-14Fix
CVE-2026-32093Microsoft Windows Function Discovery service (fdwsd.dll) elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-32091Microsoft Brokering File System elevation of privilege8.4CNA v3.10.2%2026-04-14Fix
CVE-2026-32090Microsoft Windows Speech Brokered Api elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-32089Microsoft Windows Speech Brokered Api elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32088Microsoft Windows Biometric service security feature bypass6.1CNA v3.10.2%2026-04-14Fix
CVE-2026-32087Microsoft Windows Function Discovery service (fdwsd.dll) elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-32086Microsoft Windows Function Discovery service (fdwsd.dll) elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-32085Microsoft Windows Remote Procedure Call information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-32084Microsoft Windows Print Spooler information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-32083Microsoft Windows Simple Search and Discovery Protocol (SSDP) service elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-32082Microsoft Windows Simple Search and Discovery Protocol (SSDP) service elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-32081Microsoft Windows package Catalog information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-32080Microsoft Windows WalletService elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-32079Microsoft Windows Web Account Manager information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-32078Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32077Microsoft Windows UPnP device host elevation of privilege7.8CNA v3.10.4%2026-04-14Fix
CVE-2026-32076Microsoft Windows Storage Spaces controller elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32075Microsoft Windows UPnP device host elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-32074Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32073Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-32072Microsoft Windows Active Directory spoofing6.2CNA v3.10.4%2026-04-14Fix
CVE-2026-32071Microsoft Windows Local Security Authority subsystem Service (LSASS) denial of service7.5CNA v3.11.2%2026-04-14Fix
CVE-2026-32070Microsoft Windows Common Log File System driver elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-32069Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-32068Microsoft Windows Simple Search and Discovery Protocol (SSDP) service elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-31924Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP5.3CISA ADP v3.10.4%2026-04-14Fix
CVE-2026-31923Apache APISIX: Openid-connect `tls_verify` field is disabled by default7.5CISA ADP v3.10.4%2026-04-14Fix
CVE-2026-31908Apache APISIX: Forward auth plugin allows header injection9.1CISA ADP v3.10.6%2026-04-14Exploit codeFix
CVE-2026-31049Hostbill CSV registration field CSV injection9.8CISA ADP v3.11.2%2026-04-14
CVE-2026-30480NFSen module A local file inclusion6.5CISA ADP v3.10.4%2026-04-14
CVE-2026-27931Microsoft Windows GDI information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-27930Microsoft Windows GDI information disclosure5.5CNA v3.10.5%2026-04-14Fix
CVE-2026-27929Microsoft Windows LUA File Virtualization Filter driver elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-27928Microsoft Windows Hello security feature bypass8.7CNA v3.10.7%2026-04-14Fix
CVE-2026-27927Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-27926Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-27925Microsoft Windows UPnP device host information disclosure6.5CNA v3.10.5%2026-04-14Fix
