CVEs published April 3, 2026
223 CVEs were published on April 3, 2026: 27 critical, 83 high.
- Published
- 223
- Critical
- 27
- High
- 83
- Medium
- 67
- Low
- 8
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 143
Most affected products
- Linux
- 71
- electron
- 13
- Roundcube Webmail · roundcube/roundcubemail
- 9
- Zohocorp ManageEngine Exchange Reporter Plus
- 8
- MervinPraison PraisonAI · praisonai
- 7
- Amazon Athena ODBC driver
- 6
- emlog
- 5
- f prompts.chat
- 5
- Gardyn Cloud API
- 5
- OpenPrinting cups
- 5
Critical 27
- CVE-2026-34953PraisonAI: Authentication Bypass in OAuthManager.validate_token()MervinPraison PraisonAI · praisonai
- CVE-2017-20236ProSoft Technology ICX35-HWC Command Injection via Web InterfaceProSoft Technology ICX35-HWC Cellular Gateway
- CVE-2026-34952PraisonAI: Missing Authentication in WebSocket GatewayMervinPraison PraisonAI · praisonai
- CVE-2017-20235ProSoft Technology ICX35-HWC Authentication BypassProSoft Technology ICX35-HWC Cellular Gateway
- CVE-2026-34938PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_codeMervinPraison PraisonAI · praisonaiagents
- CVE-2017-20234GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded StringBelden GarrettCom Magnum 6K and 10K Managed Switches
- CVE-2026-34934PraisonAI: Second-Order SQL Injection in `get_all_user_threads`MervinPraison PraisonAI · praisonai
- CVE-2026-34935PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()MervinPraison PraisonAI · praisonai
- CVE-2018-25236Hirschmann HiOS HiSecOS Authentication Bypass via HTTP ManagementBelden Hirschmann HiOS · Belden Hirschmann HiSecOS EAGLE
- CVE-2026-34612Kestra: Remote Code Execution via SQL Injectionkestra-io kestra
- CVE-2021-4477Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall BypassBelden Hirschmann HiLCOS OpenBAT
- CVE-2018-25237Hirschmann HiSecOS Buffer Overflow via HTTPS LoginBelden Hirschmann HiSecOS Classic Firewall
- CVE-2017-20237Hirschmann Industrial HiVision Authentication Bypass Remote Code ExecutionBelden Hirschmann Industrial HiVision
- CVE-2026-25197Gardyn Cloud API Authorization Bypass Through User-Controlled KeyGardyn Cloud API
- CVE-2026-28766Gardyn Cloud API Missing Authentication for Critical FunctionGardyn Cloud API
- CVE-2026-28798Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOSIceWhaleTech ZimaOS
- CVE-2026-32186Microsoft Bing Elevation of Privilege VulnerabilityMicrosoft Bing
- CVE-2026-0545Missing Authentication for Critical Function in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-35216Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Stepbudibase · @budibase/server
- CVE-2026-31818Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklistbudibase · @budibase/backend-core
- CVE-2026-31402nfsd: fix heap overflow in NFSv4.0 LOCK replay cacheLinux
- CVE-2026-23455netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()Linux
- CVE-2026-23450net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()Linux
- CVE-2026-23428ksmbd: fix use-after-free of share_conf in compound requestLinux
- CVE-2026-23427ksmbd: fix use-after-free in durable v2 replay of active file handlesLinux
- CVE-2026-5463pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()Dan McInerney pymetasploit3 · pymetasploit3
- CVE-2026-28373The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality w
High 83
- CVE-2026-34774Electron: Use-after-free in offscreen child window paint callbackelectron
- CVE-2026-34771Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbackselectron
- CVE-2026-34770Electron: Use-after-free in PowerMonitor on Windows and macOSelectron
- CVE-2026-34769Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferenceelectron
- CVE-2026-34955PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxMervinPraison PraisonAI · praisonai
- CVE-2026-34954PraisonAI: SSRF in FileTools.download_file() via Unvalidated URLMervinPraison PraisonAI · praisonaiagents
- CVE-2026-34937PraisonAI: Shell Injection in run_python() via Unescaped $() SubstitutionMervinPraison PraisonAI · praisonaiagents
- CVE-2026-34936PraisonAI: SSRF via Unvalidated api_base in passthrough() FallbackMervinPraison PraisonAI · praisonai
- CVE-2026-34824Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Servicemesop-dev mesop · mesop
- CVE-2026-34607Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCEemlog
- CVE-2026-34228Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Writeemlog
- CVE-2017-20238Hirschmann Industrial HiVision Improper Authorization Privilege EscalationBelden Hirschmann Industrial HiVision
- CVE-2026-33184nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panicnimiq core-rs-albatross
- CVE-2016-15058Hirschmann HiLCOS Classic Platform Password Exposure via SNMPBelden Hirschmann HiLCOS Classic Platform
- CVE-2026-33175OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claimsjupyterhub oauthenticator · oauthenticator
- CVE-2015-10148Hirschmann HiLCOS Hard-coded Credentials SSH SSL KeysBelden Hirschmann HiLCOS
- CVE-2026-28797RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Componentinfiniflow ragflow
- CVE-2026-27885Piwigo: SQL Injection in Activity.getListPiwigo
- CVE-2026-27834Piwigo: SQL Injection in pwg.users.getList API Method via filter ParameterPiwigo
- CVE-2026-27833Piwigo: Unauthenticated Information Disclosure via pwg.history.search APIPiwigo
