CVE-2026 list

CVE-2026 records published in April 2026

Page six of six: records 5,001 to 5,323 of the 5,323 published in April 2026, newest first. The first page carries the figures for April 2026.

CVE-2026 records published in April 2026, newest first: records 5,001 to 5,323 of 5,323
CVE Summary CVSS EPSS Published Signals
CVE-2026-33271Acronis True Image incorrect permission assignment6.7CNA v3.00.1%2026-04-02Fix
CVE-2026-33107Microsoft Azure Databricks elevation of privilege10.0CNA v3.10.9%2026-04-02Fix
CVE-2026-33105Microsoft Azure Kubernetes Service elevation of privilege10.0CNA v3.10.9%2026-04-02Fix
CVE-2026-32871FastMCP OpenAPI Provider has an SSRF and path traversal10.0CNA v4.01.4%2026-04-02Fix
CVE-2026-32762Rack: Forwarded header semicolon injection enables host and Scheme spoofing4.8CNA v3.10.2%2026-04-02Fix
CVE-2026-32629phpMyFAQ: Stored XSS via Unsanitized Email field in Admin FAQ Editor5.4CNA v4.00.3%2026-04-02Fix
CVE-2026-32213Microsoft Azure AI Foundry elevation of privilege10.0CNA v3.10.9%2026-04-02Fix
CVE-2026-32211Microsoft Azure MCP server information disclosure9.1CNA v3.11.0%2026-04-02Fix
CVE-2026-32173Microsoft Azure SRE Agent information disclosure8.6CNA v3.11.1%2026-04-02Fix
CVE-2026-32145Multipart form body parser bypasses body size limits in wisp8.7CNA v4.00.8%2026-04-02Fix
CVE-2026-31937Suricata dcerpc: Quadratic complexity in dcerpc buffering7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-31935Suricata http2: Unbounded resource consumption7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-31934Suricata smtp/mine: Quadratic complexity in extracting urls7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-31933Suricata stream: Quadratic complexity in stream inspection7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-31932Suricata krb5: Quadratic complexity in krb5 buffering7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-31931Suricata TLS: Null dereference in tls.alpn rule keyword7.5CNA v3.10.5%2026-04-02Fix
CVE-2026-30867CocoaMQTT: Denial of service via reachable assertion in `PUBLISH` Packet Parsing5.7CNA v3.10.4%2026-04-02Fix
CVE-2026-30603Qianniao QN-L23PA0904 firmware insufficient verification of data authenticity6.8CISA ADP v3.10.2%2026-04-02
CVE-2026-30332Balena Etcher flashing process race condition7.5CNA v3.10.1%2026-04-02Exploit code
CVE-2026-30252Interzen Zencrm login.php endpoint reflected cross-site scripting6.1CISA ADP v3.10.3%2026-04-02Exploit code
CVE-2026-30251Interzen Zenshare Suite reflected cross-site scripting6.1CISA ADP v3.10.3%2026-04-02
CVE-2026-29782OpenSTAManager: Remote code execution via insecure deserialization in OAuth27.2CNA v3.10.7%2026-04-02Fix
CVE-2026-29144SEPPmail Secure Email Gateway Unicode Subject Tags5.3NVD v3.10.3%2026-04-02Fix
CVE-2026-29143SEPPmail Secure Email Gateway S/MIME Decryption Impersonation9.1v3.10.4%2026-04-02Fix
CVE-2026-29142SEPPmail Secure Email Gateway plaintext secure-mail.html5.3v3.10.2%2026-04-02Fix
CVE-2026-29141SEPPmail Secure Email Gateway Bounded Subject Tag Sanitization5.3NVD v3.10.3%2026-04-02Fix
CVE-2026-29140SEPPmail Secure Email Gateway S/MIME Signature Additional Certificate5.3NVD v3.10.2%2026-04-02Fix
CVE-2026-29139SEPPmail Secure Email Gateway GINA State Confusion account takeover9.8v3.10.5%2026-04-02Fix
CVE-2026-29138SEPPmail Secure Email Gateway PGP Decryption Sender LDAP injection7.5v3.10.4%2026-04-02Fix
CVE-2026-29137SEPPmail Secure Email Gateway Long Subject Untagging5.3v3.10.3%2026-04-02Fix
CVE-2026-29136SEPPmail Secure Email Gateway CA Notification HTML injection6.1v3.10.2%2026-04-02Fix
CVE-2026-29135SEPPmail Secure Email Gateway Webmail Password Tag Sanitization Bypass7.5v3.10.4%2026-04-02Fix
CVE-2026-29134SEPPmail Secure Email Gateway GINA Domain Switch7.5v3.10.4%2026-04-02Fix
CVE-2026-29133SEPPmail Secure Email Gateway UID Regex Bypass9.1v3.10.4%2026-04-02Fix
CVE-2026-29132SEPPmail Secure Email Gateway GINA second-password check authentication bypass7.5v3.10.4%2026-04-02Fix
CVE-2026-29131SEPPmail Secure Email Gateway PGP Decryption Recipient LDAP injection7.5v3.10.4%2026-04-02Fix
CVE-2026-28805OpenSTAManager: Time-based blind SQL injection via `options[stato]` parameter8.8CNA v3.10.5%2026-04-02Fix
CVE-2026-28728Acronis True Image uncontrolled search path6.7CNA v3.00.1%2026-04-02Fix
