# CVEs published 2026-04-02

257 CVEs were published on April 2, 2026: 21 critical, 100 high. Days are UTC.

- [CVE-2026-32211](https://cve.now/CVE-2026-32211.md): Azure MCP Server Information Disclosure Vulnerability (CVSS 9.1, Microsoft Azure Web Apps)
- [CVE-2026-32173](https://cve.now/CVE-2026-32173.md): Azure SRE Agent Information Disclosure Vulnerability (CVSS 8.6, Microsoft Azure SRE Agent Gateway - SignalR Hub)
- [CVE-2026-33105](https://cve.now/CVE-2026-33105.md): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Kubernetes Service)
- [CVE-2026-26135](https://cve.now/CVE-2026-26135.md): Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Azure Custom Locations Resource Provider)
- [CVE-2026-33107](https://cve.now/CVE-2026-33107.md): Azure Databricks Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Databricks)
- [CVE-2026-32213](https://cve.now/CVE-2026-32213.md): Azure AI Foundry Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure AI Foundry)
- [CVE-2022-4986](https://cve.now/CVE-2022-4986.md): Hirschmann EagleSDV Denial of Service via TLS (CVSS 7.5, Belden Hirschmann EagleSDV)
- [CVE-2024-14033](https://cve.now/CVE-2024-14033.md): Hirschmann EagleSDV Denial of Service via TLS (CVSS 7.5, Belden Hirschmann EagleSDV)
- [CVE-2025-15620](https://cve.now/CVE-2025-15620.md): HiOS Switch Platform Denial-of-Service via Web Interface (CVSS 8.6, Belden Hirschmann HiOS Switch Platform)
- [CVE-2026-35467](https://cve.now/CVE-2026-35467.md): Private Key stored as extractable in browser IndexeDB (CVSS 7.5, CERT/CC cveClient/encrypt-storage.js)
- [CVE-2026-35466](https://cve.now/CVE-2026-35466.md): Stored XSS via unsanitized input from remote service (CVSS 6.1, CERT/CC cveClient/cveInterface.js)
- [CVE-2024-14034](https://cve.now/CVE-2024-14034.md): Hirschmann HiEOS Authentication Bypass via HTTP Management Module (CVSS 9.8, Belden Hirschmann HiEOS LRS11)
- [CVE-2023-7343](https://cve.now/CVE-2023-7343.md): Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File (CVSS 7.8, Belden Hirschmann Industrial HiVision)
- [CVE-2026-34931](https://cve.now/CVE-2026-34931.md): hoppscotch: Improper loopback redirect\_uri validation in device-login flow (CVSS 8.5, hoppscotch)
- [CVE-2026-34848](https://cve.now/CVE-2026-34848.md): hoppscotch: Stored XSS in team member overflow tooltip via display name (CVSS 5.4, hoppscotch)
- [CVE-2026-34932](https://cve.now/CVE-2026-34932.md): hoppscotch: Stored XSS via mock server responses on backend origin (CVSS 8.5, hoppscotch)
- [CVE-2026-34847](https://cve.now/CVE-2026-34847.md): hoppscotch: Open redirect via \`/enter?redirect=\` (CVSS 4.7, hoppscotch)
- [CVE-2026-34838](https://cve.now/CVE-2026-34838.md): Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in \`AbstractSettingsCollection\` (CVSS 10.0, Intermesh groupoffice)
- [CVE-2026-34834](https://cve.now/CVE-2026-34834.md): Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation (CVSS 8.7, bulwarkmail webmail)
- [CVE-2026-34833](https://cve.now/CVE-2026-34833.md): Bulwark Webmail: Information Exposure: password returned in /api/auth/session (CVSS 8.7, bulwarkmail webmail)
- [CVE-2026-34832](https://cve.now/CVE-2026-34832.md): Scoold: Cross-Account Feedback Deletion (IDOR) (CVSS 6.5, Erudika scoold)
- [CVE-2026-34825](https://cve.now/CVE-2026-34825.md): NocoBase Has SQL Injection via template variable substitution in workflow SQL node (CVSS 8.5, nocobase · @nocobase/plugin-workflow-sql)
- [CVE-2026-35383](https://cve.now/CVE-2026-35383.md): Bentley Systems iTwin Platform exposed access token (CVSS 6.5, Bentley Systems iTwin Platform)
- [CVE-2026-34762](https://cve.now/CVE-2026-34762.md): Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber (CVSS 2.7, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-34761](https://cve.now/CVE-2026-34761.md): Ella Core Panics Upon NGAP handover failure (CVSS 5.8, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-5420](https://cve.now/CVE-2026-5420.md): Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key (CVSS 2.0, Shinrays Games Goods Triple App)
- [CVE-2026-34760](https://cve.now/CVE-2026-34760.md): vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models (CVSS 5.9, vllm-project vllm · vllm)
- [CVE-2026-35053](https://cve.now/CVE-2026-35053.md): OneUptime: Unauthenticated Workflow Execution via ManualAPI (CVSS 9.2, oneuptime)
- [CVE-2026-34840](https://cve.now/CVE-2026-34840.md): OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification (CVSS 8.1, oneuptime)
- [CVE-2026-34759](https://cve.now/CVE-2026-34759.md): OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure (CVSS 9.2, oneuptime)
- [CVE-2026-34758](https://cve.now/CVE-2026-34758.md): OneUptime: Missing Authentication on Notification Endpoints (CVSS 9.1, oneuptime)
