CVEs published April 1, 2026
235 CVEs were published on April 1, 2026: 29 critical, 87 high. 1 is now in CISA KEV.
- Published
- 235
- Critical
- 29
- High
- 87
- Medium
- 102
- Low
- 12
- Unrated
- 5
- Now in CISA KEV
- 1
- Fix available
- 125
Most affected products
- Google Chrome
- 21
- ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- 14
- Linux
- 11
- aio-libs aiohttp · aiohttp
- 10
- XenForo
- 10
- Cisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- 8
- Devolutions Server
- 7
- IBM Aspera Shares
- 6
- IBM Verify Identity Access Container · IBM Security Veri… +2
- 6
- Joomla! Project Joomla! CMS
- 6
Critical 29
- CVE-2026-34571CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromiseci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34569CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34568CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34567CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34566CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34565CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34564CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34563CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34560CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34559CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34456Reviactyl: OAuth account takeover via auto-linkingreviactyl panel
- CVE-2026-34751Payload has Unvalidated Input in Password Recovery Endpointspayloadcms payload · payload +1
- CVE-2026-34159llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backendggml-org llama.cpp
- CVE-2026-20160Cisco Smart Software Manager On-Prem Arbitrary Command Execution VulnerabilityCisco Smart Software Manager On-Prem
- CVE-2026-20093Cisco Integrated Management Controller Authentication Bypass VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-29014MetInfo CMS Unauthenticated PHP Code Injection RCEMetInfo CMS
- CVE-2026-4370Improper TLS Client/Server authentication and certificate verification on Database ClusterCanonical Juju · github.com/juju/juju
- CVE-2025-15484Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission BypassOrder Notification for WooCommerce
- CVE-2026-5290Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-5289Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-5288Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2025-71279XenForo Passkey Security BypassXenForo
- CVE-2024-40489There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute
- CVE-2024-43028A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code
- CVE-2026-30643An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.
- CVE-2026-31027TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste_modules/app.so.
- CVE-2026-34872An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0.
- CVE-2026-34873An issue was discovered in Mbed TLS 3.5.0 through 4.0.0.
- CVE-2026-34875An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0.
High 87
- CVE-2026-21765HCL BigFix Platform is affected by insecure permissions on private cryptographic keysHCLSoftware BigFix Platform
- CVE-2026-32929V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-32928V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-32927V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-32926V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-32925V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-34572CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-3987WatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UIWatchGuard Fireware OS
- CVE-2026-34570CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34543OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)AcademySoftwareFoundation openexr · openexr
- CVE-2026-34544OpenEXR: integer overflow to OOB write in uncompress_b44_impl()AcademySoftwareFoundation openexr · openexr
- CVE-2026-34545OpenEXR: integer overflow lead to OOB in HTJ2K decoderAcademySoftwareFoundation openexr
- CVE-2026-34528File Browser's Signup Grants Execution Permissions When Default Permissions Includes Executionfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-1345Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2026-34529File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB filefilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-4101Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2026-34455Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository ClassesHiEventsDev Hi.Events
- CVE-2026-34748@payloadcms/next has Stored XSS in Admin Panelpayloadcms payload · @payloadcms/next
- CVE-2026-34747Payload has an SQL Injection via Query Handlingpayloadcms payload · payload
- CVE-2026-34746Payload has Authenticated SSRF via Upload Functionalitypayloadcms payload · payload
- CVE-2026-35000ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Readdgtlmoon ChangeDetection.io · changedetection-io
- CVE-2026-27489ONNX: Path Traversal via Symlinkonnx
- CVE-2026-34445ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.onnx
- CVE-2026-34376PdfDing: Password-protected share bypass via direct serve endpointmrmn2 PdfDing
- CVE-2026-34236Auth0 PHP SDK Insufficient Entropy in Cookie Encryptionauth0-PHP · auth0/auth0-php
- CVE-2026-34222Open WebUI has Broken Access Control in Tool Valvesopen-webui
- CVE-2026-34076Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended hostclerk javascript · @clerk/backend +3