CVE-2026-27774Acronis True Image uncontrolled search path6.7CNA v3.00.1%2026-04-02Fix
CVE-2026-26962Rack: Header injection in multipart requests4.8CNA v3.10.2%2026-04-02Fix
CVE-2026-26961Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass3.7CNA v3.10.3%2026-04-02Fix
CVE-2026-26928Lack of Dynamic Library Validation in SzafirHost8.7CNA v4.00.2%2026-04-02Fix
CVE-2026-26927URL (HTTP Origin) call location spoofing in Szafir SDK Web5.1CNA v4.00.3%2026-04-02Fix
CVE-2026-26895Enhancesoft osTicket observable discrepancy5.3CISA ADP v3.10.4%2026-04-02
CVE-2026-26135Microsoft Azure Custom Locations Resource Provider (RP) elevation of privilege9.6CNA v3.10.7%2026-04-02Fix
CVE-2026-25212Percona Monitoring and Management execution with unnecessary privileges9.9CISA ADP v3.10.3%2026-04-02Exploit codeFix
CVE-2026-23417Linux kernel BPF JIT constant blinding vulnerability5.5v3.10.1%2026-04-02Fix
CVE-2026-23416Linux kernel mseal VMA range tracking vulnerability5.5v3.10.2%2026-04-02Exploit codeFix
CVE-2026-23415Linux kernel futex key lookup use-after-free7.8CNA v3.10.1%2026-04-02Fix
CVE-2026-23414Linux kernel TLS asynchronous decryption queue memory leak7.5CNA v3.10.3%2026-04-02Fix
CVE-2026-23413Linux kernel clsact qdisc use-after-free7.8CNA v3.10.1%2026-04-02Fix
CVE-2026-23412Linux kernel netfilter hook listing use-after-free7.8CNA v3.10.1%2026-04-02Fix
CVE-2026-21767HCL BigFix Platform is affected by insufficient authentication4.0CNA v3.10.1%2026-04-02Fix
CVE-2026-21765HCL BigFix Platform is affected by insecure permissions on private cryptographic keys8.8CNA v3.10.1%2026-04-02Fix
CVE-2026-5429Kiro IDE Webview cross-site scripting via Workspace Color theme7.1CNA v4.00.2%2026-04-02Fix
CVE-2026-5420Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key2.0CNA v4.00.1%2026-04-02
CVE-2026-5418Appsmith Dashboard server-side request forgery6.9CNA v4.00.5%2026-04-02
CVE-2026-5417Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery5.1CNA v4.00.4%2026-04-02Fix
CVE-2026-5414Newgen OmniDocs WebApiRequestRedirection resource injection6.9CNA v4.00.5%2026-04-02
CVE-2026-5413Newgen OmniDocs GetWebApiConfiguration information disclosure6.3CNA v4.00.5%2026-04-02
CVE-2026-5370krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross-site scripting5.1CNA v4.00.4%2026-04-02
CVE-2026-5368Projectworlds Car Rental Project parameter login.php SQL injection9.8v3.10.6%2026-04-02
CVE-2026-5360Free5GC aper type confusion6.3CNA v4.00.7%2026-04-02
CVE-2026-5355TRENDnet TEW-657BRM setup.cgi vpn_drop os command injection8.8v3.15.7%2026-04-02
CVE-2026-5354TRENDnet TEW-657BRM setup.cgi vpn_connect os command injection8.8v3.15.7%2026-04-02
CVE-2026-5353TRENDnet TEW-657BRM setup.cgi ping_test os command injection8.8v3.15.7%2026-04-02
CVE-2026-5352TRENDnet TEW-657BRM setup.cgi edit os command injection8.8v3.15.7%2026-04-02
CVE-2026-5351TRENDnet TEW-657BRM setup.cgi add_wps_client os command injection8.8v3.15.7%2026-04-02
CVE-2026-5350TRENDnet TEW-657BRM setup.cgi update_pcdb stack-based overflow8.7CNA v4.01.0%2026-04-02
CVE-2026-5349TRENDnet TEW-657BRM setup.cgi add_apcdb stack-based overflow8.7CNA v4.01.0%2026-04-02
CVE-2026-5346huimeicloud hm_editor image-to-base64 endpoint mcp-server.js client.get server-side request forgery6.9CNA v4.00.5%2026-04-02
CVE-2026-5344Textpattern XML-RPC TXP_RPCServer.php mt_uploadImage path traversal5.3CNA v4.00.4%2026-04-02
CVE-2026-5342LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds6.9CNA v4.01.0%2026-04-02Fix
CVE-2026-5339Tenda G103 setting gpon.lua action_set_net_settings command injection8.8v3.110.2%2026-04-02
CVE-2026-5338Tenda G103 setting system.lua action_set_system_settings command injection7.2v3.18.3%2026-04-02
CVE-2026-5334itsourcecode Online Enrollment System parameter index.php SQL injection9.8v3.10.6%2026-04-02
CVE-2026-5333DefaultFuction Content-Management-System tools.php command injection9.8v3.13.6%2026-04-02
CVE-2026-5332Xiaopi Panel WAF Firewall demo.php cross-site scripting6.1v3.10.3%2026-04-02
CVE-2026-5331OpenCart Extension Installer installer.php path traversal5.1CNA v4.00.6%2026-04-02
CVE-2026-5330SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control6.9CNA v4.00.5%2026-04-02
CVE-2026-5328shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem SQL injection5.3CNA v4.00.3%2026-04-02
CVE-2026-5327efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection5.3CNA v4.01.8%2026-04-02
