# CVEs published 2026-04-05

110 CVEs were published on April 5, 2026: 1 critical, 37 high. Days are UTC.

- [CVE-2026-5605](https://cve.now/CVE-2026-5605.md): Tenda CH22 WrlExtraSet formWrlExtraSet stack-based overflow (CVSS 8.7, Tenda CH22)
- [CVE-2026-5604](https://cve.now/CVE-2026-5604.md): Tenda CH22 Parameter CertLocalPrecreate formCertLocalPrecreate stack-based overflow (CVSS 8.7, Tenda CH22)
- [CVE-2026-5603](https://cve.now/CVE-2026-5603.md): elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection (CVSS 4.8, elgentos magento2-dev-mcp · @elgentos/magento2-dev-mcp)
- [CVE-2026-5602](https://cve.now/CVE-2026-5602.md): Nor2-io heim-mcp new\_heim\_application tools.ts registerTools os command injection (CVSS 4.8, Nor2-io heim-mcp · @nor2/heim-mcp)
- [CVE-2026-4272](https://cve.now/CVE-2026-4272.md): CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability (CVSS 8.1, Honeywell Barcode Scanners)
- [CVE-2026-5601](https://cve.now/CVE-2026-5601.md): Acrel Electrical Prepaid Cloud Platform Backup File bin.rar information disclosure (CVSS 6.9, Acrel Electrical Prepaid Cloud Platform)
- [CVE-2026-35679](https://cve.now/CVE-2026-35679.md): Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the (CVSS 3.5, zcashd)
- [CVE-2026-5597](https://cve.now/CVE-2026-5597.md): griptape-ai griptape ComputerTool tool.py path traversal (CVSS 5.3, griptape-ai griptape)
- [CVE-2019-25675](https://cve.now/CVE-2019-25675.md): eDirectory All Versions SQL Injection Authentication Bypass (CVSS 8.8, eDirectory)
- [CVE-2019-25704](https://cve.now/CVE-2019-25704.md): Kados R10 GreenBee SQL Injection via filter\_user\_mail (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25702](https://cve.now/CVE-2019-25702.md): Kados R10 GreenBee SQL Injection via id\_project Parameter (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25700](https://cve.now/CVE-2019-25700.md): Kados R10 GreenBee SQL Injection via sort\_direction Parameter (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25698](https://cve.now/CVE-2019-25698.md): Kados R10 GreenBee SQL Injection via id\_to\_delete Parameter (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25696](https://cve.now/CVE-2019-25696.md): Kados R10 GreenBee SQL Injection via language\_tag Parameter (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25694](https://cve.now/CVE-2019-25694.md): Kados R10 GreenBee SQL Injection via user2reset (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25692](https://cve.now/CVE-2019-25692.md): Kados R10 GreenBee SQL Injection via id\_to\_modify Parameter (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25690](https://cve.now/CVE-2019-25690.md): Kados R10 GreenBee SQL Injection via mng\_profile\_id (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2019-25688](https://cve.now/CVE-2019-25688.md): Kados R10 GreenBee SQL Injection via menu\_lev1 Parameter (CVSS 8.8, Kados GreenBee)
- [CVE-2019-25687](https://cve.now/CVE-2019-25687.md): Pegasus CMS 1.0 Remote Code Execution via extra\_fields.php (CVSS 9.3, wisdom Pegasus CMS)
- [CVE-2019-25686](https://cve.now/CVE-2019-25686.md): Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service (CVSS 8.7, Coreftp Core FTP)
