CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-5852 Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection 09.04.2026 9.3
CVE-2026-5853 Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection 09.04.2026 9.3
CVE-2026-5854 Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection 09.04.2026 9.3
CVE-2026-5850 Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection 09.04.2026 9.3
CVE-2026-5851 Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection 09.04.2026 9.3
CVE-2026-1830 Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload 09.04.2026 9.8
CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection 08.04.2026 9.4
CVE-2026-40035 Unfurl - Werkzeug Debugger Exposure via String Config Parsing 08.04.2026 9.3
CVE-2026-39860 Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination 08.04.2026 9
CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode) 08.04.2026 10
CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading 08.04.2026 9.8
CVE-2026-2942 ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess 08.04.2026 9.8
CVE-2025-14815 Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64 08.04.2026 9.3
CVE-2025-14816 Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64 08.04.2026 9.3
CVE-2026-25776 08.04.2026 9.3
CVE-2026-3535 DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter 08.04.2026 9.8
CVE-2026-4003 Users manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action 08.04.2026 9.8
CVE-2026-3296 Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata 08.04.2026 9.8
CVE-2026-1346 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 09.04.2026 9.3
CVE-2026-34078 Flatpak has a complete sandbox escape leading to host file access and code execution in the host context 09.04.2026 9.3
CVE-2026-39846 SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions 08.04.2026 9.1
CVE-2026-39847 Emmett has a path traversal in internal assets handler 08.04.2026 9.1
CVE-2026-34580 Botan has a certificate authentication bypass due to trust anchor confusion 09.04.2026 9.3
CVE-2026-33439 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM 08.04.2026 9.3
CVE-2026-39397 @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections 07.04.2026 9.4
CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output 08.04.2026 9.3
CVE-2026-39322 PolarLearn: Any password authenticates banned accounts and grants API access 07.04.2026 9.2
CVE-2026-39355 Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control) 08.04.2026 10
CVE-2026-39324 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization 08.04.2026 9.3
CVE-2026-39337 ChurchCRM Affected by Unauthenticated RCE in Install Wizard 07.04.2026 10
CVE-2026-39339 ChurchCRM has an API Authentication Bypass 07.04.2026 9.1
CVE-2026-39342 ChurchCRM has a SQL injection searchwhat parameter via QueryView.php 07.04.2026 9.4
CVE-2026-35573 ChurchCRM has a Path traversal leads to RCE 08.04.2026 9.1
CVE-2026-23696 Windmill < 1.603.3 File Ownership Handling SQLi RCE 08.04.2026 9.4
CVE-2026-35614 Frappe has a SQL injection in bulk_update 07.04.2026 9.3
CVE-2026-35615 PraisonAI has a Path Traversal in FileTools 07.04.2026 9.2
CVE-2026-39305 Arbitrary File Write / Path Traversal in Action Orchestrator 07.04.2026 9
CVE-2026-4631 Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection 08.04.2026 9.8
CVE-2026-35580 Emissary has GitHub Actions Shell Injection via Workflow Inputs 07.04.2026 9.1
CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering 07.04.2026 9.8
CVE-2026-20889 08.04.2026 9.8
CVE-2026-20911 08.04.2026 9.8
CVE-2026-21413 08.04.2026 9.8
CVE-2026-5627 Path Traversal in mintplex-labs/anything-llm 07.04.2026 9.1
CVE-2021-4473 Tianxin Internet Behavior Management System Command Injection via toQuery.php 08.04.2026 9.3
CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint 07.04.2026 9.3
CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root 07.04.2026 9.3