CVE-2026-5326SourceCodester Leave Application System User Information index.php authorization6.9CNA v4.00.5%2026-04-02
CVE-2026-5325SourceCodester Simple Customer Relationship Management System create-ticket.php cross-site scripting5.1CNA v4.00.3%2026-04-02
CVE-2026-5323priyankark a11y-mcp index.js A11yServer server-side request forgery4.8CNA v4.00.1%2026-04-02Fix
CVE-2026-5322AlejandroArciniegas mcp-data-vis MCP server.js request SQL injection6.9CNA v4.00.4%2026-04-02
CVE-2026-5321vanna-ai vanna FastAPI/Flask Server cross-domain policy5.3CNA v4.00.2%2026-04-02
CVE-2026-5320vanna-ai vanna Chat API endpoint v2 missing authentication6.9CNA v4.00.7%2026-04-02
CVE-2026-5319itsourcecode Payroll Management System navbar.php cross-site scripting5.3CNA v4.00.4%2026-04-02
CVE-2026-5318LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write4.3v3.10.8%2026-04-02Fix
CVE-2026-5317Nothings stb stb_vorbis.c start_decoder out-of-bounds write8.8v3.10.6%2026-04-02
CVE-2026-5316Nothings stb stb_vorbis.c setup_free allocation of resources6.5v3.10.7%2026-04-02
CVE-2026-5315Nothings stb TTF file stb_truetype.h stbtt__buf_get8 out-of-bounds8.8v3.10.8%2026-04-02
CVE-2026-5246Cesanta Mongoose P-384 Public Key Mongoose.c mg_tls_verify_cert_signature authorization8.1v3.10.6%2026-04-02Fix
CVE-2026-5245Cesanta Mongoose mDNS Record Mongoose.c handle_mdns_record stack-based overflow8.1v3.10.6%2026-04-02Fix
CVE-2026-5244Cesanta Mongoose TLS 1.3 Mongoose.c mg_tls_recv_cert heap-based overflow9.8v3.10.8%2026-04-02Fix
CVE-2026-5032W3 Total Cache WordPress plugin unauthenticated security token exposure via User-Agent Header7.5CNA v3.12.7%2026-04-02NucleiFix
CVE-2026-4636Keycloak: UMA Policy resource injection allows Unauthorized Cross-User Permission Grants8.1CNA v3.10.5%2026-04-02Fix
CVE-2026-4634Keycloak: Keycloak: Denial of service via excessive processing of openid connect scope parameters7.5CNA v3.10.9%2026-04-02Fix
CVE-2026-4347MW WP Form WordPress plugin unauthenticated arbitrary file Move via move_temp_file_to_upload_dir8.1CNA v3.10.9%2026-04-02Fix
CVE-2026-4325Keycloak: Keycloak: Replay of action tokens via improper handling of single-use entries5.3CNA v3.10.4%2026-04-02Fix
CVE-2026-4282Keycloak: Keycloak: Privilege escalation7.4CNA v3.10.5%2026-04-02Fix
CVE-2026-3872Keycloak: Keycloak: Information disclosure due to redirect_uri validation bypass7.3CNA v3.10.6%2026-04-02Fix
CVE-2026-3692Unintended command execution during report generation in Progress Flowmon8.7CNA v4.00.6%2026-04-02Fix
CVE-2026-2737Progress Software Flowmon cross-site scripting8.5CNA v4.00.3%2026-04-02Fix
CVE-2026-2701RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)9.1CNA v3.13.4%2026-04-02Emerging ThreatsKCVFix
CVE-2026-2699Progress ShareFile Storage Zones Controller improper access control9.8CNA v3.13.2%2026-04-02Reported exploitedNucleiEmerging ThreatsExploit codeKCVFix
CVE-2026-1540Spam Protect for Contact Form 7 WordPress plugin Editor+ remote code execution7.2CISA ADP v3.10.6%2026-04-02Fix
CVE-2026-1243IBM Content Navigator is affected by, a cross-site scripting (XSS)5.4CNA v3.10.2%2026-04-02Fix
CVE-2026-0688Webmention WordPress plugin authenticated (Subscriber+) server-side request forgery6.4CNA v3.10.2%2026-04-02Fix
CVE-2026-0686Webmention WordPress plugin unauthenticated blind server-side request forgery7.2CNA v3.10.3%2026-04-02Fix
CVE-2026-0634Code execution in AssistFeedbackService on TECNO Pova7 Pro 5G7.8CISA ADP v3.10.5%2026-04-02
CVE-2026-35099Lakeside Software SysTrack Agent race condition7.4CNA v3.10.1%2026-04-01Fix
CVE-2026-35094Libinput: Libinput: Information disclosure via dangling pointer in lua plugin handling5.5NVD v3.10.2%2026-04-01Fix
CVE-2026-35093Libinput: Libinput: Unauthorized code execution and information disclosure8.8CNA v3.10.2%2026-04-01Fix
CVE-2026-35092Corosync: Corosync: Denial of service via integer overflow in join message validation7.5CNA v3.11.3%2026-04-01Fix
CVE-2026-35091Corosync: Corosync: Denial of service and information disclosure via crafted udp packet8.2CNA v3.11.1%2026-04-01Fix
CVE-2026-35057XenForo stored cross-site scripting via Structured Text Mentions5.4v3.10.2%2026-04-01Fix
CVE-2026-35056XenForo remote code execution via Authenticated Admin8.6CNA v4.00.9%2026-04-01Fix
CVE-2026-35055XenForo cross-site scripting via Lightbox in Posts5.1CNA v4.00.3%2026-04-01Fix