- [CVE-2026-34752](https://cve.now/CVE-2026-34752.md): Haraka affected by DoS via \`\_\_proto\_\_\` email header (CVSS 8.7, Haraka)
- [CVE-2026-34745](https://cve.now/CVE-2026-34745.md): Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public (CVSS 9.1, ShaneIsrael fireshare)
- [CVE-2026-5429](https://cve.now/CVE-2026-5429.md): Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme (CVSS 7.8, AWS Kiro IDE)
- [CVE-2026-34743](https://cve.now/CVE-2026-34743.md): XZ Utils: Buffer overflow in lzma\_index\_append() (CVSS 1.7, tukaani-project xz)
- [CVE-2026-34742](https://cve.now/CVE-2026-34742.md): Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost (CVSS 7.6, modelcontextprotocol go-sdk · github.com/modelcontextprotoc…)
- [CVE-2026-5418](https://cve.now/CVE-2026-5418.md): appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery (CVSS 6.9, appsmithorg appsmith)
- [CVE-2026-34736](https://cve.now/CVE-2026-34736.md): Open edX Platform: Account Activation Bypass via activation\_key Exposure in REST API (CVSS 5.3, openedx-platform)
- [CVE-2025-43236](https://cve.now/CVE-2025-43236.md): A type confusion issue was addressed with improved memory handling. (CVSS 3.3, Apple macOS)
- [CVE-2023-7342](https://cve.now/CVE-2023-7342.md): Belden HiSecOS Web Server Privilege Escalation (CVSS 8.8, Belden Hirschmann HiSecOS EAGLE)
- [CVE-2025-43257](https://cve.now/CVE-2025-43257.md): This issue was addressed with improved handling of symlinks. (CVSS 8.7, Apple macOS)
- [CVE-2026-34426](https://cve.now/CVE-2026-34426.md): OpenClaw - Approval Bypass via Environment Variable Normalization (CVSS 6.9, OpenClaw)
- [CVE-2026-34735](https://cve.now/CVE-2026-34735.md): Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in \`FileController\` (CVSS 8.7, HytaleModding wiki)
- [CVE-2024-40849](https://cve.now/CVE-2024-40849.md): A race condition was addressed with additional validation. (CVSS 7.5, Apple macOS)
- [CVE-2024-44303](https://cve.now/CVE-2024-44303.md): The issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2025-43210](https://cve.now/CVE-2025-43210.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 6.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2024-44250](https://cve.now/CVE-2024-44250.md): A permissions issue was addressed with additional restrictions. (CVSS 8.2, Apple macOS)
- [CVE-2024-40858](https://cve.now/CVE-2024-40858.md): A permissions issue was addressed with additional restrictions. (CVSS 7.1, Apple macOS)
- [CVE-2026-5417](https://cve.now/CVE-2026-5417.md): Dataease SQLbot Elasticsearch es\_engine.py get\_es\_data\_by\_http server-side request forgery (CVSS 5.1, Dataease SQLbot)
- [CVE-2026-34425](https://cve.now/CVE-2026-34425.md): OpenClaw - Shell-Bleed Protection Preflight Validation Bypass (CVSS 5.3, OpenClaw)
- [CVE-2025-43264](https://cve.now/CVE-2025-43264.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple macOS)
- [CVE-2024-44286](https://cve.now/CVE-2024-44286.md): This issue was addressed through improved state management. (CVSS 7.5, Apple macOS)
- [CVE-2024-44219](https://cve.now/CVE-2024-44219.md): A permissions issue was addressed with additional restrictions. (CVSS 7.5, Apple macOS)
- [CVE-2025-43202](https://cve.now/CVE-2025-43202.md): This issue was addressed with improved memory handling. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-43238](https://cve.now/CVE-2025-43238.md): An integer overflow was addressed with improved input validation. (CVSS 6.2, Apple macOS)
- [CVE-2026-34730](https://cve.now/CVE-2026-34730.md): Copier \`\_external\_data\` allows path traversal and absolute-path local file read without unsafe mode (CVSS 5.5, copier-org copier · copier)
- [CVE-2026-34726](https://cve.now/CVE-2026-34726.md): Copier \`\_subdirectory\` allows template root escape via parent-directory traversal (CVSS 4.4, copier-org copier · copier)
- [CVE-2025-43219](https://cve.now/CVE-2025-43219.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple macOS)
- [CVE-2026-34581](https://cve.now/CVE-2026-34581.md): goshs has Auth Bypass via Share Token (CVSS 8.1, patrickhener goshs · github.com/patrickhener/goshs)
- [CVE-2026-34725](https://cve.now/CVE-2026-34725.md): dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration (CVSS 8.3, dbgate · dbgate-web)
- [CVE-2026-5414](https://cve.now/CVE-2026-5414.md): Newgen OmniDocs WebApiRequestRedirection resource injection (CVSS 6.9, Newgen OmniDocs)
- [CVE-2026-34717](https://cve.now/CVE-2026-34717.md): OpenProject: SQL Injection in Cost Reporting =n Operator via parse\_number\_string (CVSS 9.9, opf openproject)
- [CVE-2026-34715](https://cve.now/CVE-2026-34715.md): ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting) (CVSS 5.3, vshakitskiy ewe)
