CVE-2026 list

CVE-2026 records published in April 2026

Page four of six: records 3,001 to 4,000 of the 5,323 published in April 2026, newest first. The first page carries the figures for April 2026.

CVE-2026 records published in April 2026, newest first: records 3,001 to 4,000 of 5,323
CVE Summary CVSS EPSS Published Signals
CVE-2026-31425Linux kernel RDS IB memory registration null pointer dereference5.5v3.10.1%2026-04-13Fix
CVE-2026-31424Linux kernel x_tables ARP support null pointer dereference5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31423Linux kernel HFSC packet scheduler divide by zero5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31422Linux kernel tc cls_flow classifier null pointer dereference5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31421Linux kernel tc cls_fw classifier null pointer dereference5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31420Linux kernel bridge MRP protocol denial of service5.5v3.10.1%2026-04-13Fix
CVE-2026-31419Linux kernel bonding broadcast transmit path use-after-free7.8CNA v3.10.1%2026-04-13Fix
CVE-2026-31418In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_del() counts empty slots below n->pos in k, but it only drops the bucket when both n->pos and k are zero. This misses buckets whose live entries have all been remov5.5NVD v3.10.1%2026-04-13Fix
CVE-2026-31417Linux kernel X.25 fragment queue vulnerability7.5CNA v3.10.8%2026-04-13Fix
CVE-2026-31416Linux kernel netfilter log netlink message size vulnerability5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31415Linux kernel IPv6 datagram ancillary data reachable assertion5.5NVD v3.10.2%2026-04-13Fix
CVE-2026-31414Linux kernel conntrack expectation helper vulnerability9.8CNA v3.10.4%2026-04-13Fix
CVE-2026-31283In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a hard9.8CISA ADP v3.10.6%2026-04-13
CVE-2026-31282Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because (1) local logi9.8CISA ADP v3.10.5%2026-04-13
CVE-2026-31281Totara Learning in-app messaging client HTML injection8.0CISA ADP v3.10.4%2026-04-13
CVE-2026-31280Parani M10 Motorcycle Intercom Bluetooth RFCOMM service buffer overflow6.5CISA ADP v3.10.3%2026-04-13Exploit code
CVE-2026-31048Pyro pickle protocol code injection9.8CISA ADP v3.10.8%2026-04-13
CVE-2026-30999FFmpeg av_bprint_finalize function heap-based buffer overflow7.5CISA ADP v3.10.7%2026-04-13Fix
CVE-2026-30998FFmpeg denial of service7.5CISA ADP v3.10.7%2026-04-13Fix
CVE-2026-30997FFmpeg read_global_param function out-of-bounds read7.5CISA ADP v3.10.5%2026-04-13Fix
CVE-2026-30813Pandora FMS SQL injection in Module Search leads to Database Compromise8.7CNA v4.00.4%2026-04-13Fix
CVE-2026-30812Pandora FMS stored cross-site scripting in Event Comments via Filter Bypass2.1CNA v4.00.2%2026-04-13Fix
CVE-2026-30811Pandora FMS missing authorization in Configuration Ajax endpoint leads to information disclosure8.4CNA v4.00.3%2026-04-13Fix
CVE-2026-30809Pandora FMS OS command injection in WebServerModuleDebug8.7CNA v4.01.6%2026-04-13Fix
CVE-2026-30806Pandora FMS OS command injection in Network Report leads to remote code execution8.7CNA v4.01.6%2026-04-13Fix
CVE-2026-30804Pandora FMS unrestricted file upload in Extension Uploader leads to remote code execution8.6CNA v4.00.8%2026-04-13Fix
CVE-2026-29955Cloudark Kubeplus code injection8.8CISA ADP v3.12.9%2026-04-13Exploit code
CVE-2026-29628tinyobjloader tinyobj_loader_opt.h MTL parser denial of service6.2CISA ADP v3.10.2%2026-04-13
CVE-2026-28553Huawei HarmonyOS vulnerability of improper permission control in the theme setting module6.9CNA v3.10.2%2026-04-13Fix
CVE-2026-28291simple-git has command execution via Option-Parsing Bypass8.1CNA v3.10.9%2026-04-13Fix
CVE-2026-26460Dashboard module of Vtiger CRM HTML injection6.1CISA ADP v3.10.3%2026-04-13
CVE-2026-25209Samsung Open Source Escargot out-of-bounds read6.5CNA v3.10.3%2026-04-13
CVE-2026-25208Samsung Open Source Escargot integer overflow8.1CNA v3.10.3%2026-04-13
CVE-2026-25207Samsung Open Source Escargot out-of-bounds write7.4CNA v3.10.2%2026-04-13
CVE-2026-25206Samsung Open Source Escargot out-of-bounds read6.7CNA v3.10.2%2026-04-13
CVE-2026-25205Samsung Open Source Escargot heap-based buffer overflow7.4CNA v3.10.2%2026-04-13
CVE-2026-25204Samsung Open Source Escargot deserialization of untrusted data6.2CNA v3.10.3%2026-04-13
CVE-2026-23891Decidim has a cross-site scripting (XSS) vulnerability via user name field9.3CNA v4.00.4%2026-04-13Fix
CVE-2026-22566Ubiquiti UniFi Play PowerAmp improper access control7.5CNA v3.10.4%2026-04-13Fix
CVE-2026-22565Ubiquiti UniFi Play PowerAmp improper input validation7.5CISA ADP v3.10.4%2026-04-13Fix
CVE-2026-22564Ubiquiti UniFi Play PowerAmp improper access control9.8CNA v3.10.4%2026-04-13Fix
CVE-2026-22563Ubiquiti UniFi Play PowerAmp improper input validation9.8CNA v3.11.1%2026-04-13Fix
CVE-2026-22562Ubiquiti UniFi Play PowerAmp path traversal9.8CNA v3.10.8%2026-04-13Fix
CVE-2026-21014Samsung Mobile Samsung Camera improper access control5.1CNA v4.00.1%2026-04-13Fix
CVE-2026-21013Samsung Mobile Galaxy Wearable incorrect default permissions6.9CNA v4.00.1%2026-04-13Fix
CVE-2026-21012Samsung Mobile Devices AODManager vulnerability6.8CNA v4.00.1%2026-04-13Fix
CVE-2026-21011Samsung Mobile Devices Bluetooth in Maintenance mode incorrect privilege assignment5.4CNA v4.00.1%2026-04-13Fix
CVE-2026-21010Samsung Mobile Devices Retail Mode improper input validation6.6CNA v3.10.1%2026-04-13Fix
CVE-2026-21009Samsung Mobile Devices Recents improper check for exceptional conditions4.1CNA v4.00.2%2026-04-13Fix
CVE-2026-21008Samsung Mobile Devices S Share information disclosure5.1CNA v4.00.2%2026-04-13Fix
CVE-2026-21007Samsung Mobile Devices Device Care improper check for exceptional conditions4.4CNA v4.00.2%2026-04-13Fix
CVE-2026-21006Samsung Mobile Devices improper access control4.7CNA v4.00.1%2026-04-13Fix
CVE-2026-21003Samsung Mobile Devices data related to network restrictions improper input validation5.2CNA v4.00.2%2026-04-13Fix
CVE-2026-6231MongoDB C Driver bson_validate may skip validation when processing certain inputs5.3CNA v4.00.3%2026-04-13Fix
CVE-2026-6224NocoBase workflow-javascript plugin JavaScript sandbox console vulnerability6.9CNA v4.00.5%2026-04-13
CVE-2026-6220HummerRisk video file download handler server-side request forgery5.1CNA v4.00.4%2026-04-13
CVE-2026-6219aandrew-me ytDownloader Compressor feature compressor.js child_process.exec command injection4.8CNA v4.01.4%2026-04-13
CVE-2026-6218aandrew-me ytDownloader Error Details Panel createTextNode cross-site scripting5.3CNA v4.00.4%2026-04-13
CVE-2026-6216DbGate SVG Icon String FontIcon.svelte cross-site scripting5.1CNA v4.00.3%2026-04-13Fix
CVE-2026-6215DbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgery5.3CNA v4.00.3%2026-04-13
CVE-2026-6204LibreNMS is vulnerable to remote code execution by arbitrary file write7.2v3.10.9%2026-04-13Emerging ThreatsFix
CVE-2026-6203User Registration and Membership WordPress plugin unauthenticated open redirect6.1CNA v3.10.6%2026-04-13NucleiFix
CVE-2026-6202code-projects Easy Blog Site post.php SQL injection5.3CNA v4.00.3%2026-04-13
CVE-2026-6201CodeAstro Online Job Portal Delete Job Posting job-delete.php access control5.3CNA v4.00.4%2026-04-13
CVE-2026-6200Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6199Tenda F456 qossetting fromqossetting stack-based overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6198Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6197Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6196Tenda F456 exeCommand fromexeCommand stack-based overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6195Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection9.3CNA v4.03.3%2026-04-13Emerging Threats
CVE-2026-6194Totolink A3002MU HTTP request formWlanSetup sub_410188 stack-based overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6193PHPGurukul Daily Expense Tracking System register.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6192uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow4.8CNA v4.00.2%2026-04-13Fix
CVE-2026-6191itsourcecode Construction Management System equipments.php SQL injection5.3CNA v4.00.3%2026-04-13
CVE-2026-6190itsourcecode Construction Management System employees.php SQL injection5.3CNA v4.00.3%2026-04-13
CVE-2026-6189SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6188SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6187SourceCodester Pharmacy Sales and Inventory System ajax.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6186UTT HiPER 1200GW formNatStaticMap strcpy buffer overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6184code-projects Simple Content Management System welcome.php cross-site scripting4.8CNA v4.00.4%2026-04-13
CVE-2026-6183code-projects Simple Content Management System index.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6182code-projects Simple Content Management System login.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6179Stored cross-site scripting in NightWolf Penetration Testing Platform6.3CNA v4.00.2%2026-04-13
CVE-2026-6168TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6167code-projects Faculty Management System subject-print.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6166code-projects Vehicle Showroom Management System UpdateVehicleFunction.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6165code-projects Vehicle Showroom Management System Login_check.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6164code-projects Lost and Found Thing Management addcat.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6163code-projects Lost and Found Thing Management catageory.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6162PHPGurukul Company Visitor Management System bwdates-reports-details.php cross-site scripting5.1CNA v4.00.3%2026-04-13
CVE-2026-6161code-projects Simple ChatBox endpoint insert.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6160code-projects Simple ChatBox endpoint chatbox.sql SimpleChatbox_PHP file information disclosure6.9CNA v4.00.5%2026-04-13
CVE-2026-6159code-projects Simple ChatBox endpoint insert.php cross-site scripting5.3CNA v4.00.4%2026-04-13
CVE-2026-6158Totolink N300RH upgrade.so setUpgradeUboot os command injection6.9CNA v4.02.1%2026-04-13
CVE-2026-6157Totolink A800R app.so setAppEasyWizardConfig buffer overflow8.7CNA v4.00.8%2026-04-13
CVE-2026-6156Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection9.3CNA v4.03.3%2026-04-13
CVE-2026-6155Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection9.3CNA v4.03.3%2026-04-13
CVE-2026-6154Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection9.3CNA v4.03.3%2026-04-13
CVE-2026-6153code-projects Vehicle Showroom Management System StaffDetailsFunction.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6152code-projects Vehicle Showroom Management System StaffAddingFunction.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6151code-projects Vehicle Showroom Management System PaymentStatusFunction.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6150code-projects Simple Laundry System checkupdatestatus.php cross-site scripting5.3CNA v4.00.4%2026-04-13
CVE-2026-6149code-projects Vehicle Showroom Management System BookVehicleFunction.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6148code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6143farion1231 cc-switch ProxyServer server.rs cross-domain policy5.3CNA v4.00.2%2026-04-13
CVE-2026-6142tushar-2223 Hotel Management System roomdelete.php SQL injection6.9CNA v4.00.4%2026-04-13
CVE-2026-6141danielmiessler Personal_AI_Infrastructure parse_url.ts os command injection5.3CNA v4.01.8%2026-04-13
CVE-2026-6140Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection9.3CNA v4.03.3%2026-04-13
CVE-2026-6139Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection9.3CNA v4.03.3%2026-04-13
CVE-2026-6138Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection9.3CNA v4.03.3%2026-04-13
CVE-2026-6137Tenda F451 AdvSetWan fromAdvSetWan stack-based overflow8.7CNA v4.00.9%2026-04-13
CVE-2026-6136Tenda F451 L7Im frmL7ImForm stack-based overflow8.7CNA v4.00.9%2026-04-13
CVE-2026-6135Tenda F451 SetIpBind fromSetIpBind stack-based overflow8.7CNA v4.00.9%2026-04-13
CVE-2026-6100Python CPython `lzma.LZMADecompressor` use-after-free9.1CNA v4.00.8%2026-04-13Fix
CVE-2026-5936Server-side request forgery (SSRF) via URL parameter in Foxit PDF Services API8.5CNA v3.10.3%2026-04-13Fix
CVE-2026-5086Crypt::SecretBuffer versions for Perl is suseceptible to timing attacks7.5CISA ADP v3.10.4%2026-04-13Fix
CVE-2026-5085Solstice::Session versions for Perl generates session ids insecurely9.1CISA ADP v3.10.5%2026-04-13
CVE-2026-4810Remote code execution in Google Agent Development Kit (ADK)9.3CNA v4.02.2%2026-04-13NucleiFix
CVE-2026-4786Python CPython incomplete mitigation of, %action expansion for command injection to webbrowser.open7.0CNA v4.00.5%2026-04-13Fix