CVE-2026-35054XenForo stored cross-site scripting via BB Code Rendering5.4v3.10.2%2026-04-01Fix
CVE-2026-35000ChangeDetection.io SafeXPath3Parser bypass arbitrary file read7.1CNA v4.00.5%2026-04-01Fix
CVE-2026-34999OpenViking Bot Proxy endpoints allow unauthenticated access6.9CNA v4.00.8%2026-04-01Fix
CVE-2026-34889Ultimate Addons for WPBakery Page Builder WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-04-01Fix
CVE-2026-34875TrustedFirmware Tf-psa-crypto buffer overflow9.8CISA ADP v3.10.6%2026-04-01Fix
CVE-2026-34874TrustedFirmware Mbed TLS null pointer dereference7.5CISA ADP v3.10.5%2026-04-01Fix
CVE-2026-34873TrustedFirmware Mbed TLS improper authentication9.1CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-34872Arm Tf-psa-crypto improper signature verification9.1CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-34871TrustedFirmware Tf-psa-crypto weak random number generator6.7CISA ADP v3.10.2%2026-04-01Fix
CVE-2026-34751Payload has Unvalidated Input in Password Recovery endpoints9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34750Payload has Insufficient Filename Validation in Client-Upload Signed-URL endpoints6.5CNA v3.10.4%2026-04-01Fix
CVE-2026-34749Payload has a CSRF Protection Bypass in Authentication Flow5.4CNA v3.10.2%2026-04-01Fix
CVE-2026-34748@payloadcms/next has stored XSS in Admin Panel8.7CNA v3.10.4%2026-04-01Fix
CVE-2026-34747Payload has an SQL injection via Query Handling8.5CNA v3.10.4%2026-04-01Fix
CVE-2026-34746Payload has authenticated SSRF via Upload Functionality7.7CNA v3.10.4%2026-04-01Fix
CVE-2026-34604@Tinacms/graphql's `FilesystemBridge` Path Validation can be Bypassed via Symlinks or Junctions7.1CNA v3.10.5%2026-04-01Fix
CVE-2026-34603@tinacms/graphql's Media endpoints can Escape the Media Root via Symlinks or Junctions7.1CNA v3.10.5%2026-04-01Fix
CVE-2026-34572CI4MS: Account Deactivation Module Full Persistent unauthorized access for All‑Roles8.8CNA v3.10.7%2026-04-01Fix
CVE-2026-34571CI4MS user management stored cross-site scripting10.0CNA v3.10.6%2026-04-01Fix
CVE-2026-34570CI4MS: Account Deletion Module Full Persistent unauthorized access for All‑Roles8.8CNA v3.10.7%2026-04-01Fix
CVE-2026-34569CI4MS: Blogs Categories Full account takeover for All-Roles and Privilege-Escalation10.0CNA v3.10.5%2026-04-01Fix
CVE-2026-34568CI4MS: Blogs Posts Full account takeover for All-Roles and Privilege-Escalation via Stored DOM XSS9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34567CI4MS: Blogs Posts full account takeover for All-Roles and Privilege-Escalation9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34566CI4MS: Pages management full account takeover for All-Roles and Privilege-Escalation9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34565CI4MS: Menu Management full account takeover for All-Roles and Privilege-Escalation9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34564CI4MS: Menu Management full account takeover for All-Roles and Privilege-Escalation9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34563CI4MS: Backup Management Full account takeover for All-Roles and Privilege-Escalation9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34562CI4MS company information settings vulnerability4.7CNA v3.10.4%2026-04-01Fix
CVE-2026-34561CI4MS social media management settings vulnerability4.7CNA v3.10.4%2026-04-01Fix
CVE-2026-34560CI4MS: Logs Full account takeover for All-Roles and Privilege-Escalation via Stored DOM XSS9.1CNA v3.10.5%2026-04-01Fix
CVE-2026-34559CI4MS: Blogs Tags Full account takeover for All-Roles and Privilege-Escalation via Stored DOM XSS9.1CNA v3.10.4%2026-04-01Fix
CVE-2026-34545OpenEXR: Integer overflow lead to OOB in HTJ2K decoder8.4CNA v4.00.7%2026-04-01Fix
CVE-2026-34544OpenEXR: Integer overflow to OOB write in uncompress_b44_impl8.4CNA v4.00.2%2026-04-01Fix
CVE-2026-34543OpenEXR: Heap information disclosure in PXR24 decompression8.7CNA v4.00.5%2026-04-01Fix
CVE-2026-34531Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client6.5CNA v3.10.5%2026-04-01Fix
CVE-2026-34530filebrowser file Browser is vulnerable to stored cross-site scripting6.9CNA v3.10.4%2026-04-01Fix
CVE-2026-34529filebrowser file Browser is vulnerable to stored cross-site scripting via crafted EPUB file7.6CNA v3.10.4%2026-04-01Fix