- CVE-2026-27634Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filterPiwigo
- CVE-2026-22665prompts.chat Identity Confusion via Case-Sensitive Username Handlingf prompts.chat
- CVE-2026-22664prompts.chat SSRF via Fal.ai Media Status Pollingf prompts.chat
- CVE-2026-22663prompts.chat Authorization Bypass Information Disclosuref prompts.chat
- CVE-2026-22661prompts.chat Path Traversal via Skill File Handlingf prompts.chat
- CVE-2025-10681Gardyn Mobile Application and Device Firmware Use Hard-coded CredentialsGardyn Mobile Application · Gardyn Cloud API
- CVE-2020-37216Hirschmann HiOS EtherNet/IP Stack Denial of ServiceBelden Hirschmann HiOS
- CVE-2026-32646Gardyn Cloud API Missing Authentication for Critical FunctionGardyn Cloud API
- CVE-2022-4987Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code ExecutionBelden Hirschmann Industrial HiVision
- CVE-2026-35558Improper neutralization of special elements in authentication components in Amazon Athena ODBC driverAmazon Athena ODBC driver
- CVE-2026-5485OS command injection in Amazon Athena ODBC driver on LinuxAmazon Athena ODBC driver
- CVE-2026-35562Allocation of resources without limits in parsing components in Amazon Athena ODBC driverAmazon Athena ODBC driver
- CVE-2026-35561Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driverAmazon Athena ODBC driver
- CVE-2026-35560Improper certificate validation in identity provider connection components in Amazon Athena ODBC driverAmazon Athena ODBC driver
- CVE-2026-25726Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)cloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-35218Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palettebudibase
- CVE-2026-35214Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file writebudibase · @budibase/server
- CVE-2026-25044Budibase: Command Injection in Bash Automation Stepbudibase · @budibase/server
- CVE-2025-68153Juju: Resource poisoningjuju · github.com/juju/juju
- CVE-2026-27124FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilitiesjlowin fastmcp · fastmcp
- CVE-2026-31403NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fdLinux
- CVE-2026-31401HID: bpf: prevent buffer overflow in hid_hw_requestLinux
- CVE-2026-31398mm/rmap: fix incorrect pte restoration for lazyfree foliosLinux
- CVE-2026-31397mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()Linux
- CVE-2026-31396net: macb: fix use-after-free access to PTP clockLinux
- CVE-2026-31393Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before accessLinux
- CVE-2026-31392smb: client: fix krb5 mount with username optionLinux
- CVE-2026-31389spi: fix use-after-free on controller registration failureLinux
- CVE-2026-23466drm/xe: Open-code GGTT MMIO access protectionLinux
- CVE-2026-23462Bluetooth: HIDP: Fix possible UAFLinux
- CVE-2026-23461Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_userLinux
- CVE-2026-23459ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATSLinux
- CVE-2026-23458netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()Linux
- CVE-2026-23457netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()Linux
- CVE-2026-23456netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS caseLinux
- CVE-2026-23453net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy modeLinux
- CVE-2026-23451bonding: prevent potential infinite loop in bond_header_parse()Linux
- CVE-2026-23449net/sched: teql: Fix double-free in teql_master_xmitLinux
- CVE-2026-23445igc: fix page fault in XDP TX timestamps handlingLinux
- CVE-2026-23444wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failureLinux
- CVE-2026-23440net/mlx5e: Fix race condition during IPSec ESN updateLinux
- CVE-2026-23437net: shaper: protect late read accesses to the hierarchyLinux
- CVE-2026-23434mtd: rawnand: serialize lock/unlock against other NAND operationsLinux
- CVE-2026-23432mshv: Fix use-after-free in mshv_map_user_memory error pathLinux
- CVE-2026-23429iommu/sva: Fix crash in iommu_sva_unbind_device()Linux
- CVE-2026-23425KVM: arm64: Fix ID register initialization for non-protected pKVM guestsLinux
- CVE-2026-23424accel/amdxdna: Validate command buffer payload countLinux
- CVE-2026-25773Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)Mattermost Focalboard · github.com/mattermost/focalboard
- CVE-2026-23419net/rds: Fix circular locking dependency in rds_tcp_tuneLinux
- CVE-2026-27655Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-4108Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-4107Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-3880Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-3879Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-28703Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-28756Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-28754Stored XSS VulnerabilityZohocorp ManageEngine Exchange Reporter Plus
- CVE-2026-4350Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' ParameterPerfmatters
- CVE-2026-35536In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cooktornadoweb Tornado · tornado
- CVE-2026-35535In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailerSudo project Sudo
- CVE-2026-28815A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentiallyApple macOS
- CVE-2025-59710An issue was discovered in Biztalk360 before 11.5.
