CVE-2026 list

CVE-2026 records published in April 2026

Page five of six: records 4,001 to 5,000 of the 5,323 published in April 2026, newest first. The first page carries the figures for April 2026.

CVE-2026 records published in April 2026, newest first: records 4,001 to 5,000 of 5,323
CVE Summary CVSS EPSS Published Signals
CVE-2026-5858Google Chrome WebML heap-based buffer overflow8.8CISA ADP v3.10.6%2026-04-08Fix
CVE-2026-5813PHPGurukul Online Course Registration check_availability.php SQL injection6.9CNA v4.00.4%2026-04-08
CVE-2026-5812SourceCodester Pharmacy Product Management System POST parameter add-sales.php logic error5.3CNA v4.00.4%2026-04-08
CVE-2026-5811SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error5.3CNA v4.00.4%2026-04-08
CVE-2026-5810SourceCodester Sales and Inventory System GET parameter delete.php cross-site scripting5.1CNA v4.00.3%2026-04-08
CVE-2026-5808openstatusHQ openstatus Onboarding endpoint client.tsx cross-site scripting5.3CNA v4.00.5%2026-04-08
CVE-2026-5806code-projects Easy Blog Site update.php cross-site scripting5.1CNA v4.00.3%2026-04-08
CVE-2026-5805code-projects Easy Blog Site contact_us.php SQL injection6.9CNA v4.00.4%2026-04-08
CVE-2026-5803bigsk1 openai-realtime-ui API Proxy endpoint server.js server-side request forgery5.3CNA v4.00.4%2026-04-08
CVE-2026-5802idachev mcp-javadc HTTP os command injection6.9CNA v4.02.1%2026-04-08
CVE-2026-5795Eclipse Jetty sensitive information not cleared before reuse7.4CNA v3.10.6%2026-04-08Fix
CVE-2026-5747Out-of-bounds write in Firecracker virtio-pci Transport8.7CNA v4.00.2%2026-04-08Fix
CVE-2026-5726ASDA-Soft stack-based buffer overflow7.8CNA v3.10.2%2026-04-08Fix
CVE-2026-5711Post Blocks and Tools WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-5600pretix improper isolation5.5CNA v4.00.3%2026-04-08Fix
CVE-2026-5508WowPress WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08
CVE-2026-5506Wavr WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08
CVE-2026-5451Extensions for Leaflet Map WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-5436MW WP Form WordPress plugin unauthenticated arbitrary file Move via regenerate_upload_file_keys8.1CNA v3.10.9%2026-04-08Fix
CVE-2026-5302Permissive cross-domain policy with Untrusted Domains in coolercontrold6.3CNA v3.10.4%2026-04-08Fix
CVE-2026-5301Improper neutralization of input during web page generation in coolercontrol-ui7.6CNA v3.10.4%2026-04-08Fix
CVE-2026-5300Missing authentication for critical function in coolercontrold5.9CNA v3.10.3%2026-04-08Fix
CVE-2026-5208Improper neutralization of special elements used in an OS command in coolercontrold8.2CNA v3.11.5%2026-04-08Fix
CVE-2026-5173Exposed dangerous method or function in GitLab8.5CNA v3.10.4%2026-04-08Exploit codeFix
CVE-2026-5169Inquiry form to posts or pages WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-04-08
CVE-2026-5167Masteriyo LMS WordPress plugin unauthenticated authorization bypass to arbitrary order Completion5.3CNA v3.10.5%2026-04-08Fix
CVE-2026-5083Ado::Sessions versions for Perl generates insecure session ids5.3CISA ADP v3.10.5%2026-04-08
CVE-2026-5082Amon2::Plugin::Web::CSRFDefender versions from for Perl generate an insecure session id5.3CISA ADP v3.10.5%2026-04-08Fix
CVE-2026-4916Missing authorization in GitLab2.7CNA v3.10.4%2026-04-08Fix
CVE-2026-4871Sports Club Management WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08
CVE-2026-4837Eval injection in Rapid7 Insight Agent6.6CNA v3.10.7%2026-04-08Fix
CVE-2026-4808Gerador de Certificados DevApps WordPress plugin arbitrary file upload7.2CNA v3.10.8%2026-04-08
CVE-2026-4788IBM Tivoli Netcool Impact log files information disclosure8.4CNA v3.10.2%2026-04-08Fix
CVE-2026-4785LatePoint WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-4655Element Pack Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-08Fix
CVE-2026-4654Awesome Support WordPress plugin insecure direct object reference5.3CNA v3.10.4%2026-04-08Fix
CVE-2026-4498Elastic Kibana execution with unnecessary privileges7.7CNA v3.10.5%2026-04-08Fix
CVE-2026-4483Moxa MxGeneralIo exposed IOCTL without access control7.0CNA v4.00.4%2026-04-08Fix
CVE-2026-4406Gravity Forms WordPress plugin reflected cross-site scripting via form_ids parameter4.7CNA v3.10.4%2026-04-08Exploit codeFix
CVE-2026-4401Download Monitor WordPress plugin cross-site request forgery to download path deletion and Disabling5.4CNA v3.10.2%2026-04-08Fix
CVE-2026-4394Gravity Forms WordPress plugin unauthenticated stored cross-site scripting6.1CNA v3.10.4%2026-04-08Fix
CVE-2026-4379LightPress Lightbox WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-4341Prime Slider WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-4338ActivityPub Routing WordPress plugin unauthenticated Drafts/Scheduled/Pending posts disclosure7.5CISA ADP v3.10.4%2026-04-08Fix
CVE-2026-4333LearnPress WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-4332Improper neutralization of input during web page generation (cross-site scripting) in GitLab5.4CNA v3.10.3%2026-04-08Fix
CVE-2026-4330Blog2Social: Social Media Auto Post and Scheduler WordPress plugin insecure direct object reference4.3CNA v3.10.5%2026-04-08Fix
CVE-2026-4303WP Visitor Statistics (Real Time Traffic) WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-08Fix
CVE-2026-4300Robo Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.5%2026-04-08Fix
CVE-2026-4299MainWP Child Reports WordPress plugin missing authorization authenticated information disclosure5.3CNA v3.10.4%2026-04-08Fix
CVE-2026-4141Quran Translations WordPress plugin cross-site request forgery to Playlist settings form4.3CNA v3.10.2%2026-04-08
CVE-2026-4073pdfl.io WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-4025PrivateContent Free WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-08Fix
CVE-2026-4003Users manager PN WordPress plugin unauthenticated privilege escalation9.8CNA v3.11.3%2026-04-08Fix
CVE-2026-3781Attendance Manager WordPress plugin SQL injection5.4CNA v3.10.3%2026-04-08
CVE-2026-3646LTL Freight Quotes WordPress plugin missing authorization5.3CNA v3.10.7%2026-04-08Fix
CVE-2026-3618Columns by BestWebSoft WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-08
CVE-2026-3600Investi WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-3594Riaxe Product Customizer WordPress plugin unauthenticated sensitive information disclosure5.3CNA v3.10.6%2026-04-08
CVE-2026-3535DSGVO Google Web Fonts GDPR WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.11.3%2026-04-08
CVE-2026-3513TableOn WordPress Posts Table Filterable plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-3499Product Feed PRO for WooCommerce by AdTribes WordPress plugin cross-site request forgery8.8CNA v3.10.2%2026-04-08Fix
CVE-2026-3480WP Blockade WordPress plugin missing authorization authenticated arbitrary shortcode execution6.5CNA v3.10.5%2026-04-08
CVE-2026-3477PZ Frontend Manager WordPress plugin missing authorization arbitrary user deletion5.3CNA v3.10.4%2026-04-08
CVE-2026-3438Nexus Repository 3 reflected cross-site scripting (XSS) in ?describe pages5.1CNA v4.00.6%2026-04-08Fix
CVE-2026-3396WCAPF WooCommerce Ajax Product Filter WordPress plugin unauthenticated time-based SQL injection7.5CNA v3.11.7%2026-04-08NucleiFix
CVE-2026-3357IBM Langflow Desktop FAISS Vector Store remote code execution via malicious Pickle file8.8CNA v3.10.7%2026-04-08Fix
CVE-2026-3311The Plus Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-3296Everest Forms WordPress plugin unauthenticated PHP object injection via form Entry Metadata9.8CNA v3.13.0%2026-04-08NucleiExploit codeFix
CVE-2026-3243Advanced Members for ACF WordPress plugin arbitrary file deletion8.8CNA v3.11.1%2026-04-08Fix
CVE-2026-3239Strong Testimonials WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-3199Nexus Repository 3 authenticated remote code execution via Task Property injection9.4CNA v4.00.8%2026-04-08Fix
CVE-2026-3142Pinterest Site Verification plugin using Meta Tag WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-08
CVE-2026-2988Blubrry PowerPress WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-2942ProSolution WP Client WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.11.1%2026-04-08Fix
CVE-2026-2838Whole Enquiry Cart for WooCommerce WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-04-08
CVE-2026-2619Incorrect authorization in GitLab4.3CNA v3.10.4%2026-04-08Fix
CVE-2026-2509Page Builder: Pagelayer WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-2481Beaver Builder Page Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-08Fix
CVE-2026-2377Mirror-registry: Quay: Quay: Server-side request forgery via log export functionality6.5CNA v3.10.4%2026-04-08Fix
CVE-2026-2263Hustle WordPress plugin unauthorized access5.3CNA v3.10.4%2026-04-08Fix
CVE-2026-2104Authorization bypass through user-controlled key in GitLab4.3CNA v3.10.3%2026-04-08Fix
CVE-2026-1865User Registration and Membership WordPress plugin SQL injection6.5CNA v3.10.3%2026-04-08Fix
CVE-2026-1752Incorrect authorization in GitLab4.3CNA v3.10.3%2026-04-08Fix
CVE-2026-1673BEAR WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-04-08Fix
CVE-2026-1672BEAR WordPress plugin cross-site request forgery6.5CNA v3.10.2%2026-04-08Fix
CVE-2026-1516Improper control of generation of code (code injection) in GitLab5.7CNA v3.10.4%2026-04-08Fix
CVE-2026-1396Magic Conversation For Gravity Forms WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-08Fix
CVE-2026-1346IBM Verify Identity Access privilege escalation9.3CNA v3.10.2%2026-04-08KCVFix
CVE-2026-1343IBM Verify Identity Access reverse proxy server-side request forgery7.2CNA v3.10.2%2026-04-08Fix
CVE-2026-1342IBM Verify Identity Access inclusion of untrusted functionality8.5CNA v3.10.2%2026-04-08KCVFix
CVE-2026-1163Insufficient session expiration in parisneo/lollms4.1CNA v3.00.2%2026-04-08
CVE-2026-1101Improper validation of specified quantity in input in GitLab6.5CNA v3.10.4%2026-04-08Fix
CVE-2026-1092Improper validation of specified quantity in input in GitLab7.5CNA v3.10.6%2026-04-08Fix
CVE-2026-0814Advanced CF7 DB WordPress plugin missing authorization authenticated form Submissions Excel export4.3CNA v3.10.3%2026-04-08Fix
CVE-2026-0811Advanced CF7 DB WordPress plugin cross-site request forgery to form Entry deletion5.4CNA v3.10.1%2026-04-08Fix
CVE-2026-39937The Wikimedia Foundation Mediawiki global vanishing does not completely remove user email8.8CNA v4.00.4%2026-04-07Fix
CVE-2026-39936Wikimedia Foundation MediaWiki Score extension stored cross-site scripting6.9CNA v4.00.5%2026-04-07Fix
CVE-2026-39935The Wikimedia Foundation Mediawiki XSS-via-i18n in localised wiki names6.9CNA v4.00.5%2026-04-07Fix
CVE-2026-39934The Wikimedia Foundation Mediawiki growth Experiments ReassignMenteesJob runs as an infinite loop6.9CNA v4.00.4%2026-04-07Fix
CVE-2026-39933The Wikimedia Foundation Mediawiki multiple XSS vulnerabilities in GlobalWatchlist6.9CNA v4.00.5%2026-04-07Fix
CVE-2026-39847Emmett has a path traversal in internal assets handler9.1CNA v3.10.6%2026-04-07Fix
CVE-2026-39846SiYuan affected by remote code execution in the Electron desktop client9.1CNA v3.10.7%2026-04-07Fix
CVE-2026-39841Stored XSS through list fields on Cargo's page values and Special:CargoTables6.3CNA v4.00.2%2026-04-07Fix
CVE-2026-39840CSS injection in multiple Cargo display formats5.1CNA v4.00.2%2026-04-07Fix
CVE-2026-39839Stored XSS through URLs in Cargo's map format6.3CNA v4.00.3%2026-04-07Fix
CVE-2026-39838Wikimedia Foundation MediaWiki ProofreadPage extension cross-site scripting6.9CNA v4.00.5%2026-04-07Fix
CVE-2026-39837Stored XSS through the dynamic table format in Cargo6.3CNA v4.00.2%2026-04-07Fix
CVE-2026-39401Privilege escalation via update_event Job Output in Cronicle5.3CNA v4.00.3%2026-04-07Fix
CVE-2026-39400Stored XSS via Job HTML/Table Output in Cronicle5.3CNA v4.00.2%2026-04-07Fix
CVE-2026-39397Delmare Digital payload-puck puck API endpoints missing authorization9.4CNA v3.10.6%2026-04-07Fix
CVE-2026-39395Cosign's verify-blob-attestation reports false positive when payload parsing fails4.3CNA v3.10.3%2026-04-07Fix
CVE-2026-39384FreeScout customer merge insecure direct object reference7.6CNA v3.10.3%2026-04-07Fix
CVE-2026-39382dbt-labs dbt-core dbt has a command injection in Reusable Workflow9.3CNA v4.00.5%2026-04-07Exploit code
CVE-2026-39381Parse Platform Parse Server /sessions/me endpoint incorrect authorization5.3CNA v4.00.3%2026-04-07Fix
CVE-2026-39380Open Source Point of Sale has stored XSS in Stock Location (Configuration)5.4CNA v3.10.2%2026-04-07Fix
CVE-2026-39376FastFeedParser has an infinite redirect loop DoS via meta-refresh chain7.5CNA v3.10.5%2026-04-07Exploit codeFix
CVE-2026-39374Plane IDOR: Cross-Project issue Date Modification via Bulk Update endpoint6.5CNA v3.10.3%2026-04-07Fix
CVE-2026-39373JWCrypto: JWE ZIP decompression bomb5.3CNA v3.10.4%2026-04-07Fix
CVE-2026-39371RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests8.1CNA v3.10.2%2026-04-07Fix
CVE-2026-39370WWBN AVideo upload-by-URL media fetch server-side request forgery7.1CNA v3.10.3%2026-04-07
CVE-2026-39369WWBN AVideo GIF poster fetch path traversal7.6CNA v3.10.5%2026-04-07