- CVE-2026-34072cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action executionfccview cronmaster
- CVE-2026-20151Cisco Smart Software Manager On-Prem Privilege Escalation VulnerabilityCisco Smart Software Manager On-Prem
- CVE-2026-20155Cisco Evolved Programmable Network Manager Improper Authorization VulnerabilityCisco Evolved Programmable Network Manager
- CVE-2026-20094Cisco Integrated Management Controller Command Injection VulnerabilityCisco Unified Computing System
- CVE-2026-34603@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctionstinacms · @tinacms/graphql
- CVE-2026-34604@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctionstinacms · @tinacms/graphql
- CVE-2026-33949@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary filestinacms · @tinacms/graphql
- CVE-2026-35099Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM.Lakeside Software SysTrack Agent
- CVE-2026-4924Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attackeDevolutions Server
- CVE-2026-4828Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid creDevolutions Server
- CVE-2026-35093Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode pluginsRed Hat Enterprise Linux
- CVE-2026-34430ByteDance DeerFlow LocalSandboxProvider Host Bash EscapeBytedance DeerFlow
- CVE-2026-35092Corosync: corosync: denial of service via integer overflow in join message validationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-35091Corosync: corosync: denial of service and information disclosure via crafted udp packetRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-3877Reflected Cross-Site Scripting in Dashboard SearchVertiGIS FM
- CVE-2026-0522Local File Inclusion in the File Upload/Download ProcessVertiGIS FM
- CVE-2026-22768Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability.Dell AppSync
- CVE-2026-22767Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability.Dell AppSync
- CVE-2026-23898Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdateJoomla! Project Joomla! CMS
- CVE-2026-23899Joomla! Core - [20260306] - Improper access check in webservice endpointsJoomla! Project Joomla! CMS
- CVE-2026-23411apparmor: fix race between freeing data and fs accessing itLinux
- CVE-2026-23410apparmor: fix race on rawdata dereferenceLinux
- CVE-2026-23408apparmor: Fix double free of ns_name in aa_replace_profiles()Linux
- CVE-2026-23407apparmor: fix missing bounds check on DEFAULT table in verify_dfa()Linux
- CVE-2026-23406apparmor: fix side-effect bug in match_char() macro usageLinux
- CVE-2026-23401KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTELinux
- CVE-2026-4748pf silently ignores certain rulesFreeBSD
- CVE-2026-5292Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read vGoogle Chrome
- CVE-2026-5287Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-5286Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2026-5285Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-5284Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to executGoogle Chrome
- CVE-2026-5272Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML Google Chrome
- CVE-2026-5282Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read vGoogle Chrome
- CVE-2026-5281Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to executGoogle Chrome
- CVE-2026-5280Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2026-5279Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-5278Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a craGoogle Chrome
- CVE-2026-5277Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-5275Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafGoogle Chrome
- CVE-2026-5274Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted Google Chrome
- CVE-2026-3775Foxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-3780Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege EscalationFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2026-3779Foxit PDF Editor/Reader List Box Calculate Array Use-After-Free VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-4947Insecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSignFoxit Software na1.foxitesign.foxit.com
- CVE-2026-4374Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serializat...RTI Connext Professional
- CVE-2026-35056XenForo Remote Code Execution via Authenticated AdminXenForo
- CVE-2025-71282XenForo Path Disclosure via open_basedir ExceptionsXenForo
- CVE-2025-71281XenForo Template Method Call Restriction BypassXenForo
- CVE-2025-71278XenForo OAuth2 Unauthorized Scope RequestXenForo
- CVE-2025-13855IBM Storage Protect Server is affected by a vulnerability that could allow authenticated users to access administrative metadata through the JSON-RPC endpoint .IBM Storage Protect Server
- CVE-2026-25833Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function
- CVE-2026-25835Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
- CVE-2026-30273pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component.
- CVE-2026-30287An arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical i
- CVE-2026-30289An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal
- CVE-2026-30291An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical interna
- CVE-2026-30292An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal fi
- CVE-2026-30573A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0.
- CVE-2026-34874An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0.