- [CVE-2026-34610](https://cve.now/CVE-2026-34610.md): leancrypto: Integer truncation in X.509 name parser enables certificate identity impersonation (CVSS 5.9, smuellerDD leancrypto)
- [CVE-2026-34608](https://cve.now/CVE-2026-34608.md): nanomq: Heap-Buffer-Overflow in webhook\_inproc.c via cJSON\_Parse OOB Read (CVSS 4.9, nanomq)
- [CVE-2026-34606](https://cve.now/CVE-2026-34606.md): Stored XSS in Frappe LMS (CVSS 6.9, frappe lms)
- [CVE-2026-34601](https://cve.now/CVE-2026-34601.md): xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion (CVSS 7.5, xmldom · @xmldom/xmldom)
- [CVE-2026-5413](https://cve.now/CVE-2026-5413.md): Newgen OmniDocs GetWebApiConfiguration information disclosure (CVSS 6.3, Newgen OmniDocs)
- [CVE-2026-34593](https://cve.now/CVE-2026-34593.md): Ash Framework: Ash.Type.Module.cast\_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash (CVSS 8.2, ash-project ash)
- [CVE-2026-34598](https://cve.now/CVE-2026-34598.md): YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" (CVSS 7.1, yeswiki · yeswiki/yeswiki)
- [CVE-2026-34591](https://cve.now/CVE-2026-34591.md): Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write (CVSS 7.1, python-poetry poetry · poetry)
- [CVE-2026-34828](https://cve.now/CVE-2026-34828.md): listmonk: Active sessions remain valid after password reset and password change (CVSS 7.1, knadh listmonk · github.com/knadh/listmonk)
- [CVE-2026-34584](https://cve.now/CVE-2026-34584.md): listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) (CVSS 5.4, knadh listmonk)
- [CVE-2026-5370](https://cve.now/CVE-2026-5370.md): krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting (CVSS 5.1, krayin laravel-crm · krayin/laravel-crm)
- [CVE-2026-34590](https://cve.now/CVE-2026-34590.md): Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation (CVSS 5.4, gitroomhq postiz-app)
- [CVE-2026-34577](https://cve.now/CVE-2026-34577.md): Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check (CVSS 8.6, gitroomhq postiz-app)
- [CVE-2026-34576](https://cve.now/CVE-2026-34576.md): Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata (CVSS 8.3, gitroomhq postiz-app)
- [CVE-2026-34124](https://cve.now/CVE-2026-34124.md): Denial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WS (CVSS 7.1, TP-Link Systems Tapo C520WS)
- [CVE-2026-34122](https://cve.now/CVE-2026-34122.md): Stack-based Buffer Overflow Leading to Denial of Service in TP-Link Tapo C520WS (CVSS 7.1, TP-Link Systems Tapo C520WS)
- [CVE-2026-34121](https://cve.now/CVE-2026-34121.md): Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS (CVSS 8.7, TP-Link Systems Tapo C520WS)
- [CVE-2026-34120](https://cve.now/CVE-2026-34120.md): Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS (CVSS 7.1, TP-Link Systems Tapo C520WS)
- [CVE-2026-34119](https://cve.now/CVE-2026-34119.md): Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS (CVSS 7.1, TP-Link Systems Tapo C520WS)
- [CVE-2026-34118](https://cve.now/CVE-2026-34118.md): Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C100, C101, C210 & C520WS (CVSS 7.1, TP-Link Systems Tapo C520WS · TP Link Systems Tapo C100 +2)
- [CVE-2026-34526](https://cve.now/CVE-2026-34526.md): SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 (CVSS 5.0, SillyTavern)
- [CVE-2026-34524](https://cve.now/CVE-2026-34524.md): SillyTavern: Path traversal in \`/api/chats/export\` and \`/api/chats/delete\` allows arbitrary file read/delete within user data root (CVSS 8.3, SillyTavern)
- [CVE-2026-5368](https://cve.now/CVE-2026-5368.md): projectworlds Car Rental Project Parameter login.php sql injection (CVSS 6.9, projectworlds Car Rental Project)
- [CVE-2026-34523](https://cve.now/CVE-2026-34523.md): SillyTavern: Path traversal allows file existence oracle (CVSS 5.3, SillyTavern)
- [CVE-2026-34522](https://cve.now/CVE-2026-34522.md): SillyTavern: Path traversal in \`/api/chats/import\` allows arbitrary file write outside intended chat directory (CVSS 8.1, SillyTavern)
- [CVE-2026-26962](https://cve.now/CVE-2026-26962.md): Rack: Header injection in multipart requests (CVSS 4.8, rack)
- [CVE-2026-34835](https://cve.now/CVE-2026-34835.md): Rack: \`Rack::Request\` accepts invalid Host characters, enabling host allowlist bypass. (CVSS 4.8, rack)
- [CVE-2026-35414](https://cve.now/CVE-2026-35414.md): OpenSSH before 10.3 mishandles the authorized\_keys principals option in uncommon scenarios involving a principals list in conjunction with a (CVSS 4.2, OpenBSD OpenSSH)
- [CVE-2026-34827](https://cve.now/CVE-2026-34827.md): Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser (CVSS 7.5, rack)
