# CVEs published 2026-04-03

223 CVEs were published on April 3, 2026: 27 critical, 83 high. Days are UTC.

- [CVE-2026-34778](https://cve.now/CVE-2026-34778.md): Electron: Service worker can spoof executeJavaScript IPC replies (CVSS 5.9, electron)
- [CVE-2026-34777](https://cve.now/CVE-2026-34777.md): Electron: Incorrect origin passed to permission request handler for iframe requests (CVSS 5.4, electron)
- [CVE-2026-34776](https://cve.now/CVE-2026-34776.md): Electron: Out-of-bounds read in second-instance IPC on macOS and Linux (CVSS 5.3, electron)
- [CVE-2026-34775](https://cve.now/CVE-2026-34775.md): Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes (CVSS 6.8, electron)
- [CVE-2026-34774](https://cve.now/CVE-2026-34774.md): Electron: Use-after-free in offscreen child window paint callback (CVSS 8.1, electron)
- [CVE-2026-34773](https://cve.now/CVE-2026-34773.md): Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows (CVSS 4.7, electron)
- [CVE-2026-34772](https://cve.now/CVE-2026-34772.md): Electron: Use-after-free in download save dialog callback (CVSS 5.8, electron)
- [CVE-2026-34771](https://cve.now/CVE-2026-34771.md): Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks (CVSS 7.5, electron)
- [CVE-2026-34770](https://cve.now/CVE-2026-34770.md): Electron: Use-after-free in PowerMonitor on Windows and macOS (CVSS 7.0, electron)
- [CVE-2026-34768](https://cve.now/CVE-2026-34768.md): Electron: Unquoted executable path in app.setLoginItemSettings on Windows (CVSS 3.9, electron)
- [CVE-2026-34767](https://cve.now/CVE-2026-34767.md): Electron: HTTP Response Header Injection in custom protocol handlers and webRequest (CVSS 5.9, electron)
- [CVE-2026-34766](https://cve.now/CVE-2026-34766.md): Electron: USB device selection not validated against filtered device list (CVSS 3.3, electron)
- [CVE-2026-34769](https://cve.now/CVE-2026-34769.md): Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference (CVSS 7.8, electron)
- [CVE-2026-34955](https://cve.now/CVE-2026-34955.md): PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-34954](https://cve.now/CVE-2026-34954.md): PraisonAI: SSRF in FileTools.download\_file() via Unvalidated URL (CVSS 8.6, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-34953](https://cve.now/CVE-2026-34953.md): PraisonAI: Authentication Bypass in OAuthManager.validate\_token() (CVSS 9.1, MervinPraison PraisonAI · praisonai)
- [CVE-2017-20236](https://cve.now/CVE-2017-20236.md): ProSoft Technology ICX35-HWC Command Injection via Web Interface (CVSS 9.8, ProSoft Technology ICX35-HWC Cellular Gateway)
- [CVE-2026-34952](https://cve.now/CVE-2026-34952.md): PraisonAI: Missing Authentication in WebSocket Gateway (CVSS 9.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-34939](https://cve.now/CVE-2026-34939.md): PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search\_tools() (CVSS 6.5, MervinPraison PraisonAI · praisonai)
- [CVE-2017-20235](https://cve.now/CVE-2017-20235.md): ProSoft Technology ICX35-HWC Authentication Bypass (CVSS 9.1, ProSoft Technology ICX35-HWC Cellular Gateway)
- [CVE-2026-34938](https://cve.now/CVE-2026-34938.md): PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute\_code (CVSS 10.0, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-34937](https://cve.now/CVE-2026-34937.md): PraisonAI: Shell Injection in run\_python() via Unescaped $() Substitution (CVSS 7.8, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-34936](https://cve.now/CVE-2026-34936.md): PraisonAI: SSRF via Unvalidated api\_base in passthrough() Fallback (CVSS 7.7, MervinPraison PraisonAI · praisonai)
- [CVE-2017-20234](https://cve.now/CVE-2017-20234.md): GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String (CVSS 9.8, Belden GarrettCom Magnum 6K and 10K Managed Switches)