Medium, low and unrated 119
- CVE-2026-21767HCL BigFix Platform is affected by insufficient authenticationHCLSoftware BigFix Platform
- CVE-2026-5315Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-boundsNothings stb
- CVE-2025-66487Multiple vulnerabilities have been addressed in IBM Aspera SharesIBM Aspera Shares
- CVE-2025-66486Multiple vulnerabilities have been addressed in IBM Aspera SharesIBM Aspera Shares
- CVE-2025-66485Multiple vulnerabilities have been addressed in IBM Aspera SharesIBM Aspera Shares
- CVE-2025-66484Multiple vulnerabilities have been addressed in IBM Aspera SharesIBM Aspera Shares
- CVE-2025-66483Multiple vulnerabilities have been addressed in IBM Aspera SharesIBM Aspera Shares
- CVE-2025-36375IBM DataPower Gateway vulnerable to CSRFIBM DataPower Gateway 10.6CD · IBM DataPower Gateway
- CVE-2026-5314Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-boundsNothings stb
- CVE-2026-5313Nothings stb GIF Decoder stb_image.h stbi__gif_load_next denial of serviceNothings stb
- CVE-2026-34562CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34561CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-2475Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2026-4820IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flagIBM Maximo Application Suite
- CVE-2025-36373Incorrect administrative access control in IBM DataPower GatewayIBM DataPower Gateway 10.6CD · IBM DataPower Gateway
- CVE-2025-13916Multiple vulnerabilities have been addressed in IBM Aspera SharesIBM Aspera Shares
- CVE-2026-1491Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2026-34531Flask-HTTPAuth invokes token verification callback when missing or empty token was given by clientmiguelgrinberg Flask-HTTPAuth · flask-httpauth
- CVE-2026-34530File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injectionfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-2862Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2026-4364Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2026-5312D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access controlD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-34525AIOHTTP: Duplicate Host header acceptedaio-libs aiohttp · aiohttp
- CVE-2026-34520AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypassaio-libs aiohttp · aiohttp
- CVE-2026-34519AIOHTTP: HTTP response splitting via \r in reason phraseaio-libs aiohttp · aiohttp
- CVE-2026-34518AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirectaio-libs aiohttp · aiohttp
- CVE-2026-34517AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoSaio-libs aiohttp · aiohttp
- CVE-2026-34516AIOHTTP: Multipart Header Size Bypassaio-libs aiohttp · aiohttp
- CVE-2026-34515AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windowsaio-libs aiohttp · aiohttp
- CVE-2026-34514AIOHTTP: CRLF injection in multipart part content type header constructionaio-libs aiohttp · aiohttp
- CVE-2026-22815AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headersaio-libs aiohttp · aiohttp
- CVE-2026-34513AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectoraio-libs aiohttp · aiohttp
- CVE-2026-34750Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpointspayloadcms payload · @payloadcms/storage-azure +3
- CVE-2026-34749Payload has a CSRF Protection Bypass in Authentication Flowpayloadcms payload · payload
- CVE-2026-5311D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access controlD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2026-5199Cross Namespace Access via Batch OperationTemporal Technologies temporal · go.temporal.io/server
- CVE-2026-34447ONNX: External Data Symlink Traversalonnx
- CVE-2026-34446ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX loadonnx
- CVE-2026-34397himmelblau: NSS fake-primary group lookup reintroduces name collision riskhimmelblau-idm himmelblau
- CVE-2026-20090Cisco Integrated Management Controller Cross-Site Scripting VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-20089Cisco Integrated Management Controller Cross-Site Scripting VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-20087Cisco Integrated Management Controller Cross-Site Scripting VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-20088Cisco Integrated Management Controller Cross-Site Scripting VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-5310Enter Software Iperius Backup IperiusAccounts.ini hard-coded keyEnter Software Iperius Backup
- CVE-2026-20174Cisco Nexus Dashboard Insights Arbitrary File Write VulnerabilityCisco Nexus Dashboard
- CVE-2026-20096Cisco Integrated Management Controller Command Injection VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-20097Cisco Integrated Management Controller Remote Code Execution VulnerabilityCisco Unified Computing System
- CVE-2026-20095Cisco Integrated Management Controller Command Injection VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-20085Cisco Integrated Management Controller Cross-Site Scripting VulnerabilityCisco Enterprise NFV Infrastructure Software · Cisco Unifie…
- CVE-2026-20041Cisco Nexus Dashboard Server Side Request Forgery VulnerabilityCisco Nexus Dashboard
- CVE-2026-20042Cisco Nexus Dashboard Configuration REST API Unauthorized Access VulnerabilityCisco Nexus Dashboard
- CVE-2026-33990Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)docker model-runner · github.com/docker/model-runner
- CVE-2026-33978Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadatastreetwriters notesnook
- CVE-2026-2265Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure DeserializationReplicator
- CVE-2026-34510OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media LoadersOpenClaw
- CVE-2026-4989Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform seDevolutions Server
- CVE-2026-5175Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to deDevolutions Server
- CVE-2026-4925Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restricDevolutions Server
