CVEs published April 5, 2026
110 CVEs were published on April 5, 2026: 1 critical, 37 high.
- Published
- 110
- Critical
- 1
- High
- 37
- Medium
- 71
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Kados R10 GreenBee
- 8
- code-projects Simple Laundry System
- 6
- Technostrobe HI-LED-WR120-G2
- 6
- PHPGurukul Online Shopping Portal Project
- 4
- Tenda AC10
- 4
- badlogic pi-mono
- 3
- CodeAstro Online Classroom
- 3
- griptape-ai griptape
- 3
- code-projects Concert Ticket Reservation System
- 2
- FedML-AI FedML
- 2
Critical 1
High 37
- CVE-2026-5605Tenda CH22 WrlExtraSet formWrlExtraSet stack-based overflowTenda CH22
- CVE-2026-5604Tenda CH22 Parameter CertLocalPrecreate formCertLocalPrecreate stack-based overflowTenda CH22
- CVE-2026-4272CVE-2026-4272 - Bluetooth Remote Execution of System Commands VulnerabilityHoneywell Barcode Scanners
- CVE-2019-25675eDirectory All Versions SQL Injection Authentication BypasseDirectory
- CVE-2019-25704Kados R10 GreenBee SQL Injection via filter_user_mailKados R10 GreenBee
- CVE-2019-25702Kados R10 GreenBee SQL Injection via id_project ParameterKados R10 GreenBee
- CVE-2019-25700Kados R10 GreenBee SQL Injection via sort_direction ParameterKados R10 GreenBee
- CVE-2019-25698Kados R10 GreenBee SQL Injection via id_to_delete ParameterKados R10 GreenBee
- CVE-2019-25696Kados R10 GreenBee SQL Injection via language_tag ParameterKados R10 GreenBee
- CVE-2019-25694Kados R10 GreenBee SQL Injection via user2resetKados R10 GreenBee
- CVE-2019-25692Kados R10 GreenBee SQL Injection via id_to_modify ParameterKados R10 GreenBee
- CVE-2019-25690Kados R10 GreenBee SQL Injection via mng_profile_idKados R10 GreenBee
- CVE-2019-25688Kados R10 GreenBee SQL Injection via menu_lev1 ParameterKados GreenBee
- CVE-2019-25686Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of ServiceCoreftp Core FTP
- CVE-2019-25684OpenDocMan 1.3.4 SQL Injection via where ParameterOpenDocMan
- CVE-2019-25681Xlight FTP Server 3.9.1 SEH Overwrite Buffer OverflowXlightftpd Xlight
- CVE-2019-25680Advance Gift Shop Pro Script 2.0.3 SQL Injection via searchPhpscriptsmall Advance Gift Shop Pro Script
- CVE-2019-25679RealTerm Serial Terminal 2.0.0.70 Buffer Overflow SEHRealTerm: Serial Terminal
- CVE-2019-25678C4G BLIS 3.4 SQL Injection via users_select.phpC4G Basic Laboratory Information System
- CVE-2019-25676Ask Expert Script 3.0.5 Cross Site Scripting SQL InjectionPhpscriptsmall Ask Expert Script
- CVE-2019-25674CMSsite 1.0 SQL Injection via post ParameterVictorAlagwu CMSsite
- CVE-2019-25673UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File UploadUniSharp Laravel File Manager
- CVE-2019-25672PilusCart 1.4.1 SQL Injection via send ParameterPilusCart
- CVE-2019-25671VA MAX 8.3.4 Remote Code Execution via changeip.phpVA MAX
- CVE-2019-25670River Past Video Cleaner 7.6.3 Buffer Overflow via SEHRiver Past Video Cleaner
- CVE-2019-25669qdPM 9.1 SQL Injection via search_by_extrafields ParameterqdPM
- CVE-2019-25668News Website Script 2.0.5 SQL Injection via index.phpPhpscriptsmall News Website Script
- CVE-2019-25664SuiteCRM 7.10.7 SQL Injection via record ParameterSuiteCRM
- CVE-2019-25663SuiteCRM 7.10.7 SQL Injection via parentTab ParameterSuiteCRM
- CVE-2019-25662ResourceSpace 8.6 SQL Injection via watched_searches.phpMontala ResourceSpace
- CVE-2019-25656R i386 3.5.0 Local Buffer Overflow SEHR-Project R i386
- CVE-2026-5567Tenda M3 Destination setAdvPolicyData buffer overflowTenda M3
- CVE-2026-5599API allows deletion of users of other instancepretix Venueless
- CVE-2026-5566UTT HiPER 1250GW formNatStaticMap strcpy buffer overflowUTT HiPER 1250GW
- CVE-2026-5550Tenda AC10 httpd fromSysToolChangePwd stack-based overflowTenda AC10
- CVE-2026-5548Tenda AC10 httpd fromSysToolChangePwd stack-based overflowTenda AC10
- CVE-2026-5544UTT HiPER 1250GW formRemoteControl stack-based overflowUTT HiPER 1250GW