- [CVE-2026-32762](https://cve.now/CVE-2026-32762.md): Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing (CVSS 4.8, rack)
- [CVE-2026-33271](https://cve.now/CVE-2026-33271.md): Local privilege escalation due to insecure folder permissions. (CVSS 6.7, Acronis True Image)
- [CVE-2026-27774](https://cve.now/CVE-2026-27774.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis True Image)
- [CVE-2026-28728](https://cve.now/CVE-2026-28728.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis True Image)
- [CVE-2026-5360](https://cve.now/CVE-2026-5360.md): Free5GC aper type confusion (CVSS 6.3, Free5GC)
- [CVE-2026-35388](https://cve.now/CVE-2026-35388.md): OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. (CVSS 2.5, OpenBSD OpenSSH)
- [CVE-2026-35387](https://cve.now/CVE-2026-35387.md): OpenSSH before 10.3 can use unintended ECDSA algorithms. (CVSS 3.1, OpenBSD OpenSSH)
- [CVE-2026-34830](https://cve.now/CVE-2026-34830.md): Rack: Rack::Sendfile regex injection via HTTP\_X\_ACCEL\_MAPPING header allows arbitrary file reads through nginx (CVSS 5.9, rack)
- [CVE-2026-34829](https://cve.now/CVE-2026-34829.md): Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length (CVSS 7.5, rack)
- [CVE-2026-34826](https://cve.now/CVE-2026-34826.md): Rack: Unbounded Range Count in get\_byte\_ranges Enables DoS (CVSS 5.3, rack)
- [CVE-2026-5355](https://cve.now/CVE-2026-5355.md): Trendnet TEW-657BRM setup.cgi vpn\_drop os command injection (CVSS 5.3, Trendnet TEW-657BRM)
- [CVE-2026-34786](https://cve.now/CVE-2026-34786.md): Rack: Rack::Static header\_rules bypass via URL-encoded paths (CVSS 5.3, rack)
- [CVE-2026-35386](https://cve.now/CVE-2026-35386.md): In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. (CVSS 3.6, OpenBSD OpenSSH)
- [CVE-2026-34785](https://cve.now/CVE-2026-34785.md): Rack: Local file inclusion in \`Rack::Static\` via URL Prefix Matching (CVSS 7.5, rack)
- [CVE-2026-34763](https://cve.now/CVE-2026-34763.md): Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation (CVSS 5.3, rack)
- [CVE-2026-34831](https://cve.now/CVE-2026-34831.md): Rack: Content-Length mismatch in Rack::Files error responses (CVSS 4.8, rack)
- [CVE-2026-26961](https://cve.now/CVE-2026-26961.md): Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass (CVSS 3.7, rack)
- [CVE-2026-34230](https://cve.now/CVE-2026-34230.md): Rack: Quadratic complexity in Rack::Utils.select\_best\_encoding via wildcard Accept-Encoding header (CVSS 5.3, rack)
- [CVE-2026-35385](https://cve.now/CVE-2026-35385.md): In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the (CVSS 7.5, OpenBSD OpenSSH)
- [CVE-2026-5354](https://cve.now/CVE-2026-5354.md): Trendnet TEW-657BRM setup.cgi vpn\_connect os command injection (CVSS 5.3, Trendnet TEW-657BRM)
- [CVE-2026-35038](https://cve.now/CVE-2026-35038.md): signalk-server: Arbitrary Prototype Read via \`from\` Field Bypass (CVSS 2.1, signalk-server)
- [CVE-2026-5353](https://cve.now/CVE-2026-5353.md): Trendnet TEW-657BRM setup.cgi ping\_test os command injection (CVSS 5.3, Trendnet TEW-657BRM)
- [CVE-2026-34083](https://cve.now/CVE-2026-34083.md): signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow (CVSS 6.1, signalk-server)
- [CVE-2026-33951](https://cve.now/CVE-2026-33951.md): signalk-server: Unauthenticated Source Priorities Manipulation (CVSS 6.9, signalk-server)
- [CVE-2026-33950](https://cve.now/CVE-2026-33950.md): signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity (CVSS 9.4, signalk-server)
- [CVE-2026-5352](https://cve.now/CVE-2026-5352.md): Trendnet TEW-657BRM setup.cgi edit os command injection (CVSS 5.3, Trendnet TEW-657BRM)
- [CVE-2025-65114](https://cve.now/CVE-2025-65114.md): Apache Traffic Server: Malformed chunked message body allows request smuggling (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2025-58136](https://cve.now/CVE-2025-58136.md): Apache Traffic Server: A simple legitimate POST request causes a crash (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-5351](https://cve.now/CVE-2026-5351.md): Trendnet TEW-657BRM setup.cgi add\_wps\_client os command injection (CVSS 5.3, Trendnet TEW-657BRM)
- [CVE-2026-5350](https://cve.now/CVE-2026-5350.md): Trendnet TEW-657BRM setup.cgi update\_pcdb stack-based overflow (CVSS 8.7, Trendnet TEW-657BRM)
- [CVE-2026-5349](https://cve.now/CVE-2026-5349.md): Trendnet TEW-657BRM setup.cgi add\_apcdb stack-based overflow (CVSS 8.7, Trendnet TEW-657BRM)
- [CVE-2026-33746](https://cve.now/CVE-2026-33746.md): Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users (CVSS 9.8, ConvoyPanel panel)
- [CVE-2026-33691](https://cve.now/CVE-2026-33691.md): OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks (CVSS 6.8, coreruleset)