CVE-2026-34528File Browser user signup privilege escalation8.1CNA v3.10.7%2026-04-01Fix
CVE-2026-34525Aiohttp: Duplicate host header accepted6.3CNA v4.00.4%2026-04-01Fix
CVE-2026-34520aio-libs aiohttp C parser HTTP header injection2.7CNA v4.00.7%2026-04-01Fix
CVE-2026-34519Aiohttp: HTTP response splitting via \r in reason phrase2.7CNA v4.00.4%2026-04-01Fix
CVE-2026-34518Aiohttp: Cookie and Proxy-Authorization headers leaked on cross-origin redirect2.7CNA v4.00.4%2026-04-01Fix
CVE-2026-34517Aiohttp: Late size enforcement for non-file multipart fields causes memory DoS2.7CNA v4.00.5%2026-04-01Fix
CVE-2026-34516Aiohttp: Multipart Header Size Bypass6.6CNA v4.00.6%2026-04-01Fix
CVE-2026-34515Aiohttp: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows6.6CNA v4.00.5%2026-04-01Fix
CVE-2026-34514Aiohttp: CRLF injection in multipart part content type header construction2.7CNA v4.00.4%2026-04-01Fix
CVE-2026-34513Aiohttp: Denial of service (DoS) via Unbounded DNS Cache in TCPConnector2.7CNA v4.00.6%2026-04-01Fix
CVE-2026-34510OpenClaw Remote File URL Acceptance in Windows Media Loaders6.9CNA v4.00.5%2026-04-01Fix
CVE-2026-34456Reviactyl: OAuth account takeover via auto-linking9.1CNA v3.10.7%2026-04-01Fix
CVE-2026-34455Hi.Events: SQL injection via Unvalidated sort_by Query parameter in multiple Repository Classes8.7CNA v4.00.6%2026-04-01Fix
CVE-2026-34447ONNX: External Data Symlink Traversal5.5CNA v3.10.2%2026-04-01Fix
CVE-2026-34446ONNX: Arbitrary file read via ExternalData Hardlink Bypass in ONNX load4.7CNA v3.10.2%2026-04-01Fix
CVE-2026-34445ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings8.6CNA v3.10.5%2026-04-01Fix
CVE-2026-34430ByteDance DeerFlow LocalSandboxProvider Host Bash Escape9.6v3.10.8%2026-04-01
CVE-2026-34397Himmelblau NSS group lookup privilege escalation6.3CNA v3.10.2%2026-04-01Fix
CVE-2026-34376PdfDing: Password-protected share bypass via direct serve endpoint7.5CNA v3.10.5%2026-04-01Fix
CVE-2026-34236Auth0 PHP SDK insufficient entropy in Cookie Encryption8.2CNA v3.10.3%2026-04-01Fix
CVE-2026-34222open-webui open WebUI has broken access control in Tool Valves7.7CNA v3.10.5%2026-04-01Fix
CVE-2026-34159ggml-org llama.cpp RPC backend tensor deserialization memory corruption9.8CNA v3.11.2%2026-04-01Exploit codeFix
CVE-2026-34076Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host7.4CNA v3.10.4%2026-04-01Fix
CVE-2026-34072fccview cronmaster session validation middleware authentication bypass8.3CNA v3.10.9%2026-04-01Fix
CVE-2026-33990Docker Model Runner OCI Registry client vulnerable to server-side request forgery (SSRF)6.8CNA v4.00.3%2026-04-01Fix
CVE-2026-33978Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadata5.4CNA v3.10.3%2026-04-01Fix
CVE-2026-33949@Tinacms/graphql has path traversal that leads to overwrite of arbitrary files8.1CNA v3.10.6%2026-04-01Fix
CVE-2026-32929FUJI ELECTRIC CO., LTD. / Hakko Electronics V-SFT out-of-bounds read5.5NVD v3.10.2%2026-04-01Fix
CVE-2026-32928FUJI ELECTRIC CO., LTD. / Hakko Electronics V-SFT stack-based buffer overflow8.4CNA v4.00.2%2026-04-01Fix
CVE-2026-32927FUJI ELECTRIC CO., LTD. / Hakko Electronics V-SFT out-of-bounds read5.5NVD v3.10.2%2026-04-01Fix
CVE-2026-32926FUJI ELECTRIC CO., LTD. / Hakko Electronics V-SFT out-of-bounds read5.5NVD v3.10.2%2026-04-01Fix
CVE-2026-32925FUJI ELECTRIC CO., LTD. / Hakko Electronics V-SFT stack-based buffer overflow8.4CNA v4.00.2%2026-04-01Fix
CVE-2026-31027TOTOLINK A3600R buffer overflow9.8CISA ADP v3.11.6%2026-04-01
CVE-2026-30643DedeCMS code injection9.8CISA ADP v3.10.8%2026-04-01
CVE-2026-30573Senior-walter Web-based Pharmacy Product Management System improper quantity validation7.5CISA ADP v3.10.4%2026-04-01
CVE-2026-30526Pushpam02 Zoo Management System SourceCodester reflected cross-site scripting6.1CISA ADP v3.10.3%2026-04-01
CVE-2026-30523oretnom23 Loan Management System logic flaw6.5CISA ADP v3.10.5%2026-04-01
CVE-2026-30522oretnom23 Loan Management System client-side enforcement of server-side security6.5v3.10.3%2026-04-01
CVE-2026-30292Docudepot PDF Viewer file import arbitrary file overwrite8.4CISA ADP v3.10.2%2026-04-01
CVE-2026-30291Ora Tools PDF Reader and Editor file import arbitrary file overwrite8.4CISA ADP v3.10.2%2026-04-01
CVE-2026-30289Tinybeans Private Family Album arbitrary file write8.4CISA ADP v3.10.2%2026-04-01
