# CVEs published 2026-04-07

275 CVEs were published on April 7, 2026: 45 critical, 116 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-4394](https://cve.now/CVE-2026-4394.md): Gravity Forms \<= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field (CVSS 6.1, Gravity Forms)
- [CVE-2026-4406](https://cve.now/CVE-2026-4406.md): Gravity Forms \<= 2.9.30 - Reflected Cross-Site Scripting via 'form\_ids' Parameter (CVSS 4.7, Gravity Forms)
- [CVE-2026-4401](https://cve.now/CVE-2026-4401.md): Download Monitor \<= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling (CVSS 5.4, wpchill Download Monitor)
- [CVE-2026-2263](https://cve.now/CVE-2026-2263.md): Hustle – Email Marketing, Lead Generation, Optins, Popups \<= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data… (CVSS 5.3, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2026-1342](https://cve.now/CVE-2026-1342.md): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 8.5, IBM Verify Identity Access Container · IBM Security Veri… +2)
- [CVE-2026-5747](https://cve.now/CVE-2026-5747.md): Out-of-bounds Write in Firecracker virtio-pci Transport (CVSS 7.5, AWS Firecracker)
- [CVE-2025-20628](https://cve.now/CVE-2025-20628.md): Insufficient granularity of access control for Remote Connector Servers in client mode (CVSS 6.9, Ping Identity PingIDM)
- [CVE-2026-39936](https://cve.now/CVE-2026-39936.md): Stored XSS in Score due to usage of non-reserved data attributes (CVSS 6.9, The Wikimedia Foundation Mediawiki - Score Extension)
- [CVE-2026-39935](https://cve.now/CVE-2026-39935.md): XSS-via-i18n in localised wiki names (CVSS 6.9, The Wikimedia Foundation Mediawiki - CampaignEvents Extensi…)
- [CVE-2026-31790](https://cve.now/CVE-2026-31790.md): Incorrect Failure Handling in RSA KEM RSASVE Encapsulation (CVSS 7.5, OpenSSL)
- [CVE-2026-31789](https://cve.now/CVE-2026-31789.md): Heap Buffer Overflow in Hexadecimal Conversion (CVSS 5.8, OpenSSL)
- [CVE-2026-28390](https://cve.now/CVE-2026-28390.md): Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo (CVSS 7.5, OpenSSL)
- [CVE-2026-28389](https://cve.now/CVE-2026-28389.md): Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo (CVSS 7.5, OpenSSL)
- [CVE-2026-28388](https://cve.now/CVE-2026-28388.md): NULL Pointer Dereference When Processing a Delta CRL (CVSS 7.5, OpenSSL)
- [CVE-2026-28387](https://cve.now/CVE-2026-28387.md): Potential Use-after-free in DANE Client Code (CVSS 8.1, OpenSSL)
- [CVE-2026-28386](https://cve.now/CVE-2026-28386.md): Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support (CVSS 9.1, OpenSSL)
- [CVE-2026-39934](https://cve.now/CVE-2026-39934.md): Growth Experiments ReassignMenteesJob runs as an infinite loop (CVSS 6.9, The Wikimedia Foundation Mediawiki - GrowthExperiments Exte…)
- [CVE-2026-39933](https://cve.now/CVE-2026-39933.md): Multiple XSS vulnerabilities in GlobalWatchlist (CVSS 6.9, The Wikimedia Foundation Mediawiki - GlobalWatchlist Extens…)
- [CVE-2026-39937](https://cve.now/CVE-2026-39937.md): Global vanishing does not completely remove user email (CVSS 8.8, The Wikimedia Foundation Mediawiki - CentralAuth Extension)
- [CVE-2026-39847](https://cve.now/CVE-2026-39847.md): Emmett has a path traversal in internal assets handler (CVSS 9.1, emmett-framework emmett · emmett)
- [CVE-2026-39846](https://cve.now/CVE-2026-39846.md): SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions (CVSS 9.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-35406](https://cve.now/CVE-2026-35406.md): Aardvark-dns has incorrect error handling for malformed tcp packets (CVSS 6.2, containers aardvark-dns · netavark)
- [CVE-2026-34079](https://cve.now/CVE-2026-34079.md): Flatpak affected by arbitrary file deletion on the host filesystem (CVSS 8.7, flatpak)
- [CVE-2026-34078](https://cve.now/CVE-2026-34078.md): Flatpak has a complete sandbox escape leading to host file access and code execution in the host context (CVSS 9.3, flatpak)
- [CVE-2026-4065](https://cve.now/CVE-2026-4065.md): Smart Slider 3 \<= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation (CVSS 5.4, nextendweb Smart Slider)
- [CVE-2026-34781](https://cve.now/CVE-2026-34781.md): Electron crashes in clipboard.readImage() on malformed clipboard image data (CVSS 2.8, electron)
- [CVE-2026-34765](https://cve.now/CVE-2026-34765.md): Electron named window.open targets not scoped to the opener's browsing context (CVSS 6.0, electron)
- [CVE-2026-34582](https://cve.now/CVE-2026-34582.md): Botan has a TLS 1.3 certificate authentication bypass (CVSS 8.7, randombit botan)
- [CVE-2026-34580](https://cve.now/CVE-2026-34580.md): Botan has a certificate authentication bypass due to trust anchor confusion (CVSS 9.3, randombit botan)
- [CVE-2026-34371](https://cve.now/CVE-2026-34371.md): LibreChat Affected by Arbitrary File Write via \`execute\_code\` Artifact Filename Traversal (CVSS 6.3, danny-avila LibreChat)
- [CVE-2026-35568](https://cve.now/CVE-2026-35568.md): MCP Java-SDK has a DNS Rebinding Vulnerability (CVSS 7.6, modelcontextprotocol java-sdk · io.modelcontextprotocol.sdk…)
- [CVE-2026-35533](https://cve.now/CVE-2026-35533.md): mise has a local settings bypass config trust checks (CVSS 7.8, jdx mise · mise)
- [CVE-2026-34080](https://cve.now/CVE-2026-34080.md): xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception (CVSS 6.8, flatpak xdg-dbus-proxy)