- [CVE-2026-34934](https://cve.now/CVE-2026-34934.md): PraisonAI: Second-Order SQL Injection in \`get\_all\_user\_threads\` (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-34935](https://cve.now/CVE-2026-34935.md): PraisonAI: OS Command Injection in MCPHandler.parse\_mcp\_command() (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2017-20233](https://cve.now/CVE-2017-20233.md): Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic Bypass (CVSS 5.4, Belden Hirschmann HiLCOS OpenBAT, BAT450, WLC · Belden Hirs…)
- [CVE-2018-25236](https://cve.now/CVE-2018-25236.md): Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management (CVSS 9.8, Belden Hirschmann HiOS · Belden Hirschmann HiSecOS EAGLE)
- [CVE-2026-34933](https://cve.now/CVE-2026-34933.md): Avahi: Reachable assertion in \`transport\_flags\_from\_domain()\` via conflicting publish flags crashes avahi-daemon (CVSS 5.5, avahi)
- [CVE-2026-34824](https://cve.now/CVE-2026-34824.md): Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service (CVSS 7.5, mesop-dev mesop · mesop)
- [CVE-2026-34612](https://cve.now/CVE-2026-34612.md): Kestra: Remote Code Execution via SQL Injection (CVSS 10.0, kestra-io kestra)
- [CVE-2021-4477](https://cve.now/CVE-2021-4477.md): Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass (CVSS 9.3, Belden Hirschmann HiLCOS OpenBAT)
- [CVE-2026-34788](https://cve.now/CVE-2026-34788.md): Emlog: SQL Injection in tag\_model::updateTagName() via unsanitized parameters (CVSS 6.5, emlog)
- [CVE-2026-34787](https://cve.now/CVE-2026-34787.md): Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter (CVSS 6.5, emlog)
- [CVE-2026-34607](https://cve.now/CVE-2026-34607.md): Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE (CVSS 7.2, emlog)
- [CVE-2026-34229](https://cve.now/CVE-2026-34229.md): Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass (CVSS 6.1, emlog)
- [CVE-2026-34228](https://cve.now/CVE-2026-34228.md): Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write (CVSS 8.7, emlog)
- [CVE-2017-20238](https://cve.now/CVE-2017-20238.md): Hirschmann Industrial HiVision Improper Authorization Privilege Escalation (CVSS 7.1, Belden Hirschmann Industrial HiVision)
- [CVE-2026-35468](https://cve.now/CVE-2026-35468.md): nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index (CVSS 5.3, nimiq core-rs-albatross)
- [CVE-2026-33184](https://cve.now/CVE-2026-33184.md): nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic (CVSS 7.5, nimiq core-rs-albatross)
- [CVE-2026-34061](https://cve.now/CVE-2026-34061.md): nimiq/core-rs-albatross: Macro block proposal interlink bug (CVSS 4.9, nimiq core-rs-albatross)
- [CVE-2026-34052](https://cve.now/CVE-2026-34052.md): LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) (CVSS 5.9, jupyterhub ltiauthenticator · jupyterhub-ltiauthenticator)
- [CVE-2026-33709](https://cve.now/CVE-2026-33709.md): JupyterHub has an Open Redirect Vulnerability (CVSS 5.1, jupyterhub)
- [CVE-2016-15058](https://cve.now/CVE-2016-15058.md): Hirschmann HiLCOS Classic Platform Password Exposure via SNMP (CVSS 8.1, Belden Hirschmann HiLCOS Classic Platform)
- [CVE-2026-33175](https://cve.now/CVE-2026-33175.md): OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims (CVSS 8.8, jupyterhub oauthenticator · oauthenticator)
- [CVE-2015-10148](https://cve.now/CVE-2015-10148.md): Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys (CVSS 8.2, Belden Hirschmann HiLCOS)
- [CVE-2026-28797](https://cve.now/CVE-2026-28797.md): RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component (CVSS 8.7, infiniflow ragflow)
- [CVE-2026-27885](https://cve.now/CVE-2026-27885.md): Piwigo: SQL Injection in Activity.getList (CVSS 7.2, Piwigo)
- [CVE-2026-27834](https://cve.now/CVE-2026-27834.md): Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter (CVSS 7.2, Piwigo)
- [CVE-2026-27833](https://cve.now/CVE-2026-27833.md): Piwigo: Unauthenticated Information Disclosure via pwg.history.search API (CVSS 7.5, Piwigo)
- [CVE-2026-27634](https://cve.now/CVE-2026-27634.md): Piwigo: Pre-auth SQL injection via date filter parameters in ws\_std\_image\_sql\_filter (CVSS 8.7, Piwigo)
- [CVE-2026-34947](https://cve.now/CVE-2026-34947.md): Discourse: Staged user custom fields are exposed on public invite pages (CVSS 2.7, discourse)