CVE-2026-3830Product Filter for WooCommerce by WBW WordPress plugin unauthenticated SQLi8.6CISA ADP v3.10.4%2026-04-13Fix
CVE-2026-2728LibreNMS: Cross-site scripting in ShowConfigController4.8v3.10.3%2026-04-13Fix
CVE-2026-1462Safe Mode Bypass in keras-team/Keras8.8CNA v3.00.4%2026-04-13Fix
CVE-2026-0234Cortex XSOAR: Improper verification of cryptographic signature in Microsoft Teams integration7.2CNA v4.00.2%2026-04-13Fix
CVE-2026-0233Autonomous Digital Experience Manager: Improper validation of ADEM certificate2.0CNA v4.00.2%2026-04-13Fix
CVE-2026-0232Cortex XDR Agent: Local Administrator can disable the agent on Windows4.0CNA v4.00.1%2026-04-13Fix
CVE-2026-40396varnish-software Varnish Cache incorrect control flow7.5v3.10.3%2026-04-12Fix
CVE-2026-40395varnish-software Varnish Enterprise resource exhaustion7.5v3.10.2%2026-04-12Fix
CVE-2026-40394varnish-software Varnish Cache incorrect control flow7.5v3.10.2%2026-04-12Fix
CVE-2026-40393mesa3d Mesa out-of-bounds write9.8v3.10.4%2026-04-12Fix
CVE-2026-40386libexif integer underflow7.1v3.10.1%2026-04-12Fix
CVE-2026-40385libexif integer overflow7.1v3.10.1%2026-04-12Fix
CVE-2026-31413Linux kernel BPF verifier scalar tracking out-of-bounds read7.8CNA v3.10.2%2026-04-12Exploit codeFix
CVE-2026-6134Tenda F451 qossetting fromqossetting stack-based overflow8.7CNA v4.00.9%2026-04-12
CVE-2026-6133Tenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflow8.7CNA v4.00.9%2026-04-12
CVE-2026-6132Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection9.3CNA v4.03.3%2026-04-12
CVE-2026-6131Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection9.3CNA v4.03.3%2026-04-12
CVE-2026-6130chatboxai chatbox MCP server management OS command injection6.9CNA v4.02.1%2026-04-12
CVE-2026-6129zhayujie chatgpt-on-wechat CowAgent Agent Mode service missing authentication6.9CNA v4.00.7%2026-04-12
CVE-2026-6126zhayujie chatgpt-on-wechat CowAgent Administrative HTTP endpoint missing authentication6.9CNA v4.00.7%2026-04-12
CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection5.3CNA v4.00.4%2026-04-12Fix
CVE-2026-6124Tenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflow8.7CNA v4.00.9%2026-04-12
CVE-2026-6123Tenda F451 httpd addressNat fromAddressNat stack-based overflow8.7CNA v4.01.0%2026-04-12
CVE-2026-6122Tenda F451 httpd L7Prot frmL7ProtForm stack-based overflow8.7CNA v4.00.9%2026-04-12
CVE-2026-6121Tenda F451 httpd WrlclientSet stack-based overflow8.7CNA v4.00.9%2026-04-12
CVE-2026-6120Tenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflow8.7CNA v4.00.9%2026-04-12
CVE-2026-6119AstrBotDevs AstrBot API endpoint post_data.get server-side request forgery5.3CNA v4.00.3%2026-04-12
CVE-2026-6118AstrBotDevs AstrBot MCP endpoint tools.py add_mcp_server command injection5.3CNA v4.03.5%2026-04-12Nuclei
CVE-2026-6117AstrBotDevs AstrBot install-upload endpoint plugin.py install_plugin_upload sandbox5.3CNA v4.00.4%2026-04-12
CVE-2026-6116Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection9.3CNA v4.03.3%2026-04-12
CVE-2026-6115Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection9.3CNA v4.03.3%2026-04-12
CVE-2026-6114Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection9.3CNA v4.03.3%2026-04-12
CVE-2026-6113Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection9.3CNA v4.03.3%2026-04-12
CVE-2026-6112Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection9.3CNA v4.03.3%2026-04-12
CVE-2026-6111FoundationAgents MetaGPT common.py decode_image server-side request forgery6.5v3.10.4%2026-04-12Exploit code
CVE-2026-6110FoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injection9.8v3.10.7%2026-04-12
CVE-2026-6109FoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgery8.8v3.10.3%2026-04-12
CVE-2026-61081Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection5.3CNA v4.01.8%2026-04-12
CVE-2026-61071Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross-site scripting5.1CNA v4.00.4%2026-04-12Fix
CVE-2026-1116Cross-site scripting (XSS) in parisneo/Lollms6.1NVD v3.10.3%2026-04-12Fix
CVE-2026-40354flatpak xdg-desktop-portal symlink following6.3v3.10.1%2026-04-11Fix
CVE-2026-34621Adobe Acrobat and Reader prototype pollution8.6CNA v3.12.2%2026-04-11KEVExploit codeKCVFix
CVE-2026-32146Gleam Improper Path Validation in Git Dependency Handling allows arbitrary File System Modification8.3CNA v4.00.2%2026-04-11Fix
CVE-2026-31845Rukovoditel CRM reflected XSS via zd_echo parameter in Zadarma Telephony API endpoint9.3CNA v4.00.5%2026-04-11
CVE-2026-23900Extension Phoca.cz stored XSS vectors in Phoca Maps component for Joomla6.5CISA ADP v3.10.2%2026-04-11
CVE-2026-61061Panel-dev MaxKB public chat interface cross-site scripting5.1CNA v4.00.4%2026-04-11Fix
CVE-2026-6105perfree go-fastdfs-web doInstall InstallController.java improper authorization6.9CNA v4.00.5%2026-04-11
CVE-2026-5809wpForo Forum WordPress plugin arbitrary file deletion7.1CNA v3.10.6%2026-04-11Fix
CVE-2026-5496Labcenter Electronics Proteus PDSPRJ File Parsing type confusion remote code execution7.8CNA v3.00.2%2026-04-11
CVE-2026-5495Labcenter Electronics Proteus PDSPRJ File Parsing out-of-bounds write remote code execution7.8CNA v3.00.2%2026-04-11
CVE-2026-5494Labcenter Electronics Proteus PDSPRJ File Parsing out-of-bounds write remote code execution7.8CNA v3.00.2%2026-04-11
CVE-2026-5493Labcenter Electronics Proteus PDSPRJ File Parsing out-of-bounds write remote code execution7.8CNA v3.00.2%2026-04-11
CVE-2026-5226Optimole WordPress plugin reflected cross-site scripting via page Profiler URL6.1CNA v3.10.4%2026-04-11Fix
CVE-2026-5217Optimole WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-04-11Fix
CVE-2026-5207LifterLMS WordPress plugin authenticated (Custom+) SQL injection via order parameter6.5CNA v3.10.4%2026-04-11Fix
CVE-2026-5144BuddyPress Groupblog WordPress plugin privilege escalation to Administrator8.8CNA v3.10.6%2026-04-11Fix
CVE-2026-5059aws-mcp-server AWS CLI command injection remote code execution9.8CNA v3.02.3%2026-04-11Exploit code
CVE-2026-5058aws-mcp-server command injection remote code execution9.8CNA v3.02.3%2026-04-11
CVE-2026-5055NoMachine uncontrolled search path element local privilege escalation7.8CNA v3.00.2%2026-04-11
CVE-2026-5054NoMachine External Control of file path local privilege escalation7.8CNA v3.00.2%2026-04-11Exploit code
CVE-2026-5053NoMachine External Control of file path arbitrary file deletion7.1CNA v3.00.1%2026-04-11Exploit code
CVE-2026-4979UsersWP WordPress plugin server-side request forgery5.0CNA v3.10.4%2026-04-11Fix
CVE-2026-4895Greenshift WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-11Fix
CVE-2026-4158KeePassXC OpenSSL Configuration uncontrolled search path element local privilege escalation7.3CNA v3.00.2%2026-04-11Fix
CVE-2026-4157ChargePoint Home Flex revssh service command injection remote code execution7.5CNA v3.01.3%2026-04-11
CVE-2026-4156ChargePoint Home Flex OCPP getpreq stack-based buffer overflow remote code execution7.5CNA v3.00.4%2026-04-11
CVE-2026-4155ChargePoint Home Flex inclusion of sensitive information in source code information disclosure7.5CNA v3.00.7%2026-04-11
CVE-2026-4154GIMP XPM File Parsing integer overflow remote code execution7.8CNA v3.00.6%2026-04-11Fix
CVE-2026-4153GIMP PSP File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.6%2026-04-11Fix
CVE-2026-4152GIMP JP2 File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.6%2026-04-11Fix
CVE-2026-4151GIMP ANI File Parsing integer overflow remote code execution7.8CNA v3.00.5%2026-04-11Fix
CVE-2026-4150GIMP PSD File Parsing integer overflow remote code execution7.8CNA v3.00.6%2026-04-11Fix
CVE-2026-4149Sonos Era 300 SMB Response out-of-bounds access remote code execution9.8v3.11.0%2026-04-11
CVE-2026-3691OpenClaw Client PKCE Verifier information disclosure5.3CNA v3.00.4%2026-04-11Fix
CVE-2026-3690OpenClaw Canvas authentication bypass7.4CNA v3.00.6%2026-04-11Fix
CVE-2026-3689OpenClaw Canvas path traversal information disclosure6.5CNA v3.01.0%2026-04-11Fix
CVE-2026-3498BlockArt Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-11Fix
CVE-2026-3371Tutor LMS WordPress plugin insecure direct object reference to arbitrary Course content modification4.3CNA v3.10.3%2026-04-11Fix
CVE-2026-3358Themeum Tutor LMS course enrollment missing authorization5.4CNA v3.10.4%2026-04-11Fix
CVE-2026-40252Broken access control (IDOR) leading to Cross-Tenant Application Access in FastGPT5.3CNA v4.00.4%2026-04-10Fix
CVE-2026-40242Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch endpoint7.2CNA v3.10.7%2026-04-10NucleiFix
CVE-2026-40228systemd incorrect resource transfer3.3v3.10.2%2026-04-10Fix
CVE-2026-40227systemd IPC API denial of service5.5v3.10.2%2026-04-10Fix
CVE-2026-40226systemd use of a less trusted source6.4CNA v3.10.1%2026-04-10Fix
CVE-2026-40225systemd incorrect resource transfer6.4CNA v3.10.2%2026-04-10Fix
CVE-2026-40224systemd incorrect authorization7.3v3.10.1%2026-04-10Fix
CVE-2026-40223systemd incorrect behavior order5.5v3.10.1%2026-04-10Fix
CVE-2026-40217LiteLLM has a sandbox escape in custom-code guardrail8.8CNA v3.13.4%2026-04-10NucleiExploit codeFix
CVE-2026-40212OpenStack Skyline cross-site scripting5.4CNA v3.10.3%2026-04-10Fix
CVE-2026-40200musl-libc musl incorrect control flow8.1CNA v3.10.2%2026-04-10Fix
CVE-2026-40199STIGTSP Net::CIDR::Lite improper length parameter handling6.5CISA ADP v3.10.4%2026-04-10Fix
CVE-2026-40198Net::CIDR::Lite versions for Perl does not validate IPv6 group count, which may allow IP ACL bypass7.5CISA ADP v3.10.5%2026-04-10Fix
CVE-2026-40194phpseclib SSH2 packet verification vulnerability3.7CNA v3.10.4%2026-04-10Fix
CVE-2026-40191ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path6.8CNA v4.00.1%2026-04-10Fix
CVE-2026-40190LangSmith Client SDKs has prototype pollution in langsmith-sdk5.6CNA v3.10.4%2026-04-10Fix
CVE-2026-40189Goshs has a file-based ACL authorization bypass in Goshs state-changing routes9.3CNA v4.00.7%2026-04-10Fix
CVE-2026-40188Goshs is Missing Write Protection for Parametric Data Values7.7CNA v3.10.4%2026-04-10Fix
CVE-2026-40185Missing authorization on Immich Trip Photo Routes in TREK7.1CNA v3.10.4%2026-04-10Fix
CVE-2026-40184Unauthenticated access to Uploaded files in TREK3.7CNA v3.10.4%2026-04-10Fix
CVE-2026-40180Zip Slip path traversal in quarkus-openapi-generator ApicurioCodegenWrapper class7.7CNA v4.00.5%2026-04-10Fix
CVE-2026-40178ajenti ajenti.plugin.core has a race conditions in 2FA6.9CNA v4.00.3%2026-04-10Fix
CVE-2026-40177ajenti password bypass when 2FA is activated9.3CNA v4.00.4%2026-04-10Fix
CVE-2026-40175Axios has Unrestricted Cloud Metadata Exfiltration via header injection Chain4.8CNA v3.12.0%2026-04-10Exploit codeFix
CVE-2026-40168Postiz has server-side request forgery via Redirect Bypass in /API/public/stream8.2CNA v3.10.5%2026-04-10Fix
CVE-2026-40163Saltcorn sync endpoints path traversal8.2CNA v3.10.4%2026-04-10Fix
CVE-2026-40162Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble7.1CNA v3.10.5%2026-04-10Fix
CVE-2026-40160PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback7.1CNA v4.00.4%2026-04-10Fix
CVE-2026-40159PraisonAI exposes Sensitive Environment variable via Untrusted MCP Subprocess Execution5.5CNA v3.10.2%2026-04-10Fix
CVE-2026-40158PraisonAI has improper control of generation of code and protection mechanism failure in PraisonAI8.6CNA v3.10.2%2026-04-10Fix
CVE-2026-40157PraisonAI affected by arbitrary file write via path traversal in `PraisonAI recipe unpack`9.4CNA v4.00.5%2026-04-10Fix
CVE-2026-40156PraisonAI affected by Implicit execution of arbitrary code via Automatic `tools.py` Loading7.8CNA v3.10.2%2026-04-10Fix
CVE-2026-40103Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds4.3CNA v3.10.3%2026-04-10Fix
CVE-2026-40100FastGPT has unauthenticated SSRF in /API/core/app/mcpTools/runTool5.3CNA v3.10.4%2026-04-10Fix
CVE-2026-40097Smallstep Step CA TPM attestation EKU validation denial of service3.7CNA v3.10.3%2026-04-10Fix
CVE-2026-40086Rembg has a path traversal via Custom Model Loading5.3CNA v3.10.6%2026-04-10Fix
CVE-2026-40074sveltejs kit SvelteKit's invalidated redirect in handle hook causes denial of service6.3CNA v4.00.6%2026-04-10Fix
CVE-2026-40073SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node8.2CNA v4.01.0%2026-04-10Fix
CVE-2026-40023Apache Log4cxx XMLLayout improper output encoding6.3CNA v4.01.0%2026-04-10Fix
CVE-2026-40021Apache Log4net XmlLayout improper output encoding6.3CNA v4.01.0%2026-04-10Fix
CVE-2026-39922GeoNode SSRF via Service Registration6.3NVD v3.10.3%2026-04-10Fix
CVE-2026-39921GeoNode, SSRF via Document upload6.3v3.10.4%2026-04-10Fix
CVE-2026-39304Apache ActiveMQ: Denial of service via Out of Memory7.5CISA ADP v3.11.1%2026-04-10Fix
CVE-2026-36236Janobe Engineers Online Portal SQL injection9.8v3.10.3%2026-04-10
CVE-2026-36235itsourcecode Online Student Enrollment System SQL injection9.8v3.10.3%2026-04-10
CVE-2026-36234itsourcecode Online Student Enrollment System SQL injection9.8v3.10.3%2026-04-10
CVE-2026-36233itsourcecode Online Student Enrollment System SQL injection9.8v3.10.3%2026-04-10