- [CVE-2026-34045](https://cve.now/CVE-2026-34045.md): Podman Desktop WebView Server Exposed (CVSS 8.2, podman-desktop)
- [CVE-2026-33439](https://cve.now/CVE-2026-33439.md): Pre-Authentication Remote Code Execution via \`jato.clientSession\` Deserialization in OpenAM (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-32712](https://cve.now/CVE-2026-32712.md): Open Source Point of Sale has Stored XSS in Customer Name (Sales) (CVSS 5.4, opensourcepos)
- [CVE-2026-29181](https://cve.now/CVE-2026-29181.md): OpenTelemetry-Go multi-value \`baggage\` header extraction causes excessive allocations (remote dos amplification) (CVSS 7.5, open-telemetry opentelemetry-go · go.opentelemetry.io/otel)
- [CVE-2026-27949](https://cve.now/CVE-2026-27949.md): Plane Exposes User Email (PII and part of credential) in GET Parameter (CVSS 2.0, makeplane plane)
- [CVE-2026-39401](https://cve.now/CVE-2026-39401.md): Privilege Escalation via update\_event Job Output in Cronicle (CVSS 5.3, jhuckaby Cronicle)
- [CVE-2026-39400](https://cve.now/CVE-2026-39400.md): Stored XSS via Job HTML/Table Output in Cronicle (CVSS 5.3, jhuckaby Cronicle)
- [CVE-2026-39397](https://cve.now/CVE-2026-39397.md): @delmaredigital/payload-puc is missing authorization on /api/puck/ CRUD endpoints allows unauthenticated access to Puck-registered… (CVSS 9.4, delmaredigital payload-puck · @delmaredigital/payload-puck)
- [CVE-2026-39395](https://cve.now/CVE-2026-39395.md): Cosign's verify-blob-attestation reports false positive when payload parsing fails (CVSS 4.3, sigstore cosign · github.com/sigstore/cosign +2)
- [CVE-2026-5741](https://cve.now/CVE-2026-5741.md): suvarchal docker-mcp-server HTTP index.ts pull\_image os command injection (CVSS 6.9, suvarchal docker-mcp-server)
- [CVE-2026-39356](https://cve.now/CVE-2026-39356.md): SQL Injection via escapeName() in all Drizzle ORM SQL dialects (CVSS 7.5, drizzle-team drizzle-orm · drizzle-orm)
- [CVE-2025-14859](https://cve.now/CVE-2025-14859.md): Semtech LR11xx Secure Boot Bypass (CVSS 7.0, Semtech LR1110 · Semtech LR1120 +1)
- [CVE-2025-14858](https://cve.now/CVE-2025-14858.md): Semtech LR11xx Encrypted Firmware Disclosure (CVSS 5.1, Semtech LR1110 · Semtech LR1120 +1)
- [CVE-2025-14857](https://cve.now/CVE-2025-14857.md): Semtech LR11xx Memory Write Access Control Bypass (CVSS 5.4, Semtech LR1110 · Semtech LR1120 +1)
- [CVE-2026-32864](https://cve.now/CVE-2026-32864.md): Out-of-Bounds Read in mgcore\_SH\_25\_3!aligned\_free() (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39382](https://cve.now/CVE-2026-39382.md): dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output (CVSS 9.3, dbt-labs dbt-core)
- [CVE-2026-32863](https://cve.now/CVE-2026-32863.md): Out-of-Bounds Read in sentry\_transaction\_context\_set\_operation() (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39381](https://cve.now/CVE-2026-39381.md): Parse Server's Endpoint \`/sessions/me\` bypasses \`\_Session\` \`protectedFields\` (CVSS 5.3, parse-community parse-server · parse-server)
- [CVE-2026-32862](https://cve.now/CVE-2026-32862.md): Out-of-Bounds Write in ResFileFactory::InitResourceMgr() (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39380](https://cve.now/CVE-2026-39380.md): Open Source Point of Sale has Stored XSS in Stock Location (Configuration) (CVSS 5.4, opensourcepos)
- [CVE-2026-39837](https://cve.now/CVE-2026-39837.md): Stored XSS through the dynamic table format in Cargo (CVSS 6.3, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-32861](https://cve.now/CVE-2026-32861.md): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvclass file (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39376](https://cve.now/CVE-2026-39376.md): FastFeedParser has an infinite redirect loop DoS via meta-refresh chain (CVSS 7.5, kagisearch fastfeedparser · fastfeedparser)
- [CVE-2026-39841](https://cve.now/CVE-2026-39841.md): Stored XSS through list fields on Cargo's page values and Special:CargoTables (CVSS 6.3, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-32860](https://cve.now/CVE-2026-32860.md): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvlib file (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39374](https://cve.now/CVE-2026-39374.md): Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint (CVSS 6.5, makeplane plane)
- [CVE-2026-39840](https://cve.now/CVE-2026-39840.md): CSS injection in multiple Cargo display formats (CVSS 5.1, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-39373](https://cve.now/CVE-2026-39373.md): JWCrypto: JWE ZIP decompression bomb (CVSS 5.3, latchset jwcrypto · jwcrypto)
- [CVE-2026-39839](https://cve.now/CVE-2026-39839.md): Stored XSS through URLs in Cargo's map format (CVSS 6.3, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-39371](https://cve.now/CVE-2026-39371.md): RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests (CVSS 8.1, redwoodjs sdk · rwsdk)