- [CVE-2026-27481](https://cve.now/CVE-2026-27481.md): Discourse: Hidden tag visibility bypass on tag routes (CVSS 6.3, discourse)
- [CVE-2026-27456](https://cve.now/CVE-2026-27456.md): util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup (CVSS 4.7, util-linux)
- [CVE-2018-25237](https://cve.now/CVE-2018-25237.md): Hirschmann HiSecOS Buffer Overflow via HTTPS Login (CVSS 9.8, Belden Hirschmann HiSecOS Classic Firewall)
- [CVE-2026-34980](https://cve.now/CVE-2026-34980.md): OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach \`lp\` code execution over the network (CVSS 6.1, OpenPrinting cups)
- [CVE-2026-34979](https://cve.now/CVE-2026-34979.md): OpenPrinting CUPS: Heap overflow in \`get\_options()\` (CVSS 5.3, OpenPrinting cups)
- [CVE-2026-34978](https://cve.now/CVE-2026-34978.md): OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache) (CVSS 6.5, OpenPrinting cups)
- [CVE-2026-34990](https://cve.now/CVE-2026-34990.md): OpenPrinting CUPS: Local print admin token disclosure using temporary printers (CVSS 5.0, OpenPrinting cups)
- [CVE-2026-27447](https://cve.now/CVE-2026-27447.md): OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup (CVSS 4.8, OpenPrinting cups)
- [CVE-2017-20237](https://cve.now/CVE-2017-20237.md): Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution (CVSS 9.8, Belden Hirschmann Industrial HiVision)
- [CVE-2026-26058](https://cve.now/CVE-2026-26058.md): Zulip: Path Traversal in Import (CVSS 6.1, zulip)
- [CVE-2026-34511](https://cve.now/CVE-2026-34511.md): OpenClaw \< 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter (CVSS 6.0, OpenClaw)
- [CVE-2026-22665](https://cve.now/CVE-2026-22665.md): prompts.chat Identity Confusion via Case-Sensitive Username Handling (CVSS 8.6, f prompts.chat)
- [CVE-2026-22664](https://cve.now/CVE-2026-22664.md): prompts.chat SSRF via Fal.ai Media Status Polling (CVSS 7.1, f prompts.chat)
- [CVE-2026-22663](https://cve.now/CVE-2026-22663.md): prompts.chat Authorization Bypass Information Disclosure (CVSS 8.7, f prompts.chat)
- [CVE-2026-22662](https://cve.now/CVE-2026-22662.md): prompts.chat Blind SSRF via media-generate (CVSS 5.3, f prompts.chat)
- [CVE-2026-22661](https://cve.now/CVE-2026-22661.md): prompts.chat Path Traversal via Skill File Handling (CVSS 8.6, f prompts.chat)
- [CVE-2025-10681](https://cve.now/CVE-2025-10681.md): Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials (CVSS 8.8, Gardyn Mobile Application · Gardyn Cloud API)
- [CVE-2026-25197](https://cve.now/CVE-2026-25197.md): Gardyn Cloud API Authorization Bypass Through User-Controlled Key (CVSS 9.3, Gardyn Cloud API)
- [CVE-2026-28766](https://cve.now/CVE-2026-28766.md): Gardyn Cloud API Missing Authentication for Critical Function (CVSS 9.2, Gardyn Cloud API)
- [CVE-2020-37216](https://cve.now/CVE-2020-37216.md): Hirschmann HiOS EtherNet/IP Stack Denial of Service (CVSS 7.5, Belden Hirschmann HiOS)
- [CVE-2026-28767](https://cve.now/CVE-2026-28767.md): Gardyn Cloud API Missing Authentication for Critical Function (CVSS 6.9, Gardyn Cloud API)
- [CVE-2026-32646](https://cve.now/CVE-2026-32646.md): Gardyn Cloud API Missing Authentication for Critical Function (CVSS 8.7, Gardyn Cloud API)
- [CVE-2022-4987](https://cve.now/CVE-2022-4987.md): Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution (CVSS 7.3, Belden Hirschmann Industrial HiVision)
- [CVE-2026-35558](https://cve.now/CVE-2026-35558.md): Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver (CVSS 7.8, Amazon Athena ODBC driver)
- [CVE-2026-35559](https://cve.now/CVE-2026-35559.md): Out-of-bounds write in query processing components in Amazon Athena ODBC driver (CVSS 6.5, Amazon Athena ODBC driver)
- [CVE-2026-5485](https://cve.now/CVE-2026-5485.md): OS command injection in Amazon Athena ODBC driver on Linux (CVSS 7.8, Amazon Athena ODBC driver)
- [CVE-2026-25742](https://cve.now/CVE-2026-25742.md): Zulip: Anonymous File Access After Disabling Spectator Access (CVSS 5.3, zulip)