- [CVE-2026-33544](https://cve.now/CVE-2026-33544.md): Tinyauth has OAuth account confusion via shared mutable state on singleton service instances (CVSS 7.7, steveiliop56 tinyauth · github.com/steveiliop56/tinyauth)
- [CVE-2026-5346](https://cve.now/CVE-2026-5346.md): huimeicloud hm\_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery (CVSS 6.9, huimeicloud hm\_editor)
- [CVE-2026-33641](https://cve.now/CVE-2026-33641.md): Glances Vulnerable to Command Injection via Dynamic Configuration Values (CVSS 7.8, nicolargo glances · glances)
- [CVE-2026-33533](https://cve.now/CVE-2026-33533.md): Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard (CVSS 7.1, nicolargo glances · glances)
- [CVE-2026-32871](https://cve.now/CVE-2026-32871.md): FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability (CVSS 10.0, PrefectHQ fastmcp · fastmcp)
- [CVE-2026-34974](https://cve.now/CVE-2026-34974.md): phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation (CVSS 5.4, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2026-34973](https://cve.now/CVE-2026-34973.md): phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and \_ Metacharacters Enable Broad Content Disclosure (CVSS 6.9, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2026-34729](https://cve.now/CVE-2026-34729.md): phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() (CVSS 6.1, thorsten phpMyFAQ · phpmyfaq/phpmyfaq)
- [CVE-2026-34823](https://cve.now/CVE-2026-34823.md): Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34822](https://cve.now/CVE-2026-34822.md): Endian Firewall /manage/ca/certificate/ new\_cert\_name Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34821](https://cve.now/CVE-2026-34821.md): Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34820](https://cve.now/CVE-2026-34820.md): Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34819](https://cve.now/CVE-2026-34819.md): Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34818](https://cve.now/CVE-2026-34818.md): Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34817](https://cve.now/CVE-2026-34817.md): Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34816](https://cve.now/CVE-2026-34816.md): Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34815](https://cve.now/CVE-2026-34815.md): Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34814](https://cve.now/CVE-2026-34814.md): Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34813](https://cve.now/CVE-2026-34813.md): Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34812](https://cve.now/CVE-2026-34812.md): Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34811](https://cve.now/CVE-2026-34811.md): Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34810](https://cve.now/CVE-2026-34810.md): Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34809](https://cve.now/CVE-2026-34809.md): Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34808](https://cve.now/CVE-2026-34808.md): Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34807](https://cve.now/CVE-2026-34807.md): Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34806](https://cve.now/CVE-2026-34806.md): Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34805](https://cve.now/CVE-2026-34805.md): Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34804](https://cve.now/CVE-2026-34804.md): Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34803](https://cve.now/CVE-2026-34803.md): Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34802](https://cve.now/CVE-2026-34802.md): Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34801](https://cve.now/CVE-2026-34801.md): Endian Firewall /manage/dhcp/fixed\_leases/ remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34800](https://cve.now/CVE-2026-34800.md): Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34799](https://cve.now/CVE-2026-34799.md): Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34798](https://cve.now/CVE-2026-34798.md): Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting (CVSS 5.1, Endian Firewall)
- [CVE-2026-34797](https://cve.now/CVE-2026-34797.md): Endian Firewall /cgi-bin/logs\_smtp.cgi DATE Perl Command Injection (CVSS 8.7, Endian Firewall)
- [CVE-2026-34796](https://cve.now/CVE-2026-34796.md): Endian Firewall /cgi-bin/logs\_openvpn.cgi DATE Perl Command Injection (CVSS 8.7, Endian Firewall)
- [CVE-2026-34795](https://cve.now/CVE-2026-34795.md): Endian Firewall /cgi-bin/logs\_log.cgi DATE Perl Command Injection (CVSS 8.7, Endian Firewall)
- [CVE-2026-34794](https://cve.now/CVE-2026-34794.md): Endian Firewall /cgi-bin/logs\_ids.cgi DATE Perl Command Injection (CVSS 8.7, Endian Firewall)
- [CVE-2026-34793](https://cve.now/CVE-2026-34793.md): Endian Firewall /cgi-bin/logs\_firewall.cgi DATE Perl Command Injection (CVSS 8.7, Endian Firewall)