Medium, low and unrated 72
- CVE-2026-5603elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injectionelgentos magento2-dev-mcp · @elgentos/magento2-dev-mcp
- CVE-2026-5602Nor2-io heim-mcp new_heim_application tools.ts registerTools os command injectionNor2-io heim-mcp · @nor2/heim-mcp
- CVE-2026-5601Acrel Electrical Prepaid Cloud Platform Backup File bin.rar information disclosureAcrel Electrical Prepaid Cloud Platform
- CVE-2026-35679Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in thezcashd
- CVE-2026-5597griptape-ai griptape ComputerTool tool.py path traversalgriptape-ai griptape
- CVE-2019-25683FileZilla 3.40.0 Denial of Service via Local SearchFilezilla-Project FileZilla
- CVE-2019-25682CMSsite 1.0 Cross-Site Request Forgery via users.phpVictorAlagwu CMSsite
- CVE-2019-25677WinRAR 5.61 Denial of Service via Malformed Language FileWin-Rar WinRAR
- CVE-2019-25667TaskInfo 8.2.0.280 Denial of Service Buffer OverflowIarsn TaskInfo
- CVE-2019-25666SpotAuditor 3.6.7 Denial of Service Buffer OverflowNsauditor SpotAuditor
- CVE-2019-25665River Past Ringtone Converter 2.7.6.1601 Buffer Overflow DoSRiverpast River Past Ringtone Converter
- CVE-2019-25661Remote Process Explorer 1.0.0.16 Local Buffer Overflow DoSLizardsystems Remote Process Explorer
- CVE-2019-25660LanHelper 1.74 Denial of Service via Buffer OverflowHainsoft LanHelper
- CVE-2019-25659ASPRunner Professional 6.0.766 Local Buffer Overflow DoSXlinesoft ASPRunner Professional
- CVE-2019-25658a-Mac Address Change 5.4 Local Buffer Overflow DoSAmac Mac Address Change
- CVE-2019-25657AnyBurn 4.3 x86 Denial of Service via Image ConversionAnyBurn x86
- CVE-2026-5596griptape-ai griptape SqlTool tool.py sql injectiongriptape-ai griptape
- CVE-2018-25256IP TOOLS 2.50 Local Buffer Overflow Denial of ServiceKs-Soft IP TOOLS
- CVE-2026-5595griptape-ai griptape FileManagerTool save_memory_artifacts_to_disk path traversalgriptape-ai griptape
- CVE-2026-5594premAI-io premsql followup.py eval code injectionpremAI-io premsql
- CVE-2026-5587wbbeyourself MAC-SQL Refiner Agent agents.py _execute_sql sql injectionwbbeyourself MAC-SQL
- CVE-2026-5586zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injectionzhongyu09 openchatbi
- CVE-2026-5585Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosureTencent AI-Infra-Guard
- CVE-2026-5584Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injectionFosowl agenticSeek
- CVE-2026-5583PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-5580CodeAstro Online Classroom Parameter addvideos.php sql injectionCodeAstro Online Classroom
- CVE-2026-5579CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injectionCodeAstro Online Classroom
- CVE-2026-5578CodeAstro Online Classroom Parameter addassessment.php sql injectionCodeAstro Online Classroom
- CVE-2026-5577Song-Li cross_browser details Endpoint uniquemachine_app.py sql injectionSong-Li cross_browser
- CVE-2026-5576SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted uploadSourceCodester Record Management System · jkev Record Manag…
- CVE-2026-5575SourceCodester/jkev Record Management System Login index.php sql injectionSourceCodester Record Management System · jkev Record Manag…
- CVE-2026-5574Technostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorizationTechnostrobe HI-LED-WR120-G2
- CVE-2026-5573Technostrobe HI-LED-WR120-G2 fs unrestricted uploadTechnostrobe HI-LED-WR120-G2
- CVE-2026-5572Technostrobe HI-LED-WR120-G2 cross-site request forgeryTechnostrobe HI-LED-WR120-G2
- CVE-2026-5571Technostrobe HI-LED-WR120-G2 Configuration Data fs information disclosureTechnostrobe HI-LED-WR120-G2
- CVE-2026-5570Technostrobe HI-LED-WR120-G2 LoginCB index_config improper authenticationTechnostrobe HI-LED-WR120-G2
- CVE-2026-5569Technostrobe HI-LED-WR120-G2 Endpoint access controlTechnostrobe HI-LED-WR120-G2