CVE-2026-30287Deepthought.industries Ace Scanner arbitrary file write8.4CISA ADP v3.10.2%2026-04-01
CVE-2026-30273Gabrieleventuri PandasAI SQL injection7.3CISA ADP v3.10.3%2026-04-01
CVE-2026-29598DDSN Interactive Acora CMS submit_add_user.asp stored cross-site scripting5.4CISA ADP v3.10.2%2026-04-01
CVE-2026-29014MetInfo CMS Unauthenticated PHP code injection RCE9.3CNA v4.04.5%2026-04-01NucleiExploit code
CVE-2026-28265Dell PowerStore path traversal4.4CNA v3.10.2%2026-04-01Fix
CVE-2026-27489ONNX: Path traversal via Symlink8.7CNA v4.00.6%2026-04-01Fix
CVE-2026-27101Dell Secure Connect Gateway path traversal4.7CNA v3.10.6%2026-04-01Fix
CVE-2026-25835TrustedFirmware Tf-psa-crypto improper seeding7.7CISA ADP v3.10.2%2026-04-01Fix
CVE-2026-25834TrustedFirmware Mbed TLS improper certificate validation6.5CISA ADP v3.10.2%2026-04-01Fix
CVE-2026-25833TrustedFirmware Mbed TLS stack-based buffer overflow7.5CISA ADP v3.10.5%2026-04-01Fix
CVE-2026-25601Credential exposure vulnerability in MEPIS RM6.7v3.10.2%2026-04-01Fix
CVE-2026-24096Checkmk insufficient permission validation on multiple REST API Quick Setup endpoints5.3CNA v4.00.2%2026-04-01Fix
CVE-2026-23899Joomla! Core [20260306] Improper access check in webservice endpoints8.6CNA v4.00.4%2026-04-01Fix
CVE-2026-23898Joomla! Core [20260305] arbitrary file deletion in com_joomlaupdate8.6CNA v4.00.5%2026-04-01Fix
CVE-2026-23411Linux kernel AppArmor inode private data vulnerability7.8CNA v3.10.1%2026-04-01Fix
CVE-2026-23410Linux kernel AppArmor rawdata files use-after-free7.8CNA v3.10.1%2026-04-01Fix
CVE-2026-23409Linux kernel AppArmor differential encoding verification infinite loop5.5v3.10.2%2026-04-01Fix
CVE-2026-23408Linux kernel AppArmor profile replacement double free7.8CNA v3.10.2%2026-04-01Fix
CVE-2026-23407Linux kernel AppArmor DFA verification out-of-bounds read7.8CNA v3.10.2%2026-04-01Fix
CVE-2026-23406Linux kernel AppArmor DFA character matching out-of-bounds read7.8CNA v3.10.2%2026-04-01Fix
CVE-2026-23405Linux kernel AppArmor policy namespaces vulnerability5.5v3.10.2%2026-04-01Fix
CVE-2026-23404Linux kernel AppArmor profile removal denial of service5.5v3.10.2%2026-04-01Fix
CVE-2026-23403Linux kernel apparmor memory leak5.5v3.10.2%2026-04-01Fix
CVE-2026-23402Linux kernel KVM x86 MMU shadow page table entries vulnerability5.5v3.10.2%2026-04-01Fix
CVE-2026-23401Linux kernel KVM x86 MMU shadow page table entries use-after-free5.5NVD v3.10.2%2026-04-01Fix
CVE-2026-22815Aiohttp: Uncapped memory usage possible through Aiohttp allowing unlimited trailer headers6.9CNA v4.00.4%2026-04-01Fix
CVE-2026-22768Dell AppSync incorrect permission assignment7.3CNA v3.10.1%2026-04-01Fix
CVE-2026-22767Dell AppSync symlink following7.3CNA v3.10.2%2026-04-01Fix
CVE-2026-21632Joomla! Core [20260304] XSS vectors in various article title outputs5.9CNA v4.00.2%2026-04-01Fix
CVE-2026-21631Joomla! Core [20260303] XSS vector in com_associations comparison view5.9CNA v4.00.2%2026-04-01Fix
CVE-2026-21630Joomla! Core [20260302] SQL injection in com_content articles webservice endpoint6.9CNA v4.00.3%2026-04-01Fix
CVE-2026-21629Joomla! Core [20260301] ACL hardening in com_ajax6.3CNA v4.00.2%2026-04-01Fix
CVE-2026-20174Cisco Nexus Dashboard Insights arbitrary file write4.9CNA v3.10.5%2026-04-01Fix
CVE-2026-20160Cisco Smart Software Manager On-prem arbitrary command execution9.8CNA v3.10.9%2026-04-01Fix
CVE-2026-20155Cisco Evolved Programmable Network Manager improper authorization8.0CNA v3.10.3%2026-04-01Fix
CVE-2026-20151Cisco Smart Software Manager On-prem privilege escalation7.3CNA v3.10.3%2026-04-01Fix
CVE-2026-20097Cisco Integrated Management controller remote code execution6.5CNA v3.10.4%2026-04-01Fix
CVE-2026-20096Cisco Integrated Management controller command injection6.5CNA v3.10.7%2026-04-01Fix
CVE-2026-20095Cisco Integrated Management controller command injection6.5CNA v3.10.9%2026-04-01Fix
CVE-2026-20094Cisco Integrated Management controller command injection8.8CNA v3.11.1%2026-04-01Fix
CVE-2026-20093Cisco Integrated Management controller authentication bypass9.8CNA v3.11.0%2026-04-01Fix
CVE-2026-20090Cisco Integrated Management controller cross-site scripting4.8CNA v3.10.2%2026-04-01Fix
CVE-2026-20089Cisco Integrated Management controller cross-site scripting4.8CNA v3.10.2%2026-04-01Fix
CVE-2026-20088Cisco Integrated Management controller cross-site scripting4.8CNA v3.10.2%2026-04-01Fix