CVE-2026-36232itsourcecode Online Student Enrollment System SQL injection9.8v3.10.3%2026-04-10
CVE-2026-35670OpenClaw Webhook Reply Rebinding via Username Resolution in Synology Chat8.1v3.10.4%2026-04-10Fix
CVE-2026-35669OpenClaw privilege escalation via Gateway Plugin HTTP Authentication Scope8.7CNA v4.00.5%2026-04-10Fix
CVE-2026-35668OpenClaw Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl parameters7.1CNA v4.00.5%2026-04-10Fix
CVE-2026-35667OpenClaw Improper Process Termination via Unpatched killProcessTree in shell-utils.ts6.9CNA v4.00.2%2026-04-10Fix
CVE-2026-35666OpenClaw Allowlist Bypass via Unregistered Time Dispatch Wrapper7.7CNA v4.00.7%2026-04-10Fix
CVE-2026-35665OpenClaw denial of service via Feishu Webhook Pre-Auth Body Parsing6.9CNA v4.00.5%2026-04-10Fix
CVE-2026-35664OpenClaw DM Pairing Bypass via Legacy Card Callbacks6.9CNA v4.00.5%2026-04-10Fix
CVE-2026-35663OpenClaw privilege escalation via Backend Reconnect Scope Self-Claim8.7CNA v4.00.5%2026-04-10Fix
CVE-2026-35662OpenClaw Missing controlScope Enforcement in Send action5.3CNA v4.00.3%2026-04-10Fix
CVE-2026-35661OpenClaw Telegram DM-Scoped Inline Button Callback authorization bypass6.9CNA v4.00.5%2026-04-10Fix
CVE-2026-35660OpenClaw insufficient access control in Gateway Agent Session Reset7.2CNA v4.00.5%2026-04-10Fix
CVE-2026-35659OpenClaw Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery6.3v3.10.2%2026-04-10Fix
CVE-2026-35658OpenClaw Filesystem Boundary Bypass in Image tool6.0CNA v4.00.5%2026-04-10Fix
CVE-2026-35657OpenClaw authorization bypass in HTTP Session History route7.1CNA v4.00.4%2026-04-10Fix
CVE-2026-35656OpenClaw XFF Loopback spoofing Bypass in Canvas Authentication and Rate Limiter6.3CNA v4.00.6%2026-04-10Fix
CVE-2026-35655OpenClaw Identity spoofing via rawInput tool in ACP Permission Resolution6.9CNA v4.00.4%2026-04-10Fix
CVE-2026-35654OpenClaw authorization bypass in Microsoft Teams Feedback Invoke6.9CNA v4.00.4%2026-04-10Fix
CVE-2026-35653OpenClaw incorrect authorization in POST /reset-profile via browser.request7.2CNA v4.00.7%2026-04-10Fix
CVE-2026-35652OpenClaw unauthorized action Execution via Callback Dispatch9.1v3.10.6%2026-04-10Fix
CVE-2026-35651OpenClaw ANSI escape sequence injection in Approval Prompt5.3CNA v4.00.4%2026-04-10Fix
CVE-2026-35650OpenClaw Environment Variable Override Bypass via Inconsistent Sanitization8.8v3.10.7%2026-04-10Fix
CVE-2026-35649OpenClaw Settings Reconciliation Bypass via Empty Allowlist6.3CNA v4.00.4%2026-04-10Fix
CVE-2026-35648OpenClaw Policy Bypass via Unvalidated Queued Node Actions5.9v3.10.3%2026-04-10Fix
CVE-2026-35647OpenClaw Direct Message Policy Bypass via Verification Notices6.9CNA v4.00.4%2026-04-10Fix
CVE-2026-35643OpenClaw arbitrary code execution via Unvalidated WebView JavascriptInterface8.6CNA v4.00.5%2026-04-10Fix
CVE-2026-35641OpenClaw arbitrary code execution via .npmrc in Local Plugin/Hook Installation7.8v3.10.1%2026-04-10Fix
CVE-2026-35621OpenClaw privilege escalation via chat.send to Allowlist Persistence7.1CNA v4.00.3%2026-04-10Fix
CVE-2026-35620OpenClaw missing authorization in /send and /allowlist Chat commands5.3CNA v4.00.5%2026-04-10Fix
CVE-2026-35619OpenClaw authorization bypass via HTTP /v1/models endpoint5.3CNA v4.00.4%2026-04-10Fix
CVE-2026-35602Vikunja has a File Size Limit Bypass via Vikunja Import5.4CNA v3.10.6%2026-04-10Fix
CVE-2026-35601Vikunja has an iCalendar Property injection via CRLF in CalDAV Task Output4.1CNA v3.10.3%2026-04-10Fix
CVE-2026-35600Vikunja has HTML injection via Task Titles in Overdue Email Notifications5.4CNA v3.10.3%2026-04-10Fix
CVE-2026-35599Vikunja has an algorithmic complexity DoS in Repeating Task handler6.5CNA v3.10.6%2026-04-10Fix
CVE-2026-35598Vikunja has missing authorization on CalDAV Task Read4.3CNA v3.10.3%2026-04-10Fix
CVE-2026-35597Vikunja affected by TOTP brute-force due to Non-Functional Account Lockout5.9CNA v3.10.5%2026-04-10Fix
CVE-2026-35596Vikunja has broken access control on Label Read via SQL Operator Precedence Bug4.3CNA v3.10.3%2026-04-10Fix
CVE-2026-35595Vikunja affected by privilege escalation via Project Reparenting8.3CNA v3.10.5%2026-04-10Fix
CVE-2026-35594Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade6.5CNA v3.10.4%2026-04-10Fix
CVE-2026-34727Vikunja ahs a TOTP Two-Factor authentication bypass via OIDC Login Path7.4CNA v3.10.4%2026-04-10Fix
CVE-2026-34481Apache Log4j JSON Template Layout improper output encoding6.3CNA v4.00.9%2026-04-10Fix
CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML forbidden characters6.9CNA v4.01.2%2026-04-10Fix
CVE-2026-34479Apache Log4j 1 to Log4j 2 bridge Log4j1XmlLayout improper output encoding6.9CNA v4.00.9%2026-04-10Fix
CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility6.9CNA v4.01.2%2026-04-10Fix
CVE-2026-34477Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration6.3CNA v4.00.5%2026-04-10Fix
CVE-2026-33737Chamilo LMS has an XML external entity (XXE) injection5.3CNA v3.10.4%2026-04-10Fix
CVE-2026-33736Chamilo LMS has an insecure direct object reference (IDOR) user data exposure6.5CNA v3.10.4%2026-04-10Fix
CVE-2026-33710Chamilo LMS has Weak REST API Key Generation (Predictable)7.5CNA v3.10.5%2026-04-10Fix
CVE-2026-33708Chamilo LMS has REST API PII Exposure via get_user_info_from_username6.5CNA v3.10.4%2026-04-10Fix
CVE-2026-33707Weak password recovery mechanism for forgotten password in chamilo/chamilo-lms9.4CNA v3.10.8%2026-04-10Fix
CVE-2026-33706Chamilo LMS has a REST API Self-privilege escalation (Student → Teacher)7.1CNA v3.10.3%2026-04-10Fix
CVE-2026-33705Chamilo LMS has unauthenticated access to Twig template source files exposes application logic5.3CNA v3.10.4%2026-04-10Fix
CVE-2026-33704Chamilo LMS affected by authenticated arbitrary file write via BigUpload endpoint7.1CNA v3.10.8%2026-04-10Fix
CVE-2026-33703Chamilo LMS personal data endpoint insecure direct object reference7.1CNA v4.00.3%2026-04-10Fix
CVE-2026-33702Chamilo LMS has an insecure direct object reference (IDOR)7.1CNA v3.10.4%2026-04-10Fix
CVE-2026-33698Chamilo LMS affected by unauthenticated RCE in main/install folder9.3CNA v4.00.6%2026-04-10Fix
CVE-2026-33618Chamilo LMS affected by remote code execution via eval in Platform settings8.8CNA v3.10.6%2026-04-10Fix
CVE-2026-33551OpenStack Keystone: Restricted application credentials can create EC2 credentials5.3v3.10.2%2026-04-10Fix
CVE-2026-33457Checkmk potential livestatus injection in prediction graph page5.3CNA v4.00.3%2026-04-10Fix
CVE-2026-33456Checkmk potential livestatus injection in notification test5.1CNA v4.00.3%2026-04-10Fix
CVE-2026-33455Checkmk livestatus injection in monitoring quicksearch5.3CNA v4.00.3%2026-04-10Fix
CVE-2026-33141Chamilo LMS has an IDOR in REST API Stats endpoint exposes any User's Learning Data6.5CNA v3.10.2%2026-04-10Fix
CVE-2026-33119Microsoft Edge (Chromium-based) for Android spoofing5.4CNA v3.10.4%2026-04-10Fix
CVE-2026-33118Microsoft Edge (Chromium-based) spoofing4.3CNA v3.10.7%2026-04-10Fix
CVE-2026-33092Acronis True Image OEM external control of a configuration setting7.8CNA v3.00.2%2026-04-10Fix
CVE-2026-32932Chamilo LMS has an open redirect via Unvalidated page parameter in Session Course Edit4.7CNA v3.10.3%2026-04-10Fix
CVE-2026-32931Chamilo LMS has arbitrary file upload via MIME-Only Validation in Exercise Sound upload leads to RCE7.5CNA v3.10.9%2026-04-10Fix
CVE-2026-32930Chamilo LMS has an IDOR in Gradebook allows Cross-Course Evaluation Edit without Ownership Check7.1CNA v3.10.3%2026-04-10Fix
CVE-2026-32894Chamilo LMS has an IDOR in Gradebook allows Cross-Course Deletion of any Student's Grade result7.1CNA v3.10.4%2026-04-10Fix
CVE-2026-32893Chamilo LMS has reflected XSS via Unsanitized http_build_query in Exercise Question List Pagination5.4CNA v3.10.2%2026-04-10Fix
CVE-2026-32892OS command injection in Chamilo LMS9.1CNA v3.12.7%2026-04-10Fix
CVE-2026-32252Depomo Chartbrew template generation endpoint improper authorization7.7CNA v3.10.4%2026-04-10Fix
CVE-2026-31941Server-side request forgery (SSRF) in Chamilo LMS7.7CNA v3.10.4%2026-04-10Fix
CVE-2026-31940Session fixation in Chamilo LMS7.5CNA v3.10.5%2026-04-10Fix
CVE-2026-31939Path traversal (arbitrary file delete) in Chamilo LMS8.3CNA v3.10.5%2026-04-10Fix
CVE-2026-31412Linux kernel USB mass storage gadget driver integer overflow5.5v3.10.2%2026-04-10Fix
CVE-2026-31262Altenar Sportsbook cross-site scripting6.1CISA ADP v3.10.4%2026-04-10
CVE-2026-30232Chartbrew has SSRF in API Data Connection no IP Validation on User-Provided URLs7.8CNA v4.00.4%2026-04-10Fix
CVE-2026-29861PHP-MYSQL-User-Login-System login.php SQL injection9.8CISA ADP v3.10.5%2026-04-10Exploit code
CVE-2026-29043HDF5 H5T__ref_mem_setnull heap buffer overflow5.5CNA v3.10.2%2026-04-10Fix
CVE-2026-29002CouchCMS privilege escalation via f_k_levels_list parameter8.6CNA v4.00.7%2026-04-10
CVE-2026-28704Emocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be executed with the privilege of the user invoking EmoCheck.8.4CNA v4.00.2%2026-04-10
CVE-2026-27460Tandoor Recipes affected by denial of service via Recipe Import6.5CNA v3.10.4%2026-04-10Fix
CVE-2026-25203Samsung Electronics MagicINFO 9 Server incorrect default permissions7.8CNA v3.10.2%2026-04-10
CVE-2026-23782BMC Control-m/managed File Transfer unauthorized access7.5CISA ADP v3.10.3%2026-04-10Fix
CVE-2026-23781BMC Control-m/managed File Transfer hard-coded credentials9.8CISA ADP v3.10.3%2026-04-10Fix
CVE-2026-23780BMC Control-m/managed File Transfer SQL injection8.8CISA ADP v3.10.4%2026-04-10Fix
CVE-2026-22750SSL bundle configuration silently bypassed in Spring Cloud Gateway7.5CNA v3.10.2%2026-04-10Fix
CVE-2026-22560Rocket.Chat An open redirect5.3CISA ADP v3.10.3%2026-04-10Fix
CVE-2026-6069NASM out-of-bounds write7.5CISA ADP v3.10.5%2026-04-10
CVE-2026-6068NASM response file use-after-free9.6v3.10.4%2026-04-10Fix
CVE-2026-6067NASM Netwide Assembler heap-based buffer overflow5.5NVD v3.10.4%2026-04-10Fix
CVE-2026-6057Unauthenticated path traversal in FalkorDB Browser leads to remote code execution9.8CISA ADP v3.11.2%2026-04-10
CVE-2026-6042musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity4.8CNA v4.00.2%2026-04-10Exploit codeFix
CVE-2026-6038code-projects Vehicle Showroom Management System RegisterCustomerFunction.php SQL injection6.9CNA v4.00.4%2026-04-10
CVE-2026-6037code-projects Vehicle Showroom Management System AddVehicleFunction.php SQL injection6.9CNA v4.00.4%2026-04-10
CVE-2026-6036code-projects Vehicle Showroom Management System VehicleDetailsFunction.php SQL injection6.9CNA v4.00.4%2026-04-10
CVE-2026-6035code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross-site scripting5.3CNA v4.00.4%2026-04-10
CVE-2026-6034code-projects Vehicle Showroom Management System ProfitAndLossReport.php cross-site scripting5.3CNA v4.00.4%2026-04-10
CVE-2026-6033CodeAstro Online Classroom updatedetailsfromstudent.php SQL injection5.3CNA v4.00.3%2026-04-10
CVE-2026-6032code-projects Simple Laundry System checkcheckout.php cross-site scripting5.3CNA v4.00.4%2026-04-10
CVE-2026-6031code-projects Simple IT Discussion Forum add-category-function.php SQL injection6.9CNA v4.00.4%2026-04-10
CVE-2026-6030itsourcecode Construction Management System del1.php SQL injection5.3CNA v4.00.3%2026-04-10
CVE-2026-6029Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-6028Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-6027Totolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-6026Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-6025Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-6024Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversal9.8v3.10.8%2026-04-10
CVE-2026-6016Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow8.7CNA v4.01.0%2026-04-10
CVE-2026-6015Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow8.7CNA v4.01.0%2026-04-10
CVE-2026-6014D-Link DIR-513 POST request formAdvanceSetup buffer overflow8.7CNA v4.01.2%2026-04-10
CVE-2026-6013D-Link DIR-513 POST request formSetRoute buffer overflow8.7CNA v4.01.2%2026-04-10
CVE-2026-6012D-Link DIR-513 POST request formSetPassword buffer overflow8.7CNA v4.01.2%2026-04-10
CVE-2026-6011OpenClaw assertPublicHostname web-fetch.ts server-side request forgery8.1v3.10.6%2026-04-10Fix
CVE-2026-6010CodeAstro Online Classroom takeassessment2.php SQL injection5.3CNA v4.00.3%2026-04-10
CVE-2026-6007itsourcecode Construction Management System del.php SQL injection5.3CNA v4.00.3%2026-04-10
CVE-2026-6006code-projects Patient Record Management System edit_hpatient.php SQL injection5.3CNA v4.00.3%2026-04-10
CVE-2026-6005code-projects Patient Record Management System hematology_print.php SQL injection5.3CNA v4.00.3%2026-04-10
CVE-2026-6004code-projects Simple IT Discussion Forum delete-category.php SQL injection6.9CNA v4.00.4%2026-04-10
CVE-2026-6003code-projects Simple IT Discussion Forum user.php cross-site scripting4.8CNA v4.00.4%2026-04-10
CVE-2026-6000code-projects Online Library Management System information disclosure5.3CNA v4.00.4%2026-04-10
CVE-2026-5999JeecgBoot SysAnnouncementController improper authorization5.3CNA v4.00.2%2026-04-10