- [CVE-2026-39370](https://cve.now/CVE-2026-39370.md): WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete… (CVSS 7.1, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-39369](https://cve.now/CVE-2026-39369.md): WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs (CVSS 7.6, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-39368](https://cve.now/CVE-2026-39368.md): WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services (CVSS 6.5, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-39367](https://cve.now/CVE-2026-39367.md): WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-39366](https://cve.now/CVE-2026-39366.md): WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php (CVSS 6.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-39838](https://cve.now/CVE-2026-39838.md): ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS (CVSS 6.9, Wikimedia Foundation MediaWiki - ProofreadPage Extension)
- [CVE-2026-5739](https://cve.now/CVE-2026-5739.md): PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection (CVSS 6.9, PowerJob · tech.powerjob:powerjob-server-starter)
- [CVE-2026-39365](https://cve.now/CVE-2026-39365.md): Vite has a Path Traversal in Optimized Deps \`.map\` Handling (CVSS 6.3, vitejs vite · vitejs vite-plus +1)
- [CVE-2026-39364](https://cve.now/CVE-2026-39364.md): Vite has a \`server.fs.deny\` bypass with queries (CVSS 8.2, vitejs vite · vitejs vite-plus +1)
- [CVE-2026-39363](https://cve.now/CVE-2026-39363.md): Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket (CVSS 8.2, vitejs vite · vitejs vite-plus +1)
- [CVE-2026-39322](https://cve.now/CVE-2026-39322.md): PolarLearn: Any password authenticates banned accounts and grants API access (CVSS 9.2, polarnl PolarLearn)
- [CVE-2026-39361](https://cve.now/CVE-2026-39361.md): OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate\_enrichment\_url (CVSS 7.7, openobserve)
- [CVE-2026-39360](https://cve.now/CVE-2026-39360.md): RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration (CVSS 5.3, rustfs)
- [CVE-2026-39355](https://cve.now/CVE-2026-39355.md): Genealogy is Missing Authorization in \`TeamController::transferOwnership()\` Allows Any Authenticated User to Hijack Any Team (Broken… (CVSS 10.0, MGeurts genealogy)
- [CVE-2026-39354](https://cve.now/CVE-2026-39354.md): Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask (CVSS 6.5, Erudika scoold)
- [CVE-2026-39351](https://cve.now/CVE-2026-39351.md): Frappe allows unrestricted Doctype access via API exploit (CVSS 6.9, frappe)
- [CVE-2026-5736](https://cve.now/CVE-2026-5736.md): PowerJob detailPlus Endpoint InstanceController.java sql injection (CVSS 6.9, PowerJob · tech.powerjob:powerjob-server-starter)
- [CVE-2026-5762](https://cve.now/CVE-2026-5762.md): ReportIncident DiscussionTools integration causes slow requests (CVSS 5.3, Wikimedia Foundation MediaWiki - ReportIncident Extension)
- [CVE-2026-22711](https://cve.now/CVE-2026-22711.md): Stored XSS through system messages in WikiLove (CVSS 6.9, The Wikimedia Foundation Mediawiki - Wikilove Extension)
- [CVE-2026-39349](https://cve.now/CVE-2026-39349.md): OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure (CVSS 2.1, orangehrm)
- [CVE-2026-39348](https://cve.now/CVE-2026-39348.md): OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments (CVSS 5.3, orangehrm)
- [CVE-2026-39347](https://cve.now/CVE-2026-39347.md): OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion (CVSS 5.1, orangehrm)
- [CVE-2026-39346](https://cve.now/CVE-2026-39346.md): OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding (CVSS 5.3, orangehrm)
- [CVE-2026-39345](https://cve.now/CVE-2026-39345.md): OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader (CVSS 4.6, orangehrm)
- [CVE-2026-39324](https://cve.now/CVE-2026-39324.md): Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization (CVSS 9.3, rack-session)
- [CVE-2026-39321](https://cve.now/CVE-2026-39321.md): Parse Server has a login timing side-channel reveals user existence (CVSS 6.3, parse-community parse-server · parse-server)
- [CVE-2026-39337](https://cve.now/CVE-2026-39337.md): ChurchCRM Affected by Unauthenticated RCE in Install Wizard (CVSS 10.0, ChurchCRM CRM)
- [CVE-2026-39319](https://cve.now/CVE-2026-39319.md): ChurchCRM has a Second Order SQLI via FundRaiserEditor.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39344](https://cve.now/CVE-2026-39344.md): Reflected XSS the login page through the 'username' parameter (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39343](https://cve.now/CVE-2026-39343.md): ChurchCRM has a SQL Injection in Event Type Editor (Admin) (CVSS 7.2, ChurchCRM CRM)
- [CVE-2026-39342](https://cve.now/CVE-2026-39342.md): ChurchCRM has a SQL injection searchwhat parameter via QueryView.php (CVSS 9.4, ChurchCRM CRM)
- [CVE-2026-39341](https://cve.now/CVE-2026-39341.md): SQL injection in ChurchCRM.0 (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39340](https://cve.now/CVE-2026-39340.md): ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39339](https://cve.now/CVE-2026-39339.md): ChurchCRM has an API Authentication Bypass (CVSS 9.1, ChurchCRM CRM)
- [CVE-2026-39338](https://cve.now/CVE-2026-39338.md): ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration (CVSS 8.6, ChurchCRM CRM)
- [CVE-2026-39336](https://cve.now/CVE-2026-39336.md): ChurchCRM has Stored XSS from unescaped config values in HTML attributes (CVSS 6.1, ChurchCRM CRM)
- [CVE-2026-39334](https://cve.now/CVE-2026-39334.md): ChurchCRM has a Blind SQL injection in SettingsIndividual.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39333](https://cve.now/CVE-2026-39333.md): ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php (CVSS 8.7, ChurchCRM CRM)