- CVE-2025-59711An issue was discovered in Biztalk360 before 11.5.
Medium, low and unrated 113
- CVE-2026-34778Electron: Service worker can spoof executeJavaScript IPC replieselectron
- CVE-2026-34777Electron: Incorrect origin passed to permission request handler for iframe requestselectron
- CVE-2026-34776Electron: Out-of-bounds read in second-instance IPC on macOS and Linuxelectron
- CVE-2026-34775Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processeselectron
- CVE-2026-34773Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windowselectron
- CVE-2026-34772Electron: Use-after-free in download save dialog callbackelectron
- CVE-2026-34768Electron: Unquoted executable path in app.setLoginItemSettings on Windowselectron
- CVE-2026-34767Electron: HTTP Response Header Injection in custom protocol handlers and webRequestelectron
- CVE-2026-34766Electron: USB device selection not validated against filtered device listelectron
- CVE-2026-34939PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()MervinPraison PraisonAI · praisonai
- CVE-2017-20233Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic BypassBelden Hirschmann HiLCOS OpenBAT, BAT450, WLC · Belden Hirs…
- CVE-2026-34933Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemonavahi
- CVE-2026-34788Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parametersemlog
- CVE-2026-34787Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameteremlog
- CVE-2026-34229Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypassemlog
- CVE-2026-35468nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history indexnimiq core-rs-albatross
- CVE-2026-34061nimiq/core-rs-albatross: Macro block proposal interlink bugnimiq core-rs-albatross
- CVE-2026-34052LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)jupyterhub ltiauthenticator · jupyterhub-ltiauthenticator
- CVE-2026-33709JupyterHub has an Open Redirect Vulnerabilityjupyterhub
- CVE-2026-34947Discourse: Staged user custom fields are exposed on public invite pagesdiscourse
- CVE-2026-27481Discourse: Hidden tag visibility bypass on tag routesdiscourse
- CVE-2026-27456util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setuputil-linux
- CVE-2026-34980OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the networkOpenPrinting cups
- CVE-2026-34979OpenPrinting CUPS: Heap overflow in `get_options()`OpenPrinting cups
- CVE-2026-34978OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)OpenPrinting cups
- CVE-2026-34990OpenPrinting CUPS: Local print admin token disclosure using temporary printersOpenPrinting cups
- CVE-2026-27447OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookupOpenPrinting cups
- CVE-2026-26058Zulip: Path Traversal in Importzulip
- CVE-2026-34511OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State ParameterOpenClaw
- CVE-2026-22662prompts.chat Blind SSRF via media-generatef prompts.chat
- CVE-2026-28767Gardyn Cloud API Missing Authentication for Critical FunctionGardyn Cloud API
- CVE-2026-35559Out-of-bounds write in query processing components in Amazon Athena ODBC driverAmazon Athena ODBC driver
- CVE-2026-25742Zulip: Anonymous File Access After Disabling Spectator Accesszulip
- CVE-2026-32662Gardyn Cloud API Active Debug CodeGardyn Cloud API
- CVE-2026-5484BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access controlBookStackApp BookStack
- CVE-2026-3184Util-linux: util-linux: access control bypass due to improper hostname canonicalizationRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-2625Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verificationRed Hat Hardened Images · Red Hat Enterprise Linux
- CVE-2026-5476NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflowNASA cFS
- CVE-2026-5475NASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruptionNASA cFS
- CVE-2026-5474NASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflowNASA cFS
- CVE-2026-5473NASA cFS Pickle pickle.load deserializationNASA cFS
- CVE-2026-5472ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted uploadProjectsAndPrograms School Management System
- CVE-2026-25118immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albumsimmich-app immich
- CVE-2026-5471Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded keyInvestory Toy Planet Trouble App
- CVE-2026-25043Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Floodingbudibase
- CVE-2026-5470mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgerymixelpixx Google-Research-MCP
- CVE-2025-68152Juju: Read All Controller Logs From Compromised Workloadjuju · github.com/juju/juju
- CVE-2025-64340FastMCP has a Command Injection vulnerability - Gemini CLIjlowin fastmcp · fastmcp
- CVE-2026-31400sunrpc: fix cache_request leak in cache_releaseLinux
- CVE-2026-31399nvdimm/bus: Fix potential use after free in asynchronous initializationLinux
- CVE-2026-31395bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handlerLinux
- CVE-2026-31394mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stationsLinux