CVE-2026-39368WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services6.5CNA v3.10.3%2026-04-07
CVE-2026-39367WWBN AVideo has stored XSS via Malicious EPG XML Program Titles in AVideo EPG page5.4CNA v3.10.2%2026-04-07
CVE-2026-39366WWBN AVideo PayPal IPN handler vulnerability6.5CNA v3.10.2%2026-04-07
CVE-2026-39365Vite has a path traversal in Optimized Deps `.map` Handling6.3CNA v4.01.0%2026-04-07NucleiFix
CVE-2026-39364Vite has a `server.fs.deny` bypass with queries8.2CNA v4.01.5%2026-04-07Reported exploitedNucleiKCVFix
CVE-2026-39363Vite affected by arbitrary file read via Vite Dev Server WebSocket8.2CNA v4.02.6%2026-04-07NucleiExploit codeFix
CVE-2026-39361OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url7.7CNA v3.10.4%2026-04-07
CVE-2026-39360RustFS multipart upload copy missing authorization5.3CNA v4.00.3%2026-04-07
CVE-2026-39356SQL injection via escapeName in all Drizzle ORM SQL dialects7.5CNA v3.10.4%2026-04-07Fix
CVE-2026-39355MGeurts Genealogy team ownership transfer missing authorization10.0CNA v3.10.4%2026-04-07Fix
CVE-2026-39354Erudika Scoold question submission endpoint insecure direct object reference6.5CNA v3.10.3%2026-04-07Fix
CVE-2026-39351Frappe allows unrestricted Doctype access via API exploit6.9CNA v4.00.4%2026-04-07Fix
CVE-2026-39349OrangeHRM Uses AES-ECB for Sensitive Data Encryption enables Pattern Disclosure2.1CNA v4.00.2%2026-04-07Fix
CVE-2026-39348OrangeHRM attachment download handlers missing authorization5.3CNA v4.00.3%2026-04-07Fix
CVE-2026-39347OrangeHRM's Self‑Appraisal Submission of Admin Users can be Modified after Completion5.1CNA v4.00.3%2026-04-07Fix
CVE-2026-39346OrangeHRM has improper access control allowing Access to Disabled modules via URL Encoding5.3CNA v4.00.3%2026-04-07Fix
CVE-2026-39345OrangeHRM affected by arbitrary file read via path traversal in Email Template Loader4.6CNA v4.00.5%2026-04-07Fix
CVE-2026-39344ChurchCRM CRM reflected XSS the login page through the username parameter8.1CNA v3.00.4%2026-04-07Fix
CVE-2026-39343ChurchCRM has a SQL injection in Event Type Editor (Admin)7.2CNA v3.10.4%2026-04-07Fix
CVE-2026-39342ChurchCRM has a SQL injection searchwhat parameter via QueryView.php9.4CNA v4.00.5%2026-04-07Fix
CVE-2026-39341ChurchCRM CRM SQL injection in ChurchCRM.08.1CNA v3.10.4%2026-04-07Fix
CVE-2026-39340ChurchCRM has a SQL injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution8.1CNA v3.10.4%2026-04-07Fix
CVE-2026-39339ChurchCRM has an API authentication bypass9.1CNA v3.11.8%2026-04-07NucleiFix
CVE-2026-39338ChurchCRM has blind XSS via Global Search Administrative Cookie Session Exfiltration8.6CNA v4.00.3%2026-04-07Fix
CVE-2026-39337ChurchCRM affected by unauthenticated RCE in Install Wizard10.0CNA v3.11.1%2026-04-07Fix
CVE-2026-39336ChurchCRM has stored XSS from unescaped config values in HTML attributes6.1CNA v3.10.4%2026-04-07Fix
CVE-2026-39335ChurchCRM has stored XSS via Unescaped data-* attributes in Group/Family Controls6.1CNA v3.10.4%2026-04-07Fix
CVE-2026-39334ChurchCRM has a blind SQL injection in SettingsIndividual.php8.8CNA v3.10.4%2026-04-07Fix
CVE-2026-39333ChurchCRM has reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php8.7CNA v3.10.4%2026-04-07Fix
CVE-2026-39332ChurchCRM has reflected cross-site scripting (XSS) in GeoPage.php8.7CNA v3.10.4%2026-04-07Fix
CVE-2026-39331ChurchCRM family management API incorrect authorization8.1CNA v3.10.4%2026-04-07Fix
CVE-2026-39330ChurchCRM has a blind SQL injection in PropertyAssign.php8.8CNA v3.10.4%2026-04-07Fix
CVE-2026-39329ChurchCRM has a blind SQL injection in EventNames.php8.8CNA v3.10.4%2026-04-07Fix
CVE-2026-39328ChurchCRM has stored XSS in Social Profile fields8.9CNA v3.10.4%2026-04-07Fix
CVE-2026-39327ChurchCRM has a SQL injection in MemberRoleChange.php8.8CNA v3.10.4%2026-04-07Fix
CVE-2026-39326ChurchCRM has a blind SQL injection in PropertyTypeEditor.php8.8CNA v3.10.4%2026-04-07Fix
CVE-2026-39325ChurchCRM has a blind SQL injection in SettingsUser.php7.2CNA v3.10.5%2026-04-07Fix
CVE-2026-39324rack-session Cookie session store authentication bypass9.3CNA v4.00.3%2026-04-07Exploit codeFix
CVE-2026-39322PolarLearn: Any password authenticates banned accounts and grants API access9.2CNA v4.00.4%2026-04-07Fix
CVE-2026-39321parse-community parse-server parse Server has a login timing side-channel reveals user existence6.3CNA v4.00.4%2026-04-07Fix
CVE-2026-39319ChurchCRM has a Second Order SQLI via FundRaiserEditor.php8.8CNA v3.10.4%2026-04-07Fix
CVE-2026-39318ChurchCRM has a DDL SQL injection in GroupPropsFormRowOps.php8.8CNA v3.10.5%2026-04-07Fix
CVE-2026-39316CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer4.0CNA v3.10.2%2026-04-07Fix
CVE-2026-39314CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash4.0CNA v3.10.2%2026-04-07Fix
CVE-2026-39312Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition7.5CNA v3.10.7%2026-04-07
CVE-2026-39308PraisonAI recipe registry publish path traversal allows out-of-root file write7.1CNA v3.10.5%2026-04-07Fix
CVE-2026-39307PraisonAI has an arbitrary file write (Zip Slip) in Templates Extraction8.1CNA v3.10.5%2026-04-07Fix
CVE-2026-39306PraisonAI recipe registry pull path traversal writes files outside the chosen output directory7.3CNA v3.10.4%2026-04-07Fix
CVE-2026-39305MervinPraison PraisonAI arbitrary file write / path traversal in Action Orchestrator9.0CNA v3.10.4%2026-04-07Fix
CVE-2026-35615PraisonAI has a path traversal in FileTools9.2CNA v4.00.5%2026-04-07Fix
CVE-2026-35614Frappe has a SQL injection in bulk_update9.3CNA v4.00.5%2026-04-07Fix
CVE-2026-35613Path traversal in coursevault-preview due to improper base-directory boundary validation5.1CNA v3.10.1%2026-04-07Fix
CVE-2026-35611Addressable has a regular expression denial of service in Addressable templates7.5CNA v3.10.5%2026-04-07Fix
CVE-2026-35610PolarLearn has a Server Action Admin Bypass in Account Management Actions8.8CNA v3.10.4%2026-04-07
CVE-2026-35608QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript execution5.3CNA v4.00.3%2026-04-07Fix
CVE-2026-35607filebrowser file Browser: Proxy auth auto-provisioned users inherit Execute permission and commands8.1CNA v3.10.6%2026-04-07Fix
CVE-2026-35606File Browser resources endpoint missing authorization5.3CNA v4.00.4%2026-04-07Fix
CVE-2026-35605File Browser access rule path matching path traversal6.3CNA v4.00.4%2026-04-07Fix
CVE-2026-35604filebrowser file Browser share links remain accessible after Share/Download permissions are revoked8.2CNA v4.00.4%2026-04-07Fix
CVE-2026-35592pyLoad has an Incomplete Tar path traversal Fix in UnTar._safe_extractall5.3CNA v3.10.4%2026-04-07Fix
CVE-2026-35586Authorization bypass for SSL Certificate/Key Configuration due to Option Name Mismatch in Pyload-ng6.8CNA v3.10.2%2026-04-07Fix
CVE-2026-35585filebrowser File Browser has a command injection via Hook Runner7.5CNA v4.02.4%2026-04-07Fix
CVE-2026-35584FreeScout open tracking endpoint missing authentication6.9CNA v4.00.4%2026-04-07Exploit codeFix
CVE-2026-35583Emissary has a path traversal via Blacklist Bypass in Configuration API5.3CNA v3.10.4%2026-04-07Fix
CVE-2026-35581Emissary has a command injection via PLACE_NAME Configuration in Executrix7.2CNA v3.10.9%2026-04-07Fix
CVE-2026-35580Emissary has GitHub Actions Shell injection via Workflow Inputs9.1CNA v3.10.7%2026-04-07Exploit codeFix
CVE-2026-35576ChurchCRM has stored cross-site scripting (XSS) in Person Properties via PrintView.php8.7CNA v3.10.4%2026-04-07Fix
CVE-2026-35575ChurchCRM has stored XSS in Group Name8.0CNA v3.10.4%2026-04-07Fix
CVE-2026-35574ChurchCRM has a stored XSS in Person Profile Add a Note7.3CNA v3.10.4%2026-04-07Fix
CVE-2026-35573ChurchCRM has a path traversal leads to RCE9.1CNA v3.10.9%2026-04-07Fix
CVE-2026-35572SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts7.0CNA v4.00.4%2026-04-07Fix
CVE-2026-35571Emissary has stored XSS via Navigation Template Link injection4.8CNA v3.10.3%2026-04-07Fix
CVE-2026-35568MCP Java SDK origin validation error7.6CNA v4.00.2%2026-04-07Fix
CVE-2026-35554Apache Kafka Clients race condition8.7CISA ADP v3.10.6%2026-04-07Fix
CVE-2026-35534ChurchCRM has stored XSS in PersonView.php via Facebook field attribute injection7.6CNA v3.10.3%2026-04-07Fix
CVE-2026-35533mise has a local settings bypass config trust checks7.8CNA v3.10.1%2026-04-07Fix
CVE-2026-35526Strawberry GraphQL affected by a denial of service via unbounded WebSocket subscriptions7.5CNA v3.10.5%2026-04-07Fix
CVE-2026-35523Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol7.5CNA v3.10.6%2026-04-07Fix
CVE-2026-35521Pi-hole FTL affected by remote code execution (RCE) via dhcp.hosts Newline injection8.8CNA v3.11.0%2026-04-07Fix
CVE-2026-35520Pi-hole FTL affected by remote code execution (RCE) via dhcp.leaseTime Newline injection8.8CNA v3.11.0%2026-04-07Fix
CVE-2026-35519Pi-hole FTL affected by remote code execution (RCE) via dns.hostRecord Newline injection8.8CNA v3.11.0%2026-04-07Fix
CVE-2026-35518Pi-hole FTL affected by remote code execution (RCE) via dns.cnameRecords Newline injection8.8CNA v3.11.0%2026-04-07Fix
CVE-2026-35517Pi-hole FTL affected by remote code execution (RCE) via dns.upstreams Newline injection8.8CNA v3.11.0%2026-04-07Fix
CVE-2026-35516LinkAce has SSRF via CheckLinksCommand Link URL Update Bypasses laravel-html-meta Protection5.0CNA v3.10.3%2026-04-07Fix
CVE-2026-35515NestJS Nest SseStream injection6.3CNA v4.00.3%2026-04-07Fix
CVE-2026-35492kedro-datasets PartitionedDataset path traversal6.5CNA v3.10.4%2026-04-07Fix
CVE-2026-35491Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration6.1CNA v3.10.2%2026-04-07Fix
CVE-2026-35490Changedetection.io has an authentication bypass via Decorator Ordering9.8CNA v3.10.6%2026-04-07Fix
CVE-2026-35489Tandoor Recipes shopping list entry endpoint improper quantity validation7.3CNA v3.10.3%2026-04-07Fix
CVE-2026-35488Tandoor Recipes CustomIsShared permits delete/PUT on RecipeBook by shared (read-only) users8.1CNA v3.10.5%2026-04-07Fix
CVE-2026-35487text-generation-webui has a path traversal in load_prompt .txt file read without authentication5.3CNA v3.10.4%2026-04-07Fix
CVE-2026-35486text-generation-webui has a SSRF in superbooga/superboogav2 extensions no URL validation7.5CNA v3.10.4%2026-04-07Fix
CVE-2026-35485oobabooga text-generation-webui load_grammar path traversal7.5CNA v3.10.9%2026-04-07Fix
CVE-2026-35484text-generation-webui has a path traversal in load_preset .yaml file read without authentication5.3CNA v3.10.4%2026-04-07Fix
CVE-2026-35483oobabooga text-generation-webui load_template path traversal5.3CNA v3.10.4%2026-04-07Fix
CVE-2026-35480Go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers6.2CNA v3.10.2%2026-04-07Fix
CVE-2026-35464pyLoad storage_folder setting deserialization of untrusted data7.5CNA v3.10.6%2026-04-07
CVE-2026-35463pyLoad has improper neutralization of special elements used in an OS command8.8CNA v3.10.9%2026-04-07Fix
CVE-2026-35462Papra Does not Reject Expired API Keys4.3CNA v3.10.3%2026-04-07Fix
CVE-2026-35461Papra has a blind server-side request forgery (SSRF) via Webhook URL5.0CNA v3.10.3%2026-04-07Fix
CVE-2026-35460Papra has an HTML injection in Transactional Emails via Unescaped User Display Name4.3CNA v3.10.2%2026-04-07Fix
CVE-2026-35458Gotenberg has a ReDoS via extraHttpHeaders scope feature8.7CNA v4.00.6%2026-04-07Fix
CVE-2026-35457rust-libp2p rendezvous server resource exhaustion8.2CNA v3.10.4%2026-04-07Fix
CVE-2026-35406Aardvark-dns has incorrect error handling for malformed tcp packets6.2CNA v3.10.5%2026-04-07Fix
CVE-2026-35405libp2p rendezvous server denial of service7.5CNA v3.10.5%2026-04-07Fix
CVE-2026-34904Simple Social Media Share Buttons WordPress plugin cross-site request forgery (CSRF)7.5CNA v3.10.2%2026-04-07Fix
CVE-2026-34903Ocean Extra WordPress plugin broken access control5.4CNA v3.10.3%2026-04-07Fix
CVE-2026-34899LTL Freight Quotes Worldwide Express Edition WordPress plugin broken access control5.3CNA v3.10.3%2026-04-07Fix
CVE-2026-34896Under Construction, Coming Soon and Maintenance Mode WordPress plugin cross-site request forgery7.5CNA v3.10.2%2026-04-07Fix
CVE-2026-34781Electron crashes in clipboard.readImage on malformed clipboard image data2.8CNA v3.10.1%2026-04-07Fix
CVE-2026-34765Electron named window.open targets not scoped to the opener's browsing context6.0CNA v3.10.4%2026-04-07Fix
CVE-2026-34582Botan has a TLS 1.3 certificate authentication bypass8.7CNA v4.00.4%2026-04-07Fix
CVE-2026-34580Botan has a certificate authentication bypass due to trust anchor confusion9.3CNA v4.00.3%2026-04-07Fix
CVE-2026-34371LibreChat affected by arbitrary file write via `execute_code` Artifact Filename Traversal6.3CNA v3.10.3%2026-04-07Fix
CVE-2026-34197Apache ActiveMQ improper input validation8.8CISA ADP v3.115.5%2026-04-07KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix
CVE-2026-34080xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception6.8CNA v4.00.2%2026-04-07Fix
CVE-2026-34079Flatpak affected by arbitrary file deletion on the host filesystem8.7CNA v4.00.4%2026-04-07Fix
CVE-2026-34078Flatpak portal sandbox-expose symlink following9.3CNA v4.00.9%2026-04-07Fix
CVE-2026-34045podman-desktop Podman Desktop WebView Server Exposed8.2CNA v3.10.7%2026-04-07Fix
CVE-2026-33866Authorization bypass in MLflow AJAX endpoint4.3v3.10.4%2026-04-07Fix