- [CVE-2026-39332](https://cve.now/CVE-2026-39332.md): ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php (CVSS 8.7, ChurchCRM CRM)
- [CVE-2026-39331](https://cve.now/CVE-2026-39331.md): ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39330](https://cve.now/CVE-2026-39330.md): ChurchCRM has a Blind SQL injection in PropertyAssign.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39329](https://cve.now/CVE-2026-39329.md): ChurchCRM has a Blind SQL injection in EventNames.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39328](https://cve.now/CVE-2026-39328.md): ChurchCRM has Stored XSS in Social Profile Fields (CVSS 8.9, ChurchCRM CRM)
- [CVE-2026-39327](https://cve.now/CVE-2026-39327.md): ChurchCRM has a SQL injection in MemberRoleChange.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39326](https://cve.now/CVE-2026-39326.md): ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39325](https://cve.now/CVE-2026-39325.md): ChurchCRM has a Blind SQL injection in SettingsUser.php (CVSS 7.2, ChurchCRM CRM)
- [CVE-2026-39318](https://cve.now/CVE-2026-39318.md): ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39335](https://cve.now/CVE-2026-39335.md): ChurchCRM has Stored XSS via Unescaped data- Attributes in Group/Family Controls (CVSS 6.1, ChurchCRM CRM)
- [CVE-2026-24175](https://cve.now/CVE-2026-24175.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header… (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24174](https://cve.now/CVE-2026-24174.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the… (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24173](https://cve.now/CVE-2026-24173.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the… (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24147](https://cve.now/CVE-2026-24147.md): NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by… (CVSS 4.8, NVIDIA Triton Inference Server)
- [CVE-2026-24146](https://cve.now/CVE-2026-24146.md): NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a… (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-35576](https://cve.now/CVE-2026-35576.md): ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php (CVSS 8.7, ChurchCRM CRM)
- [CVE-2026-24156](https://cve.now/CVE-2026-24156.md): NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. (CVSS 7.3, NVIDIA DALI)
- [CVE-2026-22682](https://cve.now/CVE-2026-22682.md): OpenHarness Improper Access Control via File Tools (CVSS 8.4, HKUDS OpenHarness)
- [CVE-2026-35575](https://cve.now/CVE-2026-35575.md): ChurchCRM has Stored XSS in Group Name (CVSS 8.0, ChurchCRM CRM)
- [CVE-2026-22680](https://cve.now/CVE-2026-22680.md): OpenViking \< 0.3.3 Missing Authorization via Task Polling (CVSS 6.9, Volcengine OpenViking · openviking)
- [CVE-2026-35572](https://cve.now/CVE-2026-35572.md): SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts (CVSS 7.0, ChurchCRM CRM)
- [CVE-2026-35573](https://cve.now/CVE-2026-35573.md): ChurchCRM has a Path traversal leads to RCE (CVSS 9.1, ChurchCRM CRM)
- [CVE-2026-35574](https://cve.now/CVE-2026-35574.md): ChurchCRM has a Stored XSS in Person Profile - Add a Note (CVSS 7.3, ChurchCRM CRM)
- [CVE-2026-39316](https://cve.now/CVE-2026-39316.md): CUPS has a use-after-free in \`cupsdDeleteTemporaryPrinters\` via dangling subscription pointer (CVSS 4.0, OpenPrinting cups)
- [CVE-2026-39314](https://cve.now/CVE-2026-39314.md): CUPS has an integer underflow in \`\_ppdCreateFromIPP\` causes root cupsd crash via negative \`job-password-supported\` (CVSS 4.0, OpenPrinting cups)
- [CVE-2026-35610](https://cve.now/CVE-2026-35610.md): PolarLearn has a Server Action Admin Bypass in Account Management Actions (CVSS 8.8, polarnl PolarLearn)
- [CVE-2026-39312](https://cve.now/CVE-2026-39312.md): Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition (CVSS 7.5, SoftEtherVPN)
- [CVE-2026-23696](https://cve.now/CVE-2026-23696.md): Windmill \< 1.603.3 File Ownership Handling SQLi RCE (CVSS 9.4, Windmill Labs Windmill CE · Windmill Labs Windmill EE)
- [CVE-2026-22683](https://cve.now/CVE-2026-22683.md): Windmill \< 1.615.0 Operator Role Missing Authorization Checks RCE (CVSS 8.7, Windmill Labs Windmill CE · Windmill Labs Windmill EE)
- [CVE-2026-39307](https://cve.now/CVE-2026-39307.md): PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction (CVSS 8.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39308](https://cve.now/CVE-2026-39308.md): PraisonAI recipe registry publish path traversal allows out-of-root file write (CVSS 7.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39306](https://cve.now/CVE-2026-39306.md): PraisonAI recipe registry pull path traversal writes files outside the chosen output directory (CVSS 7.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39305](https://cve.now/CVE-2026-39305.md): Arbitrary File Write / Path Traversal in Action Orchestrator (CVSS 9.0, MervinPraison PraisonAI · praisonai)
- [CVE-2026-35615](https://cve.now/CVE-2026-35615.md): PraisonAI has a Path Traversal in FileTools (CVSS 9.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-32588](https://cve.now/CVE-2026-32588.md): Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing (CVSS 6.5, Apache Software Foundation org.apache.cassandra:cassandra-a…)