CVE-2026-27924Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27923Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27922Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-27921Microsoft Windows TDI Translation driver (tdx.sys) elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-27920Microsoft Windows UPnP device host elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27919Microsoft Windows UPnP device host elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27918Microsoft Windows Shell elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-27917Microsoft Windows WFP NDIS Lightweight Filter driver (wfplwfs.sys) elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-27916Microsoft Windows UPnP device host elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27915Microsoft Windows UPnP device host elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27914Microsoft Management console elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27913Microsoft Windows BitLocker security feature bypass7.7CNA v3.10.4%2026-04-14Fix
CVE-2026-27912Microsoft Windows Kerberos elevation of privilege8.0CNA v3.10.4%2026-04-14Exploit codeFix
CVE-2026-27911Microsoft Windows User Interface Core elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-27910Microsoft Windows Installer elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27909Microsoft Windows Search service elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27908Microsoft Windows TDI Translation driver (tdx.sys) elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-27907Microsoft Windows Storage Spaces controller elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27906Microsoft Windows Hello security feature bypass4.4CNA v3.10.4%2026-04-14Fix
CVE-2026-27683Reflected cross-site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform4.1CNA v3.10.3%2026-04-14Fix
CVE-2026-27681SQL injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse9.9CNA v3.10.5%2026-04-14Fix
CVE-2026-27679Missing authorization check in SAP S/4hana Frontend OData Service (Manage Reference Structures)6.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27678Missing authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)6.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27677Missing authorization check in SAP S/4HANA OData Service (Manage Reference Equipment)6.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27676Missing authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures)4.3CNA v3.10.3%2026-04-14Fix
CVE-2026-27675Code injection vulnerability in SAP Landscape Transformation2.0CNA v3.10.2%2026-04-14Fix
CVE-2026-27674Code injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)6.1CNA v3.10.3%2026-04-14Fix
CVE-2026-27673Missing authorization Check in SAP S/4HANA (Private Cloud and On-Premise)4.9CNA v3.10.3%2026-04-14Fix
CVE-2026-27672Missing authorization check in Material Master Application4.3CNA v3.10.3%2026-04-14Fix
CVE-2026-27668Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) incorrect privilege assignment8.7CNA v4.00.4%2026-04-14Fix
CVE-2026-27316Fortinet FortiSandbox insufficiently protected credentials2.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27313Adobe Bridge heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27312Adobe Bridge heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27311Adobe Bridge heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27310Adobe Bridge heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27308Adobe ColdFusion uncontrolled resource consumption2.4CNA v3.10.4%2026-04-14Fix
CVE-2026-27307Adobe ColdFusion uncontrolled resource consumption2.4CNA v3.10.4%2026-04-14Fix
CVE-2026-27306Adobe ColdFusion improper input validation8.4CNA v3.10.5%2026-04-14Fix
CVE-2026-27305Adobe ColdFusion improper limitation of a pathname to a restricted directory (path traversal)8.6CNA v3.11.0%2026-04-14Fix
CVE-2026-27304Adobe ColdFusion improper input validation9.3CNA v3.10.5%2026-04-14Fix
CVE-2026-27303Adobe Connect deserialization of untrusted data9.6CNA v3.11.9%2026-04-14Fix
CVE-2026-27301Adobe FrameMaker heap-based buffer overflow5.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27300Adobe FrameMaker access of uninitialized pointer5.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27299Adobe FrameMaker improper input validation6.3CNA v3.10.3%2026-04-14Fix