- [CVE-2026-34792](https://cve.now/CVE-2026-34792.md): Endian Firewall /cgi-bin/logs\_clamav.cgi DATE Perl Command Injection (CVSS 8.7, Endian Firewall)
- [CVE-2026-34791](https://cve.now/CVE-2026-34791.md): Endian Firewall /cgi-bin/logs\_proxy.cgi DATE Perl Command Injection (CVSS 8.7, Endian Firewall)
- [CVE-2026-34790](https://cve.now/CVE-2026-34790.md): Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal (CVSS 7.1, Endian Firewall)
- [CVE-2026-5344](https://cve.now/CVE-2026-5344.md): Textpattern XML-RPC TXP\_RPCServer.php mt\_uploadImage path traversal (CVSS 5.3, Textpattern)
- [CVE-2026-34728](https://cve.now/CVE-2026-34728.md): phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController (CVSS 8.7, thorsten phpMyFAQ · phpmyfaq/phpmyfaq)
- [CVE-2026-32629](https://cve.now/CVE-2026-32629.md): phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor (CVSS 5.4, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-31937](https://cve.now/CVE-2026-31937.md): Suricata dcerpc: quadratic complexity in dcerpc buffering (CVSS 7.5, OISF suricata)
- [CVE-2026-31935](https://cve.now/CVE-2026-31935.md): Suricata http2: unbounded resource consumption (CVSS 7.5, OISF suricata)
- [CVE-2026-35002](https://cve.now/CVE-2026-35002.md): Agno \< 2.3.24 field\_type Eval Injection Arbitrary Code Execution (CVSS 9.3, Agno)
- [CVE-2026-5342](https://cve.now/CVE-2026-5342.md): LibRaw TIFF/NEF decoders\_libraw.cpp nikon\_load\_padded\_packed\_raw out-of-bounds (CVSS 6.9, LibRaw)
- [CVE-2026-31934](https://cve.now/CVE-2026-31934.md): Suricata smtp/mine: quadratic complexity in extracting urls (CVSS 7.5, OISF suricata)
- [CVE-2026-5339](https://cve.now/CVE-2026-5339.md): Tenda G103 Setting gpon.lua action\_set\_net\_settings command injection (CVSS 5.1, Tenda G103)
- [CVE-2026-31933](https://cve.now/CVE-2026-31933.md): Suricata stream: quadratic complexity in stream inspection (CVSS 7.5, OISF suricata)
- [CVE-2026-31932](https://cve.now/CVE-2026-31932.md): Suricata krb5: quadratic complexity in krb5 buffering (CVSS 7.5, OISF suricata)
- [CVE-2026-26928](https://cve.now/CVE-2026-26928.md): Lack of Dynamic Library Validation in SzafirHost (CVSS 8.7, Krajowa Izba Rozliczeniowa SzafirHost)
- [CVE-2026-26927](https://cve.now/CVE-2026-26927.md): URL (HTTP Origin) call location spoofing in Szafir SDK Web (CVSS 5.1, Krajowa Izba Rozliczeniowa Szafir SDK Web)
- [CVE-2026-31931](https://cve.now/CVE-2026-31931.md): Suricata tls: null dereference in tls.alpn rule keyword (CVSS 7.5, OISF suricata)
- [CVE-2026-5338](https://cve.now/CVE-2026-5338.md): Tenda G103 Setting system.lua action\_set\_system\_settings command injection (CVSS 5.1, Tenda G103)
- [CVE-2026-30867](https://cve.now/CVE-2026-30867.md): CocoaMQTT: Denial of Service via Reachable Assertion in \`PUBLISH\` Packet Parsing (CVSS 5.7, emqx CocoaMQTT)
- [CVE-2026-35168](https://cve.now/CVE-2026-35168.md): OpenSTAManager: SQL Injection via Aggiornamenti Module (CVSS 8.8, devcode-it openstamanager · devcode-it/openstamanager)
- [CVE-2026-5334](https://cve.now/CVE-2026-5334.md): itsourcecode Online Enrollment System Parameter index.php sql injection (CVSS 6.9, itsourcecode Online Enrollment System)
- [CVE-2026-28805](https://cve.now/CVE-2026-28805.md): OpenSTAManager: Time-Based Blind SQL Injection via \`options\[stato\]\` Parameter (CVSS 8.8, devcode-it openstamanager · devcode-it/openstamanager)
- [CVE-2026-29782](https://cve.now/CVE-2026-29782.md): OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2 (CVSS 7.2, devcode-it openstamanager · devcode-it/openstamanager)
- [CVE-2026-5333](https://cve.now/CVE-2026-5333.md): DefaultFuction Content-Management-System tools.php command injection (CVSS 6.9, DefaultFuction Content-Management-System)
- [CVE-2026-2737](https://cve.now/CVE-2026-2737.md): Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application (CVSS 8.5, Progress Software Flowmon)
- [CVE-2026-3692](https://cve.now/CVE-2026-3692.md): Unintended command execution during report generation in Progress Flowmon (CVSS 8.7, Progress Software Flowmon)
- [CVE-2026-5332](https://cve.now/CVE-2026-5332.md): Xiaopi Panel WAF Firewall demo.php cross site scripting (CVSS 5.1, Xiaopi Panel)
- [CVE-2026-2701](https://cve.now/CVE-2026-2701.md): RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC) (CVSS 9.1, Progress ShareFile Storage Zones Controller)
- [CVE-2026-2699](https://cve.now/CVE-2026-2699.md): EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) (CVSS 9.8, Progress ShareFile Storage Zones Controller)
- [CVE-2026-5331](https://cve.now/CVE-2026-5331.md): OpenCart Extension Installer installer.php path traversal (CVSS 5.1, OpenCart)