CVE-2026-1114 Improper Access Control via Weak JWT Token in parisneo/lollms 07.04.2026 9.8
CVE-2026-0740 Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload 08.04.2026 9.8
CVE-2026-35471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs 07.04.2026 9.8
CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload 07.04.2026 9.8
CVE-2026-35393 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload 08.04.2026 9.8
CVE-2026-35459 pyLoad has SSRF fix bypass via HTTP redirect 07.04.2026 9.3
CVE-2026-35022 Anthropic Claude Code & Agent SDK OS Command Injection via Authentication Helper 07.04.2026 9.3
CVE-2026-35178 Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion 07.04.2026 9.3
CVE-2026-35174 Chyrp Lite has a Path Traversal to Remote Code Execution 07.04.2026 9.1
CVE-2026-35050 text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml". 07.04.2026 9.1
CVE-2026-35171 Arbitrary Code Execution via Malicious Logging Configuration in Kedro 07.04.2026 9.8
CVE-2026-35047 Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint 07.04.2026 9.3
CVE-2026-35030 LiteLLM has an authentication bypass via OIDC userinfo cache key collision 07.04.2026 9.4
CVE-2026-35039 fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) 08.04.2026 9.1
CVE-2026-34989 CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 07.04.2026 9.4
CVE-2026-34841 Axios npm Supply Chain Incident Impacting @usebruno/cli 08.04.2026 9.8
CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization 07.04.2026 10
CVE-2026-34977 Aperi'Solve Affected by Unauthenticated RCE via JPSeek Analyzer Command 07.04.2026 9.3
CVE-2026-34950 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key 06.04.2026 9.1
CVE-2026-34208 SandboxJS: Sandbox integrity escape 06.04.2026 10
CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation 07.04.2026 9.1
CVE-2019-25687 Pegasus CMS 1.0 Remote Code Execution via extra_fields.php 06.04.2026 9.3
CVE-2016-20052 Snews CMS 1.7 Unrestricted File Upload via snews_files 06.04.2026 9.3
CVE-2018-25254 NICO-FTP 3.0.1.19 Buffer Overflow SEH 06.04.2026 9.3
CVE-2026-35616 07.04.2026 9.1
CVE-2017-20236 ProSoft Technology ICX35-HWC Command Injection via Web Interface 06.04.2026 9.3
CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code 06.04.2026 10
CVE-2026-34952 PraisonAI: Missing Authentication in WebSocket Gateway 06.04.2026 9.1
CVE-2026-34953 PraisonAI: Authentication Bypass in OAuthManager.validate_token() 06.04.2026 9.1
CVE-2017-20234 GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String 06.04.2026 9.3
CVE-2018-25236 Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management 06.04.2026 9.3
CVE-2021-4477 Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass 06.04.2026 9.3
CVE-2026-34612 Kestra: Remote Code Execution via SQL Injection 06.04.2026 10
CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads` 06.04.2026 9.8
CVE-2026-34935 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() 06.04.2026 9.8
CVE-2018-25237 Hirschmann HiSecOS Buffer Overflow via HTTPS Login 06.04.2026 9.3
CVE-2017-20237 Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution 06.04.2026 9.3
CVE-2026-25197 Gardyn Cloud API Authorization Bypass Through User-Controlled Key 07.04.2026 9.3
CVE-2026-28766 Gardyn Cloud API Missing Authentication for Critical Function 07.04.2026 9.2
CVE-2026-35560 Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver 07.04.2026 9.1
CVE-2026-35561 Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver 07.04.2026 9.1
CVE-2026-28798 Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS 06.04.2026 9.1
CVE-2026-32186 Microsoft Bing Elevation of Privilege Vulnerability 07.04.2026 10
CVE-2026-0545 Missing Authentication for Critical Function in mlflow/mlflow 03.04.2026 9.1
CVE-2026-35216 Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step 03.04.2026 9.1
CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist 03.04.2026 9.6
CVE-2026-5463 03.04.2026 9.3
CVE-2026-26135 Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability 07.04.2026 9.6