- [CVE-2026-32662](https://cve.now/CVE-2026-32662.md): Gardyn Cloud API Active Debug Code (CVSS 6.9, Gardyn Cloud API)
- [CVE-2026-35562](https://cve.now/CVE-2026-35562.md): Allocation of resources without limits in parsing components in Amazon Athena ODBC driver (CVSS 7.5, Amazon Athena ODBC driver)
- [CVE-2026-35561](https://cve.now/CVE-2026-35561.md): Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver (CVSS 7.4, Amazon Athena ODBC driver)
- [CVE-2026-35560](https://cve.now/CVE-2026-35560.md): Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver (CVSS 7.4, Amazon Athena ODBC driver)
- [CVE-2026-25726](https://cve.now/CVE-2026-25726.md): Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) (CVSS 8.1, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-28798](https://cve.now/CVE-2026-28798.md): Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS (CVSS 9.1, IceWhaleTech ZimaOS)
- [CVE-2026-5484](https://cve.now/CVE-2026-5484.md): BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control (CVSS 6.9, BookStackApp BookStack)
- [CVE-2026-3184](https://cve.now/CVE-2026-3184.md): Util-linux: util-linux: access control bypass due to improper hostname canonicalization (CVSS 3.7, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-2625](https://cve.now/CVE-2026-2625.md): Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification (CVSS 4.0, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-5476](https://cve.now/CVE-2026-5476.md): NASA cFS cfe\_tbl\_passthru\_codec.c CFE\_TBL\_ValidateCodecLoadSize integer overflow (CVSS 2.1, NASA cFS)
- [CVE-2026-32186](https://cve.now/CVE-2026-32186.md): Microsoft Bing Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Bing)
- [CVE-2026-5475](https://cve.now/CVE-2026-5475.md): NASA cFS CCSDS Header Size cfe\_sb\_priv.c CFE\_SB\_TransmitMsg memory corruption (CVSS 5.1, NASA cFS)
- [CVE-2026-0545](https://cve.now/CVE-2026-0545.md): Missing Authentication for Critical Function in mlflow/mlflow (CVSS 9.1, mlflow/mlflow · mlflow)
- [CVE-2026-5474](https://cve.now/CVE-2026-5474.md): NASA cFS CCSDS Packet Header to\_lab\_passthru\_encode.c CFE\_MSG\_GetSize heap-based overflow (CVSS 5.3, NASA cFS)
- [CVE-2026-5473](https://cve.now/CVE-2026-5473.md): NASA cFS Pickle pickle.load deserialization (CVSS 2.0, NASA cFS)
- [CVE-2026-5472](https://cve.now/CVE-2026-5472.md): ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload (CVSS 5.3, ProjectsAndPrograms School Management System)
- [CVE-2026-25118](https://cve.now/CVE-2026-25118.md): immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums (CVSS 6.3, immich-app immich)
- [CVE-2026-35218](https://cve.now/CVE-2026-35218.md): Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette (CVSS 8.7, budibase)
- [CVE-2026-35216](https://cve.now/CVE-2026-35216.md): Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step (CVSS 9.1, budibase · @budibase/server)
- [CVE-2026-5471](https://cve.now/CVE-2026-5471.md): Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded key (CVSS 4.8, Investory Toy Planet Trouble App)
- [CVE-2026-35214](https://cve.now/CVE-2026-35214.md): Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write (CVSS 8.7, budibase · @budibase/server)
- [CVE-2026-31818](https://cve.now/CVE-2026-31818.md): Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist (CVSS 9.6, budibase · @budibase/backend-core)
- [CVE-2026-25044](https://cve.now/CVE-2026-25044.md): Budibase: Command Injection in Bash Automation Step (CVSS 8.7, budibase · @budibase/server)
- [CVE-2026-25043](https://cve.now/CVE-2026-25043.md): Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding (CVSS 5.3, budibase)
- [CVE-2026-5470](https://cve.now/CVE-2026-5470.md): mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery (CVSS 5.3, mixelpixx Google-Research-MCP)
- [CVE-2025-68153](https://cve.now/CVE-2025-68153.md): Juju: Resource poisoning (CVSS 7.1, juju · github.com/juju/juju)
- [CVE-2025-68152](https://cve.now/CVE-2025-68152.md): Juju: Read All Controller Logs From Compromised Workload (CVSS 6.9, juju · github.com/juju/juju)