CVE-2026-27298Adobe FrameMaker access of resource using incompatible type (type confusion)7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27297Adobe FrameMaker integer underflow (wrap or wraparound)7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27296Adobe FrameMaker integer underflow (wrap or wraparound)7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27295Adobe FrameMaker out-of-bounds write7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27294Adobe FrameMaker out-of-bounds read7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27293Adobe FrameMaker heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27292Adobe FrameMaker use-after-free7.8CNA v3.10.4%2026-04-14Fix
CVE-2026-27291Adobe InDesign Desktop out-of-bounds write7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27290Adobe FrameMaker untrusted search path8.6CNA v3.10.3%2026-04-14Fix
CVE-2026-27289Adobe Photoshop Desktop out-of-bounds read7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27288Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-04-14Fix
CVE-2026-27287Adobe InCopy out-of-bounds read7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27286Adobe InDesign Desktop heap-based buffer overflow5.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27285Adobe InDesign Desktop heap-based buffer overflow5.5CNA v3.10.3%2026-04-14Fix
CVE-2026-27284Adobe InDesign Desktop out-of-bounds read7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27283Adobe InDesign Desktop use-after-free7.8CNA v3.10.4%2026-04-14Fix
CVE-2026-27282Adobe ColdFusion improper input validation7.5CNA v3.10.8%2026-04-14Fix
CVE-2026-27258Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.6%2026-04-14Fix
CVE-2026-27246Adobe Connect cross-site scripting (DOM-based XSS)9.3CNA v3.10.7%2026-04-14Fix
CVE-2026-27245Adobe Connect cross-site scripting (reflected XSS)9.3CNA v3.10.7%2026-04-14Fix
CVE-2026-27243Adobe Connect cross-site scripting (reflected XSS)9.3CNA v3.10.7%2026-04-14Fix
CVE-2026-27238Adobe InDesign Desktop heap-based buffer overflow7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-27222Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.6%2026-04-14Fix
CVE-2026-26184Microsoft Windows Projected File System elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26183Microsoft Windows remote Access Management service/API (RPC server) elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26182Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-26181Microsoft Brokering File System elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26180Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26179Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-04-14Exploit codeFix
CVE-2026-26178Microsoft Windows Advanced Rasterization Platform elevation of privilege8.8CNA v3.10.8%2026-04-14Fix
CVE-2026-26177Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-26176Microsoft Windows Client Side Caching driver (csc.sys) elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26175Microsoft Windows Boot Manager security feature bypass4.6CNA v3.10.5%2026-04-14Fix
CVE-2026-26174Microsoft Windows Server Update Service (WSUS) elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-26173Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-26172Microsoft Windows Push Notifications elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-26171Microsoft .NET denial of service7.5CNA v3.12.3%2026-04-14Fix
CVE-2026-26170Microsoft Windows PowerShell elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26169Microsoft Windows Kernel Memory information disclosure6.1CNA v3.10.3%2026-04-14Fix
CVE-2026-26168Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-26167Microsoft Windows Push Notifications elevation of privilege8.8CNA v3.10.2%2026-04-14Fix
CVE-2026-26166Microsoft Windows Shell elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-26165Microsoft Windows Shell elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-26163Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26162Microsoft Windows OLE elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26161Microsoft Windows Sensor Data service elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26160Microsoft Windows remote Desktop Licensing service elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26159Microsoft Windows remote Desktop Licensing service elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26156Microsoft Windows Hyper-V remote code execution7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-26155Microsoft Local Security Authority subsystem service information disclosure6.5CNA v3.11.0%2026-04-14Fix