CVE-2026-32211 Azure MCP Server Information Disclosure Vulnerability 07.04.2026 9.1
CVE-2026-32213 Azure AI Foundry Elevation of Privilege Vulnerability 07.04.2026 10
CVE-2026-33105 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability 07.04.2026 10
CVE-2026-33107 Azure Databricks Elevation of Privilege Vulnerability 07.04.2026 10
CVE-2025-15620 HiOS Switch Platform Denial-of-Service via Web Interface 03.04.2026 9.2
CVE-2024-14034 Hirschmann HiEOS Authentication Bypass via HTTP Management Module 03.04.2026 9.3
CVE-2026-34838 Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection` 03.04.2026 10
CVE-2026-35053 OneUptime: Unauthenticated Workflow Execution via ManualAPI 03.04.2026 9.2
CVE-2026-34745 Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public 02.04.2026 9.1
CVE-2026-34758 OneUptime: Missing Authentication on Notification Endpoints 03.04.2026 9.1
CVE-2026-34759 OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure 03.04.2026 9.2
CVE-2026-34717 OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string 03.04.2026 9.9
CVE-2026-33950 signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity 03.04.2026 9.4
CVE-2026-33746 Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users 02.04.2026 9.8
CVE-2026-32871 FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability 02.04.2026 10
CVE-2026-35002 Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution 02.04.2026 9.3
CVE-2026-2699 EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) 08.04.2026 9.8
CVE-2026-2701 RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC) 03.04.2026 9.1

Latest Updates

CVE Title Updated Score
CVE-2026-5852 Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection 09.04.2026
CVE-2026-5853 Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection 09.04.2026
CVE-2026-5854 Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection 09.04.2026
CVE-2026-5850 Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection 09.04.2026
CVE-2026-5851 Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection 09.04.2026
CVE-2026-5848 jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection 09.04.2026
CVE-2026-5849 Tenda i12 HTTP path traversal 09.04.2026
CVE-2026-5841 Tenda i3 HTTP R7WebsSecurityHandler path traversal 09.04.2026
CVE-2026-5842 decolua 9router Administrative API Endpoint api authorization 09.04.2026
CVE-2026-5844 D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection 09.04.2026
CVE-2026-5847 code-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosure 09.04.2026
CVE-2026-1830 Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload 09.04.2026 9.8
CVE-2026-4336 Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content 09.04.2026 6.4
CVE-2026-5742 UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution 09.04.2026 6.4
CVE-2026-5838 PHPGurukul News Portal Project add-subadmins.php sql injection 09.04.2026
CVE-2026-5839 PHPGurukul News Portal Project add-subcategory.php sql injection 09.04.2026
CVE-2026-5840 PHPGurukul News Portal Project check_availability.php sql injection 09.04.2026
CVE-2026-3568 MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update 09.04.2026 4.3
CVE-2026-3574 Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting 09.04.2026 4.4
CVE-2026-4124 Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action 09.04.2026 5.4
CVE-2026-4429 OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute 09.04.2026 6.4
CVE-2026-5357 Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 09.04.2026 6.4
CVE-2026-5833 awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection 09.04.2026
CVE-2026-5834 code-projects Online Shoe Store admin_running.php cross site scripting 09.04.2026
CVE-2026-5835 code-projects Online Shoe Store admin_football.php cross site scripting 09.04.2026
CVE-2026-5836 code-projects Online Shoe Store admin_product.php cross site scripting 09.04.2026