- [CVE-2026-27124](https://cve.now/CVE-2026-27124.md): FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities (CVSS 8.2, jlowin fastmcp · fastmcp)
- [CVE-2025-64340](https://cve.now/CVE-2025-64340.md): FastMCP has a Command Injection vulnerability - Gemini CLI (CVSS 6.7, jlowin fastmcp · fastmcp)
- [CVE-2026-31403](https://cve.now/CVE-2026-31403.md): NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVSS 7.8, Linux)
- [CVE-2026-31402](https://cve.now/CVE-2026-31402.md): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVSS 9.8, Linux)
- [CVE-2026-31401](https://cve.now/CVE-2026-31401.md): HID: bpf: prevent buffer overflow in hid\_hw\_request (CVSS 7.8, Linux)
- [CVE-2026-31400](https://cve.now/CVE-2026-31400.md): sunrpc: fix cache\_request leak in cache\_release (no CVSS, Linux)
- [CVE-2026-31399](https://cve.now/CVE-2026-31399.md): nvdimm/bus: Fix potential use after free in asynchronous initialization (no CVSS, Linux)
- [CVE-2026-31398](https://cve.now/CVE-2026-31398.md): mm/rmap: fix incorrect pte restoration for lazyfree folios (CVSS 7.8, Linux)
- [CVE-2026-31397](https://cve.now/CVE-2026-31397.md): mm/huge\_memory: fix use of NULL folio in move\_pages\_huge\_pmd() (CVSS 7.8, Linux)
- [CVE-2026-31396](https://cve.now/CVE-2026-31396.md): net: macb: fix use-after-free access to PTP clock (CVSS 7.8, Linux)
- [CVE-2026-31395](https://cve.now/CVE-2026-31395.md): bnxt\_en: fix OOB access in DBG\_BUF\_PRODUCER async event handler (no CVSS, Linux)
- [CVE-2026-31394](https://cve.now/CVE-2026-31394.md): mac80211: fix crash in ieee80211\_chan\_bw\_change for AP\_VLAN stations (no CVSS, Linux)
- [CVE-2026-31393](https://cve.now/CVE-2026-31393.md): Bluetooth: L2CAP: Validate L2CAP\_INFO\_RSP payload length before access (CVSS 8.1, Linux)
- [CVE-2026-31392](https://cve.now/CVE-2026-31392.md): smb: client: fix krb5 mount with username option (CVSS 8.1, Linux)
- [CVE-2026-31391](https://cve.now/CVE-2026-31391.md): crypto: atmel-sha204a - Fix OOM -\>tfm\_count leak (no CVSS, Linux)
- [CVE-2026-31390](https://cve.now/CVE-2026-31390.md): drm/xe: Fix memory leak in xe\_vm\_madvise\_ioctl (no CVSS, Linux)
- [CVE-2026-31389](https://cve.now/CVE-2026-31389.md): spi: fix use-after-free on controller registration failure (CVSS 7.8, Linux)
- [CVE-2026-23475](https://cve.now/CVE-2026-23475.md): spi: fix statistics allocation (no CVSS, Linux)
- [CVE-2026-23474](https://cve.now/CVE-2026-23474.md): mtd: Avoid boot crash in RedBoot partition table parser (no CVSS, Linux)
- [CVE-2026-23472](https://cve.now/CVE-2026-23472.md): serial: core: fix infinite loop in handle\_tx() for PORT\_UNKNOWN (no CVSS, Linux)
- [CVE-2026-23470](https://cve.now/CVE-2026-23470.md): drm/imagination: Fix deadlock in soft reset sequence (no CVSS, Linux)
- [CVE-2026-23469](https://cve.now/CVE-2026-23469.md): drm/imagination: Synchronize interrupts before suspending the GPU (no CVSS, Linux)
- [CVE-2026-23468](https://cve.now/CVE-2026-23468.md): drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (no CVSS, Linux)
- [CVE-2026-23467](https://cve.now/CVE-2026-23467.md): drm/i915/dmc: Fix an unlikely NULL pointer deference at probe (no CVSS, Linux)
- [CVE-2026-23466](https://cve.now/CVE-2026-23466.md): drm/xe: Open-code GGTT MMIO access protection (CVSS 7.8, Linux)
- [CVE-2026-23465](https://cve.now/CVE-2026-23465.md): btrfs: log new dentries when logging parent dir of a conflicting inode (no CVSS, Linux)
- [CVE-2026-23464](https://cve.now/CVE-2026-23464.md): soc: microchip: mpfs: Fix memory leak in mpfs\_sys\_controller\_probe() (no CVSS, Linux)
- [CVE-2026-23463](https://cve.now/CVE-2026-23463.md): soc: fsl: qbman: fix race condition in qman\_destroy\_fq (no CVSS, Linux)
- [CVE-2026-23462](https://cve.now/CVE-2026-23462.md): Bluetooth: HIDP: Fix possible UAF (CVSS 8.8, Linux)
- [CVE-2026-23461](https://cve.now/CVE-2026-23461.md): Bluetooth: L2CAP: Fix use-after-free in l2cap\_unregister\_user (CVSS 8.8, Linux)
- [CVE-2026-23460](https://cve.now/CVE-2026-23460.md): net/rose: fix NULL pointer dereference in rose\_transmit\_link on reconnect (no CVSS, Linux)