CVE-2026-26154Microsoft Windows Server Update Service (WSUS) tampering7.5CNA v3.11.2%2026-04-14Fix
CVE-2026-26153Microsoft Windows Encrypted File System (EFS) elevation of privilege7.8CNA v3.10.3%2026-04-14Fix
CVE-2026-26152Microsoft Cryptographic services elevation of privilege7.0CNA v3.10.3%2026-04-14Fix
CVE-2026-26151Microsoft Windows Remote Desktop spoofing7.1CNA v3.10.8%2026-04-14Fix
CVE-2026-26149Microsoft Power Apps Desktop Client spoofing9.0CNA v3.10.8%2026-04-14Fix
CVE-2026-26143Microsoft PowerShell security feature bypass7.8CNA v3.10.5%2026-04-14Fix
CVE-2026-25691Fortinet FortiSandbox PaaS path traversal6.2CNA v3.10.5%2026-04-14Fix
CVE-2026-25654Siemens SINEC NMS insecure direct object reference8.7CNA v4.00.5%2026-04-14Fix
CVE-2026-25184Microsoft Windows applocker Filter driver (applockerfltr.sys) elevation of privilege7.0CNA v3.10.2%2026-04-14Fix
CVE-2026-25133October CMS has stored XSS via SVG Filter Bypass4.8CNA v4.00.2%2026-04-14Fix
CVE-2026-25125October CMS: Environment Variable Exfiltration via INI Parser Interpolation4.9CNA v3.10.3%2026-04-14Fix
CVE-2026-24907October CMS has stored XSS via Event Log Mail Preview5.1CNA v4.00.2%2026-04-14Fix
CVE-2026-24906October CMS has stored XSS in its Backend Editor Markup Classes5.1CNA v4.00.3%2026-04-14Fix
CVE-2026-24893openITCOCKPIT has authenticated command injection leading to remote code execution8.8CNA v3.11.4%2026-04-14Fix
CVE-2026-24318Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform4.2CNA v3.10.2%2026-04-14Fix
CVE-2026-24069Improper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST5.4CISA ADP v3.10.2%2026-04-14Fix
CVE-2026-24032Siemens SINEC NMS improper signature verification6.9CNA v4.00.3%2026-04-14Fix
CVE-2026-23708Fortinet FortiSOAR PaaS improper authentication6.7CNA v3.10.3%2026-04-14Fix
CVE-2026-23670Microsoft Windows Virtualization-Based Security (VBS) security feature bypass5.7CNA v3.10.3%2026-04-14Fix
CVE-2026-23666NET Framework denial of service7.5CNA v3.11.3%2026-04-14Fix
CVE-2026-23657Microsoft Word remote code execution7.8CNA v3.10.4%2026-04-14Fix
CVE-2026-23653GitHub Copilot and Visual Studio Code information disclosure5.7CNA v3.10.7%2026-04-14Fix
CVE-2026-22828Fortinet FortiAnalyzer Cloud heap-based buffer overflow7.3CNA v3.10.9%2026-04-14Fix
CVE-2026-22692October CMS: Twig sandbox bypass via Collection Methods4.9CNA v3.10.4%2026-04-14Exploit codeFix
CVE-2026-22576Fortinet FortiSOAR PaaS recoverable password storage4.1CNA v3.10.3%2026-04-14Fix
CVE-2026-22574Fortinet FortiSOAR PaaS recoverable password storage4.1CNA v3.10.3%2026-04-14Fix
CVE-2026-22573Fortinet FortiSOAR on-premise path traversal6.2CNA v3.10.4%2026-04-14Fix
CVE-2026-22155Fortinet FortiSOAR PaaS cleartext transmission of sensitive information6.2CNA v3.10.2%2026-04-14Fix
CVE-2026-22154Fortinet FortiSOAR PaaS cross-site scripting4.4CNA v3.10.2%2026-04-14Fix
CVE-2026-21742Fortinet FortiSOAR PaaS cleartext transmission of sensitive information5.4CNA v3.10.1%2026-04-14Fix
CVE-2026-21741Fortinet FortiNAC-F open redirect2.2CNA v3.10.2%2026-04-14Fix
CVE-2026-21331Adobe Connect cross-site scripting (reflected XSS)6.1CNA v3.10.3%2026-04-14Fix
CVE-2026-20945Microsoft SharePoint server spoofing4.6CNA v3.119.1%2026-04-14Fix
CVE-2026-20930Microsoft Windows Management services elevation of privilege7.8CNA v3.10.2%2026-04-14Fix
CVE-2026-20928Microsoft Windows Recovery Environment security feature bypass4.6CNA v3.10.4%2026-04-14Fix
CVE-2026-20806Microsoft Windows COM server information disclosure5.5CNA v3.10.3%2026-04-14Fix
CVE-2026-6264Critical Security fix for the Talend JobServer and Talend Runtime9.8CNA v3.10.9%2026-04-14Fix
CVE-2026-6227BackWPup WordPress plugin local file inclusion7.2CNA v3.11.0%2026-04-14Fix
CVE-2026-5756Unauthenticated Configuration File Modification vulnerability in DRC Central Office Services (COS)7.5CISA ADP v3.10.4%2026-04-14
CVE-2026-5754Radware Alteon has a reflected XSS6.1CISA ADP v3.10.3%2026-04-14