CVE-2026-5998zhayujie chatgpt-on-wechat CowAgent API Memory Content endpoint service.py dispatch path traversal6.9CNA v4.00.7%2026-04-10Fix
CVE-2026-5997Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-5996Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-5995Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-5994Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-5993Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection9.3CNA v4.03.3%2026-04-10
CVE-2026-5992Tenda F451 P2pListFilter fromP2pListFilter stack-based overflow8.7CNA v4.00.9%2026-04-10
CVE-2026-5991Tenda F451 WrlExtraSet formWrlExtraSet stack-based overflow8.7CNA v4.00.9%2026-04-10
CVE-2026-5990Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflow8.7CNA v4.00.9%2026-04-10
CVE-2026-5989Tenda F451 RouteStatic fromRouteStatic stack-based overflow8.7CNA v4.00.9%2026-04-10
CVE-2026-5777EGate Atom 3X Projector Android Debug Bridge service missing authentication8.7CNA v4.00.3%2026-04-10Fix
CVE-2026-5774Juju API server denial of service and Authentication Replay via Unsynchronized Token Map6.1CNA v4.00.3%2026-04-10Fix
CVE-2026-5724Temporal missing authentication on Streaming gRPC Replication endpoint6.3CNA v4.00.7%2026-04-10Fix
CVE-2026-5525Stack-based buffer overflow in Notepad++ File Drop handler leads to DoS7.8NVD v3.10.2%2026-04-10
CVE-2026-5501wolfSSL X.509 certificate chain verification improper certificate validation8.6CNA v4.00.2%2026-04-10Fix
CVE-2026-5500wolfSSL man-in-the-middle8.7CNA v4.00.4%2026-04-10Fix
CVE-2026-5483Red Hat OpenShift AI (RHOAI) odh-dashboard: Odh dashboard kubernetes service account exposure8.5CNA v3.10.7%2026-04-10Fix
CVE-2026-5479wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag7.6CNA v4.00.2%2026-04-10Fix
CVE-2026-5477wolfSSL prefix-substitution forgery via integer overflow in wolfCrypt CMAC8.2CNA v4.00.4%2026-04-10Fix
CVE-2026-5466wolfSSL wc_VerifyEccsiHash missing sanity check7.6CNA v4.00.2%2026-04-10Fix
CVE-2026-5460Heap use-after-free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.36.3CNA v4.00.3%2026-04-10Fix
CVE-2026-5448wolfSSL 1-2 Byte buffer overflow in wolfSSL_X509_notAfter/notBefore2.3CNA v4.00.1%2026-04-10Fix
CVE-2026-5412Juju CloudSpec API could leak senstive information9.9CNA v3.10.5%2026-04-10Fix
CVE-2026-5393wolfSSL OOB read in DoTls13CertificateVerify with WOLFSSL_DUAL_ALG_CERTS6.3CNA v4.00.3%2026-04-10Fix
CVE-2026-5392wolfSSL heap OOB read in PKCS7 SignedData streaming2.3CNA v4.00.2%2026-04-10Fix
CVE-2026-5188Integer underflow in X.509 SAN parsing in wolfSSL2.3CNA v4.00.2%2026-04-10Fix
CVE-2026-4977UsersWP WordPress plugin Restricted Usermeta modification via htmlvar parameter4.3CNA v3.10.4%2026-04-10Fix
CVE-2026-4664Customer Reviews for WooCommerce WordPress plugin authentication bypass5.3CNA v3.10.6%2026-04-10Fix
CVE-2026-4482Insight Agent Private Key information disclosure via Inherited File Permissions6.8CNA v4.00.1%2026-04-10Fix
CVE-2026-4432YITH WooCommerce Wishlist WordPress plugin unauthenticated arbitrary Wishlist Renaming via IDOR6.5CISA ADP v3.10.3%2026-04-10Fix
CVE-2026-4351Perfmatters WordPress plugin arbitrary file overwrite8.1CNA v3.10.5%2026-04-10Fix
CVE-2026-4305Royal WordPress Backup and Restore plugin reflected cross-site scripting6.1CNA v3.10.4%2026-04-10Fix
CVE-2026-4162Gravity SMTP WordPress plugin missing authorization to authenticated (Subscriber+) plugin Uninstall7.1CNA v3.10.4%2026-04-10Fix
CVE-2026-4057Download Manager WordPress plugin missing authorization authenticated Media file Protection Removal4.3CNA v3.10.4%2026-04-10Fix
CVE-2026-3446Python CPython base64 decoding stops at first padded quad by default6.0CNA v4.00.2%2026-04-10Fix
CVE-2026-3360Tutor LMS WordPress plugin missing authorization unauthenticated arbitrary Billing Profile Overwrite7.5CNA v3.10.6%2026-04-10Fix
CVE-2026-2712WP-Optimize WordPress plugin unauthorized access5.4CNA v3.10.4%2026-04-10Fix
CVE-2026-2305AddFunc Head and Footer Code WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-10Fix
CVE-2026-1924Aruba HiSpeed Cache WordPress plugin cross-site request forgery to plugin settings reset4.3CNA v3.10.2%2026-04-10Fix
CVE-2026-1502Python CPython HTTP client proxy tunnel headers not validated for CR/LF5.7CNA v4.00.6%2026-04-10Fix
CVE-2026-1263Webling WordPress plugin authenticated (Subscriber+) stored cross-site scripting via title parameter6.4CNA v3.10.3%2026-04-10Fix
CVE-2026-1115Stored XSS in parisneo/Lollms9.6CNA v3.01.3%2026-04-10NucleiFix
CVE-2026-40154PraisonAI affected by Untrusted Remote template code execution9.3CNA v3.10.5%2026-04-09Fix
CVE-2026-40153MervinPraison PraisonAIAgents shell tool command execution vulnerability7.4CNA v3.10.4%2026-04-09Fix
CVE-2026-40152PraisonAIAgents has a path traversal5.3CNA v3.10.4%2026-04-09Fix
CVE-2026-40151PraisonAI affected by unauthenticated information disclosure of Agent Instructions5.3CNA v3.10.8%2026-04-09NucleiFix
CVE-2026-40150PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl tool7.7CNA v3.10.4%2026-04-09Fix
CVE-2026-40149PraisonAI: Unauthenticated Allow-List Manipulation Bypasses agent Tool Approval Safety Controls7.9CNA v3.10.2%2026-04-09Fix
CVE-2026-40148PraisonAI affected by decompression bomb DoS via Recipe Bundle Extraction without Size Limits6.5CNA v3.10.4%2026-04-09Fix
CVE-2026-40117PraisonAIAgents affected by arbitrary file read6.2CNA v3.10.3%2026-04-09Fix
CVE-2026-40116MervinPraison PraisonAI media stream WebSocket endpoint missing authentication7.5CNA v3.10.6%2026-04-09Fix
CVE-2026-40115MervinPraison PraisonAI WSGI recipe registry server resource exhaustion6.2CNA v3.10.4%2026-04-09Fix
CVE-2026-40114PraisonAI has server-side request forgery via Unvalidated webhook_url in Jobs API7.2CNA v3.10.3%2026-04-09Fix
CVE-2026-40113PraisonAI has an argument injection into Cloud Run Environment variables8.4CNA v3.10.3%2026-04-09Fix
CVE-2026-40112PraisonAI has stored XSS5.4CNA v3.10.3%2026-04-09Fix
CVE-2026-40111PraisonAIAgents has an OS command injection9.3CNA v4.00.3%2026-04-09Fix
CVE-2026-40109Flux notification-controller GCR receiver token improper authentication3.1CNA v3.10.2%2026-04-09Fix
CVE-2026-40107SiYuan affected by Zero-Click NTLM Hash Theft and blind SSRF via Mermaid Diagram Rendering8.7CNA v4.00.5%2026-04-09Fix
CVE-2026-40093nimiq core-rs-albatross nimiq-blockchain is missing a wall-clock upper bound on block timestamps8.1CNA v3.10.4%2026-04-09
CVE-2026-40089Sonicverse has server-side request forgery via user-controlled URLs in dashboard API client9.9CNA v3.10.4%2026-04-09Fix
CVE-2026-40088Improper neutralization of special elements used in an OS command in PraisonAI9.7CNA v3.10.6%2026-04-09Fix
CVE-2026-40087LangChain has incomplete f-string validation in prompt templates5.3CNA v3.10.5%2026-04-09Fix
CVE-2026-40077Beszel has an IDOR in hub API endpoints that read system ID from URL parameter3.5CNA v3.10.3%2026-04-09Fix
CVE-2026-40072web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling1.7CNA v4.00.3%2026-04-09Exploit codeFix
CVE-2026-40071pyLoad WebUI JSON permission mismatch lets ADD/delete users invoke MODIFY-only actions5.4CNA v3.10.3%2026-04-09Fix
CVE-2026-40070bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate8.1CNA v3.10.2%2026-04-09Fix
CVE-2026-40069sgbett BSV Ruby SDK ARC broadcaster failure detection vulnerability7.5CNA v3.10.5%2026-04-09Fix
CVE-2026-40046Apache ActiveMQ integer overflow7.5CISA ADP v3.10.6%2026-04-09Fix
CVE-2026-39987Marimo remote code execution9.3CNA v4.037.9%2026-04-09KEVNucleiExploit codeFix
CVE-2026-39985Loris has an open redirect field on login4.3CNA v3.10.3%2026-04-09Fix
CVE-2026-39983FTP command injection via CRLF in basic-ftp8.6CNA v3.12.8%2026-04-09Fix
CVE-2026-39981AGiXT has a path traversal in safe_join8.8CNA v3.11.4%2026-04-09Fix
CVE-2026-39980OpenCTI affected by RCE via notifier template9.1CNA v3.10.7%2026-04-09MetasploitKCVFix
CVE-2026-39977flatpak-builder license file path resolution path traversal7.1CNA v4.00.4%2026-04-09Fix
CVE-2026-39976Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens7.1CNA v3.10.4%2026-04-09Fix
CVE-2026-39974n8n-MCP has an authenticated SSRF via instance-URL header in multi-tenant HTTP mode8.5CNA v3.10.4%2026-04-09Fix
CVE-2026-39972Mercure has a Topic Selector Cache Key Collision7.1CNA v4.00.4%2026-04-09Fix
CVE-2026-39962LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable8.8CNA v4.00.7%2026-04-09Fix
CVE-2026-39961Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource6.8CNA v3.10.5%2026-04-09Fix
CVE-2026-39959Tmds.DBus D-Bus peer message handling denial of service7.1CNA v3.10.1%2026-04-09Fix
CVE-2026-39958AOSC-Dev oma oma-topic: Name field in Topic Manifests (topic.json) may allow CRLF injection5.2CNA v4.00.6%2026-04-09Fix
CVE-2026-39957LycheeOrg Lychee sharing controller incorrect authorization2.3CNA v4.00.3%2026-04-09Fix
CVE-2026-39943Directus exposes sensitive fields in revision history6.5CNA v3.10.3%2026-04-09Fix
CVE-2026-39942Directus has a path traversal and broken access control in File Management API8.5CNA v3.10.4%2026-04-09Fix
CVE-2026-39941ChurchCRM has an XSS5.3CNA v4.00.4%2026-04-09Fix
CVE-2026-39912v2board / Xboard Authentication token exposure via loginWithMailLink9.1CNA v4.00.7%2026-04-09Exploit code
CVE-2026-39911Hashgraph Guardian Unsandboxed JavaScript execution RCE8.7CNA v4.00.8%2026-04-09
CVE-2026-39856osslsigncode has an out-of-bounds read via Unvalidated Section Bounds in PE Page Hash Calculation5.5CNA v3.10.2%2026-04-09Fix
CVE-2026-39855osslsigncode has an integer underflow in PE Page Hash Calculation can cause out-of-bounds read5.5CNA v3.10.2%2026-04-09Fix
CVE-2026-39853osslsigncode has a stack buffer overflow via Unbounded Digest Copy during signature verification7.8CNA v3.10.2%2026-04-09Fix
CVE-2026-39848Dockyard container start/stop endpoint missing authentication6.5CNA v3.10.2%2026-04-09Fix
CVE-2026-39843Plane has a server-side request forgery (SSRF) in Favicon Fetching7.7CNA v3.10.4%2026-04-09Fix
CVE-2026-39315Unhead has a hasDangerousProtocol bypass via leading-zero padded HTML entities in useHeadSafe6.1CNA v3.10.3%2026-04-09Fix
CVE-2026-35646OpenClaw Pre-Authentication Rate-Limit Bypass in Webhook Token Validation6.5v3.10.4%2026-04-09Fix
CVE-2026-35645OpenClaw privilege escalation via Synthetic operator.admin in deleteSession8.8v3.10.5%2026-04-09Fix
CVE-2026-35644OpenClaw credential exposure via baseUrl fields in Gateway Snapshots7.1CNA v4.00.3%2026-04-09Fix
CVE-2026-35642OpenClaw authorization bypass in Group Reactions via requireMention Bypass5.3CNA v4.00.3%2026-04-09Fix
CVE-2026-35640OpenClaw denial of service via Unauthenticated Webhook Request Parsing7.5v3.10.8%2026-04-09Fix
CVE-2026-35639OpenClaw privilege escalation via device.pair.approve Scope Validation8.7CNA v4.00.8%2026-04-09Fix
CVE-2026-35638OpenClaw privilege escalation via Self-Declared Scopes in Trusted-Proxy Control UI8.7CNA v4.00.5%2026-04-09Fix
CVE-2026-35637OpenClaw Premature Cite Expansion before Authorization in Channel and DM6.9CNA v4.00.4%2026-04-09Fix
CVE-2026-35636OpenClaw Session Isolation Bypass via sessionId Resolution7.1CNA v4.00.5%2026-04-09Fix
CVE-2026-35635OpenClaw Webhook Path Route Replacement vulnerability in Synology Chat6.5v3.10.4%2026-04-09Fix
CVE-2026-35634OpenClaw authentication bypass via Local-Direct requests in Canvas Gateway5.1CNA v4.00.2%2026-04-09Fix
CVE-2026-35633OpenClaw Unbounded Memory Allocation via Remote Media Error Responses6.9CNA v4.00.7%2026-04-09Fix
CVE-2026-35632OpenClaw Symlink Traversal via IDENTITY.md appendFile in agents.create/update7.8v3.10.3%2026-04-09
CVE-2026-35631OpenClaw missing authorization Enforcement in Internal ACP Chat commands7.1CNA v4.00.4%2026-04-09Fix
CVE-2026-35629OpenClaw server-side request forgery via Unguarded Configured Base URLs in Channel extensions5.3CNA v4.00.3%2026-04-09Fix
CVE-2026-35628OpenClaw brute-force Attack via Missing Telegram Webhook Rate Limiting6.5v3.10.4%2026-04-09Fix
CVE-2026-35627OpenClaw Unauthenticated Cryptographic Work in Nostr Inbound DM Handling8.2v3.10.7%2026-04-09Fix
CVE-2026-35626OpenClaw unauthenticated resource exhaustion via Voice Call Webhook6.9CNA v4.00.7%2026-04-09Fix
CVE-2026-35625OpenClaw privilege escalation via Silent Local Shared-Auth Reconnect8.5CNA v4.00.3%2026-04-09Fix
CVE-2026-35624OpenClaw Policy Confusion via Room Name Collision in Nextcloud Talk5.4v3.10.3%2026-04-09Fix
CVE-2026-35623OpenClaw brute-force Attack via Missing Webhook Password Rate Limiting6.5v3.10.5%2026-04-09Fix
CVE-2026-35622OpenClaw improper authentication Verification in Google Chat Webhook7.1v3.10.4%2026-04-09Fix
CVE-2026-35618OpenClaw Replay Identity Drift via Query-Only Variants in Plivo V2 Verification8.3CNA v4.00.4%2026-04-09Fix
CVE-2026-35617OpenClaw authorization bypass via Group Policy Rebinding with Mutable Space displayName5.4v3.10.3%2026-04-09Fix
CVE-2026-35577Apollo MCP Server StreamableHTTP transport origin validation error6.8CNA v3.10.3%2026-04-09Fix
CVE-2026-35556Plaintext storage of a password in OpenPLC_V37.5NVD v3.10.4%2026-04-09Fix