- [CVE-2026-23459](https://cve.now/CVE-2026-23459.md): ip\_tunnel: adapt iptunnel\_xmit\_stats() to NETDEV\_PCPU\_STAT\_DSTATS (CVSS 8.2, Linux)
- [CVE-2026-23458](https://cve.now/CVE-2026-23458.md): netfilter: ctnetlink: fix use-after-free in ctnetlink\_dump\_exp\_ct() (CVSS 7.8, Linux)
- [CVE-2026-23457](https://cve.now/CVE-2026-23457.md): netfilter: nf\_conntrack\_sip: fix Content-Length u32 truncation in sip\_help\_tcp() (CVSS 8.6, Linux)
- [CVE-2026-23456](https://cve.now/CVE-2026-23456.md): netfilter: nf\_conntrack\_h323: fix OOB read in decode\_int() CONS case (CVSS 8.2, Linux)
- [CVE-2026-23455](https://cve.now/CVE-2026-23455.md): netfilter: nf\_conntrack\_h323: check for zero length in DecodeQ931() (CVSS 9.1, Linux)
- [CVE-2026-23454](https://cve.now/CVE-2026-23454.md): net: mana: fix use-after-free in mana\_hwc\_destroy\_channel() by reordering teardown (no CVSS, Linux)
- [CVE-2026-23453](https://cve.now/CVE-2026-23453.md): net: ti: icssg-prueth: Fix memory leak in XDP\_DROP for non-zero-copy mode (CVSS 7.5, Linux)
- [CVE-2026-23452](https://cve.now/CVE-2026-23452.md): PM: runtime: Fix a race condition related to device removal (no CVSS, Linux)
- [CVE-2026-23451](https://cve.now/CVE-2026-23451.md): bonding: prevent potential infinite loop in bond\_header\_parse() (CVSS 7.5, Linux)
- [CVE-2026-23450](https://cve.now/CVE-2026-23450.md): net/smc: fix NULL dereference and UAF in smc\_tcp\_syn\_recv\_sock() (CVSS 9.8, Linux)
- [CVE-2026-23449](https://cve.now/CVE-2026-23449.md): net/sched: teql: Fix double-free in teql\_master\_xmit (CVSS 7.8, Linux)
- [CVE-2026-23448](https://cve.now/CVE-2026-23448.md): net: usb: cdc\_ncm: add ndpoffset to NDP16 nframes bounds check (no CVSS, Linux)
- [CVE-2026-23447](https://cve.now/CVE-2026-23447.md): net: usb: cdc\_ncm: add ndpoffset to NDP32 nframes bounds check (no CVSS, Linux)
- [CVE-2026-23446](https://cve.now/CVE-2026-23446.md): net: usb: aqc111: Do not perform PM inside suspend callback (no CVSS, Linux)
- [CVE-2026-23445](https://cve.now/CVE-2026-23445.md): igc: fix page fault in XDP TX timestamps handling (CVSS 7.8, Linux)
- [CVE-2026-23444](https://cve.now/CVE-2026-23444.md): wifi: mac80211: always free skb on ieee80211\_tx\_prepare\_skb() failure (CVSS 7.8, Linux)
- [CVE-2026-23443](https://cve.now/CVE-2026-23443.md): ACPI: processor: Fix previous acpi\_processor\_errata\_piix4() fix (no CVSS, Linux)
- [CVE-2026-23442](https://cve.now/CVE-2026-23442.md): ipv6: add NULL checks for idev in SRv6 paths (no CVSS, Linux)
- [CVE-2026-23441](https://cve.now/CVE-2026-23441.md): net/mlx5e: Prevent concurrent access to IPSec ASO context (no CVSS, Linux)
- [CVE-2026-23440](https://cve.now/CVE-2026-23440.md): net/mlx5e: Fix race condition during IPSec ESN update (CVSS 7.5, Linux)
- [CVE-2026-23439](https://cve.now/CVE-2026-23439.md): udp\_tunnel: fix NULL deref caused by udp\_sock\_create6 when CONFIG\_IPV6=n (no CVSS, Linux)
- [CVE-2026-23438](https://cve.now/CVE-2026-23438.md): net: mvpp2: guard flow control update with global\_tx\_fc in buffer switching (no CVSS, Linux)
- [CVE-2026-23437](https://cve.now/CVE-2026-23437.md): net: shaper: protect late read accesses to the hierarchy (CVSS 7.8, Linux)
- [CVE-2026-23436](https://cve.now/CVE-2026-23436.md): net: shaper: protect from late creation of hierarchy (no CVSS, Linux)
- [CVE-2026-23435](https://cve.now/CVE-2026-23435.md): perf/x86: Move event pointer setup earlier in x86\_pmu\_enable() (no CVSS, Linux)
- [CVE-2026-23434](https://cve.now/CVE-2026-23434.md): mtd: rawnand: serialize lock/unlock against other NAND operations (CVSS 7.1, Linux)
- [CVE-2026-23433](https://cve.now/CVE-2026-23433.md): arm\_mpam: Fix null pointer dereference when restoring bandwidth counters (no CVSS, Linux)
- [CVE-2026-23432](https://cve.now/CVE-2026-23432.md): mshv: Fix use-after-free in mshv\_map\_user\_memory error path (CVSS 7.8, Linux)
- [CVE-2026-23431](https://cve.now/CVE-2026-23431.md): spi: amlogic-spisg: Fix memory leak in aml\_spisg\_probe() (no CVSS, Linux)