- [CVE-2026-35614](https://cve.now/CVE-2026-35614.md): Frappe has a SQL injection in bulk\_update (CVSS 9.3, frappe)
- [CVE-2026-27315](https://cve.now/CVE-2026-27315.md): Apache Cassandra: cqlsh history sensitive information leak (CVSS 5.5, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2026-35613](https://cve.now/CVE-2026-35613.md): Path traversal in coursevault-preview due to improper base-directory boundary validation (CVSS 5.1, moritzmyrz coursevault-preview · coursevault-preview)
- [CVE-2026-35611](https://cve.now/CVE-2026-35611.md): Addressable has a Regular Expression Denial of Service in Addressable templates (CVSS 7.5, sporkmonger addressable · addressable)
- [CVE-2026-35608](https://cve.now/CVE-2026-35608.md): QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript execution (CVSS 5.3, RoastSlav quickdrop)
- [CVE-2025-14821](https://cve.now/CVE-2025-14821.md): Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows (CVSS 7.8, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-27314](https://cve.now/CVE-2026-27314.md): Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass (CVSS 8.8, Apache Software Foundation org.apache.cassandra:cassandra-a…)
- [CVE-2026-35607](https://cve.now/CVE-2026-35607.md): File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands (CVSS 8.1, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-4631](https://cve.now/CVE-2026-4631.md): Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection (CVSS 9.8, Red Hat Enterprise Linux)
- [CVE-2026-35606](https://cve.now/CVE-2026-35606.md): File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check (CVSS 5.3, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2025-14944](https://cve.now/CVE-2025-14944.md): Backup Migration \<= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage (CVSS 5.3, inisev BackupBliss – Backup & Migration with Free Cloud Sto…)
- [CVE-2026-35605](https://cve.now/CVE-2026-35605.md): File Browser has an access rule bypass via HasPrefix without trailing separator in path matching (CVSS 6.3, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-35604](https://cve.now/CVE-2026-35604.md): File Browser share links remain accessible after Share/Download permissions are revoked (CVSS 8.2, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-35585](https://cve.now/CVE-2026-35585.md): File Browser has a Command Injection via Hook Runner (CVSS 7.5, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-35592](https://cve.now/CVE-2026-35592.md): pyLoad has an Incomplete Tar Path Traversal Fix in UnTar.\_safe\_extractall via os.path.commonprefix Bypass (CVSS 5.3, pyload · pyload-ng)
- [CVE-2026-35586](https://cve.now/CVE-2026-35586.md): Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng (CVSS 6.8, pyload · pyload-ng)
- [CVE-2026-35584](https://cve.now/CVE-2026-35584.md): FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration (CVSS 6.9, freescout-help-desk freescout)
- [CVE-2026-39384](https://cve.now/CVE-2026-39384.md): FreeScout Customer Merge Cross-Mailbox Authorization Bypass (CVSS 7.6, freescout-help-desk freescout)
- [CVE-2026-35523](https://cve.now/CVE-2026-35523.md): Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol (CVSS 7.5, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-35583](https://cve.now/CVE-2026-35583.md): Emissary has a Path Traversal via Blacklist Bypass in Configuration API (CVSS 5.3, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35581](https://cve.now/CVE-2026-35581.md): Emissary has a Command Injection via PLACE\_NAME Configuration in Executrix (CVSS 7.2, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35580](https://cve.now/CVE-2026-35580.md): Emissary has GitHub Actions Shell Injection via Workflow Inputs (CVSS 9.1, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35534](https://cve.now/CVE-2026-35534.md): ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection (CVSS 7.6, ChurchCRM CRM)
- [CVE-2026-35571](https://cve.now/CVE-2026-35571.md): Emissary has Stored XSS via Navigation Template Link Injection (CVSS 4.8, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35526](https://cve.now/CVE-2026-35526.md): Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions (CVSS 7.5, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-4931](https://cve.now/CVE-2026-4931.md): CVE-2026-4931 (CVSS 6.8, Marginal Smart Contract)
- [CVE-2026-35521](https://cve.now/CVE-2026-35521.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-33816](https://cve.now/CVE-2026-33816.md): CVE-2026-33816 in github.com/jackc/pgx (CVSS 9.8, github.com/jackc/pgx/v5/pgproto3 · github.com/jackc/pgx/v5)
- [CVE-2026-33815](https://cve.now/CVE-2026-33815.md): CVE-2026-33815 in github.com/jackc/pgx (CVSS 9.8, github.com/jackc/pgx/v5/pgproto3 · github.com/jackc/pgx/v5)
- [CVE-2026-35520](https://cve.now/CVE-2026-35520.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-35519](https://cve.now/CVE-2026-35519.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-1079](https://cve.now/CVE-2026-1079.md): A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have… (CVSS 6.0, Pegasystems Pega Browser Extension)
- [CVE-2026-35518](https://cve.now/CVE-2026-35518.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-35517](https://cve.now/CVE-2026-35517.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-35516](https://cve.now/CVE-2026-35516.md): LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection (CVSS 5.0, Kovah LinkAce)
