CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-7240 Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection 28.04.2026 9.3
CVE-2026-32644 Milesight Cameras Use of Hard-coded Cryptographic Key 27.04.2026 9.2
CVE-2026-7202 Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection 27.04.2026 9.3
CVE-2026-7203 Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection 28.04.2026 9.3
CVE-2026-7204 Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection 28.04.2026 9.3
CVE-2026-40976 27.04.2026 9.1
CVE-2026-7156 Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection 27.04.2026 9.3
CVE-2026-7154 Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection 27.04.2026 9.3
CVE-2026-7155 Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection 27.04.2026 9.3
CVE-2026-7152 Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection 27.04.2026 9.3
CVE-2026-7153 Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection 27.04.2026 9.3
CVE-2026-7139 Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection 27.04.2026 9.3
CVE-2026-7140 Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection 27.04.2026 9.3
CVE-2026-7136 Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection 27.04.2026 9.3
CVE-2026-7137 Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection 27.04.2026 9.3
CVE-2026-7138 Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection 27.04.2026 9.3
CVE-2026-41462 ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login 27.04.2026 9.3
CVE-2026-7123 Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection 27.04.2026 9.3
CVE-2026-7124 Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection 27.04.2026 9.3
CVE-2026-7125 Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection 27.04.2026 9.3
CVE-2026-7121 Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection 27.04.2026 9.3
CVE-2026-7122 Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection 27.04.2026 9.3
CVE-2026-22336 WordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerability 27.04.2026 9.3
CVE-2026-22337 WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability 27.04.2026 9.8
CVE-2026-41409 Apache MINA: CWE-502 Deserialization of Untrusted Data 27.04.2026 9.8
CVE-2026-41635 Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE 28.04.2026 9.8
CVE-2026-42363 GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability 27.04.2026 9.3
CVE-2026-7037 Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection 27.04.2026 9.3
CVE-2026-31682 bridge: br_nd_send: linearize skb before parsing ND options 27.04.2026 9.1
CVE-2026-31685 netfilter: ip6t_eui64: reject invalid MAC header for all packets 27.04.2026 9.4
CVE-2026-6951 25.04.2026 9.2
CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass 27.04.2026 9.1
CVE-2026-41478 Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) 27.04.2026 10
CVE-2026-41428 Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints 24.04.2026 9.1
CVE-2026-41327 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field 24.04.2026 9.1
CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph 24.04.2026 9.8
CVE-2026-41328 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field 24.04.2026 9.1
CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel 24.04.2026 9.3
CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE 24.04.2026 9.3
CVE-2026-31536 smb: server: let send_done handle a completion without IB_SEND_SIGNALED 27.04.2026 9.8
CVE-2026-31589 mm: call ->free_folio() directly in folio_unmap_invalidate() 27.04.2026 9.8
CVE-2026-31607 usbip: validate number_of_packets in usbip_pack_ret_submit() 27.04.2026 9.8
CVE-2026-31608 smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() 27.04.2026 9.8
CVE-2026-31609 smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() 27.04.2026 9.8
CVE-2026-31633 rxrpc: Fix integer overflow in rxgk_verify_response() 27.04.2026 9.8
CVE-2026-31636 rxrpc: fix RESPONSE authenticator parser OOB read 27.04.2026 9.1
CVE-2026-31637 rxrpc: reject undecryptable rxkad response tickets 27.04.2026 9.8
CVE-2026-31649 net: stmmac: fix integer underflow in chain mode 27.04.2026 9.8