CVE-2026-20087Cisco Integrated Management controller cross-site scripting4.8CNA v3.10.2%2026-04-01Fix
CVE-2026-20085Cisco Integrated Management controller cross-site scripting6.1CNA v3.10.2%2026-04-01Fix
CVE-2026-20042Cisco Nexus Dashboard Configuration REST API unauthorized access6.5CNA v3.10.3%2026-04-01Fix
CVE-2026-20041Cisco Nexus Dashboard server side request forgery6.1CNA v3.10.2%2026-04-01Fix
CVE-2026-5314Nothings stb TTF file stb_truetype.h stbtt_InitFont_internal out-of-bounds8.8v3.10.8%2026-04-01
CVE-2026-5313Nothings stb GIF Decoder stb_image.h stbi__gif_load_next denial of service5.3CNA v4.00.5%2026-04-01
CVE-2026-5312D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control6.9CNA v4.00.9%2026-04-01
CVE-2026-5311D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control6.9CNA v4.01.3%2026-04-01
CVE-2026-5310Enter Software Iperius Backup IperiusAccounts.ini hard-coded key2.0CNA v4.00.1%2026-04-01Fix
CVE-2026-5292Google Chrome WebCodecs out-of-bounds read8.8CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5291Google Chrome WebGL inappropriate implementation6.5CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5290Google Chrome Compositing use-after-free9.6CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5289Google Chrome Navigation use-after-free9.6CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5288Google Chrome WebView use-after-free9.6CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5287Google Chrome PDF use-after-free8.8CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5286Google Chrome Dawn use-after-free8.8CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-5285Google Chrome WebGL use-after-free8.8CISA ADP v3.10.5%2026-04-01Fix
CVE-2026-5284Google Chrome Dawn use-after-free7.5CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5283Google Chrome ANGLE inappropriate implementation6.5CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5282Google Chrome WebCodecs out-of-bounds read8.1v3.10.2%2026-04-01Fix
CVE-2026-5281Google Dawn use-after-free8.8CISA ADP v3.10.7%2026-04-01KEVExploit codeFix
CVE-2026-5280Google Chrome WebCodecs use-after-free8.8CISA ADP v3.10.5%2026-04-01Fix
CVE-2026-5279Google Chrome buffer overflow8.8CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-5278Google Chrome Web MIDI use-after-free8.8CISA ADP v3.10.5%2026-04-01Fix
CVE-2026-5277Google Chrome ANGLE integer overflow7.5CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5276Google Chrome WebUSB insufficient policy enforcement6.5CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5275Google Chrome ANGLE heap-based buffer overflow8.8CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-5274Google Chrome Codecs integer overflow8.8CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-5273Google Chrome CSS use-after-free6.3CISA ADP v3.10.2%2026-04-01Fix
CVE-2026-5272Google Chrome GPU heap-based buffer overflow8.8CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-5271Python pymanager possible to hijack modules in current working directory5.6CNA v4.00.2%2026-04-01Fix
CVE-2026-5261Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload6.9CNA v4.00.5%2026-04-01
CVE-2026-5259AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery5.3CNA v4.00.3%2026-04-01
CVE-2026-5258Sanster IOPaint File Manager file_manager.py _get_file path traversal6.9CNA v4.00.7%2026-04-01
CVE-2026-5257code-projects Simple Laundry System parameter delstaffinfo.php SQL injection9.8v3.10.6%2026-04-01
CVE-2026-5256code-projects Simple Laundry System parameter modify.php SQL injection9.8v3.10.6%2026-04-01
CVE-2026-5255code-projects Simple Laundry System parameter delstaffinfo.php cross-site scripting6.1v3.10.5%2026-04-01
CVE-2026-5254welovemedia FFmate Webhook AppJsonTreeView.vue cross-site scripting5.1CNA v4.00.3%2026-04-01
CVE-2026-5253bufanyun HotGo editNotice Endpoint MessageList.vue cross-site scripting5.1CNA v4.00.3%2026-04-01
CVE-2026-5252z-9527 admin Message Create endpoint message.js cross-site scripting5.1CNA v4.00.3%2026-04-01
CVE-2026-5251z-9527 admin User Update endpoint user.js dynamically-determined object attributes5.3CNA v4.00.4%2026-04-01
CVE-2026-5249gougucms Record endpoint record.html cross-site scripting5.1CNA v4.00.3%2026-04-01