CVE-2026-35207dde-control-center deepinid avatar download improper certificate validation5.4CNA v3.10.2%2026-04-09Fix
CVE-2026-35206Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment4.8CNA v4.00.2%2026-04-09Fix
CVE-2026-35205Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install8.4CNA v4.00.2%2026-04-09Fix
CVE-2026-35204helm path traversal8.4CNA v4.00.2%2026-04-09Exploit codeFix
CVE-2026-35195Wasmtime has an out-of-bounds write or crash when transcoding component model strings6.1CNA v4.00.3%2026-04-09Fix
CVE-2026-35186Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend6.1CNA v4.00.4%2026-04-09Fix
CVE-2026-35063Missing authorization in OpenPLC_V38.8v3.10.4%2026-04-09Fix
CVE-2026-35041ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification4.2CNA v3.10.4%2026-04-09Fix
CVE-2026-35040nearform fast-jwt claim verification denial of service5.3CNA v3.10.6%2026-04-09Fix
CVE-2026-34988Wasmtime leaks data between pooling allocator instances2.3CNA v4.00.3%2026-04-09Fix
CVE-2026-34987Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access9.0CNA v4.00.5%2026-04-09Fix
CVE-2026-34983Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`1.0CNA v4.00.1%2026-04-09Fix
CVE-2026-34971Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift9.0CNA v4.00.4%2026-04-09Fix
CVE-2026-34946Wasmtime's host panics when Winch compiler executes `table.fill`5.9CNA v4.00.4%2026-04-09Fix
CVE-2026-34945Wasmtime leaks host data with 64-bit tables and Winch2.3CNA v4.00.4%2026-04-09Fix
CVE-2026-34944Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-644.1CNA v4.00.3%2026-04-09Fix
CVE-2026-34943Wasmtime panics when lifting `flags` component value5.6CNA v4.00.4%2026-04-09Fix
CVE-2026-34942Wasmtime panics when transcoding misaligned utf-16 strings5.9CNA v4.00.4%2026-04-09Fix
CVE-2026-34941Wasmtime has a heap OOB read in component model UTF-16 to latin1+utf16 string transcoding6.9CNA v4.00.5%2026-04-09Fix
CVE-2026-34757libpng PLTE, tRNS and hIST chunk setters use-after-free5.1CNA v3.10.2%2026-04-09Fix
CVE-2026-34734HDF5: H5T__conv_struct use-after-free7.8CNA v3.10.2%2026-04-09Fix
CVE-2026-34578OPNsense has an LDAP injection via Unsanitized Username in Authentication8.2CNA v3.10.5%2026-04-09Fix
CVE-2026-34538Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)6.5CISA ADP v3.10.8%2026-04-09Fix
CVE-2026-34512OpenClaw improper access control in /sessions/:sessionKey/kill endpoint7.2CNA v4.00.5%2026-04-09Fix
CVE-2026-34500Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled6.5CISA ADP v3.10.5%2026-04-09Fix
CVE-2026-34487Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token7.5CISA ADP v3.10.4%2026-04-09Fix
CVE-2026-34486Apache Tomcat missing encryption of sensitive data7.5CISA ADP v3.16.6%2026-04-09KEVNucleiEmerging ThreatsExploit codeFix
CVE-2026-34483Apache Tomcat: Incomplete escaping of JSON access logs7.5CISA ADP v3.10.5%2026-04-09Fix
CVE-2026-34424Smart Slider 3 Pro Supply Chain Attack Remote Access Toolkit9.3CNA v4.01.0%2026-04-09Fix
CVE-2026-34185SQL injection in AlanWeb SCADA8.8v3.10.5%2026-04-09Fix
CVE-2026-34184Missing authorization inAlanWeb SCADA9.1v3.10.5%2026-04-09Fix
CVE-2026-34179Canonical LXD TLS certificate update API privilege escalation9.1CNA v3.10.4%2026-04-09Fix
CVE-2026-34178Canonical LXD importing a crafted backup leads to project restriction bypass9.1CNA v3.10.7%2026-04-09Fix
CVE-2026-34177Canonical LXD VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf9.1CNA v3.10.6%2026-04-09Fix
CVE-2026-34020Apache OpenMeetings: Login Credentials Passed via GET Query parameters7.5CISA ADP v3.10.8%2026-04-09Fix
CVE-2026-33797Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset7.1CNA v4.00.3%2026-04-09Fix
CVE-2026-33793Juniper Networks Junos OS User interface execution with unnecessary privileges8.5CNA v4.00.2%2026-04-09Fix
CVE-2026-33791Juniper Networks Junos OS Evolved OS command injection8.4CNA v4.00.7%2026-04-09Fix
CVE-2026-33790Juniper Networks Junos OS flow daemon improper check for exceptional conditions8.7CNA v4.00.5%2026-04-09Fix
CVE-2026-33788Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs8.5CNA v4.00.2%2026-04-09Fix
CVE-2026-33787Juniper Networks Junos OS chassis control daemon improper check for exceptional conditions6.8CNA v4.00.1%2026-04-09Fix
CVE-2026-33786Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes6.8CNA v4.00.1%2026-04-09Fix
CVE-2026-33785Junos OS: MX Series: Missing authorization for specific request CLI commands in a JDM/CSDS scenario6.3CNA v4.00.1%2026-04-09Fix
CVE-2026-33784Juniper Networks JSI LWC A default password9.3CNA v4.00.5%2026-04-09Fix
CVE-2026-33783Juniper Networks Junos OS Evolved gRPC sensor interface denial of service7.1CNA v4.00.4%2026-04-09Fix
CVE-2026-33782Juniper Networks Junos OS DHCP daemon memory leak8.7CNA v4.00.6%2026-04-09Fix
CVE-2026-33781Juniper Networks Junos OS packet forwarding engine improper check for exceptional conditions7.1CNA v4.00.3%2026-04-09Fix
CVE-2026-33780Juniper Networks Junos OS Layer memory leak7.1CNA v4.00.3%2026-04-09Fix
CVE-2026-33779Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication8.3CNA v4.00.2%2026-04-09Fix
CVE-2026-33778Juniper Networks Junos OS improper syntax validation8.7CNA v4.00.5%2026-04-09Fix
CVE-2026-33776Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information6.8CNA v4.00.1%2026-04-09Fix
CVE-2026-33775Juniper Networks Junos OS BroadBand Edge subscriber management daemon memory leak7.1CNA v4.00.3%2026-04-09Fix
CVE-2026-33774Juniper Networks Junos OS packet forwarding engine improper check for exceptional conditions6.9CNA v4.00.3%2026-04-09Fix
CVE-2026-33773Juniper Networks Junos OS packet forwarding engine incorrect initialization6.9CNA v4.00.3%2026-04-09Fix
CVE-2026-33771CTP OS: Configuring password requirements does not work which permits the use of weak passwords9.1CNA v4.00.4%2026-04-09Fix
CVE-2026-33266Apache OpenMeetings: Hard-coded Remember-Me Cookie Encryption Key and Salt7.5CISA ADP v3.10.3%2026-04-09Fix
CVE-2026-33005Apache OpenMeetings: Insufficient checks in FileWebService4.3CISA ADP v3.10.6%2026-04-09Fix
CVE-2026-32990Apache Tomcat has an improper input validation5.3CISA ADP v3.10.6%2026-04-09Fix
CVE-2026-31170TOTOLINK A3300R Firmware command injection9.8CISA ADP v3.11.4%2026-04-09
CVE-2026-30479OSGeo Project MapServer Dynamic-link library injection9.1CISA ADP v3.10.5%2026-04-09
CVE-2026-30478GatewayGeo MapServer for Windows version Dynamic-link library injection8.8CISA ADP v3.10.2%2026-04-09
CVE-2026-29923EnTech Taiwan PowerStrip pstrip64.sys driver privilege escalation7.8CISA ADP v3.10.1%2026-04-09Exploit code
CVE-2026-29146Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default7.5CISA ADP v3.12.9%2026-04-09Fix
CVE-2026-29145Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled9.1CISA ADP v3.10.7%2026-04-09Exploit codeFix
CVE-2026-29129Apache Tomcat: TLS cipher order is not preserved7.5CISA ADP v3.10.4%2026-04-09Fix
CVE-2026-28205Initialization of a resource with an insecure default in OpenPLC_V39.8v3.10.7%2026-04-09Fix
CVE-2026-25854Apache Tomcat: Occasionally open redirect6.1CISA ADP v3.10.5%2026-04-09Fix
CVE-2026-24880Apache Tomcat: Request smuggling via invalid chunk extension7.5CISA ADP v3.10.7%2026-04-09Fix
CVE-2026-24661Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint3.7CNA v3.10.3%2026-04-09Fix
CVE-2026-21919Juniper Networks Junos OS management daemon incorrect synchronization7.1CNA v4.00.2%2026-04-09Fix
CVE-2026-21916Junos OS: A low privileged user can escalate their privileges so that they can login as root7.0CNA v4.00.1%2026-04-09Fix
CVE-2026-21915JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root8.4CNA v4.02.2%2026-04-09Fix
CVE-2026-21904Junos Space: IlpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection5.1CNA v4.00.2%2026-04-09Fix
CVE-2026-21388Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint3.7CNA v3.10.3%2026-04-09Fix
CVE-2026-5988Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow8.7CNA v4.00.9%2026-04-09
CVE-2026-5987Sanluan PublicCMS FreeMarker template handler server-side template injection5.1CNA v4.00.4%2026-04-09
CVE-2026-5986Zod jsVideoUrlParser util.js getTime redos6.9CNA v4.00.6%2026-04-09
CVE-2026-5985code-projects Simple IT Discussion Forum crud.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5984D-Link DIR-605L POST request formSetLog buffer overflow8.7CNA v4.01.2%2026-04-09
CVE-2026-5983D-Link DIR-605L POST request formSetDDNS buffer overflow8.7CNA v4.01.2%2026-04-09
CVE-2026-5982D-Link DIR-605L POST request formAdvNetwork buffer overflow8.7CNA v4.01.2%2026-04-09
CVE-2026-5981D-Link DIR-605L POST request formAdvFirewall buffer overflow8.7CNA v4.01.2%2026-04-09
CVE-2026-5980D-Link DIR-605L POST request formSetMACFilter buffer overflow8.7CNA v4.01.2%2026-04-09
CVE-2026-5979D-Link DIR-605L POST request formVirtualServ buffer overflow8.7CNA v4.01.2%2026-04-09
CVE-2026-5978Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection9.3CNA v4.03.3%2026-04-09
CVE-2026-5977Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection9.3CNA v4.03.3%2026-04-09
CVE-2026-5976Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection9.3CNA v4.03.3%2026-04-09
CVE-2026-5975Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection9.3CNA v4.03.3%2026-04-09
CVE-2026-5974FoundationAgents MetaGPT terminal.py Bash.run os command injection9.8v3.13.5%2026-04-09
CVE-2026-5973FoundationAgents MetaGPT common.py get_mime_type os command injection9.8v3.13.5%2026-04-09
CVE-2026-5972FoundationAgents MetaGPT terminal.py Terminal.run_command os command injection9.8v3.13.5%2026-04-09Fix
CVE-2026-5971FoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injection9.8v3.10.7%2026-04-09
CVE-2026-5970FoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check_solution code injection9.8v3.10.7%2026-04-09
CVE-2026-5962Tenda CH22 httpd R7WebsSecurityHandlerfunction path traversal9.8v3.10.8%2026-04-09
CVE-2026-5961code-projects Simple IT Discussion Forum topic-details.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5960code-projects Patient Record Management System information disclosure5.3CNA v4.00.4%2026-04-09
CVE-2026-5959GL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authentication7.5CNA v4.00.9%2026-04-09Fix
CVE-2026-5854Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection9.3CNA v4.03.3%2026-04-09Emerging Threats
CVE-2026-5853Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection9.3CNA v4.03.3%2026-04-09Emerging Threats
CVE-2026-5852Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection9.3CNA v4.03.3%2026-04-09Emerging Threats
CVE-2026-5851Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection9.3CNA v4.03.3%2026-04-09Emerging Threats
CVE-2026-5850Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection9.3CNA v4.03.3%2026-04-09Emerging Threats
CVE-2026-5849Tenda i12 HTTP path traversal9.8v3.10.8%2026-04-09
CVE-2026-5848jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection5.1CNA v4.00.4%2026-04-09
CVE-2026-5847code-projects Movie Ticketing System SQL Database Backup file moviedb.sql information disclosure5.3CNA v4.00.4%2026-04-09
CVE-2026-5844D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection8.6CNA v4.06.2%2026-04-09
CVE-2026-5842decolua 9router Administrative API endpoint API authorization6.9CNA v4.00.5%2026-04-09Fix
CVE-2026-5841Tenda i3 HTTP R7WebsSecurityHandler path traversal9.8v3.10.8%2026-04-09
CVE-2026-5840PHPGurukul News Portal Project check_availability.php SQL injection5.1CNA v4.00.3%2026-04-09
CVE-2026-5839PHPGurukul News Portal Project add-subcategory.php SQL injection5.1CNA v4.00.3%2026-04-09
CVE-2026-5838PHPGurukul News Portal Project add-subadmins.php SQL injection5.1CNA v4.00.3%2026-04-09
CVE-2026-5837PHPGurukul News Portal Project news-details.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5836code-projects Online Shoe Store admin_product.php cross-site scripting4.8CNA v4.00.4%2026-04-09
CVE-2026-5835code-projects Online Shoe Store admin_football.php cross-site scripting4.8CNA v4.00.4%2026-04-09
CVE-2026-5834code-projects Online Shoe Store admin_running.php cross-site scripting4.8CNA v4.00.4%2026-04-09
CVE-2026-5833awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection4.8CNA v4.01.1%2026-04-09
CVE-2026-5832atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery6.9CNA v4.00.5%2026-04-09
CVE-2026-5831Agions taskflow-ai terminal_execute handlers.ts os command injection5.3CNA v4.01.8%2026-04-09Fix
CVE-2026-5830Tenda AC15 SysToolChangePwd websGetVar stack-based overflow8.7CNA v4.01.0%2026-04-09
CVE-2026-5829code-projects Simple IT Discussion Forum content.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5828code-projects Simple IT Discussion Forum addcomment.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5827code-projects Simple IT Discussion Forum question-function.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5826code-projects Simple IT Discussion Forum edit-category.php cross-site scripting5.3CNA v4.00.4%2026-04-09
CVE-2026-5825code-projects Simple Laundry System delmemberinfo.php cross-site scripting5.3CNA v4.00.4%2026-04-09