- [CVE-2026-34890](https://cve.now/CVE-2026-34890.md): WordPress MSTW League Manager plugin \<= 2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mark O’Donnell MSTW League Manager)
- [CVE-2026-5330](https://cve.now/CVE-2026-5330.md): SourceCodester/mayuri\_k Best Courier Management System User Delete ajax.php access control (CVSS 6.9, SourceCodester Best Courier Management System · mayuri\_k Be…)
- [CVE-2026-4636](https://cve.now/CVE-2026-4636.md): Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. (CVSS 8.1, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-4634](https://cve.now/CVE-2026-4634.md): Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters (CVSS 7.5, Red Hat build of Keycloak · Red Hat Single Sign-On +2)
- [CVE-2026-4325](https://cve.now/CVE-2026-4325.md): Keycloak: keycloak: replay of action tokens via improper handling of single-use entries (CVSS 5.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-4282](https://cve.now/CVE-2026-4282.md): Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw (CVSS 7.4, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-3872](https://cve.now/CVE-2026-3872.md): Keycloak: keycloak: information disclosure due to redirect\_uri validation bypass (CVSS 7.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-5328](https://cve.now/CVE-2026-5328.md): shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection (CVSS 5.3, shsuishang modulithshop)
- [CVE-2026-5327](https://cve.now/CVE-2026-5327.md): efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection (CVSS 5.3, efforthye fast-filesystem-mcp · fast-filesystem-mcp)
- [CVE-2026-23417](https://cve.now/CVE-2026-23417.md): bpf: Fix constant blinding for PROBE\_MEM32 stores (no CVSS, Linux)
- [CVE-2026-23416](https://cve.now/CVE-2026-23416.md): mm/mseal: update VMA end correctly on merge (no CVSS, Linux)
- [CVE-2026-23415](https://cve.now/CVE-2026-23415.md): futex: Fix UaF between futex\_key\_to\_node\_opt() and vma\_replace\_policy() (CVSS 7.8, Linux)
- [CVE-2026-23414](https://cve.now/CVE-2026-23414.md): tls: Purge async\_hold in tls\_decrypt\_async\_wait() (CVSS 7.5, Linux)
- [CVE-2026-23413](https://cve.now/CVE-2026-23413.md): clsact: Fix use-after-free in init/destroy rollback asymmetry (CVSS 7.8, Linux)
- [CVE-2026-23412](https://cve.now/CVE-2026-23412.md): netfilter: bpf: defer hook memory release until rcu readers are done (CVSS 7.8, Linux)
- [CVE-2026-5326](https://cve.now/CVE-2026-5326.md): SourceCodester Leave Application System User Information index.php authorization (CVSS 6.9, SourceCodester Leave Application System)
- [CVE-2026-32145](https://cve.now/CVE-2026-32145.md): Multipart form body parser bypasses body size limits in wisp (CVSS 8.7, gleam-wisp wisp)
- [CVE-2026-5246](https://cve.now/CVE-2026-5246.md): Cesanta Mongoose P-384 Public Key mongoose.c mg\_tls\_verify\_cert\_signature authorization (CVSS 6.3, Cesanta Mongoose)
- [CVE-2026-5245](https://cve.now/CVE-2026-5245.md): Cesanta Mongoose mDNS Record mongoose.c handle\_mdns\_record stack-based overflow (CVSS 6.3, Cesanta Mongoose)
- [CVE-2026-33617](https://cve.now/CVE-2026-33617.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint (CVSS 5.3, MB connect line mbCONNECT24 · MB connect line mymbCONNECT24)
- [CVE-2026-33616](https://cve.now/CVE-2026-33616.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint (CVSS 7.5, MB connect line mbCONNECT24 · MB connect line mymbCONNECT24)
- [CVE-2026-33615](https://cve.now/CVE-2026-33615.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint (CVSS 9.1, MB connect line mbCONNECT24 · MB connect line mymbCONNECT24)
- [CVE-2026-33614](https://cve.now/CVE-2026-33614.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint (CVSS 7.5, MB connect line mbCONNECT24 · MB connect line mymbCONNECT24)
- [CVE-2026-33613](https://cve.now/CVE-2026-33613.md): MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray (CVSS 7.2, MB connect line mbCONNECT24 · MB connect line mymbCONNECT24)
- [CVE-2026-29136](https://cve.now/CVE-2026-29136.md): CA Notification HTML Injection (CVSS 5.3, SEPPmail Secure Email Gateway)
- [CVE-2026-29139](https://cve.now/CVE-2026-29139.md): GINA State Confusion Account Takeover (CVSS 7.8, SEPPmail Secure Email Gateway)
- [CVE-2026-29144](https://cve.now/CVE-2026-29144.md): Unicode Subject Tags (CVSS 7.8, SEPPmail Secure Email Gateway)
- [CVE-2026-29143](https://cve.now/CVE-2026-29143.md): S/MIME Decryption Impersonation (CVSS 7.8, SEPPmail Secure Email Gateway)
- [CVE-2026-0634](https://cve.now/CVE-2026-0634.md): Code Execution in AssistFeedbackService on TECNO Pova7 Pro 5G (CVSS 7.8, TECNO Mobile TECNO Pova7 Pro)
- [CVE-2026-29138](https://cve.now/CVE-2026-29138.md): PGP Decryption Sender LDAP Injection (CVSS 6.3, SEPPmail Secure Email Gateway)