CVE-2026-5837 PHPGurukul News Portal Project news-details.php sql injection 09.04.2026
CVE-2026-4326 Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins' 09.04.2026 8.8
CVE-2026-5830 Tenda AC15 SysToolChangePwd websGetVar stack-based overflow 09.04.2026
CVE-2026-5831 Agions taskflow-ai terminal_execute handlers.ts os command injection 09.04.2026
CVE-2026-5832 atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery 09.04.2026
CVE-2026-5828 code-projects Simple IT Discussion Forum addcomment.php sql injection 09.04.2026
CVE-2026-5829 code-projects Simple IT Discussion Forum content.php sql injection 09.04.2026
CVE-2026-5825 code-projects Simple Laundry System delmemberinfo.php cross site scripting 09.04.2026
CVE-2026-5826 code-projects Simple IT Discussion Forum edit-category.php cross site scripting 09.04.2026
CVE-2026-5827 code-projects Simple IT Discussion Forum question-function.php sql injection 09.04.2026
CVE-2026-5824 code-projects Simple Laundry System userchecklogin.php sql injection 08.04.2026
CVE-2026-5823 itsourcecode Construction Management System borrowed_tool_report.php sql injection 08.04.2026
CVE-2026-5814 PHPGurukul Online Course Registration check_availability.php sql injection 08.04.2026
CVE-2026-5815 D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflow 08.04.2026
CVE-2026-5813 PHPGurukul Online Course Registration check_availability.php sql injection 08.04.2026
CVE-2025-12664 Improper Validation of Specified Quantity in Input in GitLab 08.04.2026 7.5
CVE-2025-9484 Missing Authorization in GitLab 08.04.2026 4.3
CVE-2026-1092 Improper Validation of Specified Quantity in Input in GitLab 08.04.2026 7.5
CVE-2026-1101 Improper Validation of Specified Quantity in Input in GitLab 08.04.2026 6.5
CVE-2026-1516 Improper Control of Generation of Code ('Code Injection') in GitLab 08.04.2026 5.7
CVE-2026-1752 Incorrect Authorization in GitLab 08.04.2026 4.3
CVE-2026-2104 Authorization Bypass Through User-Controlled Key in GitLab 08.04.2026 4.3
CVE-2026-2619 Incorrect Authorization in GitLab 08.04.2026 4.3
CVE-2026-4332 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab 08.04.2026 5.4
CVE-2026-4916 Missing Authorization in GitLab 08.04.2026 2.7
CVE-2026-5173 Exposed Dangerous Method or Function in GitLab 08.04.2026 8.5
CVE-2026-5812 SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error 08.04.2026
CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection 08.04.2026
CVE-2026-3438 Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages 08.04.2026
CVE-2026-4398 08.04.2026
CVE-2026-5811 SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error 08.04.2026
CVE-2026-5810 SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting 08.04.2026
CVE-2026-40024 Sleuth Kit tsk_recover Path Traversal 08.04.2026
CVE-2026-40025 Sleuth Kit APFS Keybag Parser Out-of-Bounds Read 08.04.2026
CVE-2026-40026 Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read 08.04.2026
CVE-2026-40027 ALEAPP NQ Vault Artifact Parser Path Traversal 08.04.2026
CVE-2026-40028 Hayabusa < 3.8.0 XSS via JSON Log Import 08.04.2026
CVE-2026-40029 parseusbs < 1.9 Command Injection via Crafted LNK Filename 08.04.2026
CVE-2026-40030 parseusbs < 1.9 Command Injection via Volume Path Argument 08.04.2026
CVE-2026-40031 MemProcFS < 5.17 DLL/Shared Library Hijacking 08.04.2026
CVE-2026-40032 UAC < 3.3.0-rc1 Command Injection via Placeholder Substitution 08.04.2026
CVE-2026-40035 Unfurl - Werkzeug Debugger Exposure via String Config Parsing 08.04.2026
CVE-2026-40036 Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression 08.04.2026
CVE-2026-40037 OpenClaw < 2026.3.31 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects 08.04.2026
CVE-2026-5711 Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute 08.04.2026 6.4
CVE-2026-5808 openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting 08.04.2026
CVE-2026-39901 monetr: Protected Transactions Deletable via PUT 08.04.2026 5.7