CVE-2026-5824code-projects Simple Laundry System userchecklogin.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5823itsourcecode Construction Management System borrowed_tool_report.php SQL injection5.3CNA v4.00.3%2026-04-09
CVE-2026-5815D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflow8.7CNA v4.00.9%2026-04-09
CVE-2026-5814PHPGurukul Online Course Registration check_availability.php SQL injection6.9CNA v4.00.4%2026-04-09
CVE-2026-5778wolfSSL integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path2.1CNA v4.00.4%2026-04-09Fix
CVE-2026-5772wolfSSL MatchDomainName 1-Byte Stack buffer over-read in Hostname Validation2.1CNA v4.00.3%2026-04-09Fix
CVE-2026-5742UsersWP WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-09Fix
CVE-2026-5507wolfSSL Session Cache Restore arbitrary Free via Deserialized Pointer4.1CNA v4.00.2%2026-04-09Fix
CVE-2026-5504wolfSSL PKCS7 CBC Padding Oracle Plaintext Recovery6.3CNA v4.00.1%2026-04-09Fix
CVE-2026-5503wolfSSL out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName6.9CNA v4.00.5%2026-04-09Fix
CVE-2026-5447wolfSSL heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier6.3CNA v4.00.2%2026-04-09Fix
CVE-2026-5446wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse6.0CNA v4.00.3%2026-04-09Fix
CVE-2026-5445Orthanc DICOM Server out-of-bounds read in DicomImageDecoder (DecodeLookupTable)9.1CISA ADP v3.10.8%2026-04-09Fix
CVE-2026-5444Orthanc DICOM Server heap buffer overflow in PAM Image Buffer Allocation7.1CISA ADP v3.10.2%2026-04-09Fix
CVE-2026-5443Heap buffer overflow in DICOM Image Decoder (Palette Color Decode)9.8CISA ADP v3.10.9%2026-04-09Fix
CVE-2026-5442Heap buffer overflow in DICOM Image Decoder via VR UL Dimensions9.8CISA ADP v3.10.9%2026-04-09Fix
CVE-2026-5441Orthanc DICOM Server out-of-bounds read in DicomImageDecoder (PMSCT_RLE1 Decompression)7.1CISA ADP v3.10.2%2026-04-09Fix
CVE-2026-5440Orthanc DICOM Server memory exhaustion via Unbounded Content-Length7.5CISA ADP v3.10.9%2026-04-09Fix
CVE-2026-5439Orthanc DICOM Server memory exhaustion via Forged ZIP Metadata7.5CISA ADP v3.10.8%2026-04-09Fix
CVE-2026-5438Orthanc DICOM Server gzip decompression bomb via Content-Encoding header7.5CISA ADP v3.10.8%2026-04-09Fix
CVE-2026-5437Orthanc DICOM Server out-of-bounds read in DicomStreamReader7.5CISA ADP v3.10.8%2026-04-09Fix
CVE-2026-5357Download Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-09Fix
CVE-2026-5329Rapid7 Velociraptor improper input validation in client message handler8.5CNA v3.10.6%2026-04-09Fix
CVE-2026-5295Stack buffer overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri via Oversized OID5.9CNA v4.00.3%2026-04-09Fix
CVE-2026-5264wolfSSL DTLS 1.3 ACK heap buffer overflow8.3CNA v4.00.6%2026-04-09Fix
CVE-2026-5263wolfSSL URI nameConstraints not enforced in ConfirmNameConstraints7.0CNA v4.00.3%2026-04-09Fix
CVE-2026-5194wolfSSL ECDSA Certificate Verification9.3CNA v4.00.3%2026-04-09Fix
CVE-2026-5187Heap out-of-bounds write in DecodeObjectId in wolfSSL2.3CNA v4.00.5%2026-04-09Fix
CVE-2026-4901Insertion of Sesitive Information into Log file in AlanWeb SCADA6.5v3.10.4%2026-04-09Fix
CVE-2026-4878Libcap: Libcap: Privilege escalation via toctou race condition in cap_set_file7.0NVD v3.10.1%2026-04-09Fix
CVE-2026-4660HashiCorp Tooling go-getter may allow to arbitrary filesystem reads through git operations7.5CNA v3.10.5%2026-04-09Exploit codeFix
CVE-2026-4436GPL Odorizers GPL750 missing authentication for critical function8.6CNA v3.10.5%2026-04-09Fix
CVE-2026-4429OSM WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-09Fix
CVE-2026-4336Ultimate FAQ Accordion WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-09Fix
CVE-2026-4326Vertex Addons for Elementor WordPress plugin missing authorization8.8CNA v3.10.8%2026-04-09Fix
CVE-2026-4124Ziggeo WordPress plugin missing authorization authenticated arbitrary modification5.4CNA v3.10.5%2026-04-09Fix
CVE-2026-4116SonicWall SMA1000 improper Unicode handling7.2CISA ADP v3.10.7%2026-04-09Fix
CVE-2026-4114SonicWall SMA1000 improper Unicode handling6.6CISA ADP v3.10.7%2026-04-09Fix
CVE-2026-4113SonicWall SMA1000 An response discrepancy7.2CISA ADP v3.10.6%2026-04-09Fix
CVE-2026-4112SonicWall SMA1000 SQL command improper neutralization7.2CISA ADP v3.10.5%2026-04-09Exploit codeFix
CVE-2026-3574Experto Dashboard for WooCommerce WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-04-09Fix
CVE-2026-3568MStore API WordPress plugin insecure direct object reference to arbitrary user Meta update4.3CNA v3.10.4%2026-04-09Fix
CVE-2026-3005List category posts WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-09Fix
CVE-2026-2519Bookly tips parameter vulnerability5.3CNA v3.10.5%2026-04-09Fix
CVE-2026-1830Quick Playground WordPress plugin missing authorization to unauthenticated arbitrary file upload9.8CNA v3.18.1%2026-04-09NucleiExploit codeFix
CVE-2026-1584GnuTLS: GnuTLS: Remote denial of service via crafted clienthello with invalid psk binder7.5CNA v3.11.3%2026-04-09Fix
CVE-2026-40037OpenClaw Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects7.1CNA v4.00.5%2026-04-08Fix
CVE-2026-40036Unfurl denial of service via Unbounded zlib Decompression8.7CNA v4.00.8%2026-04-08Fix
CVE-2026-40035Unfurl Werkzeug Debugger Exposure via String Config Parsing9.3CNA v4.00.7%2026-04-08
CVE-2026-40032tclahr uac OS command injection8.5CNA v4.01.2%2026-04-08Fix
CVE-2026-40031MemProcFS DLL/Shared Library Hijacking8.5CNA v4.00.2%2026-04-08Fix
CVE-2026-40030parseusbs command injection via Volume Path argument8.4CNA v4.01.2%2026-04-08Fix
CVE-2026-40029parseusbs command injection via Crafted LNK Filename7.8v3.11.3%2026-04-08Fix
CVE-2026-40028Hayabusa XSS via JSON Log Import5.1CNA v4.00.4%2026-04-08Fix
CVE-2026-40027ALEAPP NQ Vault Artifact parser path traversal8.4CNA v4.00.2%2026-04-08Fix
CVE-2026-40026Sleuth Kit ISO9660 SUSP Extension Reference out-of-bounds read7.1v3.10.2%2026-04-08Fix
CVE-2026-40025Sleuth Kit APFS Keybag parser out-of-bounds read6.1v3.10.2%2026-04-08Fix
CVE-2026-40024Sleuth Kit tsk_recover path traversal7.1v3.10.2%2026-04-08Fix
CVE-2026-39901monetr transaction update endpoint improper authorization5.7CNA v3.10.3%2026-04-08Fix
CVE-2026-39892cryptography has a buffer overflow if non-contiguous buffers were passed to APIs6.9CNA v4.00.8%2026-04-08Fix
CVE-2026-39891PraisonAI has a template injection in agent Tool Definitions8.8CNA v3.10.6%2026-04-08Fix
CVE-2026-39890PraisonAI affected by remote code execution via YAML deserialization in Agent Definition Loading9.8CNA v3.10.8%2026-04-08Fix
CVE-2026-39889PraisonAI has Unauthenticated SSE Event Stream exposes All Agent Activity in A2U Server7.5CNA v3.10.5%2026-04-08Fix
CVE-2026-39888PraisonAIAgents has a sandbox escape10.0CNA v3.10.6%2026-04-08Fix
CVE-2026-39885FrontMCP affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications7.5CNA v3.10.4%2026-04-08Fix
CVE-2026-39883OpenTelemetry-Go BSD kenv command untrusted search path7.3CNA v4.00.2%2026-04-08Fix
CVE-2026-39882OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3CNA v3.10.2%2026-04-08Fix
CVE-2026-39881Vim Ex command injection in Vims NetBeans integration5.0CNA v3.10.8%2026-04-08Fix
CVE-2026-39880Remnawave Backend has a race condition in HWID device limit allows bypassing max devices5.0CNA v3.10.2%2026-04-08Fix
CVE-2026-39865Axios HTTP/2 Session Cleanup State Corruption vulnerability5.9CNA v3.10.8%2026-04-08Fix
CVE-2026-39864Kamailio Auth: Processing vulnerability for Additional Authenticated User Identity Checks4.4CNA v3.10.5%2026-04-08Fix
CVE-2026-39863Kamailio Core: TCP Data Processing vulnerability7.5CNA v3.10.5%2026-04-08Fix
CVE-2026-39862Tophat has a command injection vulnerability when Accessing a Maliciously Crafted Tophat Link6.3CNA v4.01.1%2026-04-08Fix
CVE-2026-39860Nix sandbox escape: File write via symlink at FOD `.tmp` copy destination9.0CNA v3.10.2%2026-04-08Fix
CVE-2026-39859LiquidJS has a renderFile / parseFile bypass configured root and allow arbitrary file read6.3CNA v4.00.5%2026-04-08Fix
CVE-2026-39851Saleor has a user enumeration vulnerability due to different error messages5.3CNA v4.00.4%2026-04-08Fix
CVE-2026-39844NiceGUI has a path traversal in NiceGUI Upload Filename on Windows5.9CNA v3.10.5%2026-04-08Fix
CVE-2026-39716Flipmart WordPress theme broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39715AnyTrack Affiliate Link Manager WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39714G5Plus April WordPress theme broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39713Mailercloud WordPress plugin missing authorization5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39712tagDiv Composer WordPress plugin arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39711RT-Theme 18 Extensions WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39710RT-Theme 18 Extensions WordPress plugin cross-site request forgery (CSRF)5.4CISA ADP v3.10.1%2026-04-08
CVE-2026-39709The Tribal WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39708UiCore Elements WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39707Accept PayPal Payments using Contact Form 7 WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39706Netro Systems Make My Trivia missing authorization5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39705MIPL WC Multisite Sync WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39704Precious Metals Automated Product Pricing Pro WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39703WPBITS Addons For Elementor Page Builder WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08
CVE-2026-39702Animation Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08
CVE-2026-39701ShopWP WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39700WowOptin WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39699AI Workflow Automation WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39698The Publisher Desk ads.txt WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39697MAIO The new AI GEO / SEO tool WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39696Elfsight WhatsApp Chat CC WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08
CVE-2026-39695Podigee WordPress plugin server side request forgery (SSRF)5.4CISA ADP v3.10.2%2026-04-08
CVE-2026-39694Simply Schedule Appointments WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39693FSM Custom Featured Image Caption WordPress plugin cross-site scripting (XSS)5.9CISA ADP v3.10.2%2026-04-08
CVE-2026-39692tagDiv Composer WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39691Cryptocurrency Donation Box Bitcoin and Crypto Donations WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39690Author Avatars List/Block WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39689eShipper Commerce WordPress plugin broken access control5.3CNA v3.10.4%2026-04-08Fix
CVE-2026-39688WP Frontend Profile WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39687Rapid Car Check Vehicle Data WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39686BSK PDF Manager WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-04-08Fix
CVE-2026-39685The Moneytizer WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39684OrganicFood WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08
CVE-2026-39683Garden Gnome Package WordPress plugin cross-site scripting (XSS)5.9CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39682linkPizza-Manager WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39681Homeo WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08
CVE-2026-39680Diet Calorie Calculator WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39679Freeio WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08
CVE-2026-39678Pinpoint Booking System WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39677Emphires WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08
CVE-2026-39676Download Manager WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Exploit codeFix
CVE-2026-39675Court Reservation WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39674MK Google Directions WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08
CVE-2026-39673iZooto WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39672ShipTime: Discounted Shipping Rates WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39671Extra Fees Plugin for WooCommerce WordPress plugin cross-site request forgery (CSRF)7.1CISA ADP v3.10.1%2026-04-08Fix
CVE-2026-39670Visual Link Preview WordPress plugin server side request forgery (SSRF)6.0CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39669NitroPack WordPress plugin broken access control5.3CNA v3.10.3%2026-04-08Fix
CVE-2026-39668Book Previewer for Woocommerce WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39667Korea SNS WordPress plugin cross-site scripting (XSS)5.9CISA ADP v3.10.2%2026-04-08
CVE-2026-39666Hello Bar Popup Builder WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39665SEO Friendly Images WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08