CVE-2026-5752cohere-terrarium sandbox escape9.3CISA ADP v3.10.2%2026-04-14
CVE-2026-5713Python CPython remote debugging out-of-bounds write5.3CNA v4.00.2%2026-04-14Fix
CVE-2026-4914Ivanti Neurons for ITSM (On-Premise) stored cross-site scripting5.4CNA v3.10.5%2026-04-14Fix
CVE-2026-4913Ivanti Neurons for ITSM (On-Premise) unprotected alternate path5.7CNA v3.10.9%2026-04-14Fix
CVE-2026-4832Schneider Electric Easergy MiCOM P14x hard-coded credentials6.9CNA v4.00.4%2026-04-14Fix
CVE-2026-4479wpcodefactory WholeSale Products Dynamic Pricing Management stored cross-site scripting4.4CNA v3.10.2%2026-04-14Fix
CVE-2026-4388Form Maker by 10Web WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-04-14Fix
CVE-2026-4369Autodesk Fusion stored cross-site scripting (XSS) vulnerability in Assembly Variant Name7.1CNA v3.10.3%2026-04-14Fix
CVE-2026-4365LearnPress WordPress plugin missing authorization to unauthenticated arbitrary Quiz Answer deletion9.1CNA v3.10.9%2026-04-14Fix
CVE-2026-4352JetEngine WordPress plugin unauthenticated SQL injection via _cct_search parameter7.5CNA v3.10.5%2026-04-14Fix
CVE-2026-4345Autodesk Fusion stored cross-site scripting (XSS) vulnerability in Design Name7.1CNA v3.10.3%2026-04-14Fix
CVE-2026-4344Autodesk Fusion stored cross-site scripting (XSS) vulnerability in Assembly Component Name7.1CNA v3.10.3%2026-04-14Fix
CVE-2026-4109Eventin WordPress plugin unauthorized access4.3CNA v3.10.3%2026-04-14Fix
CVE-2026-4059ShopLentor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-14Fix
CVE-2026-3017Smart Post Show WordPress plugin PHP object injection7.2CNA v3.10.7%2026-04-14Fix
CVE-2026-2582Germanized for WooCommerce WordPress plugin unauthenticated arbitrary shortcode execution6.5CNA v3.10.5%2026-04-14Fix
CVE-2026-2450upKeeper Solutions Instant Privilege Access impersonation handling vulnerability7.4CNA v4.00.3%2026-04-14
CVE-2026-2449upKeeper Solutions upKeeper Instant Privilege Access command improper neutralization9.0CNA v4.00.3%2026-04-14
CVE-2026-2405Schneider Electric PowerChute™ Serial Shutdown resource exhaustion5.3CNA v4.00.2%2026-04-14Fix
CVE-2026-2404Schneider Electric PowerChute™ Serial Shutdown improper output encoding6.9CNA v4.00.2%2026-04-14Fix
CVE-2026-2403Schneider Electric PowerChute™ Serial Shutdown improper quantity validation5.3CNA v4.00.2%2026-04-14Fix
CVE-2026-2402Schneider Electric PowerChute™ Serial Shutdown missing brute-force protection6.9CNA v4.00.3%2026-04-14Fix
CVE-2026-2401Schneider Electric PowerChute™ Serial Shutdown sensitive information in log files2.4CNA v4.00.1%2026-04-14Fix
CVE-2026-2400Schneider Electric PowerChute™ Serial Shutdown CRLF injection5.3CNA v4.00.2%2026-04-14Fix
CVE-2026-2399Schneider Electric PowerChute™ Serial Shutdown path traversal6.9CNA v4.00.2%2026-04-14Fix
CVE-2026-2332Eclipse Jetty HTTP request smuggling via Chunked Extension Quoted-String Parsing7.4CNA v3.11.3%2026-04-14Fix
CVE-2026-1607Surbma Booking.com WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-14Fix
CVE-2026-0512Cross-site scripting vulnerability in SAP Supplier Relationship Management6.1CNA v3.10.2%2026-04-14Fix
CVE-2026-0390Microsoft Windows UEFI Secure Boot security feature bypass6.7CNA v3.10.3%2026-04-14Fix
CVE-2026-0209Pure Storage FlashArray Purity snapshot retention vulnerability6.9CNA v4.00.4%2026-04-14
CVE-2026-0207Sensitive Information Logging vulnerability in FlashBlade8.5CNA v4.00.4%2026-04-14
CVE-2026-40447Samsung Open Source Escargot integer overflow5.1CNA v3.10.3%2026-04-13
CVE-2026-40446Samsung Open Source Escargot type confusion6.9CNA v3.10.3%2026-04-13
CVE-2026-40436ZTE ZXEDM iEMS product has a password reset vulnerability7.1CNA v3.10.4%2026-04-13Fix
CVE-2026-40312ImageMagick: Off-by-one in MSL decoder could result in crash6.2CNA v3.10.2%2026-04-13Fix
CVE-2026-40311ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values5.5CNA v3.10.2%2026-04-13Fix
CVE-2026-40310ImageMagick: Heap out-of-bounds write in JP2 encoder5.5CNA v3.10.2%2026-04-13Fix
CVE-2026-40183ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float5.5CNA v3.10.2%2026-04-13Fix
CVE-2026-40169ImageMagick: Heap buffer overflow (write) in the YAML and JSON encoders6.2CNA v3.10.2%2026-04-13Fix