CVE-2026-33865Stored XSS via unsafe YAML parsing in MLflow5.4v3.10.3%2026-04-07Fix
CVE-2026-33816Memory-safety vulnerability in github.com/jackc/pgx/v59.8CISA ADP v3.10.9%2026-04-07Fix
CVE-2026-33815pgx pgproto3 out-of-bounds write9.8CISA ADP v3.10.9%2026-04-07Fix
CVE-2026-33439Pre-authentication remote code execution via `jato.clientSession` deserialization in OpenAM9.3CNA v4.08.4%2026-04-07NucleiExploit codeFix
CVE-2026-33227Apache ActiveMQ: Improper validation and restriction of a classpath path name4.3CISA ADP v3.10.7%2026-04-07Fix
CVE-2026-33034Django potential denial of service vulnerability in ASGI requests via memory upload limit bypass7.5CISA ADP v3.10.9%2026-04-07Fix
CVE-2026-33033Django potential denial of service vulnerability in MultiPartParser via base64-encoded file upload6.5CISA ADP v3.10.9%2026-04-07Exploit codeFix
CVE-2026-32864NI LabVIEW out-of-bounds read in mgcore_SH_25_3!aligned_free8.5CNA v4.00.2%2026-04-07Fix
CVE-2026-32863NI LabVIEW out-of-bounds read in sentry_transaction_context_set_operation8.5CNA v4.00.2%2026-04-07Fix
CVE-2026-32862NI LabVIEW out-of-bounds write in ResFileFactory::InitResourceMgr8.5CNA v4.00.2%2026-04-07Fix
CVE-2026-32861Out-of-bounds write vulnerability in NI LabVIEW when loading lvclass file8.5CNA v4.00.2%2026-04-07Fix
CVE-2026-32860Out-of-bounds write vulnerability in NI LabVIEW when loading lvlib file8.5CNA v4.00.2%2026-04-07Fix
CVE-2026-32712Open Source Point of Sale customer name field stored cross-site scripting5.4CNA v3.10.2%2026-04-07Fix
CVE-2026-32588Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing6.5CISA ADP v3.10.7%2026-04-07Fix
CVE-2026-32144Erlang OTP OCSP designated-responder authorization bypass via missing signature verification7.6CNA v4.00.3%2026-04-07Fix
CVE-2026-31842Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling8.7CNA v4.00.7%2026-04-07
CVE-2026-31790OpenSSL Incorrect failure Handling in RSA KEM RSASVE Encapsulation7.5CISA ADP v3.11.0%2026-04-07Fix
CVE-2026-31789OpenSSL heap buffer overflow in Hexadecimal Conversion9.8v3.10.2%2026-04-07Fix
CVE-2026-31272MRCMS improper access control9.8CISA ADP v3.10.6%2026-04-07
CVE-2026-31271megagao production_ssm user addition endpoint authentication bypass9.8CISA ADP v3.10.7%2026-04-07
CVE-2026-30460Thedaylightstudio Fuel CMS code injection8.8v3.10.8%2026-04-07
CVE-2026-30079Openairinterface Oai-cn5g-amf authentication bypass9.8CISA ADP v3.10.7%2026-04-07
CVE-2026-29181OpenTelemetry-Go baggage header parser denial of service7.5CNA v3.10.9%2026-04-07Fix
CVE-2026-28810Erlang OTP Predictable DNS Transaction IDs Enable cache poisoning in Built-in Resolver6.3CNA v4.00.4%2026-04-07Fix
CVE-2026-28808ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)8.3CNA v4.00.8%2026-04-07Fix
CVE-2026-28390OpenSSL possible null dereference when Processing CMS KeyTransportRecipientInfo7.5NVD v3.10.8%2026-04-07Fix
CVE-2026-28389OpenSSL possible null dereference when Processing CMS KeyAgreeRecipientInfo7.5NVD v3.10.8%2026-04-07Fix
CVE-2026-28388OpenSSL null pointer dereference when Processing a Delta CRL7.5NVD v3.10.9%2026-04-07Fix
CVE-2026-28387OpenSSL Potential use-after-free in DANE Client Code8.1NVD v3.10.7%2026-04-07Fix
CVE-2026-28386OpenSSL out-of-bounds read in AES-CFB-128 on X86-64 with AVX-512 Support7.5NVD v3.10.3%2026-04-07Fix
CVE-2026-27949Plane exposes User Email (PII and part of credential) in GET parameter2.0CNA v3.10.3%2026-04-07Fix
CVE-2026-27315Apache Cassandra: Cqlsh history sensitive information leak5.5CISA ADP v3.10.2%2026-04-07Fix
CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass8.8CISA ADP v3.10.3%2026-04-07Fix
CVE-2026-24660LibRaw x3f_load_huffman functionality heap-based buffer overflow9.8NVD v3.10.7%2026-04-07Fix
CVE-2026-24450LibRaw uncompressed_fp_dng_load_raw functionality integer overflow9.8v3.10.6%2026-04-07Fix
CVE-2026-24175NVIDIA Triton Inference Server uncaught exception7.5CNA v3.10.5%2026-04-07Fix
CVE-2026-24174NVIDIA Triton Inference Server incorrect numeric conversion7.5CNA v3.10.5%2026-04-07Fix
CVE-2026-24173NVIDIA Triton Inference Server integer overflow7.5CNA v3.10.5%2026-04-07Fix
CVE-2026-24156NVIDIA DALI deserialization of untrusted data7.3CNA v3.10.3%2026-04-07Fix
CVE-2026-24147NVIDIA Triton Inference Server path traversal4.8CNA v3.10.5%2026-04-07Fix
CVE-2026-24146NVIDIA Triton Inference Server excessive memory allocation7.5CNA v3.10.5%2026-04-07Fix
CVE-2026-23818Open redirect vulnerability in HPE Aruba Networking Private 5G Core On-Prem8.8CNA v3.10.3%2026-04-07Fix
CVE-2026-23696Windmill File Ownership Handling SQLi RCE9.4CNA v4.013.6%2026-04-07NucleiFix
CVE-2026-22711The Wikimedia Foundation Mediawiki stored XSS through system messages in WikiLove6.9CNA v4.00.3%2026-04-07Fix
CVE-2026-22683Windmill Operator Role missing authorization checks RCE8.7CNA v4.02.6%2026-04-07NucleiFix
CVE-2026-22682OpenHarness improper access control via file tools8.4CNA v4.00.1%2026-04-07
CVE-2026-22680OpenViking missing authorization via Task Polling6.9CNA v4.00.4%2026-04-07Fix
CVE-2026-22679Weaver E-cology Unauthenticated RCE via dubboApi Debug endpoint9.3CNA v4.020.4%2026-04-07Exploit codeFix
CVE-2026-22666Dolibarr ERP/CRM authenticated RCE via dol_eval_standard8.6CNA v4.015.5%2026-04-07Emerging ThreatsExploit codeFix
CVE-2026-21413LibRaw lossless_jpeg_load_raw functionality heap-based buffer overflow9.8CNA v3.11.4%2026-04-07Fix
CVE-2026-20911LibRaw HuffTable::initval functionality heap-based buffer overflow9.8CNA v3.10.6%2026-04-07Fix
CVE-2026-20889LibRaw x3f_thumb_loader functionality heap-based buffer overflow9.8CNA v3.10.8%2026-04-07Fix
CVE-2026-20884LibRaw deflate_dng_load_raw functionality integer overflow9.8v3.10.6%2026-04-07Fix
CVE-2026-20446MediaTek chipset sec boot out-of-bounds write4.3v3.10.2%2026-04-07Fix
CVE-2026-20433MediaTek chipset Modem out-of-bounds write8.8v3.10.3%2026-04-07Fix
CVE-2026-20432MediaTek chipset Modem out-of-bounds write8.0CISA ADP v3.10.3%2026-04-07Fix
CVE-2026-20431MediaTek chipset Modem crash6.5CISA ADP v3.10.3%2026-04-07Fix
CVE-2026-5762Wikimedia Foundation MediaWiki ReportIncident DiscussionTools integration causes slow requests5.3CNA v4.00.4%2026-04-07Fix
CVE-2026-5745Libarchive: A null pointer dereference vulnerability exists in the acl parser of libarchive5.5CNA v3.10.2%2026-04-07Fix
CVE-2026-5741suvarchal docker-mcp-server HTTP index.ts pull_image os command injection6.9CNA v4.02.1%2026-04-07
CVE-2026-5739PowerJob OpenAPI endpoint addWorkflowNode GroovyEvaluator.evaluate code injection6.9CNA v4.00.5%2026-04-07
CVE-2026-5736PowerJob detailPlus Endpoint InstanceController.java SQL injection6.9CNA v4.00.4%2026-04-07
CVE-2026-5735Mozilla memory safety bugs fixed in Firefox and Thunderbird9.8v3.10.3%2026-04-07Fix
CVE-2026-5734Mozilla memory safety bugs fixed in Firefox ESR, Thunderbird ESR, Firefox and Thunderbird9.8v3.10.3%2026-04-07Fix
CVE-2026-5733Mozilla Firefox incorrect boundary conditions in the Graphics: WebGPU component8.8CISA ADP v3.10.5%2026-04-07Fix
CVE-2026-5732Mozilla Firefox incorrect boundary conditions, integer overflow in the Graphics: Text component8.8CISA ADP v3.10.7%2026-04-07Fix
CVE-2026-5731Mozilla Firefox memory safety bugs9.8CISA ADP v3.10.6%2026-04-07Fix
CVE-2026-5719itsourcecode Construction Management System borrowedtool.php SQL injection5.3CNA v4.00.3%2026-04-07
CVE-2026-5705code-projects Online Hotel Booking Booking endpoint booknow.php cross-site scripting5.3CNA v4.00.4%2026-04-07
CVE-2026-5692Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection6.9CNA v4.02.1%2026-04-07
CVE-2026-5627Path traversal in mintplex-labs/anything-llm7.2NVD v3.11.1%2026-04-07Fix
CVE-2026-5465Booking for Appointments and Events Calendar WordPress plugin insecure direct object reference8.8CNA v3.10.6%2026-04-07Fix
CVE-2026-5384runZero Platform incorrect credential scope5.8CNA v3.10.3%2026-04-07Fix
CVE-2026-5383runZero Explorer missing authorization check4.4CNA v3.10.3%2026-04-07Fix
CVE-2026-5382runZero Platform MCP endpoint information leak3.0CNA v3.10.3%2026-04-07Fix
CVE-2026-5381runZero Platform task information leak2.2CNA v3.10.3%2026-04-07Fix
CVE-2026-5380runZero Platform cleartext secret exposure5.3CNA v3.10.3%2026-04-07Fix
CVE-2026-5379runZero Platform MCP certification information leak3.0CNA v3.10.2%2026-04-07Fix
CVE-2026-5378runZero Platform user creation leak5.8CNA v3.10.3%2026-04-07Fix
CVE-2026-5376runZero Platform session timeout failure5.9CNA v3.10.3%2026-04-07Fix
CVE-2026-5375runZero Platform API credential information leak2.7CNA v3.10.3%2026-04-07Fix
CVE-2026-5374runZero Platform MCP information leak5.8CNA v3.10.3%2026-04-07Fix
CVE-2026-5373runZero Platform superuser privilege escalation8.1CNA v3.10.4%2026-04-07Fix
CVE-2026-5372runZero Platform SQL injection in saved queries6.4CNA v3.10.3%2026-04-07Fix
CVE-2026-4931Marginal V1-core debt position settlement incorrect numeric conversion8.6v3.10.3%2026-04-07
CVE-2026-4740Rhacm: Open cluster management: Cross-cluster privilege escalation8.2CNA v3.10.2%2026-04-07Fix
CVE-2026-4631Red Hat Cockpit remote login feature OS command injection9.8CNA v3.19.2%2026-04-07Reported exploitedNucleiExploit codeFix
CVE-2026-4420Stored XSS via Page Creating functionality in Bludit5.4v3.10.3%2026-04-07
CVE-2026-4292Django privilege abuse in ModelAdmin.list_editable2.7CISA ADP v3.10.4%2026-04-07Fix
CVE-2026-4277Django privilege abuse in GenericInlineModelAdmin9.8CISA ADP v3.10.6%2026-04-07Fix
CVE-2026-4079SQL Chart Builder WordPress plugin unauthenticated SQL injection6.5CISA ADP v3.10.3%2026-04-07Fix
CVE-2026-4065Smart Slider 3 WordPress plugin unauthorized access5.4CNA v3.10.3%2026-04-07Fix
CVE-2026-3902Django ASGI header spoofing via underscore/hyphen conflation7.5CISA ADP v3.10.5%2026-04-07Fix
CVE-2026-3466Checkmk cross-site scripting in dashlet title8.5CNA v4.00.3%2026-04-07Fix
CVE-2026-3177Charitable WordPress plugin insufficient verification of data authenticity5.3CNA v3.10.2%2026-04-07Fix
CVE-2026-1900Link Whisper Free WordPress plugin unauthenticated settings and user Meta update6.5CISA ADP v3.10.2%2026-04-07Fix
CVE-2026-1839HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class7.8v3.10.3%2026-04-07Fix
CVE-2026-1114Improper access control via Weak JWT Token in parisneo/Lollms9.8CNA v3.00.5%2026-04-07Fix
CVE-2026-1079Pegasystems Pega Browser Extension native messaging host improper access control6.0CNA v4.00.3%2026-04-07Fix
CVE-2026-1078Pegasystems Pega Robot Studio improper access control7.2CNA v4.00.3%2026-04-07
CVE-2026-0740Ninja Forms - File Upload WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.162.9%2026-04-07Reported exploitedNucleiExploit codeFix
CVE-2026-37977Keycloak: Org.keycloak.protocol.oidc.grants.ciba: Keycloak: Information disclosure3.7CNA v3.10.3%2026-04-06Fix
CVE-2026-35475WeGIA open redirect backup redirection Unvalidated $_GET['redirect']5.1CNA v4.00.3%2026-04-06Fix
CVE-2026-35474WeGIA open redirect atualizacao redirection Unvalidated $_GET['redirect']5.1CNA v4.00.3%2026-04-06Fix
CVE-2026-35473WeGIA open redirect IentradaControle listarId Unvalidated $_GET['nextPage']5.1CNA v4.00.3%2026-04-06Fix
CVE-2026-35472WeGIA open redirect EstoqueControle listarTodos Unvalidated $_GET['nextPage']5.1CNA v4.00.3%2026-04-06Fix
CVE-2026-35471Improper limitation of a pathname to a restricted directory (path traversal) in Goshs9.8CNA v3.00.7%2026-04-06Fix
CVE-2026-35470OpenSTAManager has a SQL injection via righe parameter in confronta_righe Modals8.8CNA v3.10.5%2026-04-06Fix
CVE-2026-35459pyLoad has SSRF fix bypass via HTTP redirect9.3CNA v4.00.4%2026-04-06
CVE-2026-35454coder code-marketplace Code Extension Marketplace has a Zip Slip path traversal8.7CNA v4.00.4%2026-04-06Fix
CVE-2026-35452WWBN AVideo has unauthenticated information disclosure via Missing Auth on CloneSite client.log.php5.3CNA v3.10.4%2026-04-06
CVE-2026-35450WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php5.3CNA v3.10.4%2026-04-06
CVE-2026-35449WWBN AVideo has unauthenticated information disclosure via Disabled CLI Guard in install/test.php5.3CNA v3.10.3%2026-04-06
CVE-2026-35448WWBN AVideo Provides unauthenticated access to Payment Order Data via BlockonomicsYPT check.php3.7CNA v3.10.3%2026-04-06
CVE-2026-35444SDL_image has a heap buffer overflow read via unchecked colormap index in XCF loader7.1CNA v3.10.3%2026-04-06Fix
CVE-2026-35442Directus: Authenticated Users can Extract Concealed fields via Aggregate Queries8.1CNA v3.10.4%2026-04-06Fix
CVE-2026-35441Directus: GraphQL Alias Amplification denial of service due to Missing Query Cost/Complexity Limits6.5CNA v3.10.4%2026-04-06Fix
CVE-2026-35413Directus GraphQL Schema SDL Disclosure setting5.3CNA v3.10.4%2026-04-06Fix
CVE-2026-35412Directus has a TUS upload authorization bypass allows arbitrary file overwrite7.1CNA v3.10.4%2026-04-06Fix
CVE-2026-35411Directus is an open redirect in Admin 2FA Setup page4.3CNA v3.10.3%2026-04-06Fix
CVE-2026-35410Directus has an open redirect via Parser Bypass in OAuth2/SAML Authentication Flow6.1CNA v3.10.3%2026-04-06Fix
CVE-2026-35409Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import7.7CNA v3.10.4%2026-04-06Fix
CVE-2026-35408Directus is Missing Cross-Origin Opener Policy8.7CNA v3.10.2%2026-04-06Fix
CVE-2026-35404openedx-platform Open edX Platform has an open redirect in Survey Views4.7CNA v3.10.3%2026-04-06