CVE-2026-39664Leadrebel WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39663TrueBooker WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39662Product Price by Formula for WooCommerce WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39658Panda Pods Repeater Field WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39657leadlovers forms WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39656Razorpay for WooCommerce WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39654WP Simple HTML Sitemap WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-04-08Fix
CVE-2026-39653Video Conferencing with Zoom WordPress plugin broken access control4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39652iGMS Direct Booking WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39651Total Poll Lite WordPress plugin broken access control6.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39650UnitechPay WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39649Royale News WordPress theme broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39648Cream Blog WordPress theme broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39647MP3 Audio Player for Music, Radio and Podcast by Sonaar WordPress plugin server side request forgery5.4CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39646Leaflet Map WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39645GlobalPayments WooCommerce WordPress plugin server side request forgery (SSRF)5.4CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39644Wp Ultimate Review WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39643Payment Plugins for PayPal WooCommerce WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39641Blackfyre WordPress theme cross-site request forgery (CSRF)6.5CISA ADP v3.10.2%2026-04-08
CVE-2026-39640Theme Editor WordPress plugin cross-site request forgery (CSRF) to remote code execution9.6CISA ADP v3.10.2%2026-04-08
CVE-2026-39639RPS Include Content WordPress plugin broken access control6.5CISA ADP v3.10.3%2026-04-08
CVE-2026-39638Qubely WordPress plugin cross-site scripting (XSS)5.9CISA ADP v3.10.2%2026-04-08
CVE-2026-39637Mogi WordPress theme arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39636Livemesh Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Exploit code
CVE-2026-39635Grand Magazine WordPress theme cross-site request forgery (CSRF)5.4CISA ADP v3.10.1%2026-04-08
CVE-2026-39634Grand Portfolio WordPress theme cross-site request forgery (CSRF)5.4CISA ADP v3.10.1%2026-04-08
CVE-2026-39633Grand Car Rental WordPress theme cross-site request forgery (CSRF)6.5CISA ADP v3.10.1%2026-04-08
CVE-2026-39632Grand Blog WordPress theme cross-site request forgery (CSRF)6.5CISA ADP v3.10.2%2026-04-08
CVE-2026-39631WPSchoolPress WordPress plugin broken access control4.9CISA ADP v3.10.4%2026-04-08
CVE-2026-39630Getty Images WordPress plugin server side request forgery (SSRF)6.4CISA ADP v3.10.2%2026-04-08
CVE-2026-39629Uminex WordPress theme arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39628DukaMarket WordPress theme arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39627Ashe WordPress theme broken access control4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39626Armania WordPress theme arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39625TechOne WordPress theme arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39624Biolife WordPress theme arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39623Biolife WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08
CVE-2026-39622Education Base WordPress theme broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39621SpicePress WordPress theme CSRF to arbitrary plugin installation8.8CISA ADP v3.10.2%2026-04-08
CVE-2026-39620Appointment WordPress theme cross-site request forgery (CSRF) to arbitrary file upload9.6CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39619Busiprof WordPress theme cross-site request forgery (CSRF) to arbitrary file upload9.6CISA ADP v3.10.2%2026-04-08
CVE-2026-39618NewsExo WordPress theme cross-site request forgery (CSRF)4.3CISA ADP v3.10.1%2026-04-08
CVE-2026-39617Bluestreet WordPress theme cross-site request forgery (CSRF) to arbitrary plugin installation9.6CISA ADP v3.10.2%2026-04-08
CVE-2026-39616Download Attachments WordPress plugin insecure direct object references (IDOR)5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39615Download Manager WordPress plugin cross-site scripting (XSS)5.9CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39614JW Player for WordPress plugin broken access control5.4CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39613Boutique WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08
CVE-2026-39612KuteShop WordPress theme arbitrary shortcode execution vulnerability5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39611KuteShop WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08
CVE-2026-39610WpXmas-Snow WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39609Wava Payment WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39608iPOSpays Gateways WC WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39607Filter Plus WordPress plugin broken access control5.4CISA ADP v3.10.2%2026-04-08
CVE-2026-39606BizReview WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39605Super Custom Login WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08
CVE-2026-39604MyBookTable Bookstore WordPress plugin cross-site scripting (XSS)5.9CISA ADP v3.10.2%2026-04-08
CVE-2026-39603Grand Photography WordPress theme cross-site request forgery (CSRF)5.4CISA ADP v3.10.1%2026-04-08
CVE-2026-39602Order Tracking WordPress plugin broken access control5.3CNA v3.10.3%2026-04-08
CVE-2026-39592DEPART WordPress plugin broken access control4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39588NM Gift Registry and Wishlist Lite WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39586RepairBuddy WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39585Booktics WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39575Custom Query Blocks WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39572Bus Ticket Booking with Seat Reservation WordPress plugin sensitive data exposure4.0CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39571Instantio WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-3957012 Step Meeting List WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-3956912 Step Meeting List WordPress plugin broken access control6.5CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39566DirectoryPress WordPress plugin sensitive data exposure4.0CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39565WpTravelly WordPress plugin broken access control4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39564Sunshine Photo Cart WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39563Share This Image WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39562Client Invoicing by Sprout Invoices WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39561Revive.so WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39544LabtechCO WordPress theme local file inclusion7.5CISA ADP v3.10.5%2026-04-08Fix
CVE-2026-39543Tourfic WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39542Doofinder for WooCommerce WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39541Hydra Booking WordPress plugin cross-site scripting (XSS)5.9CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39538Mikado Core WordPress plugin local file inclusion7.5CISA ADP v3.10.5%2026-04-08Fix
CVE-2026-39536RSVP and Event Management WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39535Display Eventbrite Events WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39528WP Delicious WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39526WpStream WordPress plugin insecure direct object references (IDOR)5.4CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39521Nelio Content WordPress plugin server side request forgery (SSRF)4.9CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39520weDocs WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39517Blog Filter WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39516Nexter Blocks WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39510Image Photo Gallery Final Tiles Grid WordPress plugin insecure direct object references (IDOR)2.7CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39509Directorist WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39508Advanced Coupons for WooCommerce Coupons WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39506AI Engine (Pro) WordPress plugin broken access control4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39505Seriously Simple Podcasting WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39504InstaWP Connect WordPress plugin broken access control5.4CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39501FOX WordPress plugin broken access control5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39500Themesflat Addons For Elementor stored cross-site scripting6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39497FOX WordPress plugin SQL injection7.6CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39496YayMail WordPress plugin SQL injection7.6CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39495Simply Schedule Appointments WordPress plugin SQL injection8.5CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39488SureCart WordPress plugin broken access control6.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39487Amelia WordPress plugin SQL injection7.6CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39486Download Monitor WordPress plugin SQL injection7.6CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39485Youtube Embed Plus WordPress plugin broken access control4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39484Hide My WP Ghost WordPress plugin open redirection4.7CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39483VK All in One Expansion Unit WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39482Post Expirator WordPress plugin cross-site scripting (XSS)6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39479OttoKit WordPress plugin SQL injection7.6CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39477CartFlows WordPress plugin broken access control4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39476User Feedback WordPress plugin broken access control4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39475User Feedback WordPress plugin SQL injection8.5CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39473Simple History WordPress plugin sensitive data exposure5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39469PageLayer WordPress plugin sensitive data exposure4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-39466Broken Link Checker WordPress plugin SQL injection7.6CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-39464SeedProd Coming Soon Page, Under Construction and Maintenance Mode server-side request forgery5.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-39429Kcp's cache server is accessible without authentication or authorization checks8.2CNA v3.10.5%2026-04-08Fix
CVE-2026-39416Stored XSS in modal item preview for long item content in AIL Framework8.5CNA v4.00.3%2026-04-08Fix
CVE-2026-39415Frappe Learning Management System has Client-Side Manipulation of Quiz Scores5.3CNA v4.00.3%2026-04-08Fix
CVE-2026-39414MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing7.1CNA v4.00.6%2026-04-08Fix
CVE-2026-39413LightRAG has a JWT Algorithm Confusion vulnerability in LightRAG API4.2CNA v3.10.2%2026-04-08Fix
CVE-2026-39412LiquidJS sort_natural filter information disclosure5.3CNA v3.10.5%2026-04-08Fix
CVE-2026-39411LobeHub has an unauthenticated authentication bypass on `webapi` routes5.0CNA v3.10.2%2026-04-08Fix
CVE-2026-39410Hono has a non-breaking space prefix bypass in cookie name handling in getCookie4.8CNA v3.10.3%2026-04-08Fix
CVE-2026-39409Hono has incorrect IP matching in ipRestriction for IPv4-mapped IPv6 addresses6.3CNA v4.00.4%2026-04-08Fix
CVE-2026-39408Hono has a path traversal in toSSG allows writing files outside the output directory5.9CNA v4.00.5%2026-04-08Fix
CVE-2026-39407Hono has a middleware bypass via repeated slashes in serveStatic5.3CNA v3.10.5%2026-04-08Fix
CVE-2026-39406@Hono/node-server has a middleware bypass via repeated slashes in serveStatic5.3CNA v3.10.4%2026-04-08Fix
CVE-2026-39394CI4MS has an .env CRLF injection via Unvalidated `host` parameter in Install controller8.1CNA v3.10.5%2026-04-08Fix
CVE-2026-39393Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms8.1CNA v3.10.4%2026-04-08Fix
CVE-2026-39392CI4MS has stored XSS in Pages Content due to Missing html_purify Sanitization5.5CNA v3.10.3%2026-04-08Fix
CVE-2026-39391CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List4.8CNA v3.10.3%2026-04-08Fix
CVE-2026-39390CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting5.5CNA v3.10.2%2026-04-08Fix