CVE-2026-40164jq hash table denial of service7.5CNA v3.10.6%2026-04-13Fix
CVE-2026-40044Pachno FileCache deserialization remote code execution9.3CNA v4.00.9%2026-04-13
CVE-2026-40043Pachno authentication bypass via runSwitchUser7.1CNA v4.00.5%2026-04-13
CVE-2026-40042Pachno Wiki TextParser XML external entity injection9.3CNA v4.00.6%2026-04-13
CVE-2026-40041Pachno cross-site request forgery via State-Changing endpoints5.3CNA v4.00.2%2026-04-13
CVE-2026-40040Pachno unrestricted file upload remote code execution8.7CNA v4.00.8%2026-04-13
CVE-2026-40039Pachno open redirection via return_to parameter7.1CNA v4.00.4%2026-04-13
CVE-2026-40038Pachno stored cross-site scripting via multiple parameters5.1CNA v4.00.3%2026-04-13
CVE-2026-39979jqlang jq jv_parse_sized error formatting out-of-bounds read6.9CNA v4.00.8%2026-04-13Fix
CVE-2026-39956jq _strindices builtin type confusion6.1CNA v3.10.2%2026-04-13Fix
CVE-2026-39940ChurchCRM has an open redirect via the linkBack URL parameter in DonatedItemEditor.php5.3CNA v4.00.4%2026-04-13Fix
CVE-2026-36952Sourcecodester Online Thesis Archiving System curriculum management page SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36950Sourcecodester Online Thesis Archiving System projects-per-department report SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36948Sourcecodester Online Thesis Archiving System archive view page SQL injection7.3CISA ADP v3.10.3%2026-04-13
CVE-2026-36947oretnom23 Computer And Mobile Repair Shop Management System SQL injection2.7v3.10.2%2026-04-13
CVE-2026-36946oretnom23 Computer And Mobile Repair Shop Management System SQL injection2.7v3.10.3%2026-04-13
CVE-2026-36945Sourcecodester Computer and Mobile Repair Shop Management System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36944Sourcecodester Computer and Mobile Repair Shop Management System repair details page SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36943Sourcecodester Computer and Mobile Repair Shop Management System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36942Sourcecodester Online Resort Management System activity management page SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36941Sourcecodester Online Resort Management System room management page SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36938Sourcecodester Online Resort Management System room details page SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36937Sourcecodester Online Resort Management System reservation details page SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36923oretnom23 Cab Management System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36922oretnom23 Cab Management System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36920Janobe Online Reviewer System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36919Janobe Online Reviewer System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36874Razormist Basic Library System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36873Razormist Basic Library System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-36872Razormist Basic Library System SQL injection2.7CISA ADP v3.10.3%2026-04-13
CVE-2026-35565Apache Storm UI: Stored cross-site scripting (XSS) via Unsanitized Topology Metadata in Storm UI5.4CISA ADP v3.10.6%2026-04-13Fix
CVE-2026-35553Dynabook TOSRFEC.SYS stack-based buffer overflow8.4CNA v4.00.2%2026-04-13
CVE-2026-35337Apache Storm Client: RCE through unsafe deserialization via Kerberos TGT Credential Handling8.8CISA ADP v3.11.1%2026-04-13Fix
CVE-2026-34867Huawei HarmonyOS double free vulnerability in the multi-mode input system5.6CNA v3.10.1%2026-04-13Fix
CVE-2026-34866Huawei HarmonyOS out-of-bounds write5.1CNA v3.10.1%2026-04-13Fix
CVE-2026-34865Huawei HarmonyOS out-of-bounds write10.0CNA v4.00.4%2026-04-13Fix
CVE-2026-34864Huawei HarmonyOS boundary-unlimited vulnerability in the application read module6.8CNA v3.10.1%2026-04-13Fix
CVE-2026-34863Huawei HarmonyOS out-of-bounds write vulnerability in the file system6.7CNA v3.10.1%2026-04-13Fix
CVE-2026-34862Huawei HarmonyOS race condition vulnerability in the power consumption statistics module6.3CNA v3.10.1%2026-04-13Fix