CVE-2026-35399WeGIA has stored XSS in backup file names8.5CNA v4.00.3%2026-04-06Fix
CVE-2026-35398WeGIA OrigemControle module open redirect5.1CNA v4.00.3%2026-04-06Fix
CVE-2026-35396WeGIA open redirect IsaidaControle listarId Unvalidated $_GET['nextPage']5.1CNA v4.00.3%2026-04-06Fix
CVE-2026-35395WeGIA has a SQL injection in DespachoDAO.php via id_memorando parameter8.8CNA v3.10.5%2026-04-06Fix
CVE-2026-35394mobile-next mobile-mcp Mobile Next has arbitrary Android Intent Execution via mobile_open_url8.3CNA v3.10.4%2026-04-06Fix
CVE-2026-35393Improper limitation of a pathname to a restricted directory in Goshs POST multipart upload9.8CNA v3.00.7%2026-04-06Fix
CVE-2026-35392Goshs has an improper limitation of a pathname to a restricted directory in Goshs PUT upload9.8CNA v3.00.7%2026-04-06Fix
CVE-2026-35391Bulwark Webmail client IP detection vulnerability8.7CNA v4.00.2%2026-04-06Fix
CVE-2026-35390bulwarkmail webmail cross-site scripting5.3CNA v4.00.2%2026-04-06Fix
CVE-2026-35389Bulwark Webmail S/MIME signature verification accepted self-signed certificates8.7CNA v4.00.2%2026-04-06Fix
CVE-2026-35213Regular expression denial of service (ReDoS) in @hapi/content HTTP header parsing8.7CNA v4.00.6%2026-04-06Fix
CVE-2026-35209unjs defu prototype pollution7.5CNA v3.10.5%2026-04-06Fix
CVE-2026-35208lichess-org lila Lichess.org has an Unsanitized Stream Title injection on /streamer5.3CNA v4.00.4%2026-04-06
CVE-2026-35203ZLMediaKit VP9 RTP parser out-of-bounds read7.5CNA v3.10.5%2026-04-06
CVE-2026-35201Discount has an out-of-bounds read in rdiscount5.9CNA v3.10.4%2026-04-06Fix
CVE-2026-35200parse-community parse-server parse Server has a file upload Content-Type override2.1CNA v4.00.3%2026-04-06Fix
CVE-2026-35199Microsoft SymCrypt SymCryptXmssSign function heap overflow via 64- leaf-count truncation6.1CNA v3.10.3%2026-04-06Fix
CVE-2026-35197Code injection in dye template expressions6.6CNA v3.10.4%2026-04-06Fix
CVE-2026-35187pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter7.7CNA v3.10.4%2026-04-06
CVE-2026-35185HAX CMS server-status endpoint information disclosure8.7CNA v4.00.5%2026-04-06Fix
CVE-2026-35184EcclesiaCRM has a critical SQL injection8.7CNA v4.00.6%2026-04-06Fix
CVE-2026-35183Ajax30 BraveCMS-2.0 brave CMS has an insecure direct object reference in Article Image Deletion7.1CNA v3.10.3%2026-04-06Fix
CVE-2026-35182Ajax30 BraveCMS-2.0 missing authorization privilege escalation8.8CNA v3.10.5%2026-04-06Fix
CVE-2026-35181WWBN AVideo affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php4.3CNA v3.10.1%2026-04-06Fix
CVE-2026-35180WWBN AVideo affected by CSRF on Site Customization endpoint enables Logo Overwrite4.3CNA v3.10.1%2026-04-06Fix
CVE-2026-35179WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php5.3CNA v3.10.3%2026-04-06
CVE-2026-35178forceworkbench Workbench affected by remote code execution9.3CNA v4.00.9%2026-04-06Fix
CVE-2026-35177Path traversal issue with zip.Vim in Vim4.1CNA v3.10.2%2026-04-06Fix
CVE-2026-35176openFPGALoader has a heap buffer overflow in POFParser::parseSection via crafted .pof file7.1CNA v3.10.2%2026-04-06
CVE-2026-35175Ajenti has an authorization bypass during custom package installation7.2CNA v4.00.4%2026-04-06Fix
CVE-2026-35174xenocrat chyrp-lite chyrp Lite has a path traversal to remote code execution9.1CNA v3.10.9%2026-04-06Fix
CVE-2026-35173xenocrat chyrp-lite Chyrp Lite has an IDOR via mass assignment in Post Model6.5CNA v3.10.3%2026-04-06Fix
CVE-2026-35172Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation7.5CNA v3.10.7%2026-04-06Fix
CVE-2026-35171Arbitrary code execution via Malicious Logging Configuration in Kedro9.8CNA v3.10.9%2026-04-06Fix
CVE-2026-35170openFPGALoader has a heap buffer overflow in BitParser::parseHeader via crafted .bit file7.1CNA v3.10.2%2026-04-06
CVE-2026-35167Kedro has a path traversal in versioned dataset loading via unsanitized version string7.1CNA v3.10.4%2026-04-06Fix
CVE-2026-35166Hugo does not properly escape some Markdown links5.3CNA v4.00.2%2026-04-06Fix
CVE-2026-35164Ajax30 BraveCMS-2.0 brave CMS Sffected by unrestricted file upload via CKEditor endpoint8.8CNA v3.10.8%2026-04-06Fix
CVE-2026-35052man-group dtale D-Tale affected by remote code execution through redis/shelf storage5.3CNA v4.00.9%2026-04-06Fix
CVE-2026-35050text-generation-webui affected by remote code execution9.1CNA v3.10.6%2026-04-06Fix
CVE-2026-35047Brave CMS has unrestricted file upload in BraveCMS via CKEditor endpoint9.3CNA v4.01.0%2026-04-06Fix
CVE-2026-35046Tandoor Recipes recipe instructions sanitizer vulnerability5.4CNA v3.10.2%2026-04-06Fix
CVE-2026-35045Tandoor Recipes affected by Private Recipe Exposure and unauthorized modification8.1CNA v3.10.4%2026-04-06Exploit codeFix
CVE-2026-35044BentoML has a server-side template injection8.8CNA v3.10.5%2026-04-06Fix
CVE-2026-35043BentoML: Command injection in cloud deployment setup script (deployment.py)7.8CNA v3.10.3%2026-04-06Fix
CVE-2026-35042fast-jwt accepts unknown `crit` header extensions (RFC 7515 § MUST violation)7.5CNA v3.10.2%2026-04-06
CVE-2026-35039nearform fast-jwt token cache vulnerability9.1CNA v3.10.2%2026-04-06Fix
CVE-2026-35037Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata7.2CNA v3.10.7%2026-04-06NucleiExploit codeFix
CVE-2026-35036Ech0 affected by unauthenticated server-side request forgery in Website Preview feature7.5CNA v3.10.4%2026-04-06Fix
CVE-2026-35035CI4MS company information settings vulnerability7.2CNA v3.10.6%2026-04-06Fix
CVE-2026-35030LiteLLM has an authentication bypass via OIDC userinfo cache key collision9.4CNA v4.00.9%2026-04-06Exploit codeFix
CVE-2026-35029LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint8.7CNA v4.04.0%2026-04-06NucleiEmerging ThreatsExploit codeFix
CVE-2026-34992Missing encryption of sensitive data in antrea.io/antrea7.1CNA v4.00.2%2026-04-06Fix
CVE-2026-34989CI4MS: Profile and user management full account takeover for All-Roles and Privilege-Escalation9.4CNA v4.00.4%2026-04-06Fix
CVE-2026-34986go-jose go JOSE affect by a panic in JWE decryption7.5CNA v3.10.7%2026-04-06Fix
CVE-2026-34982Vim modeline bypass via various options affects Vim8.2CNA v3.10.3%2026-04-06Fix
CVE-2026-34981whisperX REST API URL download service server-side request forgery5.8CNA v3.10.4%2026-04-06Fix
CVE-2026-34977Zeecka AperiSolve Aperi'Solve affected by unauthenticated RCE via JPSeek Analyzer command9.3CNA v4.01.2%2026-04-06Fix
CVE-2026-34976Dgraph affected by Pre-Auth Database Overwrite + SSRF + File Read10.0CNA v3.11.7%2026-04-06NucleiFix
CVE-2026-34975Plunk email message construction CRLF injection8.5CNA v3.10.3%2026-04-06Exploit codeFix
CVE-2026-34972OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions5.0CNA v3.10.3%2026-04-06Fix
CVE-2026-34969Nhost leaks the refresh token via URL Query parameter in OAuth Provider Callback2.3CNA v4.00.4%2026-04-06Fix
CVE-2026-34951Reflected XSS in footer.php in Workbench allows Attackers to Hijack Authenticated Sessions5.1CNA v4.00.3%2026-04-06Fix
CVE-2026-34950fast-jwt has an incomplete fix for JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key9.1CNA v3.10.3%2026-04-06Fix
CVE-2026-34940KubeAI has an OS command injection8.7CNA v3.10.5%2026-04-06Exploit codeFix
CVE-2026-34897Media LIbrary Assistant WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-04-06Fix
CVE-2026-34885Media LIbrary Assistant WordPress plugin SQL injection8.5CNA v3.11.2%2026-04-06NucleiFix
CVE-2026-34841Axios npm Supply Chain Incident Impacting @usebruno/cli9.8CNA v3.10.3%2026-04-06Fix
CVE-2026-34783Ferret: Path traversal in IO::FS::write allows arbitrary file write when scraping malicious websites8.1CNA v3.10.7%2026-04-06Fix
CVE-2026-34764Electron has a use-after-free in offscreen shared texture release callback2.3CNA v3.10.1%2026-04-06Fix
CVE-2026-34756vLLM affected by Unauthenticated OOM denial of service6.5CNA v3.10.8%2026-04-06Fix
CVE-2026-34755vLLM affected by denial of service via Unbounded Frame Count in video/jpeg Base64 Processing6.5CNA v3.10.8%2026-04-06Fix
CVE-2026-34753vLLM affected by server-side request forgery (SSRF) in `download_bytes_from_url `5.4CNA v3.10.3%2026-04-06Fix
CVE-2026-34589OpenEXR: DWA Lossy Decoder Heap out-of-bounds write8.4CNA v4.00.5%2026-04-06Fix
CVE-2026-34588OpenEXR has a signed 32-bit Overflow in PIZ Decoder leads to OOB read/Write8.6CNA v4.00.6%2026-04-06Fix
CVE-2026-34444Lupa attribute filter sandbox escape7.9CNA v4.00.8%2026-04-06Exploit codeFix
CVE-2026-34380Academy Software Foundation OpenEXR PXR24 decompression out-of-bounds write5.9CNA v3.10.4%2026-04-06Fix
CVE-2026-34379OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior7.1CNA v3.10.5%2026-04-06Fix
CVE-2026-34378Academy Software Foundation OpenEXR EXR file parser integer overflow6.5CNA v3.10.4%2026-04-06Fix
CVE-2026-34217SandboxJS has a sandbox escape via Prop object leak in New handler6.9CNA v4.00.3%2026-04-06Fix
CVE-2026-34211SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser6.9CNA v4.00.5%2026-04-06Fix
CVE-2026-34208SandboxJS: Sandbox integrity escape10.0CNA v3.10.6%2026-04-06Fix
CVE-2026-34148Fedify remote document loader resource exhaustion7.5CNA v3.10.7%2026-04-06Fix
CVE-2026-33752Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)8.6CNA v3.10.4%2026-04-06Exploit codeFix
CVE-2026-33727Pi-hole version-check script privilege escalation6.4CNA v3.10.2%2026-04-06Fix
CVE-2026-33540Distribution pull-through cache token realm validation server-side request forgery7.5CNA v3.10.4%2026-04-06Fix
CVE-2026-33510DOM-based XSS in Homarr /auth/login Redirect8.8CNA v3.10.3%2026-04-06Fix
CVE-2026-33406Pi-hole has a Stored HTML attribute injection5.4CNA v3.10.4%2026-04-06Fix
CVE-2026-33405Pi-hole has a stored HTML injection in queries.js3.1CNA v3.10.3%2026-04-06Fix
CVE-2026-33404Pi-hole has a stored XSS / HTML injection in the Network page/Dashboard3.4CNA v3.10.2%2026-04-06Fix
CVE-2026-33403Pi-hole has a reflected XSS / HTML injection in taillog.js6.1CNA v3.10.3%2026-04-06Fix
CVE-2026-32602Homarr has a race condition in Invite Token Registration (TOCTOU)4.2CNA v3.10.2%2026-04-06Fix
CVE-2026-31410Linux kernel ksmbd object identifier vulnerability5.5NVD v3.10.2%2026-04-06Fix
CVE-2026-31409Linux kernel ksmbd multichannel session binding vulnerability8.8CNA v3.10.7%2026-04-06Fix
CVE-2026-31408Linux kernel Bluetooth SCO socket handling use-after-free8.8CNA v3.10.4%2026-04-06Fix
CVE-2026-31407Linux kernel conntrack netlink attribute validation out-of-bounds write7.1CNA v3.10.2%2026-04-06Fix
CVE-2026-31406Linux kernel xfrm NAT keepalive work race condition7.8CNA v3.10.2%2026-04-06Fix
CVE-2026-31405Linux kernel DVB-net ULE extension headers out-of-bounds read9.8CNA v3.10.8%2026-04-06Fix
CVE-2026-31354Feehi CMS has authenticated stored cross-site scripting vulnerabilities5.4v3.10.2%2026-04-06
CVE-2026-31353Feehi CMS has an authenticated stored cross-site scripting vulnerability5.4v3.10.2%2026-04-06
CVE-2026-31352Feehi CMS has an authenticated stored cross-site scripting vulnerability5.4v3.10.2%2026-04-06
CVE-2026-31351Feehi CMS has an authenticated stored cross-site scripting vulnerability4.8CISA ADP v3.10.2%2026-04-06
CVE-2026-31350Feehi CMS has an authenticated stored cross-site scripting vulnerability5.4v3.10.2%2026-04-06
CVE-2026-31313Feehi CMS has an authenticated stored cross-site scripting vulnerability5.4v3.10.1%2026-04-06
CVE-2026-31153Bynder A stored cross-site scripting5.4CISA ADP v3.10.2%2026-04-06
CVE-2026-31151Kaleris Yard Management Solutions authentication bypass9.8v3.10.4%2026-04-06
CVE-2026-31150Kaleris Yard Management Solutions insecure direct object reference4.3CISA ADP v3.10.3%2026-04-06
CVE-2026-31067UTT 进取 520W /goform/formReleaseConnect component remote command execution6.8CISA ADP v3.10.6%2026-04-06
CVE-2026-31066UTT 810G buffer overflow4.5CISA ADP v3.10.3%2026-04-06
CVE-2026-31065UTT 进取 520W buffer overflow4.5CISA ADP v3.10.3%2026-04-06
CVE-2026-31063UTT 1200GW buffer overflow4.5CISA ADP v3.10.3%2026-04-06
CVE-2026-31062UTT 进取 520W buffer overflow4.5CISA ADP v3.10.3%2026-04-06
CVE-2026-31061UTT 810G buffer overflow4.5CISA ADP v3.10.3%2026-04-06
CVE-2026-31060UTT 810G buffer overflow4.5CISA ADP v3.10.3%2026-04-06
CVE-2026-31059UTT 进取 520W /goform/formDia component remote command execution9.8v3.10.9%2026-04-06
CVE-2026-31058UTT 1200GW buffer overflow4.5CISA ADP v3.10.3%2026-04-06
CVE-2026-31053rizin LE fixup record loader double free6.2CISA ADP v3.10.2%2026-04-06
CVE-2026-30613AZIOT An information disclosure4.6CISA ADP v3.10.2%2026-04-06
CVE-2026-30078Openairinterface Oai-cn5g-amf crash7.5CISA ADP v3.10.5%2026-04-06
CVE-2026-29047GLPI has an authenticated SQL injection via log exports7.2CNA v3.10.4%2026-04-06Fix
CVE-2026-26263GLPI has an unauthenticated SQL injection via Search engine8.1CNA v3.10.4%2026-04-06Fix
CVE-2026-26027GLPI has an unauthenticated stored XSS via inventory7.5CNA v3.10.3%2026-04-06Fix
CVE-2026-26026GLPI has a server-side template injection via Double-Compilation9.1CNA v3.10.5%2026-04-06Exploit codeFix
CVE-2026-25932GLPI has stored XSS in Supplier Website field7.2CNA v3.10.3%2026-04-06Fix
CVE-2026-22675OCS Inventory NG Server stored XSS via User-Agent6.1v3.10.2%2026-04-06