CVE-2026-39389CI4MS file editor improper authorization6.7CNA v3.10.5%2026-04-08Fix
CVE-2026-39362InvenTree has SSRF via Remote Image Download no IP/Hostname Validation on remote_image URLs5.3CNA v4.00.3%2026-04-08Fix
CVE-2026-35525LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates8.2CNA v4.00.5%2026-04-08Fix
CVE-2026-35479InvenTree Plugin Installation insufficient permissions6.6CNA v3.10.4%2026-04-08Fix
CVE-2026-35478InvenTree has arbitrary API Token Creation8.3CNA v3.10.4%2026-04-08Fix
CVE-2026-35477InvenTree PART_NAME_FORMAT template renderer server-side template injection5.5CNA v3.10.4%2026-04-08Fix
CVE-2026-35476InvenTree affected by privilege escalation via API7.2CNA v3.10.2%2026-04-08Fix
CVE-2026-35455immich has stored XSS via OCR Text in 360° Panorama Viewer7.3CNA v3.10.3%2026-04-08Exploit codeFix
CVE-2026-35446Loris has a path traversal in FilesDownloadHandler7.7CNA v3.10.4%2026-04-08Fix
CVE-2026-35407Saleor has Cross-Account Email Change via Unbound Confirmation Token5.9CNA v4.00.4%2026-04-08Fix
CVE-2026-35403Loris has potential cross-site scripting in survey_accounts module6.5CNA v3.10.2%2026-04-08Fix
CVE-2026-35401Saleor has a resource exhaustion vulnerability in GraphQL queries7.5CNA v3.10.5%2026-04-08Fix
CVE-2026-35400Loris incorrectly trusts user input in publication module3.5CNA v3.10.3%2026-04-08Fix
CVE-2026-35169Loris has potential cross-site scripting in help_editor module8.7CNA v3.10.3%2026-04-08Fix
CVE-2026-35165Loris has incorrect access checks in document_repository6.3CNA v3.10.3%2026-04-08Fix
CVE-2026-35023Wimi Teamwork On-Premises IDOR via preview.php5.3CNA v4.00.3%2026-04-08Fix
CVE-2026-34985Loris has incorrect access checks in media module6.3CNA v3.10.3%2026-04-08Fix
CVE-2026-34837Zammad is miissing authorization in AI assistance controller for context data used in text tools5.3CNA v4.00.3%2026-04-08Fix
CVE-2026-34782Zammad has improper access control in AI assistance controller for text tools5.3CNA v4.00.3%2026-04-08Fix
CVE-2026-34724Zammad has a server-side template injection leading to RCE via AI agent8.7CNA v4.00.5%2026-04-08Fix
CVE-2026-34723Zammad has incorrect access control in getting_started_controller8.7CNA v4.00.5%2026-04-08Fix
CVE-2026-34722Zammad ticket creation endpoint missing authorization6.9CNA v4.00.3%2026-04-08Fix
CVE-2026-34721Zammad has cross-site request forgery (CSRF) in OAuth callback endpoints5.9CNA v4.00.1%2026-04-08Fix
CVE-2026-34720Zammad has an origin validation error in SSO mechanism2.3CNA v4.00.1%2026-04-08Fix
CVE-2026-34719Zammad has a server-side request forgery (SSRF) via webhooks8.3CNA v4.00.3%2026-04-08Fix
CVE-2026-34718Zammad ticket article HTML sanitizer cross-site scripting5.3CNA v4.00.3%2026-04-08Fix
CVE-2026-34392Loris has a path traversal in static router7.5CNA v3.10.4%2026-04-08Fix
CVE-2026-34248Zammad ticket detail view information disclosure2.1CNA v4.00.3%2026-04-08Fix
CVE-2026-34166LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter3.7CNA v3.10.6%2026-04-08Fix
CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x5098.2v3.10.3%2026-04-08Fix
CVE-2026-33756Saleor affected by denial of service via Unbounded GraphQL Query Batching7.5CNA v3.10.8%2026-04-08Fix
CVE-2026-33753Improper certificate validation in rfc3161-client6.2CNA v3.10.2%2026-04-08Fix
CVE-2026-33466Elastic Logstash path traversal8.1CNA v3.10.8%2026-04-08Fix
CVE-2026-33461Incorrect authorization in Kibana Fleet leading to information disclosure7.7CNA v3.10.5%2026-04-08Fix
CVE-2026-33460Incorrect authorization in Kibana Fleet leading to information disclosure4.3CNA v3.10.3%2026-04-08Fix
CVE-2026-33459Uncontrolled resource consumption in Kibana leading to denial of service6.5CNA v3.10.5%2026-04-08Fix
CVE-2026-33458Server-side request forgery (SSRF) in Kibana One Workflow leading to information disclosure6.8CNA v3.10.4%2026-04-08Fix
CVE-2026-33350Loris has a SQL injection in MRI feedback popup7.5CNA v3.10.4%2026-04-08Fix
CVE-2026-33273ICZ MATCHA INVOICE unrestricted file upload7.2v3.10.4%2026-04-08Fix
CVE-2026-33229XWiki Platform affected by remote code execution with script right8.6CNA v4.01.2%2026-04-08Fix
CVE-2026-33088Six Apart Movable Type SQL injection9.8v3.10.5%2026-04-08Fix
CVE-2026-32591Mirror-registry: Quay: Server-side request forgery in proxy cache upstream registry configuration5.2CNA v3.10.5%2026-04-08Fix
CVE-2026-32590Red Hat mirror registry for Red Hat OpenShift mirror-registry: Remote code execution7.1CNA v3.10.8%2026-04-08Fix
CVE-2026-32589Mirror-registry: Quay: Insecure direct object reference in blobupload7.4CNA v3.10.4%2026-04-08Fix
CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/template6.1v3.10.3%2026-04-08Fix
CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tar5.5v3.10.3%2026-04-08Fix
CVE-2026-32283Go standard library crypto/tls package deadlock7.5v3.10.7%2026-04-08Fix
CVE-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix6.4v3.10.3%2026-04-08Fix
CVE-2026-32281Inefficient policy validation in crypto/x5097.5v3.10.4%2026-04-08Fix
CVE-2026-32280Unexpected work during chain building in crypto/x5097.5CISA ADP v3.10.6%2026-04-08Fix
CVE-2026-31411Linux kernel ATM signaling daemon interface null pointer dereference5.5NVD v3.10.1%2026-04-08Fix
CVE-2026-31040stata-mcp code injection9.8CISA ADP v3.11.1%2026-04-08Fix
CVE-2026-31017frappe erpnext Print Format functionality server-side request forgery9.1v3.10.2%2026-04-08
CVE-2026-30818OS command injection vulnerability in dnsmasq module in TP-Link AX538.5CNA v4.01.8%2026-04-08Fix
CVE-2026-30817Arbitrary file reading vulnerability in dnsmasq module in TP-Link AX536.8CNA v4.00.4%2026-04-08Fix
CVE-2026-30816Arbitrary file reading vulnerability in OpenVPN module in TP-Link AX536.8CNA v4.00.4%2026-04-08Fix
CVE-2026-30815OS command injection vulnerability in OpenVPN module in TP-Link AX538.5CNA v4.02.2%2026-04-08Fix
CVE-2026-30814Buffer overflow vulnerability in TP-Link AX537.3CNA v4.00.6%2026-04-08Fix
CVE-2026-30080Openairinterface Oai-cn5g-amf authentication bypass by replay7.5CISA ADP v3.10.3%2026-04-08
CVE-2026-30075Openairinterface Oai-cn5g-amf buffer overflow7.5CISA ADP v3.10.7%2026-04-08
CVE-2026-28264Dell PowerProtect Agent incorrect permission assignment3.3CNA v3.10.1%2026-04-08Fix
CVE-2026-28261Dell Elastic Cloud Storage sensitive information in log files7.8CNA v3.10.2%2026-04-08Fix
CVE-2026-27806Fleet affected by local privilege escalation via Tcl command injection in Orbit7.8CNA v3.10.1%2026-04-08Fix
CVE-2026-27787ICZ MATCHA SNS cross-site scripting5.1CNA v4.00.2%2026-04-08Fix
CVE-2026-27144Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile7.1v3.10.3%2026-04-08Fix
CVE-2026-27143Missing bound checks can lead to memory corruption in safe Go in cmd/compile9.8v3.10.5%2026-04-08Fix
CVE-2026-27140Code execution vulnerability in SWIG code generation in cmd/go8.8NVD v3.10.7%2026-04-08Fix
CVE-2026-27102Dell PowerScale OneFS incorrect privilege assignment6.6CNA v3.10.1%2026-04-08Fix
CVE-2026-25776Six Apart Movable Type code injection9.3CNA v4.01.0%2026-04-08Fix
CVE-2026-24913ICZ MATCHA INVOICE SQL injection8.7CNA v4.00.3%2026-04-08Fix
CVE-2026-24511Dell PowerScale OneFS information disclosure through error messages4.4CNA v3.10.2%2026-04-08Fix
CVE-2026-23869Meta react-server-dom-turbopack react Server components have a denial of service7.5CNA v3.11.6%2026-04-08Exploit codeFix
CVE-2026-20709Intel(R) Pentium(R) Processor Silver Series privilege escalation5.8CNA v4.00.1%2026-04-08
CVE-2026-5919Google Chrome improper input validation6.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5918Google Chrome Navigation inappropriate implementation4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5915Google Chrome improper input validation8.1CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5914Google Chrome CSS type confusion8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5913Google Chrome Blink out-of-bounds read8.1CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5912Google Chrome WebRTC integer overflow8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5911Google Chrome protection mechanism failure4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5910Google Chrome Media integer overflow8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5909Google Chrome Media integer overflow8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5908Google Chrome Media integer overflow8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5907Google Chrome Media improper input validation8.1CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5906Google Chrome Omnibox incorrect security UI4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5905Google Chrome Permissions incorrect security UI6.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5903Google Chrome protection mechanism failure6.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5902Google Chrome race condition9.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5901Google Chrome DevTools insufficient policy enforcement6.5CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5900Google Chrome protection mechanism failure4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5899Google Chrome History Navigation insufficient policy enforcement6.1CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5898Google Chrome Omnibox incorrect security UI4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5897Google Chrome Downloads incorrect security UI4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5896Google Chrome protection mechanism failure6.1CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5895Google Chrome Omnibox incorrect security UI5.4CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5894Google Chrome PDF inappropriate implementation4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5893Google Chrome race condition6.8CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5892Google Chrome PWAs insufficient policy enforcement6.6CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5891Google Chrome browser UI insufficient policy enforcement4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5890Google Chrome race condition5.3NVD v3.10.2%2026-04-08Fix
CVE-2026-5889Google Chrome inadequate encryption strength4.3CISA ADP v3.10.1%2026-04-08Fix
CVE-2026-5888Google Chrome uninitialized variable use6.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5887Google Chrome improper input validation4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5886Google Chrome WebAudio out-of-bounds read5.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5885Google Chrome improper input validation6.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5884Google Chrome arbitrary code execution8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5883Google Chrome Media use-after-free8.8v3.10.4%2026-04-08Fix
CVE-2026-5882Google Chrome Fullscreen incorrect security UI4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5881Google Chrome improper access control6.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5880Google Chrome browser UI insufficient policy enforcement4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5879Google Chrome arbitrary code execution8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5878Google Chrome Blink incorrect security UI4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5877Google Chrome Navigation use-after-free8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5876Google Chrome Navigation side-channel information leak6.5CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5875Google Chrome insecure direct object reference4.3CISA ADP v3.10.2%2026-04-08Fix
CVE-2026-5874Google Chrome PrivateAI use-after-free9.6CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5873Google Chrome V8 out-of-bounds read8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5872Google Chrome Blink use-after-free8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5871Google Chrome V8 type confusion8.8CISA ADP v3.10.5%2026-04-08Fix
CVE-2026-5870Google Chrome Skia integer overflow8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5869Google Chrome WebML heap-based buffer overflow4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5868Google Chrome ANGLE heap-based buffer overflow8.8CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5867Google Chrome WebML heap-based buffer overflow4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5866Google Chrome Media use-after-free8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5865Google Chrome V8 type confusion8.8CISA ADP v3.10.5%2026-04-08Exploit codeFix
CVE-2026-5864Google Chrome WebAudio heap-based buffer overflow4.3CISA ADP v3.10.3%2026-04-08Fix
CVE-2026-5863Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5862Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5861Google Chrome V8 use-after-free8.8CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-5860Google Chrome WebRTC use-after-free8.8CISA ADP v3.10.5%2026-04-08Fix
CVE-2026-5859Google Chrome WebML integer overflow8.8CISA ADP v3.10.3%2026-04-08Fix