CVE-2026-5806 code-projects Easy Blog Site update.php cross site scripting 08.04.2026
CVE-2026-5858 08.04.2026
CVE-2026-5859 08.04.2026
CVE-2026-5860 08.04.2026
CVE-2026-5861 08.04.2026
CVE-2026-5862 08.04.2026
CVE-2026-5863 08.04.2026
CVE-2026-5864 08.04.2026
CVE-2026-5865 08.04.2026
CVE-2026-5866 08.04.2026
CVE-2026-5867 08.04.2026
CVE-2026-5868 08.04.2026
CVE-2026-5869 08.04.2026
CVE-2026-5870 08.04.2026
CVE-2026-5871 08.04.2026
CVE-2026-5872 08.04.2026
CVE-2026-5873 08.04.2026
CVE-2026-5874 08.04.2026
CVE-2026-5875 08.04.2026
CVE-2026-5876 08.04.2026
CVE-2026-5877 08.04.2026
CVE-2026-5878 08.04.2026
CVE-2026-5879 08.04.2026
CVE-2026-5880 08.04.2026
CVE-2026-5881 08.04.2026
CVE-2026-5882 08.04.2026
CVE-2026-5883 08.04.2026
CVE-2026-5884 08.04.2026
CVE-2026-5885 08.04.2026
CVE-2026-5886 08.04.2026
CVE-2026-5887 08.04.2026
CVE-2026-5888 08.04.2026
CVE-2026-5889 08.04.2026
CVE-2026-5890 08.04.2026
CVE-2026-5891 08.04.2026
CVE-2026-5892 08.04.2026
CVE-2026-5893 08.04.2026
CVE-2026-5894 08.04.2026
CVE-2026-5895 08.04.2026
CVE-2026-5896 08.04.2026
CVE-2026-5897 08.04.2026
CVE-2026-5898 08.04.2026
CVE-2026-5899 08.04.2026
CVE-2026-5900 08.04.2026
CVE-2026-5901 08.04.2026
CVE-2026-5902 08.04.2026
CVE-2026-5903 08.04.2026
CVE-2026-5904 08.04.2026
CVE-2026-5905 08.04.2026
CVE-2026-5906 08.04.2026
CVE-2026-5907 08.04.2026
CVE-2026-5908 08.04.2026
CVE-2026-5909 08.04.2026
CVE-2026-5910 08.04.2026
CVE-2026-5911 08.04.2026
CVE-2026-5912 08.04.2026
CVE-2026-5913 08.04.2026
CVE-2026-5914 08.04.2026
CVE-2026-5915 08.04.2026
CVE-2026-5918 08.04.2026
CVE-2026-5919 08.04.2026
CVE-2026-39860 Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination 08.04.2026 9
CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode) 08.04.2026 10
CVE-2026-39889 PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server 08.04.2026 7.5
CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading 08.04.2026 9.8
CVE-2026-39891 PraisonAI has a Template Injection in Agent Tool Definitions 08.04.2026 8.8
CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs 08.04.2026
CVE-2026-39882 OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies 08.04.2026 5.3
CVE-2026-39883 OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking 08.04.2026
CVE-2026-39885 FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications 08.04.2026 7.5
CVE-2026-5436 MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys 08.04.2026 8.1
CVE-2026-5451 Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode 08.04.2026 6.4
CVE-2026-5805 code-projects Easy Blog Site contact_us.php sql injection 08.04.2026
CVE-2026-39414 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing 08.04.2026
CVE-2026-39415 Frappe Learning Management System has Client-Side Manipulation of Quiz Scores 08.04.2026
CVE-2026-39416 Stored XSS in modal item preview for long item content in AIL Framework 08.04.2026
CVE-2026-39429 kcp's cache server is accessible without authentication or authorization checks 08.04.2026 8.2
CVE-2026-39844 NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization 08.04.2026 5.9
CVE-2026-39881 Vim Ex command injection in Vims NetBeans integration 08.04.2026 5
CVE-2026-5803 bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery 08.04.2026
CVE-2026-39413 LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API 08.04.2026 4.2
CVE-2026-39859 LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read 08.04.2026
CVE-2026-39862 Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link 08.04.2026
CVE-2026-39863 Kamailio Core: TCP Data Processing Vulnerability 08.04.2026 7.5
CVE-2026-39864 Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks 08.04.2026 4.4
CVE-2026-39880 Remnawave Backend has a race condition in HWID device limit allows bypassing max devices 08.04.2026 5
CVE-2026-5802 idachev mcp-javadc HTTP os command injection 08.04.2026
CVE-2026-23869 08.04.2026 7.5
CVE-2026-35476 InvenTree Affected by Privilege Escalation via API 08.04.2026 7.2