- [CVE-2025-24819](https://cve.now/CVE-2025-24819.md): A Relative Path Traversal vulnerability in Nokia MantaRay NM (CVSS 5.7, Nokia MantaRay NM)
- [CVE-2025-24818](https://cve.now/CVE-2025-24818.md): An OS Command Injection vulnerability in Nokia MantaRay NM (CVSS 8.0, Nokia MantaRay NM)
- [CVE-2025-24817](https://cve.now/CVE-2025-24817.md): An OS Command Injection vulnerability in Nokia MantaRay NM (CVSS 8.0, Nokia MantaRay NM)
- [CVE-2026-35515](https://cve.now/CVE-2026-35515.md): @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (CVSS 6.3, nestjs nest · @nestjs/core)
- [CVE-2026-1078](https://cve.now/CVE-2026-1078.md): An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are… (CVSS 7.2, Pegasystems Pega Robot Studio)
- [CVE-2026-35492](https://cve.now/CVE-2026-35492.md): Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write (CVSS 6.5, kedro-org kedro-plugins · kedro-datasets)
- [CVE-2026-35491](https://cve.now/CVE-2026-35491.md): Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration (CVSS 6.1, pi-hole FTL)
- [CVE-2026-5745](https://cve.now/CVE-2026-5745.md): Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-35490](https://cve.now/CVE-2026-35490.md): changedetection.io has an Authentication Bypass via Decorator Ordering (CVSS 9.8, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2026-35489](https://cve.now/CVE-2026-35489.md): Tandoor Recipes — \`amount\`/\`unit\` bypass serializer in \`food/{id}/shopping/\` (CVSS 7.3, TandoorRecipes recipes)
- [CVE-2026-35488](https://cve.now/CVE-2026-35488.md): Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users (CVSS 8.1, TandoorRecipes recipes)
- [CVE-2026-35487](https://cve.now/CVE-2026-35487.md): text-generation-webui has a Path Traversal in load\_prompt() — .txt file read without authentication (CVSS 5.3, oobabooga text-generation-webui)
- [CVE-2026-35486](https://cve.now/CVE-2026-35486.md): text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation (CVSS 7.5, oobabooga text-generation-webui)
- [CVE-2026-35485](https://cve.now/CVE-2026-35485.md): text-generation-webui has a Path Traversal in load\_grammar() — arbitrary file read without authentication (CVSS 7.5, oobabooga text-generation-webui)
- [CVE-2026-35484](https://cve.now/CVE-2026-35484.md): text-generation-webui has a Path Traversal in load\_preset() — .yaml file read without authentication (CVSS 5.3, oobabooga text-generation-webui)
- [CVE-2026-35483](https://cve.now/CVE-2026-35483.md): text-generation-webui has a Path Traversal in load\_template() — .jinja/.yaml/.yml file read without authentication (CVSS 5.3, oobabooga text-generation-webui)
- [CVE-2026-35480](https://cve.now/CVE-2026-35480.md): go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers (CVSS 6.2, go-ipld-prime · github.com/ipld/go-ipld-prime)
- [CVE-2026-35464](https://cve.now/CVE-2026-35464.md): pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage\_folder enables arbitrary file write to Flask session store and code… (CVSS 7.5, pyload · pyload-ng)
- [CVE-2026-35463](https://cve.now/CVE-2026-35463.md): pyLoad has Improper Neutralization of Special Elements used in an OS Command (CVSS 8.8, pyload · pyload-ng)
- [CVE-2026-4740](https://cve.now/CVE-2026-4740.md): Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation (CVSS 8.2, Red Hat multicluster engine for Kubernetes · open-cluster-m…)
- [CVE-2026-35462](https://cve.now/CVE-2026-35462.md): Papra Does Not Reject Expired API Keys (CVSS 4.3, papra-hq papra)
- [CVE-2026-35461](https://cve.now/CVE-2026-35461.md): Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL (CVSS 5.0, papra-hq papra)
- [CVE-2026-35460](https://cve.now/CVE-2026-35460.md): Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name (CVSS 4.3, papra-hq papra)
- [CVE-2026-35458](https://cve.now/CVE-2026-35458.md): Gotenberg has a ReDoS via extraHttpHeaders scope feature (CVSS 8.7, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-33034](https://cve.now/CVE-2026-33034.md): Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass (CVSS 7.5, djangoproject django · django)
- [CVE-2026-33033](https://cve.now/CVE-2026-33033.md): Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (CVSS 6.5, djangoproject django · django)
- [CVE-2026-4292](https://cve.now/CVE-2026-4292.md): Privilege abuse in ModelAdmin.list\_editable (CVSS 2.7, djangoproject django · django)
- [CVE-2026-4277](https://cve.now/CVE-2026-4277.md): Privilege abuse in GenericInlineModelAdmin (CVSS 9.8, djangoproject django · django)
- [CVE-2026-35457](https://cve.now/CVE-2026-35457.md): libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion (CVSS 8.2, rust-libp2p · libp2p-rendezvous)
- [CVE-2026-3902](https://cve.now/CVE-2026-3902.md): ASGI header spoofing via underscore/hyphen conflation (CVSS 7.5, djangoproject django · django)
- [CVE-2026-35405](https://cve.now/CVE-2026-35405.md): libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers (CVSS 7.5, rust-libp2p · libp2p-rendezvous)
- [CVE-2026-5384](https://cve.now/CVE-2026-5384.md): runZero Platform incorrect credential scope (CVSS 5.8, runZero Platform)
- [CVE-2026-5383](https://cve.now/CVE-2026-5383.md): runZero Explorer missing authorization check (CVSS 4.4, runZero Explorer)