- CVE-2026-4927Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain otheDevolutions Server
- CVE-2026-4829Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user tDevolutions Server
- CVE-2025-13535King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgetskingaddons King Addons for Elementor – 80+ Elementor Widget…
- CVE-2026-35094Libinput: libinput: information disclosure via dangling pointer in lua plugin handlingRed Hat Enterprise Linux
- CVE-2026-5271Possible to hijack modules in current working directoryPython Software Foundation pymanager
- CVE-2026-34999OpenViking 0.2.5 < 0.2.14 Bot Proxy Endpoints Allow Unauthenticated AccessVolcengine OpenViking
- CVE-2026-25601Credential Exposure vulnerability in MEPIS RMMetronik d.o.o. MEPIS RM
- CVE-2026-24096Insufficient permission validation on multiple REST API Quick Setup endpointsCheckmk
- CVE-2026-0932Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server befoM-Files Server
- CVE-2026-1879Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted uploadHarvard University IQSS Dataverse
- CVE-2024-53828Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure VulnerabilityEricsson Packet Core Controller
- CVE-2026-21630Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpointJoomla! Project Joomla! CMS
- CVE-2026-21629Joomla! Core - [20260301] - ACL hardening in com_ajaxJoomla! Project Joomla! CMS
- CVE-2026-21631Joomla! Core - [20260303] - XSS vector in com_associations comparison viewJoomla! Project Joomla! CMS
- CVE-2026-21632Joomla! Core - [20260304] - XSS vectors in various article title outputsJoomla! Project Joomla! CMS
- CVE-2026-34889WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.4 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Ultimate Addons for WPBakery Page Builder
- CVE-2026-23409apparmor: fix differential encoding verificationLinux
- CVE-2026-23405apparmor: fix: limit the number of levels of policy namespacesLinux
- CVE-2026-23404apparmor: replace recursive profile removal with iterative approachLinux
- CVE-2026-23403apparmor: fix memory leak in verify_headerLinux
- CVE-2026-23402KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTELinux
- CVE-2026-5261Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted uploadShandong Hoteam InforCenter PLM
- CVE-2026-28265PowerStore, contains a Path Traversal vulnerability in the Service user.Dell PowerStore
- CVE-2026-5259AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgeryAutohomeCorp frostmourne
- CVE-2026-27101Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00.xx, contain(s) an Improper Limitation of a Dell Secure Connect Gateway
- CVE-2026-5258Sanster IOPaint File Manager file_manager.py _get_file path traversalSanster IOPaint
- CVE-2026-5257code-projects Simple Laundry System Parameter delstaffinfo.php sql injectioncode-projects Simple Laundry System
- CVE-2026-5256code-projects Simple Laundry System Parameter modify.php sql injectioncode-projects Simple Laundry System
- CVE-2026-2696Export All URLs < 5.1 - Unauthenticated Sensitive Data ExposureExport All URLs
- CVE-2026-5255code-projects Simple Laundry System Parameter delstaffinfo.php cross site scriptingcode-projects Simple Laundry System
- CVE-2026-5291Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive infGoogle Chrome
- CVE-2026-5273Use after free in CSS in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-5283Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2026-5276Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitiveGoogle Chrome
- CVE-2026-5254welovemedia FFmate Webhook AppJsonTreeView.vue cross site scriptingwelovemedia FFmate
- CVE-2026-5253bufanyun HotGo editNotice Endpoint MessageList.vue cross site scriptingbufanyun HotGo
- CVE-2026-5252z-9527 admin Message Create Endpoint message.js cross site scriptingz-9527 admin
- CVE-2026-5251z-9527 admin User Update Endpoint user.js dynamically-determined object attributesz-9527 admin
- CVE-2026-3774Self-Modifications Affecting Altered Printing and Redaction in Foxit PDF EditorFoxit Software Foxit PDF Editor
- CVE-2026-3776Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotationFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-3778Stack exhaustion caused by cyclic references in Foxit PDF Editor/ReaderFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-3777Use after free of view cache in Foxit PDF Editor/ReaderFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-5249gougucms Record Endpoint record.html cross site scriptinggougucms
- CVE-2026-3831Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcodecrmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2026-2394Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.RTI Connext Professional
- CVE-2026-5248gougucms User Registration Login.php reg_submit dynamically-determined object attributesgougucms
- CVE-2026-35057XenForo Stored Cross-Site Scripting via Structured Text MentionsXenForo
- CVE-2026-35055XenForo Cross-Site Scripting via Lightbox in PostsXenForo
- CVE-2026-35054XenForo Stored Cross-Site Scripting via BB Code RenderingXenForo
- CVE-2025-71280XenForo Local Account Page Caching Information DisclosureXenForo
- CVE-2024-58342XenForo Open Redirect via getDynamicRedirectXenForo
- CVE-2025-66442In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's sele
- CVE-2025-67805A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor featur
- CVE-2025-67806The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing ac
- CVE-2025-67807The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing ac
- CVE-2026-25834Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
- CVE-2026-29598Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow a
- CVE-2026-30522A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation.
- CVE-2026-30523A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input validation.
- CVE-2026-30526A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Zoo Management System v1.0.
- CVE-2026-34871An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0.