CVE-2026-21382Qualcomm Snapdragon buffer copy without checking size of input in Power Management IC7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21381Qualcomm Snapdragon buffer over-read in WLAN firmware7.6CNA v3.10.1%2026-04-06Fix
CVE-2026-21380Qualcomm Snapdragon use-after-free in DSP service7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21378Qualcomm Snapdragon buffer over-read in Camera7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21376Qualcomm Snapdragon buffer over-read in Camera7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21375Qualcomm Snapdragon buffer over-read in Camera7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21374Qualcomm Snapdragon buffer over-read in Camera7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21373Qualcomm Snapdragon buffer over-read in Camera7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21372Qualcomm Snapdragon heap-based buffer overflow in Power Management IC7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21371Qualcomm Snapdragon buffer over-read in WinBlast driver7.8CNA v3.10.1%2026-04-06Fix
CVE-2026-21367Qualcomm Snapdragon buffer over-read in WLAN firmware7.6CNA v3.10.2%2026-04-06Fix
CVE-2026-5709AWS Research And Engineering Studio (RES) FileBrowser command injection7.7CNA v4.01.0%2026-04-06Fix
CVE-2026-5708Improper Control of User-Modifiable attributes in RES CreateSession API8.7CNA v4.00.7%2026-04-06Fix
CVE-2026-5707Command injection via Virtual Desktop Session Name in AWS Research And Engineering Studio (RES)8.7CNA v4.01.0%2026-04-06Fix
CVE-2026-5704Tar: Tar: Hidden file injection via crafted archives5.5NVD v3.10.4%2026-04-06Fix
CVE-2026-5691Totolink A7100RU cstecgi.cgi setFirewallType os command injection6.9CNA v4.02.1%2026-04-06
CVE-2026-5690Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection6.9CNA v4.02.1%2026-04-06
CVE-2026-5689Totolink A7100RU cstecgi.cgi setNtpCfg os command injection6.9CNA v4.02.1%2026-04-06
CVE-2026-5688Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection6.9CNA v4.02.1%2026-04-06
CVE-2026-5687Tenda CX12L NatStaticSetting fromNatStaticSetting stack-based overflow8.7CNA v4.01.0%2026-04-06
CVE-2026-5686Tenda CX12L RouteStatic fromRouteStatic stack-based overflow8.7CNA v4.01.0%2026-04-06
CVE-2026-5685Tenda CX12L addressNat fromAddressNat stack-based overflow8.7CNA v4.01.0%2026-04-06
CVE-2026-5684Tenda CX12L webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow8.6CNA v4.00.7%2026-04-06
CVE-2026-5683Tenda CX12L P2pListFilter fromP2pListFilter stack-based overflow8.0v3.10.6%2026-04-06
CVE-2026-5682Meesho Online Shopping App com.Meesho.supply endpoint risky encryption6.3CNA v4.00.3%2026-04-06
CVE-2026-5681itsourcecode sanitize or validate this input parameter borrowedequip.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5679Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection5.1CNA v4.02.5%2026-04-06
CVE-2026-5678Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection6.9CNA v4.02.1%2026-04-06
CVE-2026-5677Totolink A7100RU cstecgi.cgi CsteSystem os command injection6.9CNA v4.02.1%2026-04-06
CVE-2026-5676Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication6.9CNA v4.00.7%2026-04-06
CVE-2026-5675itsourcecode Construction Management System parameter borrowed_tool.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5673Xiph Theora libtheora: Libtheora: Denial of service or information disclosure7.1NVD v3.10.2%2026-04-06
CVE-2026-5672code-projects Simple IT Discussion Forum parameter edit-category.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5671Cyber-III Student-Management-System Class Schedule Deletion Endpoint cross-site scripting5.3CNA v4.00.4%2026-04-06
CVE-2026-5670Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload5.3CNA v4.00.3%2026-04-06
CVE-2026-5669Cyber-III Student-Management-System parameter login.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5668Cyber-III Student-Management-System add%20notice.php cross-site scripting4.8CNA v4.00.4%2026-04-06
CVE-2026-5666code-projects Online FIR System SQL Database Backup file complaints.sql sensitive information6.9CNA v4.00.5%2026-04-06
CVE-2026-5665code-projects Online FIR System Login checklogin.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5663OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection9.8v3.12.8%2026-04-06Fix
CVE-2026-5661Free5GC NGSetupRequest denial of service6.9CNA v4.00.7%2026-04-06
CVE-2026-5660itsourcecode Construction Management System parameter borrowed_equip.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5659pytries datrie trie file datrie.pyx Trie.__setstate__ deserialization5.3CNA v4.00.5%2026-04-06
CVE-2026-5650code-projects Online Application System for Admission oas.sql sensitive information6.9CNA v4.00.5%2026-04-06
CVE-2026-5649code-projects Online Application System for Admission endpoint admsnform.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5648code-projects Simple Laundry System parameter userfinishregister.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5647code-projects Online Shoe Store Add Product admin_feature.php cross-site scripting4.8CNA v4.00.4%2026-04-06
CVE-2026-5646code-projects Easy Blog Site login.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5645Projectworlds Car Rental System parameter pay.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5644Cyber-III Student-Management-System batch-notice.php cross-site scripting4.8CNA v4.00.4%2026-04-06
CVE-2026-5643Cyber-III Student-Management-System Admin Add endpoint notice.php cross-site scripting4.8CNA v4.00.4%2026-04-06
CVE-2026-5642Cyber-III Student-Management-System HTTP POST request update.php improper authorization6.9CNA v4.00.5%2026-04-06
CVE-2026-5641PHPGurukul Online Shopping Portal Project parameter update-image1.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5640PHPGurukul Online Shopping Portal Project parameter update-image2.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5639PHPGurukul Online Shopping Portal Project parameter update-image3.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5638HerikLyma CPPWebFramework path traversal6.9CNA v4.00.7%2026-04-06
CVE-2026-5637Projectworlds Car Rental System parameter message_admin.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5636PHPGurukul Online Shopping Portal Project parameter cancelorder.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5635PHPGurukul Online Shopping Portal Project parameter categorywise-products.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5634Projectworlds Car Rental Project parameter book_car.php SQL injection6.9CNA v4.00.4%2026-04-06
CVE-2026-5633assafelovic gpt-researcher ws endpoint server-side request forgery6.9CNA v4.00.5%2026-04-06
CVE-2026-5632assafelovic gpt-researcher HTTP REST API endpoint missing authentication6.9CNA v4.00.7%2026-04-06
CVE-2026-5631assafelovic gpt-researcher ws endpoint server_utils.py extract_command_data code injection6.9CNA v4.00.5%2026-04-06
CVE-2026-5630assafelovic gpt-researcher Report API app.py cross-site scripting5.3CNA v4.00.4%2026-04-06
CVE-2026-5629Belkin F9K1015 formSetFirewall stack-based overflow8.7CNA v4.01.1%2026-04-06
CVE-2026-5628Belkin F9K1015 setting formSetSystemSettings stack-based overflow8.7CNA v4.01.1%2026-04-06
CVE-2026-5625assafelovic gpt-researcher WebSocket researcher.py cross-site scripting5.3CNA v4.00.4%2026-04-06
CVE-2026-5624ProjectSend upload.php cross-site request forgery5.3CNA v4.00.2%2026-04-06Fix
CVE-2026-5623hcengineering Huly Platform Import endpoint index.ts server-side request forgery5.3CNA v4.00.3%2026-04-06
CVE-2026-5622hcengineering Huly Platform JWT Token token.ts hard-coded key6.3CNA v4.00.4%2026-04-06
CVE-2026-5621ChrisChinchilla Vale-MCP HTTP index.ts os command injection4.8CNA v4.01.4%2026-04-06
CVE-2026-5620itsourcecode Construction Management System parameter borrowed_equip_report.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5619Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection4.8CNA v4.01.4%2026-04-06
CVE-2026-5618kalcaddle kodbox shareMake/shareCheck server-side request forgery6.3CNA v4.00.4%2026-04-06
CVE-2026-5616JeecgBoot AI Chat JeecgBizToolsProvider.java missing authentication6.9CNA v4.00.7%2026-04-06
CVE-2026-5615givanz Vvvebjs file upload endpoint upload.php cross-site scripting5.3CNA v4.01.0%2026-04-06NucleiExploit code
CVE-2026-5614Belkin F9K1015 formSetPassword stack-based overflow8.7CNA v4.01.5%2026-04-06
CVE-2026-5613Belkin F9K1015 formReboot stack-based overflow8.7CNA v4.01.1%2026-04-06
CVE-2026-5612Belkin F9K1015 formWlEncrypt stack-based overflow8.7CNA v4.01.1%2026-04-06
CVE-2026-5611Belkin F9K1015 formCrossBandSwitch stack-based overflow8.7CNA v4.01.1%2026-04-06
CVE-2026-5610Belkin F9K1015 formWISP5G stack-based overflow8.7CNA v4.01.1%2026-04-06
CVE-2026-5609Tenda i12 parameter wifiSSIDset formwrlSSIDset stack-based overflow8.7CNA v4.01.0%2026-04-06
CVE-2026-5608Belkin F9K1122 formWlanSetup stack-based overflow8.7CNA v4.01.1%2026-04-06
CVE-2026-5607imprvhub mcp-browser-agent URL parameter handler server-side request forgery5.3CNA v4.00.5%2026-04-06
CVE-2026-5606PHPGurukul Online Shopping Portal Project parameter order-details.php SQL injection5.3CNA v4.00.3%2026-04-06
CVE-2026-5605Tenda CH22 WrlExtraSet formWrlExtraSet stack-based overflow8.7CNA v4.00.9%2026-04-06
CVE-2026-3524Authorization bypass in Mattermost Legal Hold plugin due to Missing Return after Permission Check8.3CNA v3.10.4%2026-04-06Fix
CVE-2026-0049Google Android LocalImageResolver.java denial of service6.2CISA ADP v3.10.1%2026-04-06Exploit codeFix
CVE-2026-35679zcashd improperly implemented security check3.5CNA v3.10.3%2026-04-05Fix
CVE-2026-5604Tenda CH22 Parameter CertLocalPrecreate formCertLocalPrecreate stack-based overflow8.7CNA v4.00.9%2026-04-05
CVE-2026-5603elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection4.8CNA v4.01.1%2026-04-05
CVE-2026-5602Nor2-io heim-mcp new_heim_application tools.ts registerTools os command injection4.8CNA v4.01.1%2026-04-05
CVE-2026-5601Acrel Electrical Prepaid Cloud Platform Backup file bin.rar information disclosure6.9CNA v4.00.5%2026-04-05
CVE-2026-5599pretix Venueless API allows deletion of users of other instance7.3CNA v4.00.4%2026-04-05Fix
CVE-2026-5597griptape-ai griptape ComputerTool tool.py path traversal5.3CNA v4.00.5%2026-04-05
CVE-2026-5596griptape-ai griptape SqlTool tool.py SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5595griptape-ai griptape FileManagerTool save_memory_artifacts_to_disk path traversal5.3CNA v4.00.5%2026-04-05
CVE-2026-5594premAI-io premsql followup.py eval code injection5.3CNA v4.00.4%2026-04-05
CVE-2026-5590zephyrproject-rtos Zephyr net: Ip/tcp: Null pointer dereference can be triggered by a race condition6.4CNA v3.10.3%2026-04-05
CVE-2026-5587wbbeyourself MAC-SQL Refiner agent agents.py _execute_sql SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5586zhongyu09 openchatbi Multi-stage Text2SQL Workflow SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5585Tencent AI-Infra-Guard Task Detail endpoint task_manager.go information disclosure7.5v3.10.8%2026-04-05
CVE-2026-5584Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection9.8v3.10.7%2026-04-05
CVE-2026-5583PHPGurukul Online Shopping Portal Project parameter my-profile.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5580CodeAstro Online Classroom parameter addvideos.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5579CodeAstro Online Classroom parameter updatedetailsfromfaculty.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5578CodeAstro Online Classroom parameter addassessment.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5577Song-Li cross_browser details endpoint uniquemachine_app.py SQL injection8.6v3.10.5%2026-04-05
CVE-2026-5576SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload5.1CNA v4.00.4%2026-04-05
CVE-2026-5575SourceCodester/jkev Record Management System Login index.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5574Technostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorization9.1v3.10.7%2026-04-05
CVE-2026-5573Technostrobe HI-LED-WR120-G2 fs unrestricted upload9.8v3.10.7%2026-04-05
CVE-2026-5572Technostrobe HI-LED-WR120-G2 cross-site request forgery5.3CNA v4.00.3%2026-04-05
CVE-2026-5571Technostrobe HI-LED-WR120-G2 Configuration Data fs information disclosure7.5v3.10.7%2026-04-05
CVE-2026-5570Technostrobe HI-LED-WR120-G2 LoginCB index_config improper authentication9.8v3.11.0%2026-04-05
CVE-2026-5569Technostrobe HI-LED-WR120-G2 endpoint access control9.8v3.10.7%2026-04-05
CVE-2026-5568Akaunting Invoice/Billing cross-site scripting5.1CNA v4.00.3%2026-04-05
CVE-2026-5567Tenda M3 Destination setAdvPolicyData buffer overflow8.7CNA v4.01.0%2026-04-05
CVE-2026-5566UTT HiPER 1250GW formNatStaticMap strcpy buffer overflow8.7CNA v4.00.8%2026-04-05
CVE-2026-5565code-projects Simple Laundry System parameter delmemberinfo.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5564code-projects Simple Laundry System parameter searchguest.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5563AutohomeCorp frostmourne Alarm Preview previewData httpTest SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5562provectus kafka-ui endpoint testexecutions validateAccess code injection9.8v3.13.4%2026-04-05Nuclei