CVE-2026-31657 batman-adv: hold claim backbone gateways by reference 27.04.2026 9.8
CVE-2026-31659 batman-adv: reject oversized global TT response buffers 27.04.2026 9.8
CVE-2026-31668 seg6: separate dst_cache for input and output paths in seg6 lwtunnel 27.04.2026 9.8
CVE-2026-31669 mptcp: fix slab-use-after-free in __inet_lookup_established 27.04.2026 9.8
CVE-2026-25660 Authentication bypass for certain API calls 24.04.2026 9.3
CVE-2026-21515 Azure IoT Central Elevation of Privilege Vulnerability 28.04.2026 9.9
CVE-2026-1950 No checking of the length of the buffer with the file name in AS320T 24.04.2026 9.8
CVE-2026-1951 No checking of the length of the buffer with the directory name in AS320T 24.04.2026 9.8
CVE-2026-1952 Denial of service via the undocumented subfunction in AS320T 24.04.2026 9.8
CVE-2026-1949 Incorrect calculation of buffer size on the stack in AS320T 24.04.2026 9.8
CVE-2026-25775 SenseLive X3050 Missing authentication for critical function 24.04.2026 9.3
CVE-2026-27843 SenseLive X3050 Missing authentication for critical function 24.04.2026 9.2
CVE-2026-35503 SenseLive X3050 Use of Hard-coded Credentials 24.04.2026 9.3
CVE-2026-39462 SenseLive X3050 Insufficiently Protected Credentials 24.04.2026 9.3
CVE-2026-40620 SenseLive X3050 Missing authentication for critical function 24.04.2026 9.3
CVE-2026-40630 SenseLive X3050 Authentication bypass using an alternate path or channel 24.04.2026 9.3
CVE-2026-24303 Microsoft Partner Center Elevation of Privilege Vulnerability 27.04.2026 9.6
CVE-2026-32210 Microsoft Dynamics 365 (online) Spoofing Vulnerability 27.04.2026 9.3
CVE-2026-33102 Microsoft 365 Copilot Elevation of Privilege Vulnerability 27.04.2026 9.3
CVE-2026-33819 Microsoft Bing Remote Code Execution Vulnerability 27.04.2026 10
CVE-2026-35431 Microsoft Entra ID Entitlement Management Spoofing Vulnerability 27.04.2026 10
CVE-2026-26210 KTransformers Unsafe Deserialization RCE via balance_serve 24.04.2026 9.3
CVE-2026-41274 Flowise: Cypher Injection in GraphCypherQAChain 24.04.2026 9.3
CVE-2026-6942 radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass 24.04.2026 9.3
CVE-2026-25874 LeRobot Unsafe Deserialization Remote Code Execution via gRPC 24.04.2026 9.3
CVE-2026-41264 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability 24.04.2026 9.2
CVE-2026-41265 Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability 23.04.2026 9.2
CVE-2026-41137 Flowise: Code Injection in CSVAgent leads to Authenticated RCE 23.04.2026 9.4
CVE-2026-6074 Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW) 23.04.2026 9.3
CVE-2026-31533 net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption 27.04.2026 9.8
CVE-2025-62373 Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer 23.04.2026 9.8
CVE-2026-23751 Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting 25.04.2026 9.3
CVE-2026-40470 Hackage package and doc upload stored XSS vulnerability 23.04.2026 9.9
CVE-2026-40471 Hackage CSRF vulnerability 23.04.2026 9.6
CVE-2026-40472 Hackage package metadata stored XSS vulnerability 23.04.2026 9.9
CVE-2026-41460 SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall 23.04.2026 9.3
CVE-2026-39440 WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability 23.04.2026 9.9
CVE-2026-6885 BorG Technology Corporation｜Borg SPM 2007 - Arbitrary File Upload 23.04.2026 9.3
CVE-2026-6886 BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass 23.04.2026 9.3
CVE-2026-6887 BorG Technology Corporation｜Borg SPM 2007 - SQL Injection 23.04.2026 9.3
CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution 23.04.2026 10
CVE-2026-41229 Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) 23.04.2026 9.1
CVE-2026-3844 Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote 23.04.2026 9.8
CVE-2026-41196 Luanti has a mod security sandbox escape 23.04.2026 9
CVE-2026-41197 Brillig: Heap corruption in foreign call results with nested tuple arrays 25.04.2026 9.3
CVE-2026-41679 Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass 23.04.2026 10
CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution 28.04.2026 9.2
CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution 28.04.2026 9.2
CVE-2026-41167 Jellystat has SQL Injection that leads to to Remote Code Execution 23.04.2026 9.1
CVE-2026-33656 EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user 23.04.2026 9.1
CVE-2026-33471 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation 23.04.2026 9.6
CVE-2026-34415 Xerte Online Toolkits File Upload RCE via elfinder Connector 24.04.2026 9.3
CVE-2026-41468 Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection 22.04.2026 9.3
CVE-2018-25270 ThinkPHP 5.0.23 Remote Code Execution via invokefunction 22.04.2026 9.3
CVE-2018-25272 ELBA5 5.8.0 Remote Code Execution via Database Access 22.04.2026 9.3
CVE-2026-31436 dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() 27.04.2026 9.8
CVE-2026-31444 ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() 27.04.2026 9.8
CVE-2026-31448 ext4: avoid infinite loops caused by residual data 27.04.2026 9.4
CVE-2026-31463 iomap: fix invalid folio access when i_blkbits differs from I/O granularity 27.04.2026 9.8
CVE-2026-31478 ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() 27.04.2026 9.8
CVE-2026-31501 net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path 27.04.2026 9.8
CVE-2026-4119 Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php 22.04.2026 9.1
CVE-2026-6235 Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests 23.04.2026 9.8
CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing 22.04.2026 9.1
CVE-2026-41064 AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) 22.04.2026 9.3
CVE-2026-40946 Oxia: OIDC token audience validation bypass via SkipClientIDCheck 22.04.2026 9.2
CVE-2026-40933 Flowise: Authenticated RCE Via MCP Adapters 22.04.2026 10
CVE-2026-33518 Incorrect privilege assignment in Portal for ArcGIS 23.04.2026 9.8
CVE-2026-33519 Incorrect privilege assignment in Portal for ArcGIS 23.04.2026 9.8
CVE-2026-34275 22.04.2026 9.8
CVE-2026-34279 22.04.2026 9.1
CVE-2026-34285 22.04.2026 9.1
CVE-2026-34286 22.04.2026 9.1
CVE-2026-34287 23.04.2026 9.1
CVE-2026-40906 Electric: SQL Injection via ORDER BY Parameter in Shape API 22.04.2026 10
CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks 22.04.2026 10
CVE-2026-40884 goshs: Empty-username SFTP password authentication bypass in goshs 22.04.2026 9.8
CVE-2026-40903 Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence 22.04.2026 9.1
CVE-2026-40372 ASP.NET Core Elevation of Privilege Vulnerability 27.04.2026 9.1
CVE-2026-40872 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field 22.04.2026 9.3
CVE-2026-40887 @vendure/core has a SQL Injection vulnerability 22.04.2026 9.1
CVE-2026-41193 FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE 21.04.2026 9.1
CVE-2026-21571 23.04.2026 9.4
CVE-2026-40050 CrowdStrike LogScale Unauthenticated Path Traversal 21.04.2026 9.8
CVE-2026-40569 FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration 21.04.2026 9
CVE-2026-40576 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server 21.04.2026 9.4
CVE-2026-5652 Authorization Bypass Through User-Controlled Key in Crafty Controller 21.04.2026 9
CVE-2019-25714 Seeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet 21.04.2026 9.3
CVE-2025-41029 SQL injection in Zeon Academy Pro by Zeon Global Tech 21.04.2026 9.3

Latest Updates

CVE Title Updated Score
CVE-2024-54011 Missing Error/Exception Handling 28.04.2026
CVE-2024-54012 Command Injection 28.04.2026
CVE-2024-54013 Authentication Bypass 28.04.2026
CVE-2026-40966 VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration 28.04.2026 5.9
CVE-2026-41525 28.04.2026 6.5
CVE-2026-41526 28.04.2026 6.5
CVE-2026-4805 Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block 28.04.2026 6.4
CVE-2026-4911 Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter 28.04.2026 5.3
CVE-2026-7235 ErlichLiu claude-agent-sdk-master route.ts path traversal 28.04.2026
CVE-2026-7237 AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal 28.04.2026
CVE-2026-7238 code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload 28.04.2026