- [CVE-2026-5382](https://cve.now/CVE-2026-5382.md): runZero Platform MCP endpoint information leak (CVSS 3.0, runZero Platform)
- [CVE-2026-5381](https://cve.now/CVE-2026-5381.md): runZero Platform task information leak (CVSS 2.2, runZero Platform)
- [CVE-2026-5380](https://cve.now/CVE-2026-5380.md): runZero Platform cleartext secret exposure (CVSS 5.3, runZero Platform)
- [CVE-2026-5379](https://cve.now/CVE-2026-5379.md): runZero Platform MCP certification information leak (CVSS 3.0, runZero Platform)
- [CVE-2026-5378](https://cve.now/CVE-2026-5378.md): runZero Platform user creation leak (CVSS 5.8, runZero Platform)
- [CVE-2026-5376](https://cve.now/CVE-2026-5376.md): runZero Platform session timeout failure (CVSS 5.9, runZero Platform)
- [CVE-2026-5375](https://cve.now/CVE-2026-5375.md): runZero Platform API credential information leak (CVSS 2.7, runZero Platform)
- [CVE-2026-5374](https://cve.now/CVE-2026-5374.md): runZero Platform MCP information leak (CVSS 5.8, runZero Platform)
- [CVE-2026-5373](https://cve.now/CVE-2026-5373.md): runZero Platform superuser privilege escalation (CVSS 8.1, runZero Platform)
- [CVE-2026-5372](https://cve.now/CVE-2026-5372.md): runZero Platform SQL injection in saved queries (CVSS 6.4, runZero Platform)
- [CVE-2026-20911](https://cve.now/CVE-2026-20911.md): A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. (CVSS 9.8, LibRaw)
- [CVE-2026-21413](https://cve.now/CVE-2026-21413.md): A heap-based buffer overflow vulnerability exists in the lossless\_jpeg\_load\_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. (CVSS 9.8, LibRaw)
- [CVE-2026-20889](https://cve.now/CVE-2026-20889.md): A heap-based buffer overflow vulnerability exists in the x3f\_thumb\_loader functionality of LibRaw Commit d20315b. (CVSS 9.8, LibRaw)
- [CVE-2026-24660](https://cve.now/CVE-2026-24660.md): A heap-based buffer overflow vulnerability exists in the x3f\_load\_huffman functionality of LibRaw Commit d20315b. (CVSS 8.1, LibRaw)
- [CVE-2026-24450](https://cve.now/CVE-2026-24450.md): An integer overflow vulnerability exists in the uncompressed\_fp\_dng\_load\_raw functionality of LibRaw Commit 8dc68e2. (CVSS 8.1, LibRaw)
- [CVE-2026-20884](https://cve.now/CVE-2026-20884.md): An integer overflow vulnerability exists in the deflate\_dng\_load\_raw functionality of LibRaw Commit 8dc68e2. (CVSS 8.1, LibRaw)
- [CVE-2026-35554](https://cve.now/CVE-2026-35554.md): Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition (CVSS 8.7, Apache Software Foundation org.apache.kafka:kafka-clients ·…)
- [CVE-2026-5627](https://cve.now/CVE-2026-5627.md): Path Traversal in mintplex-labs/anything-llm (CVSS 9.1, mintplex-labs/anything-llm)
- [CVE-2026-33866](https://cve.now/CVE-2026-33866.md): Authorization Bypass in MLflow AJAX Endpoint (CVSS 5.3, Mlflow)
- [CVE-2026-33865](https://cve.now/CVE-2026-33865.md): Stored XSS via unsafe YAML parsing in MLflow (CVSS 5.1, Mlflow)
- [CVE-2026-22679](https://cve.now/CVE-2026-22679.md): Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint (CVSS 9.3, Weaver Network Co. E-cology)
- [CVE-2021-4473](https://cve.now/CVE-2021-4473.md): Tianxin Internet Behavior Management System Command Injection via toQuery.php (CVSS 9.3, Beijing Topsec Network Security Technology Co. Tianxin Inte…)
- [CVE-2026-5735](https://cve.now/CVE-2026-5735.md): Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5734](https://cve.now/CVE-2026-5734.md): Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5733](https://cve.now/CVE-2026-5733.md): Incorrect boundary conditions in the Graphics: WebGPU component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5732](https://cve.now/CVE-2026-5732.md): Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5731](https://cve.now/CVE-2026-5731.md): Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-22666](https://cve.now/CVE-2026-22666.md): Dolibarr ERP/CRM \< 23.0.2 Authenticated RCE via dol\_eval\_standard() (CVSS 8.6, Dolibarr ERP/CRM)
- [CVE-2026-28808](https://cve.now/CVE-2026-28808.md): ScriptAlias CGI targets bypass directory auth in inets httpd (mod\_auth vs mod\_cgi path mismatch) (CVSS 8.3, Erlang OTP)
- [CVE-2026-32144](https://cve.now/CVE-2026-32144.md): OCSP designated-responder authorization bypass via missing signature verification (CVSS 7.6, Erlang OTP)
- [CVE-2026-23818](https://cve.now/CVE-2026-23818.md): Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem (CVSS 8.8, Hewlett Packard Enterprise (HPE) Private 5G Core)
- [CVE-2025-39666](https://cve.now/CVE-2025-39666.md): omd: Local privilege escalation when executing omd commands as root (CVSS 9.3, Checkmk)
- [CVE-2026-3466](https://cve.now/CVE-2026-3466.md): Cross-site scripting in dashlet title (CVSS 8.5, Checkmk)
- [CVE-2026-31842](https://cve.now/CVE-2026-31842.md): Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling (CVSS 8.7, Tinyproxy Project Tinyproxy)
- [CVE-2026-4420](https://cve.now/CVE-2026-4420.md): Stored XSS via Page Creating functionality in Bludit (CVSS 5.1, Bludit)
- [CVE-2026-34903](https://cve.now/CVE-2026-34903.md): WordPress Ocean Extra plugin \<= 2.5.3 - Broken Access Control vulnerability (CVSS 5.4, OceanWP Ocean Extra)
- [CVE-2026-34899](https://cve.now/CVE-2026-34899.md): WordPress LTL Freight Quotes – Worldwide Express Edition plugin \<= 5.2.1 - Broken Access Control vulnerability (CVSS 5.3, Eniture technology LTL Freight Quotes – Worldwide Express E…)