CVE-2026-5561Campcodes Complete POS Management and Inventory System injection5.3CNA v4.00.4%2026-04-05
CVE-2026-5560PHPGurukul Online Shopping Portal Project parameter payment-method.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5559PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py5.3CNA v4.00.4%2026-04-05
CVE-2026-5558PHPGurukul PHPGurukul Online Shopping Portal Project parameter pending-orders.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5557badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass5.3CNA v4.00.5%2026-04-05
CVE-2026-5556badlogic pi-mono loader.ts discoverAndLoadExtensions code injection5.3CNA v4.00.4%2026-04-05
CVE-2026-5555code-projects Concert Ticket Reservation System parameter login.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5554code-projects Concert Ticket Reservation System parameter process_search.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5553itsourcecode Online Cellphone System parameter available.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5552PHPGurukul Online Shopping Portal Project parameter sub-category.php SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5551itsourcecode Free Hotel Reservation System parameter login.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5550Tenda AC10 httpd fromSysToolChangePwd stack-based overflow8.7CNA v4.01.0%2026-04-05
CVE-2026-5549Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded key7.5v3.10.7%2026-04-05
CVE-2026-5548Tenda AC10 httpd fromSysToolChangePwd stack-based overflow8.7CNA v4.00.8%2026-04-05
CVE-2026-5547Tenda AC10 httpd formAddMacfilterRule os command injection8.8v3.14.1%2026-04-05
CVE-2026-5546Campcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted upload5.3CNA v4.00.3%2026-04-05
CVE-2026-5544UTT HiPER 1250GW formRemoteControl stack-based overflow8.7CNA v4.00.8%2026-04-05
CVE-2026-5543PHPGurukul User Registration and Login and User Management System SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5542code-projects Simple Laundry System parameter modstaffinfo.php cross-site scripting5.3CNA v4.00.4%2026-04-05
CVE-2026-5541code-projects Simple Laundry System parameter modmemberinfo.php cross-site scripting5.3CNA v4.00.4%2026-04-05
CVE-2026-5540code-projects Simple Laundry System parameter modifymember.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5539code-projects Simple Laundry System parameter modifymember.php cross-site scripting5.3CNA v4.00.4%2026-04-05
CVE-2026-5538QingdaoU OnlineJudge judge server heartbeat endpoint server-side request forgery5.3CNA v4.00.3%2026-04-05
CVE-2026-5537halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel SQL injection5.3CNA v4.00.3%2026-04-05
CVE-2026-5536FedML-AI FedML gRPC server grpc_server.py sendMessage deserialization6.9CNA v4.00.6%2026-04-05
CVE-2026-5535FedML-AI FedML MQTT Message FileUtils.java path traversal5.4v3.10.7%2026-04-05
CVE-2026-5534itsourcecode Online Enrollment System parameter index.php SQL injection6.9CNA v4.00.4%2026-04-05
CVE-2026-5533badlogic pi-mono SVG Artifact SvgArtifact.ts cross-site scripting5.3CNA v4.00.4%2026-04-05
CVE-2026-5532scrapegraph-ai code sandbox execution OS command injection5.3CNA v4.02.2%2026-04-05
CVE-2026-5531SourceCodester Student Result Management System cleartext storage of sensitive information6.9CNA v4.00.3%2026-04-05
CVE-2026-5530Ollama Model Pull API download.go server-side request forgery5.3CNA v4.00.3%2026-04-05Exploit code
CVE-2026-5529Dromara lamp-cloud DefUserController pageUser improper authorization5.3CNA v4.00.3%2026-04-05
CVE-2026-5528MoussaabBadla code-screenshot-mcp HTTP os command injection5.3CNA v4.02.4%2026-04-05
CVE-2026-5527Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key6.9CNA v4.00.6%2026-04-05
CVE-2026-4272Honeywell Barcode Scanners Bluetooth Remote Execution of System commands vulnerability8.1CNA v3.10.5%2026-04-05Fix
CVE-2026-35616Fortinet FortiClient EMS improper access control9.1CNA v3.194.0%2026-04-04KEVNucleiExploit codeFix
CVE-2026-34955PraisonAI: Sandbox escape via shell=True and Bypassable Blocklist in SubprocessSandbox8.8CNA v3.10.4%2026-04-04Fix
CVE-2026-34780Electron: Context Isolation bypass via contextBridge VideoFrame transfer8.4CNA v3.10.4%2026-04-04Fix
CVE-2026-34779Electron: AppleScript injection in app.moveToApplicationsFolder on macOS6.5CNA v3.10.2%2026-04-04Fix
CVE-2026-34778Electron: Service worker can spoof executeJavaScript IPC replies5.9CNA v3.10.1%2026-04-04Fix
CVE-2026-34777Electron: Incorrect origin passed to permission request handler for iframe requests5.4CNA v3.10.1%2026-04-04Fix
CVE-2026-34776Electron: Out-of-bounds read in second-instance IPC on macOS and Linux5.3CNA v3.10.2%2026-04-04Fix
CVE-2026-34775Electron: NodeIntegrationInWorker not correctly scoped in shared renderer processes6.8CNA v3.10.4%2026-04-04Fix
CVE-2026-34773Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows4.7CNA v3.10.3%2026-04-04Fix
CVE-2026-34772Electron download save dialog use-after-free5.8CNA v3.10.2%2026-04-04Fix
CVE-2026-34770Electron PowerMonitor module use-after-free7.0CNA v3.10.3%2026-04-04Fix
CVE-2026-34768Electron: Unquoted executable path in app.setLoginItemSettings on Windows3.9CNA v3.10.1%2026-04-04Fix
CVE-2026-34767Electron: HTTP Response header injection in custom protocol handlers and webRequest5.9CNA v3.10.3%2026-04-04Fix
CVE-2026-34766Electron: USB device selection not validated against filtered device list3.3CNA v3.10.2%2026-04-04Fix
CVE-2026-5526Tenda 4G03 Pro httpd access control9.8v3.10.6%2026-04-04
CVE-2026-5425Widgets for Social Photo Feed WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-04-04Fix
CVE-2026-4896WCFM WordPress plugin insecure direct object reference8.1CNA v3.10.5%2026-04-04Fix
CVE-2026-3666wpForo Forum WordPress plugin authenticated (Subscriber+) arbitrary file deletion via post Body8.8CNA v3.10.6%2026-04-04Fix
CVE-2026-3571Pie Register WordPress plugin unauthorized access6.5CNA v3.10.4%2026-04-04Fix
CVE-2026-3445ProfilePress checkout process missing authorization7.1CNA v3.10.3%2026-04-04Fix
CVE-2026-3309ProfilePress checkout billing fields code injection6.5CNA v3.10.4%2026-04-04Fix
CVE-2026-2949Xpro Addons 140+ Widgets for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-04Fix
CVE-2026-2936Visitor Traffic Real Time Statistics WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-04-04Fix
CVE-2026-2924Gutenverse Ultimate WordPress FSE Blocks Addons and Ecosystem plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-04Fix
CVE-2026-2826Kadence Blocks WordPress plugin authorization bypass4.3CNA v3.10.3%2026-04-04Fix
CVE-2026-2600ElementsKit Elementor Addons and Templates WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-04Exploit codeFix
CVE-2026-2437WP Travel Engine - Travel and Tour Booking WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-04Fix
CVE-2026-1233Text to Speech for WP (AI Voices by Mementor) WordPress plugin information disclosure7.5CNA v3.10.3%2026-04-04Fix
CVE-2026-0738Shortcodes Ultimate WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-04Fix
CVE-2026-0737Shortcodes Ultimate WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-04Fix
CVE-2026-0664Royal Elementor Addons WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-04Fix
CVE-2026-0626WPFunnels WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-04Fix
CVE-2026-0552Simple Shopping Cart WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-04Fix
CVE-2026-35562Allocation of resources without limits in parsing components in Amazon Athena ODBC driver8.7CNA v4.00.7%2026-04-03Fix
CVE-2026-35561Amazon Athena ODBC driver browser-based authentication missing authorization9.1CNA v4.00.7%2026-04-03Fix
CVE-2026-35560Amazon Athena ODBC driver identity provider connection components improper certificate validation9.1CNA v4.00.4%2026-04-03Fix
CVE-2026-35559Out-of-bounds write in query processing components in Amazon Athena ODBC driver7.1CNA v4.00.5%2026-04-03Fix
CVE-2026-35558Amazon Athena ODBC driver authentication components improper neutralization7.3CNA v4.00.3%2026-04-03Fix
CVE-2026-35549MariaDB excessive memory allocation6.5CNA v3.10.5%2026-04-03Fix
CVE-2026-35545Roundcube Webmail incorrect resource transfer8.2v3.10.4%2026-04-03Fix
CVE-2026-35544Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages5.3CNA v3.10.5%2026-04-03Fix
CVE-2026-35543Roundcube Webmail: Bypass of remote image blocking via SVG content in an e-mail message5.3CNA v3.10.5%2026-04-03Fix
CVE-2026-35542Roundcube: Bypass of remote image blocking via crafted BODY background attribute5.3CNA v3.10.5%2026-04-03Fix
CVE-2026-35541Roundcube Webmail: Incorrect password comparison in the password plugin4.2CNA v3.10.3%2026-04-03Fix
CVE-2026-35540Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages6.5v3.10.4%2026-04-03Fix
CVE-2026-35539Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode6.1CNA v3.10.4%2026-04-03Fix
CVE-2026-35538Roundcube Webmail: Unsanitized IMAP SEARCH command arguments3.1CNA v3.10.4%2026-04-03Fix
CVE-2026-35537Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler7.5v3.10.5%2026-04-03Fix
CVE-2026-35536Tornado has incomplete validation of cookie attributes5.3NVD v3.10.3%2026-04-03Fix
CVE-2026-35535sudo privilege escalation7.8v3.10.2%2026-04-03Fix
CVE-2026-35508milesmcc Shynet cross-site scripting6.1v3.10.2%2026-04-03Fix
CVE-2026-35507milesmcc Shynet use of a less trusted source6.5v3.10.1%2026-04-03Fix
CVE-2026-35468Nimiq core-rs-albatross history index request handlers unchecked return value5.3CNA v3.10.6%2026-04-03Fix
CVE-2026-35218Budibase builder command palette stored cross-site scripting8.7CNA v3.10.4%2026-04-03Fix
CVE-2026-35216Budibase: Unauthenticated remote code execution via Webhook Trigger and Bash Automation Step9.1CNA v3.11.2%2026-04-03Fix
CVE-2026-35214Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write8.7CNA v3.10.7%2026-04-03Fix
CVE-2026-34990OpenPrinting CUPS: Local print admin token disclosure using temporary printers5.0CNA v4.00.2%2026-04-03Exploit codeKCVFix
CVE-2026-34980OpenPrinting CUPS PostScript print queue remote code execution6.1CNA v4.00.3%2026-04-03KCVFix
CVE-2026-34979OpenPrinting CUPS: Heap overflow in `get_options`5.3CNA v3.10.4%2026-04-03Fix
CVE-2026-34978OpenPrinting CUPS RSS notifier path traversal6.5CNA v3.10.4%2026-04-03Fix
CVE-2026-34954PraisonAI: SSRF in FileTools.download_file via Unvalidated URL8.6CNA v3.10.4%2026-04-03Fix
CVE-2026-34953PraisonAI: Authentication bypass in OAuthManager.validate_token9.1CNA v3.10.4%2026-04-03Fix
CVE-2026-34952PraisonAI: Missing authentication in WebSocket Gateway9.1CNA v3.10.5%2026-04-03Fix
CVE-2026-34947Discourse: Staged user custom fields are exposed on public invite pages2.7CNA v4.00.4%2026-04-03Fix
CVE-2026-34939PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools6.5CNA v3.10.4%2026-04-03Fix
CVE-2026-34938PraisonAI: Python sandbox escape via str Subclass startswith Override in execute_code10.0CNA v3.10.8%2026-04-03Fix
CVE-2026-34937PraisonAI: Shell injection in run_python via Unescaped $ Substitution7.8CNA v3.10.6%2026-04-03Fix
CVE-2026-34936PraisonAI: SSRF via Unvalidated api_base in passthrough Fallback7.7CNA v3.10.4%2026-04-03Fix
CVE-2026-34935PraisonAI: OS command injection in MCPHandler.parse_mcp_command9.8CNA v3.11.0%2026-04-03Fix
CVE-2026-34934PraisonAI: Second-order SQL injection in `get_all_user_threads`9.8CNA v3.10.6%2026-04-03Fix
CVE-2026-34933Avahi: Reachable assertion in `transport_flags_from_domain`5.5CNA v3.10.2%2026-04-03Fix
CVE-2026-34824Mesop: Unbounded Thread Creation in WebSocket handler leads to denial of service7.5CNA v3.10.7%2026-04-03Fix
CVE-2026-34788Emlog: SQL injection in tag_model::updateTagName via unsanitized parameters6.5CNA v3.10.4%2026-04-03
CVE-2026-34787Emlog: Local file inclusion in plugin.php via unsanitized plugin parameter6.5CNA v3.10.6%2026-04-03
CVE-2026-34774Electron offscreen child window rendering use-after-free8.1CNA v3.10.6%2026-04-03Fix
CVE-2026-34771Electron WebContents permission request handler use-after-free7.5CNA v3.10.4%2026-04-03Fix
CVE-2026-34769Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference7.8CNA v3.10.4%2026-04-03Fix
CVE-2026-34612Kestra: Remote code execution via SQL injection10.0CNA v3.10.7%2026-04-03Fix
CVE-2026-34607Emlog: Path traversal in emUnZip allows arbitrary file write leading to RCE7.2CNA v3.10.9%2026-04-03
CVE-2026-34511OpenClaw PKCE Verifier Exposure via OAuth State parameter5.9v3.10.4%2026-04-03Fix
CVE-2026-34229Emlog: Stored XSS in Comment module via URI Scheme Validation Bypass6.1CNA v3.10.3%2026-04-03Fix
CVE-2026-34228Emlog backend upgrade interface cross-site request forgery8.7CNA v4.00.2%2026-04-03Fix
CVE-2026-34061Nimiq/core-rs-albatross: Macro block proposal interlink bug4.9CNA v3.10.3%2026-04-03Fix
CVE-2026-34052LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (denial of service)5.9CNA v3.10.4%2026-04-03Fix
CVE-2026-33709JupyterHub has an open redirect5.1CNA v4.00.3%2026-04-03Fix
CVE-2026-33184Nimiq Core-rs-albatross discovery handshake handler integer underflow7.5CNA v3.10.6%2026-04-03Fix
CVE-2026-33175OAuthenticator: Authentication bypass in Auth0OAuthenticator via Unverified Email Claims8.8CNA v3.10.6%2026-04-03Fix
CVE-2026-32662Gardyn Cloud API active debug code6.9CNA v4.00.4%2026-04-03Exploit codeFix