CVE-2026-7240 Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection 28.04.2026
CVE-2026-40356 28.04.2026 5.9
CVE-2026-40967 28.04.2026 8.6
CVE-2026-5306 Check & Log Email < 2.0.13 - Unauthenticated Stored XSS 28.04.2026
CVE-2026-7229 code-projects Coaching Management System POST reply.php sql injection 28.04.2026
CVE-2026-7230 SourceCodester Safety Anger Pad cross site scripting 28.04.2026
CVE-2026-7233 Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds 28.04.2026
CVE-2026-7234 BrowserOperator browser-operator-core server.js startsWith path traversal 28.04.2026
CVE-2026-40355 28.04.2026 5.9
CVE-2026-42510 28.04.2026 6.6
CVE-2026-6551 Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute 28.04.2026 6.4
CVE-2026-6725 WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute 28.04.2026 6.4
CVE-2026-6809 Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed 28.04.2026 6.4
CVE-2026-7224 SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection 28.04.2026
CVE-2026-7225 SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection 28.04.2026
CVE-2026-7226 SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection 28.04.2026
CVE-2026-7227 SourceCodester Pizzafy Ecommerce System ajax.php login sql injection 28.04.2026
CVE-2026-7228 SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection 28.04.2026
CVE-2026-7219 Totolink N300RT formIpQoS buffer overflow 28.04.2026
CVE-2026-7220 jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection 28.04.2026
CVE-2026-7221 TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery 28.04.2026
CVE-2026-7222 code-projects Coaching Management System Complaint Form complaint.php cross site scripting 28.04.2026
CVE-2026-7223 BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery 28.04.2026
CVE-2026-0711 28.04.2026 6.8
CVE-2026-1460 28.04.2026 7.2
CVE-2026-7215 egtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection 28.04.2026
CVE-2026-7216 donchelo processing-claude-mcp-bridge create_sketch Tool processing_server.py path traversal 28.04.2026
CVE-2026-7217 Deepractice PromptX Document File index.ts read_pdf absolute path traversal 28.04.2026
CVE-2026-7218 Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow 28.04.2026
CVE-2026-7212 edvardlindelof notes-mcp notes_mcp.py path traversal 28.04.2026
CVE-2026-7213 ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal 28.04.2026
CVE-2026-7214 eghuzefa engineer-your-data server.py file_inf path traversal 28.04.2026
CVE-2026-20766 Milesight Cameras Heap-based Buffer Overflow 27.04.2026
CVE-2026-32644 Milesight Cameras Use of Hard-coded Cryptographic Key 27.04.2026
CVE-2026-32649 Milesight Cameras OS Command Injection 27.04.2026
CVE-2026-7202 Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection 27.04.2026
CVE-2026-7203 Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection 28.04.2026
CVE-2026-7204 Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection 28.04.2026
CVE-2026-7205 duartium papers-mcp-server main.py search_papers path traversal 28.04.2026
CVE-2026-7206 dubydu sqlite-mcp entry.py extract_to_json sql injection 28.04.2026
CVE-2026-7211 dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection 28.04.2026
CVE-2026-27785 Milesight Cameras Use of Hard-coded Credentials 27.04.2026
CVE-2026-40973 27.04.2026 7
CVE-2026-40974 27.04.2026 5
CVE-2026-40975 27.04.2026 4.8
CVE-2026-40976 27.04.2026 9.1
CVE-2026-40977 27.04.2026 4.7
CVE-2026-41362 OpenClaw 2026.2.19 < 2026.3.31 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication 27.04.2026
CVE-2026-41363 OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter 27.04.2026
CVE-2026-41364 OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload 27.04.2026
CVE-2026-41365 OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History 27.04.2026
CVE-2026-41366 OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting 27.04.2026
CVE-2026-41367 OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions 27.04.2026
CVE-2026-41368 OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass 27.04.2026
CVE-2026-41369 OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution 27.04.2026