- [CVE-2026-23430](https://cve.now/CVE-2026-23430.md): drm/vmwgfx: Don't overwrite KMS surface dirty tracker (no CVSS, Linux)
- [CVE-2026-23429](https://cve.now/CVE-2026-23429.md): iommu/sva: Fix crash in iommu\_sva\_unbind\_device() (CVSS 7.8, Linux)
- [CVE-2026-23428](https://cve.now/CVE-2026-23428.md): ksmbd: fix use-after-free of share\_conf in compound request (CVSS 9.8, Linux)
- [CVE-2026-23427](https://cve.now/CVE-2026-23427.md): ksmbd: fix use-after-free in durable v2 replay of active file handles (CVSS 9.8, Linux)
- [CVE-2026-5469](https://cve.now/CVE-2026-5469.md): Casdoor Webhook URL server-side request forgery (CVSS 5.1, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-5468](https://cve.now/CVE-2026-5468.md): Casdoor dangerouslySetInnerHTML cross site scripting (CVSS 5.1, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-28736](https://cve.now/CVE-2026-28736.md): Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) (CVSS 4.3, Mattermost Focalboard · github.com/mattermost/focalboard)
- [CVE-2026-23426](https://cve.now/CVE-2026-23426.md): drm/logicvc: Fix device node reference leak in logicvc\_drm\_config\_parse() (no CVSS, Linux)
- [CVE-2026-23425](https://cve.now/CVE-2026-23425.md): KVM: arm64: Fix ID register initialization for non-protected pKVM guests (CVSS 8.8, Linux)
- [CVE-2026-23424](https://cve.now/CVE-2026-23424.md): accel/amdxdna: Validate command buffer payload count (CVSS 7.1, Linux)
- [CVE-2026-23423](https://cve.now/CVE-2026-23423.md): btrfs: free pages on error in btrfs\_uring\_read\_extent() (no CVSS, Linux)
- [CVE-2026-23422](https://cve.now/CVE-2026-23422.md): dpaa2-switch: Fix interrupt storm after receiving bad if\_id in IRQ handler (no CVSS, Linux)
- [CVE-2026-23421](https://cve.now/CVE-2026-23421.md): drm/xe/configfs: Free ctx\_restore\_mid\_bb in release (no CVSS, Linux)
- [CVE-2026-23420](https://cve.now/CVE-2026-23420.md): wifi: wlcore: Fix a locking bug (no CVSS, Linux)
- [CVE-2026-25773](https://cve.now/CVE-2026-25773.md): Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix) (CVSS 8.1, Mattermost Focalboard · github.com/mattermost/focalboard)
- [CVE-2026-23419](https://cve.now/CVE-2026-23419.md): net/rds: Fix circular locking dependency in rds\_tcp\_tune (CVSS 7.5, Linux)
- [CVE-2026-23418](https://cve.now/CVE-2026-23418.md): drm/xe/reg\_sr: Fix leak on xa\_store failure (no CVSS, Linux)
- [CVE-2026-27655](https://cve.now/CVE-2026-27655.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-4108](https://cve.now/CVE-2026-4108.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-5467](https://cve.now/CVE-2026-5467.md): Casdoor OAuth Authorization Request redirect (CVSS 5.3, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-4107](https://cve.now/CVE-2026-4107.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-3880](https://cve.now/CVE-2026-3880.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-3879](https://cve.now/CVE-2026-3879.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-28703](https://cve.now/CVE-2026-28703.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-28756](https://cve.now/CVE-2026-28756.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-28754](https://cve.now/CVE-2026-28754.md): Stored XSS Vulnerability (CVSS 7.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2026-4350](https://cve.now/CVE-2026-4350.md): Perfmatters \<= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter (CVSS 8.1, Perfmatters)
- [CVE-2025-7024](https://cve.now/CVE-2025-7024.md): Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS) (CVSS 5.6, AIRBUS TETRA Connectivity Server)
- [CVE-2026-5462](https://cve.now/CVE-2026-5462.md): Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key (CVSS 4.8, Wahoo Fitness SYSTM App)
- [CVE-2026-5458](https://cve.now/CVE-2026-5458.md): Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key (CVSS 4.8, Noelse Individuals & Pro App)
- [CVE-2026-5457](https://cve.now/CVE-2026-5457.md): PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key (CVSS 4.8, PropertyGuru AgentNet Singapore App)