- [CVE-2026-29131](https://cve.now/CVE-2026-29131.md): PGP Decryption Recipient LDAP Injection (CVSS 4.9, SEPPmail Secure Email Gateway)
- [CVE-2026-29142](https://cve.now/CVE-2026-29142.md): Plaintext secure-mail.html (CVSS 6.3, SEPPmail Secure Email Gateway)
- [CVE-2026-29137](https://cve.now/CVE-2026-29137.md): Long Subject Untagging (CVSS 5.3, SEPPmail Secure Email Gateway)
- [CVE-2026-29141](https://cve.now/CVE-2026-29141.md): Bounded Subject Tag Sanitization (CVSS 7.7, SEPPmail Secure Email Gateway)
- [CVE-2026-29135](https://cve.now/CVE-2026-29135.md): Webmail Password Tag Sanitization Bypass (CVSS 5.3, SEPPmail Secure Email Gateway)
- [CVE-2026-29134](https://cve.now/CVE-2026-29134.md): GINA Domain Switch (CVSS 5.3, SEPPmail Secure Email Gateway)
- [CVE-2026-29140](https://cve.now/CVE-2026-29140.md): S/MIME Signature Additional Certificate (CVSS 7.7, SEPPmail Secure Email Gateway)
- [CVE-2026-29133](https://cve.now/CVE-2026-29133.md): UID Regex Bypass (CVSS 5.3, SEPPmail Secure Email Gateway)
- [CVE-2026-29132](https://cve.now/CVE-2026-29132.md): ESWmail-Verify Bypass (CVSS 6.3, SEPPmail Secure Email Gateway)
- [CVE-2026-5244](https://cve.now/CVE-2026-5244.md): Cesanta Mongoose TLS 1.3 mongoose.c mg\_tls\_recv\_cert heap-based overflow (CVSS 6.9, Cesanta Mongoose)
- [CVE-2026-5032](https://cve.now/CVE-2026-5032.md): W3 Total Cache \<= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header (CVSS 7.5, boldgrid W3 Total Cache)
- [CVE-2026-0686](https://cve.now/CVE-2026-0686.md): Webmention \<= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery (CVSS 7.2, pfefferle Webmention)
- [CVE-2026-0688](https://cve.now/CVE-2026-0688.md): Webmention \<= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4, pfefferle Webmention)
- [CVE-2026-5325](https://cve.now/CVE-2026-5325.md): SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting (CVSS 5.1, SourceCodester Simple Customer Relationship Management Syst…)
- [CVE-2026-5323](https://cve.now/CVE-2026-5323.md): priyankark a11y-mcp index.js A11yServer server-side request forgery (CVSS 4.8, priyankark a11y-mcp · a11y-mcp)
- [CVE-2026-1540](https://cve.now/CVE-2026-1540.md): Spam Protect for Contact Form 7 \< 1.2.10 - Editor+ Remote Code Execution (CVSS 7.2, Spam Protect for Contact Form)
- [CVE-2026-5322](https://cve.now/CVE-2026-5322.md): AlejandroArciniegas mcp-data-vis MCP server.js request sql injection (CVSS 6.9, AlejandroArciniegas mcp-data-vis)
- [CVE-2026-4347](https://cve.now/CVE-2026-4347.md): MW WP Form \<= 5.1.0 - Unauthenticated Arbitrary File Move via move\_temp\_file\_to\_upload\_dir (CVSS 8.1, inc2734 MW WP Form)
- [CVE-2026-5321](https://cve.now/CVE-2026-5321.md): vanna-ai vanna FastAPI/Flask Server cross-domain policy (CVSS 5.3, vanna-ai vanna)
- [CVE-2026-5320](https://cve.now/CVE-2026-5320.md): vanna-ai vanna Chat API Endpoint v2 missing authentication (CVSS 6.9, vanna-ai vanna)
- [CVE-2026-5319](https://cve.now/CVE-2026-5319.md): itsourcecode Payroll Management System navbar.php cross site scripting (CVSS 5.3, itsourcecode Payroll Management System)
- [CVE-2026-5318](https://cve.now/CVE-2026-5318.md): LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write (CVSS 5.3, LibRaw)
- [CVE-2026-5317](https://cve.now/CVE-2026-5317.md): Nothings stb stb\_vorbis.c start\_decoder out-of-bounds write (CVSS 5.3, Nothings stb)
- [CVE-2026-1243](https://cve.now/CVE-2026-1243.md): IBM Content Navigator is affected by , a Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, IBM Content Navigator)
- [CVE-2026-5316](https://cve.now/CVE-2026-5316.md): Nothings stb stb\_vorbis.c setup\_free allocation of resources (CVSS 5.3, Nothings stb)
- [CVE-2026-25212](https://cve.now/CVE-2026-25212.md): An issue was discovered in Percona PMM before 3.7. (CVSS 9.9)
- [CVE-2026-26895](https://cve.now/CVE-2026-26895.md): User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the pl (CVSS 5.3)
- [CVE-2026-30251](https://cve.now/CVE-2026-30251.md): A reflected cross-site scripting (XSS) vulnerability in the login\_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allo (CVSS 6.1)
- [CVE-2026-30252](https://cve.now/CVE-2026-30252.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 al (CVSS 6.1)
- [CVE-2026-30332](https://cve.now/CVE-2026-30332.md): A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escala (CVSS 7.5)
- [CVE-2026-30603](https://cve.now/CVE-2026-30603.md): An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, a (CVSS 6.8)
- [CVE-2026-34876](https://cve.now/CVE-2026-34876.md): An issue was discovered in Mbed TLS 3.x before 3.6.6. (CVSS 7.5)
- [CVE-2026-34877](https://cve.now/CVE-2026-34877.md): An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.