CVE-2026-35477 InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape 08.04.2026 5.5
CVE-2026-35478 InvenTree has Arbitrary API Token Creation 08.04.2026 8.3
CVE-2026-35479 InvenTree Plugin Installation - Insufficient Permissions 08.04.2026 6.6
CVE-2026-35525 LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates 08.04.2026
CVE-2026-39362 InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs 08.04.2026
CVE-2026-39411 LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header 08.04.2026 5
CVE-2026-39412 LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel 08.04.2026 5.3
CVE-2026-20709 08.04.2026 6.6
CVE-2026-34782 Zammad has improper access control in AI assistance controller for text tools 08.04.2026
CVE-2026-34837 Zammad is miissing authorization in AI assistance controller for context data used in text tools 08.04.2026
CVE-2026-34985 LORIS has incorrect access checks in media module 08.04.2026 6.3
CVE-2026-35165 LORIS has incorrect access checks in document_repository 08.04.2026 6.3
CVE-2026-35169 LORIS has potential cross-site scripting in help_editor module 08.04.2026 8.7
CVE-2026-35400 LORIS incorrectly trusts user input in publication module 08.04.2026 3.5
CVE-2026-35403 LORIS has potential cross-site scripting in survey_accounts module 08.04.2026 6.5
CVE-2026-35446 LORIS has a path traversal in FilesDownloadHandler 08.04.2026 7.7
CVE-2026-35455 immich has Stored XSS via OCR Text in 360° Panorama Viewer 08.04.2026 7.3
CVE-2025-50666 08.04.2026
CVE-2025-50667 08.04.2026
CVE-2025-50668 08.04.2026
CVE-2025-50669 08.04.2026
CVE-2025-50670 08.04.2026
CVE-2025-50671 08.04.2026
CVE-2025-50672 08.04.2026
CVE-2025-50673 08.04.2026
CVE-2026-27806 Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit 08.04.2026 7.8
CVE-2026-30814 Buffer Overflow Vulnerability in TP-Link AX53 09.04.2026
CVE-2026-30815 OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53 09.04.2026
CVE-2026-30816 Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53 08.04.2026
CVE-2026-30817 Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53 08.04.2026
CVE-2026-30818 OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53 09.04.2026
CVE-2026-33350 LORIS has a SQL injection in MRI feedback popup 08.04.2026 7.5
CVE-2026-34166 LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter 08.04.2026 3.7
CVE-2026-34248 Zammad has an information disclosure in ticket detail view of customers in shared organizations 08.04.2026
CVE-2026-34392 LORIS has a path traversal in static router 08.04.2026 7.5
CVE-2026-34718 Zammad improperly neutralizes of script-related HTML tags in ticket articles 08.04.2026
CVE-2026-34719 Zammad has a Server-side request forgery (SSRF) via webhooks 08.04.2026
CVE-2026-34720 Zammad has an origin validation error in SSO mechanism 08.04.2026
CVE-2026-34721 Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints 08.04.2026
CVE-2026-34722 Zammad is missing authorization in ticket create endpoint 08.04.2026
CVE-2026-34723 Zammad has incorrect access control in getting_started_controller 08.04.2026
CVE-2026-34724 Zammad has a server-side template injection leading to RCE via AI Agent 08.04.2026
CVE-2025-30650 Junos OS: Privileged local user can gain access to a Linux-based FPC as root 08.04.2026 6.7
CVE-2025-50644 08.04.2026
CVE-2025-50645 08.04.2026
CVE-2025-50646 08.04.2026
CVE-2025-50647 08.04.2026
CVE-2025-50648 08.04.2026
CVE-2025-50649 08.04.2026
CVE-2025-50650 08.04.2026
CVE-2025-50652 08.04.2026
CVE-2025-50653 08.04.2026
CVE-2025-50654 08.04.2026
CVE-2025-50655 08.04.2026
CVE-2025-50657 08.04.2026
CVE-2025-50659 08.04.2026
CVE-2025-50660 08.04.2026
CVE-2025-50661 08.04.2026
CVE-2025-50662 08.04.2026
CVE-2025-50663 08.04.2026
CVE-2025-50664 08.04.2026
CVE-2025-50665 08.04.2026
CVE-2026-0811 Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion 08.04.2026 5.4
CVE-2026-0814 Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export 08.04.2026 4.3