- [CVE-2026-34904](https://cve.now/CVE-2026-34904.md): WordPress Simple Social Media Share Buttons plugin \<= 6.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.5, Analytify Simple Social Media Share Buttons)
- [CVE-2026-34896](https://cve.now/CVE-2026-34896.md): WordPress Under Construction, Coming Soon & Maintenance Mode plugin \<= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.5, Analytify Under Construction, Coming Soon & Maintenance Mode)
- [CVE-2026-33227](https://cve.now/CVE-2026-33227.md): Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a… (CVSS 4.3, Apache Software Foundation org.apache.activemq:activemq-… +7)
- [CVE-2026-28810](https://cve.now/CVE-2026-28810.md): Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver (CVSS 6.3, Erlang OTP)
- [CVE-2026-34197](https://cve.now/CVE-2026-34197.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans (CVSS 8.8, KEV, Apache Software Foundation Apache ActiveMQ Broker · Apac… +3)
- [CVE-2026-3177](https://cve.now/CVE-2026-3177.md): Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More \<= 1.8.9.7 - Insufficient Verification of Data… (CVSS 5.3, smub Charitable – Donation Plugin for WordPress – Fundraisi…)
- [CVE-2026-5465](https://cve.now/CVE-2026-5465.md): Amelia \<= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter (CVSS 8.8, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2026-1114](https://cve.now/CVE-2026-1114.md): Improper Access Control via Weak JWT Token in parisneo/lollms (CVSS 9.8, parisneo/lollms · lollms)
- [CVE-2026-4079](https://cve.now/CVE-2026-4079.md): SQL Chart Builder \< 2.3.8 - Unauthenticated SQL Injection (CVSS 6.5, SQL Chart Builder)
- [CVE-2026-1900](https://cve.now/CVE-2026-1900.md): Link Whisper Free \< 0.9.1 - Unauthenticated Settings and User Meta Update (CVSS 6.5, Link Whisper Free)
- [CVE-2025-15611](https://cve.now/CVE-2025-15611.md): Popup Box AYS Pro \< 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF (CVSS 5.4, Popup Box)
- [CVE-2025-65116](https://cve.now/CVE-2025-65116.md): Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM (CVSS 5.5, Hitachi JP1/IT Desktop Management 2 - Manager · Hitachi… +7)
- [CVE-2026-1839](https://cve.now/CVE-2026-1839.md): Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers (CVSS 6.5, huggingface/transformers · transformers)
- [CVE-2025-65115](https://cve.now/CVE-2025-65115.md): Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM (CVSS 8.8, Hitachi JP1/IT Desktop Management 2 - Manager · Hitachi… +7)
- [CVE-2026-0740](https://cve.now/CVE-2026-0740.md): Ninja Forms - File Upload \<= 3.3.26 - Unauthenticated Arbitrary File Upload (CVSS 9.8, SaturdayDrive Ninja Forms - File Uploads)
- [CVE-2026-20446](https://cve.now/CVE-2026-20446.md): In sec boot, there is a possible out of bounds write due to an integer overflow. (CVSS 4.3, MediaTek chipset)
- [CVE-2026-20433](https://cve.now/CVE-2026-20433.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.0, MediaTek chipset)
- [CVE-2026-20432](https://cve.now/CVE-2026-20432.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.0, MediaTek chipset)
- [CVE-2026-20431](https://cve.now/CVE-2026-20431.md): In Modem, there is a possible system crash due to a logic error. (CVSS 6.5, MediaTek chipset)
- [CVE-2026-5719](https://cve.now/CVE-2026-5719.md): itsourcecode Construction Management System borrowedtool.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2025-13044](https://cve.now/CVE-2025-13044.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.2, IBM Concert)
- [CVE-2024-36057](https://cve.now/CVE-2024-36057.md): Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. (CVSS 9.8)
- [CVE-2024-36058](https://cve.now/CVE-2024-36058.md): The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the… (CVSS 9.8)
- [CVE-2025-52908](https://cve.now/CVE-2025-52908.md): An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480… (CVSS 9.8)
- [CVE-2025-52909](https://cve.now/CVE-2025-52909.md): An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480… (CVSS 9.8)
- [CVE-2025-56015](https://cve.now/CVE-2025-56015.md): In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint. (CVSS 7.5, genieacs)
- [CVE-2025-62818](https://cve.now/CVE-2025-62818.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330… (CVSS 9.8)
- [CVE-2025-69515](https://cve.now/CVE-2025-69515.md): An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting… (CVSS 9.1)
- [CVE-2025-70844](https://cve.now/CVE-2025-70844.md): yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1, kantorge/yaffa)
- [CVE-2025-71058](https://cve.now/CVE-2025-71058.md): Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a… (CVSS 9.1)
- [CVE-2026-30079](https://cve.now/CVE-2026-30079.md): In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. (CVSS 9.8)
- [CVE-2026-30460](https://cve.now/CVE-2026-30460.md): Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module. (CVSS 8.8)
- [CVE-2026-31271](https://cve.now/CVE-2026-31271.md): megagao production\_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. (CVSS 9.8)
- [CVE-2026-31272](https://cve.now/CVE-2026-31272.md): MRCMS 3.1.2 contains an access control vulnerability. (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.