CVE-2026-41370 OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP Dispatch 27.04.2026
CVE-2026-41371 OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command 27.04.2026
CVE-2026-41372 OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery 27.04.2026
CVE-2026-7200 SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting 27.04.2026
CVE-2026-40972 27.04.2026 7.5
CVE-2026-7196 CodeAstro Online Classroom guestdetails sql injection 27.04.2026
CVE-2026-7199 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection 27.04.2026
CVE-2026-28747 Milesight Cameras Authorization Bypass Through User-Controlled Key 27.04.2026
CVE-2026-40971 27.04.2026 5
CVE-2026-7194 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection 27.04.2026
CVE-2026-7179 OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal 27.04.2026
CVE-2026-7183 aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception 27.04.2026
CVE-2026-7178 ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery 27.04.2026
CVE-2026-7177 ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery 27.04.2026
CVE-2026-7159 douinc mkdocs-mcp-plugin server.py list_documents path traversal 27.04.2026
CVE-2026-7160 Tenda HG3 formTracert command injection 27.04.2026
CVE-2024-46636 27.04.2026
CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs 28.04.2026
CVE-2026-7156 Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection 27.04.2026
CVE-2026-7157 disler aider-mcp-server aider_ai_code server.py command injection 27.04.2026
CVE-2026-7158 dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery 27.04.2026
CVE-2026-29971 27.04.2026
CVE-2026-5362 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering 27.04.2026
CVE-2026-7154 Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection 27.04.2026
CVE-2026-7155 Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection 27.04.2026
CVE-2026-7191 Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS 27.04.2026 7.2
CVE-2026-5394 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling 27.04.2026
CVE-2026-6741 LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability 27.04.2026 8.8
CVE-2026-7151 Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow 27.04.2026
CVE-2026-7152 Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection 27.04.2026
CVE-2026-7153 Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection 27.04.2026
CVE-2025-69428 27.04.2026
CVE-2026-40970 27.04.2026 5
CVE-2026-7149 dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal 27.04.2026
CVE-2026-7150 dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery 27.04.2026
CVE-2021-36438 27.04.2026
CVE-2026-31255 27.04.2026
CVE-2026-31256 27.04.2026
CVE-2026-32655 28.04.2026 5.3
CVE-2026-35901 27.04.2026
CVE-2026-35902 27.04.2026
CVE-2026-35903 27.04.2026
CVE-2026-7147 JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery 27.04.2026
CVE-2026-7148 CodeAstro Online Classroom addnewfaculty sql injection 27.04.2026
CVE-2026-25908 28.04.2026 6.7
CVE-2026-7146 AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery 27.04.2026
CVE-2025-69689 27.04.2026
CVE-2026-31686 mm/kasan: fix double free for kasan pXds 27.04.2026
CVE-2026-31687 gpio: omap: do not register driver in probe() 27.04.2026
CVE-2026-31688 driver core: enforce device_lock for driver_match_device() 27.04.2026
CVE-2026-31689 EDAC/mc: Fix error path ordering in edac_mc_alloc() 27.04.2026
CVE-2026-31690 firmware: thead: Fix buffer overflow and use standard endian macros 27.04.2026
CVE-2026-31691 igb: remove napi_synchronize() in igb_down() 27.04.2026
CVE-2026-7143 1000 Projects Portfolio Management System MCA block_status.php sql injection 27.04.2026
CVE-2026-7144 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization 27.04.2026
CVE-2026-7145 mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization 27.04.2026
CVE-2026-30462 27.04.2026
CVE-2026-38934 27.04.2026
CVE-2026-38935 27.04.2026
CVE-2026-38936 27.04.2026
CVE-2026-7141 vllm KV Block kv_cache_interface.py has_mamba_layers uninitialized resource 27.04.2026
CVE-2026-7142 Wooey API Endpoint scripts.py add_or_update_script improper authorization 27.04.2026