CVE-2026-2942 ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess 08.04.2026 9.8
CVE-2026-35401 Saleor has a resource exhaustion vulnerability in GraphQL queries 08.04.2026 7.5
CVE-2026-35407 Saleor has Cross-Account Email Change via Unbound Confirmation Token 08.04.2026
CVE-2026-39851 Saleor has a user enumeration vulnerability due to different error messages 08.04.2026
CVE-2025-45057 08.04.2026
CVE-2025-45058 08.04.2026
CVE-2025-45059 08.04.2026
CVE-2025-52221 08.04.2026
CVE-2025-52222 08.04.2026
CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload 08.04.2026
CVE-2026-32590 Mirror-registry: remote code execution using pickle deserialization 08.04.2026
CVE-2026-32591 Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration 08.04.2026
CVE-2026-33458 Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure 08.04.2026 6.8
CVE-2026-33459 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service 08.04.2026 6.5
CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write 08.04.2026 8.1
CVE-2026-33756 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching 08.04.2026 7.5
CVE-2023-46945 08.04.2026
CVE-2025-14243 Mirror-registry: openshift mirror registry: user enumeration via authentication error messages 08.04.2026
CVE-2025-57175 08.04.2026 6.4
CVE-2026-2377 Mirror-registry: quay: quay: server-side request forgery via log export functionality 08.04.2026
CVE-2026-30075 08.04.2026
CVE-2026-31017 08.04.2026
CVE-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure 08.04.2026 4.3
CVE-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure 08.04.2026 7.7
CVE-2026-4498 Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope 08.04.2026 7.7
CVE-2026-30080 08.04.2026
CVE-2026-4837 Eval Injection in Rapid7 Insight Agent 09.04.2026 6.6
CVE-2026-31040 08.04.2026
CVE-2026-33229 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API 08.04.2026
CVE-2026-33753 Improper Certificate Validation in rfc3161-client 08.04.2026 6.2
CVE-2026-39389 CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files 08.04.2026 6.7
CVE-2026-39390 CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting 08.04.2026 5.5
CVE-2026-39391 CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List 08.04.2026 4.8
CVE-2026-39392 CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization 08.04.2026 5.5
CVE-2026-39393 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms 08.04.2026 8.1
CVE-2026-39394 CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller 08.04.2026 8.1
CVE-2026-39406 @hono/node-server has a middleware bypass via repeated slashes in serveStatic 08.04.2026 5.3
CVE-2026-39407 Hono has a middleware bypass via repeated slashes in serveStatic 08.04.2026 5.3
CVE-2026-39408 Hono has a path traversal in toSSG() allows writing files outside the output directory 08.04.2026
CVE-2026-39409 Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses 08.04.2026
CVE-2026-39410 Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() 08.04.2026 4.8
CVE-2026-39865 Axios HTTP/2 Session Cleanup State Corruption Vulnerability 08.04.2026 5.9
CVE-2025-57847 Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions 08.04.2026
CVE-2025-57851 Mce: privilege escalation via excessive /etc/passwd permissions 08.04.2026
CVE-2025-57853 Web-terminal: privilege escalation via excessive /etc/passwd permissions 08.04.2026
CVE-2025-57854 Osus-operator: privilege escalation via excessive /etc/passwd permissions 08.04.2026
CVE-2025-58713 Rhpam: privilege escalation via excessive /etc/passwd permissions 08.04.2026
CVE-2025-14815 Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64 08.04.2026
CVE-2025-14816 Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64 08.04.2026
CVE-2026-2509 Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes 08.04.2026 6.4
CVE-2026-31411 net: atm: fix crash due to unvalidated vcc pointer in sigd_send() 08.04.2026
CVE-2026-35023 Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php 08.04.2026
CVE-2026-5795 09.04.2026 7.4