CVE-2026-5248gougucms User Registration Login.php reg_submit dynamically-determined object attributes5.3CNA v4.00.4%2026-04-01
CVE-2026-5240code-projects BloodBank Managing System admin_state.php cross-site scripting5.3CNA v4.00.4%2026-04-01
CVE-2026-5238itsourcecode Payroll Management System parameter view_employee.php SQL injection6.9CNA v4.00.4%2026-04-01
CVE-2026-5199Temporal Cross Namespace Access via Batch Operation2.3CNA v4.00.3%2026-04-01Fix
CVE-2026-5175Devolutions Server multi-factor authentication improper access control5.0CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-4989Devolutions Server gateway health check feature improper input validation4.3CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-4947Insecure direct object reference (IDOR) leading to Signature Forgery in Foxit eSign7.1CNA v3.10.3%2026-04-01Fix
CVE-2026-4927Devolutions Server users MFA feature information disclosure6.5CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-4925Devolutions Server users MFA feature improper access control5.0CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-4924Devolutions Server two-factor improper authentication8.2CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-4829Devolutions Server external OAuth authentication flow improper authentication5.4CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-4828Devolutions Server OAuth login functionality improper authentication8.2CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-4820IBM Maximo Application Suite authentication cookie information disclosure4.3CNA v3.10.2%2026-04-01Fix
CVE-2026-4748FreeBSD pf silently ignores certain rules7.5CISA ADP v3.10.4%2026-04-01Fix
CVE-2026-4668Booking for Appointments and Events Calendar WordPress plugin SQL injection6.5CNA v3.10.4%2026-04-01Fix
CVE-2026-4374RTI Connext Professional XML external entity injection8.8CNA v4.00.4%2026-04-01Fix
CVE-2026-4370Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster10.0CNA v3.10.4%2026-04-01Fix
CVE-2026-4364IBM Verify Identity Access and Security Verify Access cross-site scripting5.4CNA v3.10.1%2026-04-01Fix
CVE-2026-4101IBM Verify Identity Access authentication bypass8.1CNA v3.10.5%2026-04-01Fix
CVE-2026-3987WatchGuard Firebox arbitrary file write vis path traversal in Fireware Web UI8.6CNA v4.01.1%2026-04-01Fix
CVE-2026-3877VertiGIS FM reflected cross-site scripting in Dashboard Search6.1NVD v3.10.3%2026-04-01Fix
CVE-2026-3831Database for Contact Form 7 WordPress plugin unauthorized access4.3CNA v3.10.3%2026-04-01Fix
CVE-2026-3780Foxit PDF Editor/Reader Installer uncontrolled search path privilege escalation7.3CNA v3.10.2%2026-04-01Fix
CVE-2026-3779Foxit PDF Editor/Reader List Box Calculate Array use-after-free7.8CNA v3.10.2%2026-04-01Fix
CVE-2026-3778Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader6.2CNA v3.10.1%2026-04-01Fix
CVE-2026-3777Foxit PDF Editor and Reader view cache use-after-free5.5CNA v3.10.2%2026-04-01Fix
CVE-2026-3776Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation5.5CNA v3.10.1%2026-04-01Fix
CVE-2026-3775Foxit PDF Editor/Reader Update service uncontrolled search path element local privilege escalation7.8CNA v3.10.2%2026-04-01Fix
CVE-2026-3774Self-Modifications Affecting Altered Printing and Redaction in Foxit PDF Editor4.7CNA v3.10.2%2026-04-01Fix
CVE-2026-2862IBM Verify Identity Access and Security Verify Access HTTP request smuggling5.3CNA v3.10.4%2026-04-01Fix
CVE-2026-2696Export All URLs WordPress plugin unauthenticated sensitive data exposure5.3CISA ADP v3.10.3%2026-04-01Fix
CVE-2026-2475IBM Verify Identity Access and Security Verify Access open redirect3.1CNA v3.10.3%2026-04-01Fix
CVE-2026-2394Buffer over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers6.3CNA v4.00.2%2026-04-01Fix
CVE-2026-2265Replicator is vulnerable to remote code execution through insecure deserialization6.5CISA ADP v3.10.4%2026-04-01
CVE-2026-1879Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload5.3CNA v4.00.3%2026-04-01Fix
CVE-2026-1491IBM Verify Identity Access reverse proxy request handling HTTP request smuggling5.3CNA v3.10.4%2026-04-01Fix
CVE-2026-1345IBM Verify Identity Access OS command injection7.3CNA v3.10.4%2026-04-01Fix
CVE-2026-0932M-Files Server server-side request forgery6.9CNA v4.00.2%2026-04-01Fix
CVE-2026-0522VertiGIS FM local file inclusion in the file upload/Download Process8.8v3.10.6%2026-04-01Fix