CVE-2026-30346 27.04.2026
CVE-2026-7139 Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection 27.04.2026
CVE-2026-7140 Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection 27.04.2026
CVE-2026-6970 authd Denial of Service and Local Privilege Escalation 27.04.2026
CVE-2026-7136 Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection 27.04.2026
CVE-2026-7137 Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection 27.04.2026
CVE-2026-7138 Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection 27.04.2026
CVE-2025-54505 27.04.2026
CVE-2026-30351 27.04.2026
CVE-2026-30352 27.04.2026
CVE-2026-41462 ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login 27.04.2026
CVE-2026-41463 ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php 27.04.2026
CVE-2026-41464 ProjeQtor < 12.4.4 Missing Authorization via objectDetail.php 27.04.2026
CVE-2026-41465 ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php 27.04.2026
CVE-2026-41466 ProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText() 27.04.2026
CVE-2026-41467 ProjeQtor < 12.4.4 Stored XSS via checkValidFileName() 27.04.2026
CVE-2026-7134 code-projects Online Lot Reservation System edithousepic.php unrestricted upload 27.04.2026
CVE-2026-7135 GPAC MP4Box box_code_base.c elng_box_read out-of-bounds 27.04.2026
CVE-2026-30350 27.04.2026
CVE-2026-40514 SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG 27.04.2026
CVE-2026-6337 27.04.2026
CVE-2026-6357 pip self-update functionality can import newly installed modules after wheel installation 27.04.2026
CVE-2026-7131 code-projects Online Lot Reservation System loginuser.php sql injection 27.04.2026
CVE-2026-7132 code-projects Online Lot Reservation System download.php readfile path traversal 27.04.2026
CVE-2026-7133 code-projects Online Lot Reservation System activity.php unrestricted upload 27.04.2026
CVE-2026-32688 Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy 28.04.2026
CVE-2026-7128 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection 27.04.2026
CVE-2026-7129 SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting 27.04.2026
CVE-2026-7130 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection 27.04.2026
CVE-2025-15626 Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application 27.04.2026
CVE-2026-40557 Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections 27.04.2026
CVE-2026-41081 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure 27.04.2026
CVE-2026-6265 Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2 27.04.2026
CVE-2026-7126 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection 27.04.2026
CVE-2026-7127 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection 27.04.2026
CVE-2026-7040 Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters 27.04.2026
CVE-2026-7123 Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection 27.04.2026
CVE-2026-7124 Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection 27.04.2026
CVE-2026-7125 Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection 27.04.2026
CVE-2026-7119 Tenda HG3 formCountrystr os command injection 27.04.2026
CVE-2026-7121 Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection 27.04.2026
CVE-2026-7122 Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection 27.04.2026
CVE-2026-5937 Foxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerability 27.04.2026 5.5
CVE-2026-5938 Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability 27.04.2026 5.5
CVE-2026-5939 UAF in Foxit PDF Editor/Reader via XFA calculate event 28.04.2026 5.5
CVE-2026-5940 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability 28.04.2026 7.8
CVE-2026-5941 Foxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability 28.04.2026 7.8
CVE-2026-5942 Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability 27.04.2026 5.5
CVE-2026-5943 Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability 28.04.2026 7.8
CVE-2026-7117 code-projects Employee Management System approve.php sql injection 27.04.2026
CVE-2026-7118 code-projects Employee Management System cancel.php sql injection 27.04.2026