- CVE-2026-31391crypto: atmel-sha204a - Fix OOM ->tfm_count leakLinux
- CVE-2026-31390drm/xe: Fix memory leak in xe_vm_madvise_ioctlLinux
- CVE-2026-23475spi: fix statistics allocationLinux
- CVE-2026-23474mtd: Avoid boot crash in RedBoot partition table parserLinux
- CVE-2026-23472serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWNLinux
- CVE-2026-23470drm/imagination: Fix deadlock in soft reset sequenceLinux
- CVE-2026-23469drm/imagination: Synchronize interrupts before suspending the GPULinux
- CVE-2026-23468drm/amdgpu: Limit BO list entry count to prevent resource exhaustionLinux
- CVE-2026-23467drm/i915/dmc: Fix an unlikely NULL pointer deference at probeLinux
- CVE-2026-23465btrfs: log new dentries when logging parent dir of a conflicting inodeLinux
- CVE-2026-23464soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()Linux
- CVE-2026-23463soc: fsl: qbman: fix race condition in qman_destroy_fqLinux
- CVE-2026-23460net/rose: fix NULL pointer dereference in rose_transmit_link on reconnectLinux
- CVE-2026-23454net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardownLinux
- CVE-2026-23452PM: runtime: Fix a race condition related to device removalLinux
- CVE-2026-23448net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds checkLinux
- CVE-2026-23447net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds checkLinux
- CVE-2026-23446net: usb: aqc111: Do not perform PM inside suspend callbackLinux
- CVE-2026-23443ACPI: processor: Fix previous acpi_processor_errata_piix4() fixLinux
- CVE-2026-23442ipv6: add NULL checks for idev in SRv6 pathsLinux
- CVE-2026-23441net/mlx5e: Prevent concurrent access to IPSec ASO contextLinux
- CVE-2026-23439udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=nLinux
- CVE-2026-23438net: mvpp2: guard flow control update with global_tx_fc in buffer switchingLinux
- CVE-2026-23436net: shaper: protect from late creation of hierarchyLinux
- CVE-2026-23435perf/x86: Move event pointer setup earlier in x86_pmu_enable()Linux
- CVE-2026-23433arm_mpam: Fix null pointer dereference when restoring bandwidth countersLinux
- CVE-2026-23431spi: amlogic-spisg: Fix memory leak in aml_spisg_probe()Linux
- CVE-2026-23430drm/vmwgfx: Don't overwrite KMS surface dirty trackerLinux
- CVE-2026-5469Casdoor Webhook URL server-side request forgeryCasdoor · github.com/casdoor/casdoor
- CVE-2026-5468Casdoor dangerouslySetInnerHTML cross site scriptingCasdoor · github.com/casdoor/casdoor
- CVE-2026-28736Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)Mattermost Focalboard · github.com/mattermost/focalboard
- CVE-2026-23426drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()Linux
- CVE-2026-23423btrfs: free pages on error in btrfs_uring_read_extent()Linux
- CVE-2026-23422dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handlerLinux
- CVE-2026-23421drm/xe/configfs: Free ctx_restore_mid_bb in releaseLinux
- CVE-2026-23420wifi: wlcore: Fix a locking bugLinux
- CVE-2026-23418drm/xe/reg_sr: Fix leak on xa_store failureLinux
- CVE-2026-5467Casdoor OAuth Authorization Request redirectCasdoor · github.com/casdoor/casdoor
- CVE-2025-7024Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)AIRBUS TETRA Connectivity Server
- CVE-2026-5462Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded keyWahoo Fitness SYSTM App
- CVE-2026-5458Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded keyNoelse Individuals & Pro App
- CVE-2026-5457PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded keyPropertyGuru AgentNet Singapore App
- CVE-2026-5456Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded keyAlign Technology My Invisalign App
- CVE-2026-5455Dialogue App ca.diagram.dialogue config.json hard-coded keyDialogue App
- CVE-2026-35549An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2.MariaDB
- CVE-2026-5454GRID Organiser App co.gridapp.organiser app.json hard-coded keyGRID Organiser App
- CVE-2026-5453Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded keyRico só vantagem pra investir App
- CVE-2026-35545An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35544An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35543An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35542An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35541An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35540An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35539An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35538An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-35537An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Roundcube Webmail · roundcube/roundcubemail
- CVE-2026-5452UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded keyUCC CampusConnect App
- CVE-2026-35508Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters,milesmcc Shynet
- CVE-2026-35507Shynet before 0.14.0 allows Host header injection in the password reset flow.milesmcc Shynet
- CVE-2025-59709An issue was discovered in Biztalk360 through 11.5.
- CVE-2026-26477An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() functDokuWiki