CVE-2026-32646Gardyn Cloud API missing authentication for critical function8.7CNA v4.00.7%2026-04-03Fix
CVE-2026-32186Microsoft Bing elevation of privilege10.0CNA v3.10.9%2026-04-03Fix
CVE-2026-31818Budibase: Server-side request forgery via REST Connector with Empty Default Blacklist9.6CNA v3.10.4%2026-04-03Fix
CVE-2026-31403Linux kernel NFSD exports proc file vulnerability7.8CNA v3.10.2%2026-04-03Fix
CVE-2026-31402Linux kernel NFSv4.0 LOCK replay cache out-of-bounds write9.8CNA v3.11.2%2026-04-03Exploit codeFix
CVE-2026-31401Linux kernel HID-BPF hid_hw_request out-of-bounds write7.8CNA v3.10.2%2026-04-03Fix
CVE-2026-31400Linux kernel SunRPC cache request handling memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-31399Linux kernel NVDIMM bus device registration use-after-free7.8v3.10.1%2026-04-03Fix
CVE-2026-31398Linux kernel rmap folio unmapping reachable assertion7.8CNA v3.10.2%2026-04-03Fix
CVE-2026-31397Linux kernel huge page migration null pointer dereference7.8CNA v3.10.2%2026-04-03Fix
CVE-2026-31396Linux kernel macb PTP clock use-after-free7.8CNA v3.10.2%2026-04-03Fix
CVE-2026-31395Linux kernel bnxt_en out-of-bounds access7.1v3.10.1%2026-04-03Fix
CVE-2026-31394Linux kernel mac80211 AP_VLAN stations null pointer dereference5.5v3.10.1%2026-04-03Fix
CVE-2026-31393Linux kernel L2CAP information response out-of-bounds read8.1CNA v3.10.4%2026-04-03Fix
CVE-2026-31392Linux kernel SMB client krb5 mount vulnerability8.1CNA v3.10.2%2026-04-03Fix
CVE-2026-31391Linux kernel atmel-sha204a driver memory leak5.5NVD v3.10.2%2026-04-03Fix
CVE-2026-31390Linux kernel Xe GPU driver madvise ioctl memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-31389Linux kernel SPI controller registration use-after-free7.8CNA v3.10.2%2026-04-03Fix
CVE-2026-28815Apple macOS Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length7.5v3.10.5%2026-04-03Fix
CVE-2026-28798Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS9.1CNA v3.10.5%2026-04-03Fix
CVE-2026-28797RAGFlow agent text processing component server-side template injection8.7CNA v4.00.6%2026-04-03
CVE-2026-28767Gardyn Cloud API missing authentication for critical function5.3v3.10.5%2026-04-03Exploit codeFix
CVE-2026-28766Gardyn Cloud API missing authentication for critical function7.5NVD v3.10.6%2026-04-03Fix
CVE-2026-28756Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-28754Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-28736Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)4.3CNA v3.10.3%2026-04-03
CVE-2026-28703Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-28373Stackfield path traversal9.6CISA ADP v3.10.6%2026-04-03
CVE-2026-27885Piwigo: SQL injection in Activity.getList7.2CNA v3.10.5%2026-04-03Fix
CVE-2026-27834Piwigo: SQL injection in pwg.users.getList API method via filter parameter7.2CNA v3.10.5%2026-04-03Fix
CVE-2026-27833Piwigo: Unauthenticated information disclosure via pwg.history.search API7.5CNA v3.11.7%2026-04-03NucleiFix
CVE-2026-27655Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-27634Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter8.7CNA v4.00.8%2026-04-03Fix
CVE-2026-27481Discourse: Hidden tag visibility bypass on tag routes6.3CNA v4.00.4%2026-04-03Fix
CVE-2026-27456util-linux mount loop device setup race condition4.7CNA v3.10.1%2026-04-03Fix
CVE-2026-27447OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup4.8CNA v3.10.3%2026-04-03Fix
CVE-2026-27124FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates confused deputy8.2CNA v4.00.3%2026-04-03Fix
CVE-2026-26477DokuWiki resource exhaustion7.5CISA ADP v3.10.6%2026-04-03Fix
CVE-2026-26058Zulip: Path traversal in Import6.1CNA v3.10.2%2026-04-03Fix
CVE-2026-25773Focalboard Second-order SQL injection in category reorder endpoint allows data exfiltration8.1CNA v3.10.4%2026-04-03
CVE-2026-25742Zulip: Anonymous File Access after Disabling Spectator Access5.3CNA v3.10.4%2026-04-03Fix
CVE-2026-25726Cloudreve is vulnerable to account takeover8.1CNA v3.10.5%2026-04-03Fix
CVE-2026-25197Gardyn Cloud API authorization bypass through user-controlled key8.1NVD v3.10.3%2026-04-03Exploit codeFix
CVE-2026-25118Immich shared album authentication information disclosure6.3CNA v4.00.4%2026-04-03Fix
CVE-2026-25044Budibase: Command injection in Bash Automation Step8.7CNA v4.00.5%2026-04-03Fix
CVE-2026-25043Budibase: Unauthenticated Password Reset endpoint lacks Rate Limiting, Enabling Email Flooding5.3CNA v3.10.3%2026-04-03Fix
CVE-2026-23475Linux kernel SPI controller statistics null pointer dereference5.5NVD v3.10.1%2026-04-03Fix
CVE-2026-23474Linux kernel RedBoot partition table parser vulnerability5.5NVD v3.10.1%2026-04-03Fix
CVE-2026-23472Linux kernel serial core write path infinite loop5.5NVD v3.10.1%2026-04-03Fix
CVE-2026-23470Linux kernel Imagination GPU driver soft reset deadlock5.5v3.10.1%2026-04-03Fix
CVE-2026-23469Linux kernel Imagination GPU driver runtime power management race condition4.7v3.10.1%2026-04-03Fix
CVE-2026-23468Linux kernel amdgpu BO list handling denial of service5.5v3.10.1%2026-04-03Fix
CVE-2026-23467Linux kernel i915 display DMC driver null pointer dereference5.5v3.10.1%2026-04-03Fix
CVE-2026-23466Linux kernel Xe graphics driver GGTT access vulnerability7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23465Linux kernel Btrfs directory logging vulnerability5.5v3.10.1%2026-04-03Fix
CVE-2026-23464Linux kernel mpfs memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-23463Linux kernel qbman race condition4.7NVD v3.10.1%2026-04-03Fix
CVE-2026-23462Linux kernel Bluetooth HIDP use-after-free8.8CNA v3.10.3%2026-04-03Fix
CVE-2026-23461Linux kernel Bluetooth L2CAP use-after-free8.8CNA v3.10.2%2026-04-03Fix
CVE-2026-23460Linux kernel ROSE socket layer null pointer dereference5.5v3.10.1%2026-04-03Fix
CVE-2026-23459Linux kernel IP tunnel statistics vulnerability8.2CNA v3.10.4%2026-04-03Fix
CVE-2026-23458Linux kernel ctnetlink dump use-after-free7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23457Linux kernel SIP conntrack helper vulnerability8.6CNA v3.10.4%2026-04-03Fix
CVE-2026-23456Linux kernel H.323 conntrack helper out-of-bounds read8.2CNA v3.10.5%2026-04-03Fix
CVE-2026-23455Linux kernel H.323 conntrack helper out-of-bounds read9.1CNA v3.11.3%2026-04-03Fix
CVE-2026-23454Linux kernel mana hardware channel use-after-free7.0NVD v3.10.1%2026-04-03Fix
CVE-2026-23453Linux kernel icssg-prueth XDP driver memory leak7.5CNA v3.10.3%2026-04-03Fix
CVE-2026-23452Linux kernel runtime power management race condition4.7NVD v3.10.1%2026-04-03Fix
CVE-2026-23451Linux kernel bonding driver header parser infinite loop7.5CNA v3.10.4%2026-04-03Fix
CVE-2026-23450Linux kernel SMC protocol TCP handling use-after-free9.8CNA v3.10.4%2026-04-03Fix
CVE-2026-23449Linux kernel teql double free7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23448Linux kernel cdc_ncm NDP16 parsing vulnerability7.8v3.10.1%2026-04-03Fix
CVE-2026-23447Linux kernel cdc_ncm NDP32 parsing out-of-bounds read7.8v3.10.1%2026-04-03Fix
CVE-2026-23446Linux kernel aqc111 USB Ethernet driver vulnerability5.5NVD v3.10.1%2026-04-03Fix
CVE-2026-23445Linux kernel igc XDP TX timestamping vulnerability7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23444Linux kernel mac80211 TX path memory leak7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23443Linux kernel ACPI processor piix4 errata handling use-after-free5.5v3.10.1%2026-04-03Fix
CVE-2026-23442Linux kernel IPv6 SRv6 handling null pointer dereference5.5NVD v3.10.1%2026-04-03Fix
CVE-2026-23441Linux kernel mlx5e IPsec ASO context race condition4.7v3.10.1%2026-04-03Fix
CVE-2026-23440Linux kernel mlx5e IPsec ESN handling race condition7.5CNA v3.10.2%2026-04-03Fix
CVE-2026-23439Linux kernel FOU tunnel driver null pointer dereference5.5NVD v3.10.1%2026-04-03Fix
CVE-2026-23438Linux kernel mvpp2 flow control null pointer dereference5.5NVD v3.10.1%2026-04-03Fix
CVE-2026-23437Linux kernel net shaper subsystem vulnerability7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23436Linux kernel net shaper subsystem vulnerability5.5v3.10.1%2026-04-03Fix
CVE-2026-23435Linux kernel x86 PMU driver null pointer dereference5.5v3.10.1%2026-04-03Fix
CVE-2026-23434Linux kernel raw NAND lock/unlock operations race condition7.1CNA v3.10.1%2026-04-03Fix
CVE-2026-23433Linux kernel Arm MPAM bandwidth counters null pointer dereference5.5v3.10.1%2026-04-03Fix
CVE-2026-23432Linux kernel mshv use-after-free7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23431Linux kernel Amlogic SPISG SPI driver memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-23430Linux kernel vmwgfx KMS surface dirty tracker memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-23429Linux kernel iommu/sva crash7.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23428Linux kernel ksmbd compound request handling use-after-free9.8CNA v3.10.3%2026-04-03Fix
CVE-2026-23427Linux kernel ksmbd durable handle replay use-after-free9.8CNA v3.10.3%2026-04-03Fix
CVE-2026-23426Linux kernel logicvc display driver vulnerability5.5v3.10.1%2026-04-03Fix
CVE-2026-23425Linux kernel KVM arm64 pKVM guest ID registers vulnerability8.8CNA v3.10.1%2026-04-03Fix
CVE-2026-23424Linux kernel amdxdna accelerator command buffer vulnerability7.1CNA v3.10.1%2026-04-03Fix
CVE-2026-23423Linux kernel Btrfs io_uring encoded read memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-23422Linux kernel dpaa2-switch interrupt handler vulnerability7.8NVD v3.10.1%2026-04-03Fix
CVE-2026-23421Linux kernel Xe GPU driver configfs memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-23420Linux kernel wlcore Wi-Fi driver improper locking5.5v3.10.1%2026-04-03Fix
CVE-2026-23419Linux kernel RDS TCP transport vulnerability7.5CNA v3.10.2%2026-04-03Fix
CVE-2026-23418Linux kernel drm/xe/reg_sr memory leak5.5v3.10.1%2026-04-03Fix
CVE-2026-22665prompts.chat Identity Confusion via Case-Sensitive Username Handling8.6CNA v4.00.3%2026-04-03
CVE-2026-22664prompts.chat SSRF via Fal.ai Media Status Polling7.1CNA v4.00.3%2026-04-03
CVE-2026-22663prompts.chat authorization bypass information disclosure8.7CNA v4.00.3%2026-04-03
CVE-2026-22662prompts.chat blind SSRF via media-generate5.3CNA v4.00.2%2026-04-03
CVE-2026-22661prompts.chat path traversal via Skill File Handling8.6CNA v4.00.4%2026-04-03
CVE-2026-5485OS command injection in Amazon Athena ODBC driver on Linux7.3CNA v4.01.1%2026-04-03Fix
CVE-2026-5484BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control6.9CNA v4.00.6%2026-04-03Fix
CVE-2026-5476NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow4.6v3.10.3%2026-04-03
CVE-2026-5475NASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruption5.5v3.10.3%2026-04-03
CVE-2026-5474NASA cFS CCSDS Packet header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflow8.8v3.10.6%2026-04-03
CVE-2026-5473NASA cFS Pickle pickle.load deserialization7.0v3.10.4%2026-04-03
CVE-2026-5472ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload5.3CNA v4.00.3%2026-04-03
CVE-2026-5471Investory Toy Planet Trouble App hard-coded configuration key vulnerability4.8CNA v4.00.1%2026-04-03
CVE-2026-5470Google-Research-MCP content extractor service server-side request forgery5.3CNA v4.00.3%2026-04-03
CVE-2026-5469Casdoor Webhook URL server-side request forgery7.2v3.10.6%2026-04-03
CVE-2026-5468Casdoor dangerouslySetInnerHTML cross-site scripting5.4v3.10.3%2026-04-03
CVE-2026-5467Casdoor OAuth Authorization request redirect6.1v3.10.4%2026-04-03
CVE-2026-5463pymetasploit3 command injection via Newline injection in console.run_module_with_output9.8v3.13.4%2026-04-03
CVE-2026-5462Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key4.8CNA v4.00.2%2026-04-03
CVE-2026-5458Noelse Individuals and Pro App com.afone.Noelse BuildConfig.java hard-coded key4.8CNA v4.00.1%2026-04-03
CVE-2026-5457PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key4.8CNA v4.00.1%2026-04-03
CVE-2026-5456Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key4.8CNA v4.00.1%2026-04-03
CVE-2026-5455Dialogue App ca.diagram.dialogue config.json hard-coded key4.8CNA v4.00.1%2026-04-03
CVE-2026-5454GRID Organiser App co.gridapp.Organiser App.json hard-coded key4.8CNA v4.00.1%2026-04-03
CVE-2026-5453Rico só vantagem pra investir App br.com.Rico.mobile SegmentSettingsModule.java hard-coded key4.8CNA v4.00.1%2026-04-03
CVE-2026-5452UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key4.8CNA v4.00.1%2026-04-03
CVE-2026-4350Perfmatters WordPress plugin arbitrary file deletion8.1CNA v3.10.5%2026-04-03Exploit codeFix
CVE-2026-4108Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-4107Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-3880Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-3879Zoho ManageEngine Exchange Reporter Plus stored XSS7.3CNA v3.11.0%2026-04-03Fix
CVE-2026-3184Util-linux: Util-linux: Access control bypass due to improper hostname canonicalization5.3NVD v3.10.6%2026-04-03Fix
CVE-2026-2625sequoia-pgp Rpm-sequoia rust-rpm-sequoia: Rust-rpm-sequoia: Denial of service4.0CNA v3.10.1%2026-04-03Fix
CVE-2026-0545Missing authentication for critical function in MLflow/MLflow9.8v3.14.4%2026-04-03NucleiFix
CVE-2026-35467cveClient/encrypt-storage.js private Key stored as extractable in browser IndexeDB7.5CISA ADP v3.10.3%2026-04-02Fix