- CVE-2026-5568Akaunting Invoice/Billing cross site scriptingAkaunting
- CVE-2026-5565code-projects Simple Laundry System Parameter delmemberinfo.php sql injectioncode-projects Simple Laundry System
- CVE-2026-5564code-projects Simple Laundry System Parameter searchguest.php sql injectioncode-projects Simple Laundry System
- CVE-2026-5563AutohomeCorp frostmourne Alarm Preview previewData httpTest sql injectionAutohomeCorp frostmourne
- CVE-2026-5562provectus kafka-ui Endpoint testexecutions validateAccess code injectionprovectus kafka-ui
- CVE-2026-5561Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injectionCampcodes Complete POS Management and Inventory System
- CVE-2026-5560PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-5559AntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template engineAntaresMugisho PyBlade · pyblade
- CVE-2026-5558PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-5557badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypassbadlogic pi-mono
- CVE-2026-5556badlogic pi-mono loader.ts discoverAndLoadExtensions code injectionbadlogic pi-mono
- CVE-2026-5555code-projects Concert Ticket Reservation System Parameter login.php sql injectioncode-projects Concert Ticket Reservation System
- CVE-2026-5554code-projects Concert Ticket Reservation System Parameter process_search.php sql injectioncode-projects Concert Ticket Reservation System
- CVE-2026-5553itsourcecode Online Cellphone System Parameter available.php sql injectionitsourcecode Online Cellphone System
- CVE-2026-5552PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-5551itsourcecode Free Hotel Reservation System Parameter login.php sql injectionitsourcecode Free Hotel Reservation System
- CVE-2026-5549Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded keyTenda AC10
- CVE-2026-5547Tenda AC10 httpd formAddMacfilterRule os command injectionTenda AC10
- CVE-2026-5546Campcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted uploadCampcodes Complete Online Learning Management System
- CVE-2026-5543PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injectionPHPGurukul User Registration & Login and User Management Sy…
- CVE-2026-5542code-projects Simple Laundry System Parameter modstaffinfo.php cross site scriptingcode-projects Simple Laundry System
- CVE-2026-5541code-projects Simple Laundry System Parameter modmemberinfo.php cross site scriptingcode-projects Simple Laundry System
- CVE-2026-5540code-projects Simple Laundry System Parameter modifymember.php sql injectioncode-projects Simple Laundry System
- CVE-2026-5590net: ip/tcp: Null pointer dereference can be triggered by a race conditionzephyrproject-rtos Zephyr
- CVE-2026-5539code-projects Simple Laundry System Parameter modifymember.php cross site scriptingcode-projects Simple Laundry System
- CVE-2026-5538QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgeryQingdaoU OnlineJudge
- CVE-2026-5537halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injectionhalex CourseSEL
- CVE-2026-5536FedML-AI FedML gRPC server grpc_server.py sendMessage deserializationFedML-AI FedML
- CVE-2026-5535FedML-AI FedML MQTT Message FileUtils.java path traversalFedML-AI FedML
- CVE-2026-5534itsourcecode Online Enrollment System Parameter index.php sql injectionitsourcecode Online Enrollment System
- CVE-2026-5533badlogic pi-mono SVG Artifact SvgArtifact.ts cross site scriptingbadlogic pi-mono
- CVE-2026-5532ScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injectionScrapeGraphAI scrapegraph-ai
- CVE-2026-5531SourceCodester Student Result Management System HTTP GET Request login_credentials.txt cleartext storage in fileSourceCodester Student Result Management System
- CVE-2026-5530Ollama Model Pull API download.go server-side request forgeryOllama
- CVE-2026-5529Dromara lamp-cloud DefUserController pageUser improper authorizationDromara lamp-cloud