- [CVE-2026-5456](https://cve.now/CVE-2026-5456.md): Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key (CVSS 4.8, Align Technology My Invisalign App)
- [CVE-2026-5455](https://cve.now/CVE-2026-5455.md): Dialogue App ca.diagram.dialogue config.json hard-coded key (CVSS 4.8, Dialogue App)
- [CVE-2026-35549](https://cve.now/CVE-2026-35549.md): An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. (CVSS 6.5, MariaDB)
- [CVE-2026-5454](https://cve.now/CVE-2026-5454.md): GRID Organiser App co.gridapp.organiser app.json hard-coded key (CVSS 4.8, GRID Organiser App)
- [CVE-2026-5463](https://cve.now/CVE-2026-5463.md): pymetasploit3 - Command Injection via Newline Injection in console.run\_module\_with\_output() (CVSS 9.3, Dan McInerney pymetasploit3 · pymetasploit3)
- [CVE-2026-5453](https://cve.now/CVE-2026-5453.md): Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key (CVSS 4.8, Rico só vantagem pra investir App)
- [CVE-2026-35545](https://cve.now/CVE-2026-35545.md): An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. (CVSS 5.3, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35544](https://cve.now/CVE-2026-35544.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 5.3, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35543](https://cve.now/CVE-2026-35543.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 5.3, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35542](https://cve.now/CVE-2026-35542.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 5.3, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35541](https://cve.now/CVE-2026-35541.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 4.2, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35540](https://cve.now/CVE-2026-35540.md): An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. (CVSS 5.4, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35539](https://cve.now/CVE-2026-35539.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 6.1, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35538](https://cve.now/CVE-2026-35538.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 3.1, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-35537](https://cve.now/CVE-2026-35537.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 3.7, Roundcube Webmail · roundcube/roundcubemail)
- [CVE-2026-5452](https://cve.now/CVE-2026-5452.md): UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key (CVSS 4.8, UCC CampusConnect App)
- [CVE-2026-35536](https://cve.now/CVE-2026-35536.md): In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set\_cook (CVSS 7.2, tornadoweb Tornado · tornado)
- [CVE-2026-35535](https://cve.now/CVE-2026-35535.md): In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer (CVSS 7.4, Sudo project Sudo)
- [CVE-2026-28815](https://cve.now/CVE-2026-28815.md): A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially (CVSS 7.5, Apple macOS)
- [CVE-2026-35508](https://cve.now/CVE-2026-35508.md): Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters, (CVSS 5.4, milesmcc Shynet)
- [CVE-2026-35507](https://cve.now/CVE-2026-35507.md): Shynet before 0.14.0 allows Host header injection in the password reset flow. (CVSS 6.4, milesmcc Shynet)
- [CVE-2025-59709](https://cve.now/CVE-2025-59709.md): An issue was discovered in Biztalk360 through 11.5. (CVSS 6.8)
- [CVE-2025-59710](https://cve.now/CVE-2025-59710.md): An issue was discovered in Biztalk360 before 11.5. (CVSS 8.8)
- [CVE-2025-59711](https://cve.now/CVE-2025-59711.md): An issue was discovered in Biztalk360 before 11.5. (CVSS 8.3)
- [CVE-2026-26477](https://cve.now/CVE-2026-26477.md): An issue in Dokuwiki v.2025-05-14b "Librarian" \[56.2\] allows a remote attacker to cause a denial of service via the media\_upload\_xhr() funct (CVSS 4.3, DokuWiki)
- [CVE-2026-28373](https://cve.now/CVE-2026-28373.md): The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality w (CVSS 9.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.