CVE-2026-34861Huawei HarmonyOS race condition vulnerability in the thermal management module6.3CNA v3.10.1%2026-04-13Fix
CVE-2026-34860Huawei HarmonyOS access control vulnerability in the memo module4.1CNA v3.10.2%2026-04-13Fix
CVE-2026-34859Huawei HarmonyOS UAF vulnerability in the kernel module5.9CNA v3.10.1%2026-04-13Fix
CVE-2026-34858Huawei HarmonyOS UAF vulnerability in the communication module4.1CNA v3.10.1%2026-04-13Fix
CVE-2026-34857Huawei HarmonyOS UAF vulnerability in the communication module4.7CNA v3.10.1%2026-04-13Fix
CVE-2026-34856Huawei HarmonyOS UAF vulnerability in the communication module7.3CNA v3.10.2%2026-04-13Fix
CVE-2026-34855Huawei HarmonyOS out-of-bounds write vulnerability in the kernel module5.7CNA v3.10.1%2026-04-13Fix
CVE-2026-34854Huawei HarmonyOS UAF vulnerability in the kernel module5.7CNA v3.10.1%2026-04-13Fix
CVE-2026-34853Huawei HarmonyOS permission bypass vulnerability in the LBS module7.7CNA v3.10.2%2026-04-13Fix
CVE-2026-34852Huawei HarmonyOS stack overflow vulnerability in the media platform6.1CNA v3.10.2%2026-04-13Fix
CVE-2026-34851Huawei HarmonyOS race condition vulnerability in the event notification module2.2CNA v3.10.2%2026-04-13Fix
CVE-2026-34850Huawei HarmonyOS race condition vulnerability in the notification service1.9CNA v3.10.2%2026-04-13Fix
CVE-2026-34849Huawei HarmonyOS UAF vulnerability in the screen management module2.5CNA v3.10.1%2026-04-13Fix
CVE-2026-34476Apache SkyWalking MCP: Server-side request forgery via SW-URL header in MCP Server7.1CISA ADP v3.10.5%2026-04-13Fix
CVE-2026-34238ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds5.1CNA v3.10.1%2026-04-13Fix
CVE-2026-34188Pandora FMS OS command injection in Event Response Execution7.5CNA v4.01.7%2026-04-13Fix
CVE-2026-34186Pandora FMS SQL injection in Custom fields leads to Database Compromise8.7CNA v4.00.4%2026-04-13Fix
CVE-2026-33947jq path functions uncontrolled recursion6.2CNA v3.10.2%2026-04-13Fix
CVE-2026-33908ImageMagick is vulnerable to stack overflow in DestroyXMLTree7.5CNA v3.10.7%2026-04-13Fix
CVE-2026-33905ImageMagick has an out-of-bounds read via -sample operation5.5CNA v3.10.2%2026-04-13Fix
CVE-2026-33902ImageMagick: Stack overflow via Recursive FX Expression Parsing5.5CNA v3.10.2%2026-04-13Fix
CVE-2026-33901ImageMagick has a heap buffer overflow via MVG decoder7.5CNA v3.10.7%2026-04-13Fix
CVE-2026-33900ImageMagick VIFF encoder integer overflow5.9CNA v3.10.6%2026-04-13Fix
CVE-2026-33899ImageMagick: Heap BufferOverflow write of single zero byte when parsing XML5.3CNA v3.10.5%2026-04-13Fix
CVE-2026-33858Apache Airflow: Unsafe deserialization8.8CISA ADP v3.11.1%2026-04-13Fix
CVE-2026-33740EspoCRM: Email importEml can import and delete another user's attachment by raw fileId5.4CNA v3.10.3%2026-04-13Fix
CVE-2026-33659EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl endpoint allows Internal Network Access3.5CNA v3.10.4%2026-04-13Fix
CVE-2026-33657EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field4.6CNA v3.10.2%2026-04-13Exploit codeFix
CVE-2026-33555HAProxy improper length parameter handling5.8NVD v3.10.6%2026-04-13Exploit codeFix
CVE-2026-33534EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation4.3CNA v3.11.7%2026-04-13NucleiExploit codeFix
CVE-2026-32605Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer7.5CNA v3.10.6%2026-04-13Fix
CVE-2026-32316jq string concatenation heap-based buffer overflow8.2CNA v3.10.8%2026-04-13Fix
CVE-2026-32272Craft Commerce: Blind SQL injection via hasVariant/hasProduct8.7CNA v4.00.5%2026-04-13Fix
CVE-2026-32271Craft Commerce: SQL injection can lead to remote code execution via TotalRevenue widget7.7CNA v4.00.6%2026-04-13Fix
CVE-2026-32270Craft CMS Commerce payment endpoint information disclosure1.7CNA v4.00.5%2026-04-13Fix
CVE-2026-31428Linux kernel NFLOG netlink logging vulnerability5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31427Linux kernel SIP connection tracking helper vulnerability5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31426Linux kernel ACPI embedded controller driver use-after-free7.0CNA v3.10.2%2026-04-13Fix