CVE-2026-35466cveClient/cveInterface.js stored XSS via unsanitized input from remote service6.1CISA ADP v3.10.3%2026-04-02Fix
CVE-2026-35414OpenBSD OpenSSH incorrect control flow8.1v3.10.2%2026-04-02Fix
CVE-2026-35388OpenBSD OpenSSH unprotected alternate channel2.5v3.10.1%2026-04-02Fix
CVE-2026-35387OpenBSD OpenSSH incorrect control flow6.5v3.10.2%2026-04-02Fix
CVE-2026-35386OpenBSD OpenSSH incorrect behavior order8.1v3.10.3%2026-04-02Fix
CVE-2026-35385OpenBSD OpenSSH improper preservation of permissions8.1v3.10.6%2026-04-02Fix
CVE-2026-35383Bentley Systems iTwin Platform exposed access token6.9CNA v4.00.5%2026-04-02Fix
CVE-2026-35168OpenSTAManager: SQL injection via Aggiornamenti module8.8CNA v3.10.8%2026-04-02Fix
CVE-2026-35053OneUptime: Unauthenticated Workflow Execution via ManualAPI9.2CNA v4.00.8%2026-04-02Fix
CVE-2026-35038signalk-server Signal K Server: Arbitrary Prototype Read via `from` Field Bypass2.1CNA v4.00.4%2026-04-02Fix
CVE-2026-35002Agno field_type eval injection arbitrary code execution9.8NVD v3.11.2%2026-04-02Fix
CVE-2026-34974phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to stored XSS and privilege escalation5.4CNA v3.10.3%2026-04-02Fix
CVE-2026-34973phpMyFAQ search information disclosure6.9CNA v4.00.4%2026-04-02Fix
CVE-2026-34932Hoppscotch mock server stored cross-site scripting8.5CNA v4.00.4%2026-04-02Fix
CVE-2026-34931Hoppscotch device login flow open redirect8.5CNA v4.00.4%2026-04-02Fix
CVE-2026-34890MSTW League Manager WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-04-02
CVE-2026-34877Arm mbed TLS execution with unnecessary privileges9.8CISA ADP v3.10.7%2026-04-02Fix
CVE-2026-34876TrustedFirmware Mbed TLS out-of-bounds read7.5CISA ADP v3.10.5%2026-04-02Fix
CVE-2026-34848Hoppscotch team member tooltip cross-site scripting5.4CNA v3.10.2%2026-04-02Fix
CVE-2026-34847Hoppscotch enter redirect parameter open redirect4.7CNA v3.10.5%2026-04-02NucleiFix
CVE-2026-34840OneUptime SSO: Multi-Assertion Identity injection via Decoupled signature verification8.1CNA v3.10.3%2026-04-02Fix
CVE-2026-34838Intermesh groupoffice Group-Office: Authenticated remote code execution10.0CNA v3.11.0%2026-04-02Exploit codeFix
CVE-2026-34835Rack: `Rack::Request` accepts invalid host characters, enabling host allowlist bypass4.8CNA v3.10.3%2026-04-02Fix
CVE-2026-34834Bulwark Webmail: Authentication bypass in verifyIdentity due to missing cookie validation8.7CNA v4.00.4%2026-04-02Fix
CVE-2026-34833Bulwark Webmail: Information exposure: Password returned in /API/auth/session8.7CNA v4.00.3%2026-04-02Fix
CVE-2026-34832Scoold: Cross-Account Feedback Deletion (IDOR)6.5CNA v3.10.5%2026-04-02Fix
CVE-2026-34831Rack: Content-Length mismatch in Rack::Files error responses4.8CNA v3.10.2%2026-04-02Fix
CVE-2026-34830Rack: Rack::Sendfile regex injection5.9CNA v3.10.4%2026-04-02Fix
CVE-2026-34829Rack: Denial of service via Unbounded Multipart file upload without Content-Length7.5CNA v3.10.7%2026-04-02Fix
CVE-2026-34828Listmonk's active sessions remain valid after password reset and password change7.1CNA v3.10.4%2026-04-02Fix
CVE-2026-34827Rack: Algorithmic-complexity DoS in Rack::Multipart::Parser7.5CNA v3.10.7%2026-04-02Fix
CVE-2026-34826Rack: Unbounded Range Count in get_byte_ranges enables DoS5.3CNA v3.10.5%2026-04-02Fix
CVE-2026-34825NocoBase Has SQL injection via template variable substitution in workflow SQL node8.5CNA v4.00.5%2026-04-02Fix
CVE-2026-34823Endian Firewall /manage/password/web/ remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34822Endian Firewall /manage/ca/certificate/ new_cert_name stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34821Endian Firewall /manage/vpnauthentication/user/ remark stored cross-site scripting5.4v3.10.3%2026-04-02Fix
CVE-2026-34820Endian Firewall /manage/ipsec/ remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34819Endian Firewall /cgi-bin/openvpnclient.cgi REMARK stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34818Endian Firewall /manage/dnsmasq/localdomains/ remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34817Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34816Endian Firewall /manage/smtpscan/domainrouting/ domain stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34815Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34814Endian Firewall /cgi-bin/proxygroup.cgi group stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34813Endian Firewall /cgi-bin/proxyuser.cgi user stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34812Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34811Endian Firewall /cgi-bin/xtaccess.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34810Endian Firewall /cgi-bin/vpnfw.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34809Endian Firewall /cgi-bin/zonefw.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34808Endian Firewall /cgi-bin/outgoingfw.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34807Endian Firewall /cgi-bin/incoming.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34806Endian Firewall /cgi-bin/snat.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34805Endian Firewall /cgi-bin/dnat.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34804Endian Firewall /manage/qos/rules/ dscp stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34803Endian Firewall /manage/qos/classes/ name stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34802Endian Firewall /cgi-bin/salearn.cgi remark user ham spam stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34801Endian Firewall /manage/dhcp/fixed_leases/ remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34800Endian Firewall /cgi-bin/uplinkeditor.cgi NAME stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34799Endian Firewall /manage/dnsmasq/hosts/ remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34798Endian Firewall /cgi-bin/routing.cgi remark stored cross-site scripting5.4v3.10.2%2026-04-02Fix
CVE-2026-34797Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl command injection8.7CNA v4.01.9%2026-04-02Fix
CVE-2026-34796Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl command injection8.7CNA v4.01.9%2026-04-02Fix
CVE-2026-34795Endian Firewall /cgi-bin/logs_log.cgi DATE Perl command injection8.7CNA v4.01.9%2026-04-02Fix
CVE-2026-34794Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl command injection8.7CNA v4.01.9%2026-04-02Fix
CVE-2026-34793Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl command injection8.7CNA v4.01.9%2026-04-02Fix
CVE-2026-34792Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl command injection8.7CNA v4.01.9%2026-04-02Fix
CVE-2026-34791Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl command injection8.7CNA v4.01.9%2026-04-02Fix
CVE-2026-34790Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE directory traversal8.1v3.10.9%2026-04-02Fix
CVE-2026-34786Rack: Rack::Static header_rules bypass via URL-encoded paths5.3CNA v3.10.3%2026-04-02Fix
CVE-2026-34785Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-34763Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation5.3CNA v3.10.3%2026-04-02Fix
CVE-2026-34762Ella Core has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber2.7CNA v3.10.3%2026-04-02Fix
CVE-2026-34761Ella Core Panics upon NGAP handover failure5.8CNA v3.10.4%2026-04-02Fix
CVE-2026-34760vLLM: Downmix Implementation Differences as Attack Vectors against Audio AI Models5.9CNA v3.10.5%2026-04-02Fix
CVE-2026-34759HackerBay OneUptime notification API endpoints missing authorization9.2CNA v4.00.7%2026-04-02Fix
CVE-2026-34758OneUptime: Missing authentication on Notification endpoints9.1CNA v3.10.5%2026-04-02Fix
CVE-2026-34752Haraka affected by DoS via `__proto__` email header8.7CNA v4.00.5%2026-04-02Fix
CVE-2026-34745ShaneIsrael Fireshare public chunked upload endpoint path traversal9.1CNA v3.10.7%2026-04-02Fix
CVE-2026-34743XZ Utils: Buffer overflow in lzma_index_append1.7CNA v4.00.6%2026-04-02Fix
CVE-2026-34742Model Context Protocol Go SDK HTTP server DNS rebinding protection vulnerability7.6CNA v4.00.7%2026-04-02Fix
CVE-2026-34736Open edX Platform account activation API improper authentication5.3CNA v3.10.4%2026-04-02
CVE-2026-34735HytaleModding wiki hytale Modding vulnerable to remote code execution8.7CNA v4.00.5%2026-04-02
CVE-2026-34730Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode5.5CNA v3.10.2%2026-04-02Fix
CVE-2026-34729phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes6.1CNA v3.10.3%2026-04-02Fix
CVE-2026-34728phpMyFAQ: Path traversal arbitrary file deletion in MediaBrowserController8.7CNA v3.10.8%2026-04-02Fix
CVE-2026-34726Copier `_subdirectory` allows template root escape via parent-directory traversal4.4CNA v3.10.4%2026-04-02Fix
CVE-2026-34725DbGate application icon rendering cross-site scripting8.3CNA v3.10.2%2026-04-02Fix
CVE-2026-34717OpenProject: SQL injection in Cost Reporting =n Operator via parse_number_string9.9CNA v3.10.5%2026-04-02Fix
CVE-2026-34715ewe has improper neutralization of CRLF sequences in HTTP headers (HTTP Request/Response Splitting)5.3CNA v3.10.4%2026-04-02Fix
CVE-2026-34610Leancrypto: Integer truncation in X.509 name parser enables certificate identity impersonation5.9CNA v3.10.3%2026-04-02Fix
CVE-2026-34608EMQX NanoMQ MQTT webhook handler out-of-bounds read4.9CNA v3.10.6%2026-04-02Fix
CVE-2026-34606Stored XSS in Frappe LMS6.9CNA v4.00.3%2026-04-02Fix
CVE-2026-34601xmldom XML serializer XML injection7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-34598YesWiki has Persistant Blind XSS at /?BazaR&vue=consulter7.1CNA v4.00.3%2026-04-02Fix
CVE-2026-34593Ash Framework module type casting resource exhaustion8.2CNA v4.00.5%2026-04-02Fix
CVE-2026-34591Poetry has Wheel path traversal which can lead to arbitrary file write7.1CNA v4.00.6%2026-04-02Fix
CVE-2026-34590Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation5.4CNA v3.10.3%2026-04-02Fix
CVE-2026-34584Knadh listmonk list permission checks insecure direct object reference5.4CNA v3.10.3%2026-04-02Fix
CVE-2026-34581Goshs has Auth Bypass via Share Token8.1CNA v3.10.5%2026-04-02Fix
CVE-2026-34577Postiz: Unauthenticated Full-read SSRF8.6CNA v3.10.5%2026-04-02Fix
CVE-2026-34576Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata8.3CNA v4.00.4%2026-04-02Fix
CVE-2026-34526SillyTavern: Incomplete IP validation in /API/search/visit allows SSRF via localhost and IPv65.0CNA v3.10.3%2026-04-02Fix
CVE-2026-34524SillyTavern chat export and delete endpoints path traversal8.3CNA v3.10.6%2026-04-02Fix
CVE-2026-34523SillyTavern: Path traversal allows file existence oracle5.3CNA v3.10.4%2026-04-02Fix
CVE-2026-34522SillyTavern chat import endpoint path traversal8.1CNA v3.10.6%2026-04-02Fix
CVE-2026-34426OpenClaw Approval Bypass via Environment Variable Normalization7.3v3.10.5%2026-04-02Fix
CVE-2026-34425OpenClaw Shell-Bleed Protection Preflight Validation Bypass4.3v3.10.4%2026-04-02Fix
CVE-2026-34230Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header5.3CNA v3.10.5%2026-04-02Fix
CVE-2026-34124Denial of service via Path Expansion Overflow in HTTP service in TP-Link Tapo C520WS7.1CNA v4.00.4%2026-04-02Fix
CVE-2026-34122Stack-based buffer overflow leading to denial of service in TP-Link Tapo C520WS7.1CNA v4.00.4%2026-04-02Fix
CVE-2026-34121TP-Link Tapo C520WS DS configuration service authentication bypass8.7CNA v4.00.5%2026-04-02Fix
CVE-2026-34120Heap-based buffer overflow vulnerability leading to denial of service in TP-Link Tapo C520WS7.1CNA v4.00.4%2026-04-02Fix
CVE-2026-34119Heap-based buffer overflow vulnerability leading to denial of service in TP-Link Tapo C520WS7.1CNA v4.00.4%2026-04-02Fix
CVE-2026-34118TP-Link Systems Tapo C520WS heap-based buffer overflow7.1CNA v4.00.5%2026-04-02Fix
CVE-2026-34083signalk-server OIDC login and logout handlers origin validation error6.1CNA v3.10.1%2026-04-02Fix
CVE-2026-33951signalk-server Signal K Server: Unauthenticated Source Priorities Manipulation6.9CNA v4.00.5%2026-04-02Fix
CVE-2026-33950signalk-server signal K Server: Privilege escalation by admin role injection via /enableSecurity9.4CNA v3.10.5%2026-04-02Fix
CVE-2026-33746Convoy: JWT signature verification Bypass allows Authentication as arbitrary Users9.8CNA v3.10.4%2026-04-02Fix
CVE-2026-33691OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks6.8CNA v3.11.6%2026-04-02Fix
CVE-2026-33641Glances vulnerable to command injection via Dynamic Configuration Values7.8CNA v3.10.8%2026-04-02Exploit codeFix
CVE-2026-33617MB connect line mbCONNECT24 data24 endpoint information disclosure5.3CNA v3.10.4%2026-04-02Fix
CVE-2026-33616MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api endpoint7.5CNA v3.10.6%2026-04-02Fix
CVE-2026-33615MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo endpoint9.1CNA v3.10.6%2026-04-02Fix
CVE-2026-33614MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint7.5CNA v3.10.6%2026-04-02Fix
CVE-2026-33613MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray8.8v3.10.5%2026-04-02Fix
CVE-2026-33544Tinyauth has OAuth account confusion via shared mutable state on singleton service instances7.7CNA v3.10.3%2026-04-02Fix
CVE-2026-33533Glances vulnerable to Cross-Origin system information disclosure via XML-RPC Server CORS Wildcard7.1CNA v4.00.5%2026-04-02Fix