- [CVE-2019-25684](https://cve.now/CVE-2019-25684.md): OpenDocMan 1.3.4 SQL Injection via where Parameter (CVSS 8.8, OpenDocMan)
- [CVE-2019-25683](https://cve.now/CVE-2019-25683.md): FileZilla 3.40.0 Denial of Service via Local Search (CVSS 6.9, Filezilla-Project FileZilla)
- [CVE-2019-25682](https://cve.now/CVE-2019-25682.md): CMSsite 1.0 Cross-Site Request Forgery via users.php (CVSS 5.3, VictorAlagwu CMSsite)
- [CVE-2019-25681](https://cve.now/CVE-2019-25681.md): Xlight FTP Server 3.9.1 SEH Overwrite Buffer Overflow (CVSS 8.6, Xlightftpd Xlight)
- [CVE-2019-25680](https://cve.now/CVE-2019-25680.md): Advance Gift Shop Pro Script 2.0.3 SQL Injection via search (CVSS 8.8, Phpscriptsmall Advance Gift Shop Pro Script)
- [CVE-2019-25679](https://cve.now/CVE-2019-25679.md): RealTerm Serial Terminal 2.0.0.70 Buffer Overflow SEH (CVSS 8.5, RealTerm: Serial Terminal)
- [CVE-2019-25678](https://cve.now/CVE-2019-25678.md): C4G BLIS 3.4 SQL Injection via users\_select.php (CVSS 8.8, C4G Basic Laboratory Information System)
- [CVE-2019-25677](https://cve.now/CVE-2019-25677.md): WinRAR 5.61 Denial of Service via Malformed Language File (CVSS 6.9, Win-Rar WinRAR)
- [CVE-2019-25676](https://cve.now/CVE-2019-25676.md): Ask Expert Script 3.0.5 Cross Site Scripting SQL Injection (CVSS 8.8, Phpscriptsmall Ask Expert Script)
- [CVE-2019-25674](https://cve.now/CVE-2019-25674.md): CMSsite 1.0 SQL Injection via post Parameter (CVSS 8.8, VictorAlagwu CMSsite)
- [CVE-2019-25673](https://cve.now/CVE-2019-25673.md): UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload (CVSS 8.7, UniSharp Laravel File Manager)
- [CVE-2019-25672](https://cve.now/CVE-2019-25672.md): PilusCart 1.4.1 SQL Injection via send Parameter (CVSS 8.8, PilusCart)
- [CVE-2019-25671](https://cve.now/CVE-2019-25671.md): VA MAX 8.3.4 Remote Code Execution via changeip.php (CVSS 8.7, VA MAX)
- [CVE-2019-25670](https://cve.now/CVE-2019-25670.md): River Past Video Cleaner 7.6.3 Buffer Overflow via SEH (CVSS 8.6, River Past Video Cleaner)
- [CVE-2019-25669](https://cve.now/CVE-2019-25669.md): qdPM 9.1 SQL Injection via search\_by\_extrafields Parameter (CVSS 8.8, qdPM)
- [CVE-2019-25668](https://cve.now/CVE-2019-25668.md): News Website Script 2.0.5 SQL Injection via index.php (CVSS 8.8, Phpscriptsmall News Website Script)
- [CVE-2019-25667](https://cve.now/CVE-2019-25667.md): TaskInfo 8.2.0.280 Denial of Service Buffer Overflow (CVSS 6.9, Iarsn TaskInfo)
- [CVE-2019-25666](https://cve.now/CVE-2019-25666.md): SpotAuditor 3.6.7 Denial of Service Buffer Overflow (CVSS 6.9, Nsauditor SpotAuditor)
- [CVE-2019-25665](https://cve.now/CVE-2019-25665.md): River Past Ringtone Converter 2.7.6.1601 Buffer Overflow DoS (CVSS 6.9, Riverpast River Past Ringtone Converter)
- [CVE-2019-25664](https://cve.now/CVE-2019-25664.md): SuiteCRM 7.10.7 SQL Injection via record Parameter (CVSS 7.1, SuiteCRM)
- [CVE-2019-25663](https://cve.now/CVE-2019-25663.md): SuiteCRM 7.10.7 SQL Injection via parentTab Parameter (CVSS 7.1, SuiteCRM)
- [CVE-2019-25662](https://cve.now/CVE-2019-25662.md): ResourceSpace 8.6 SQL Injection via watched\_searches.php (CVSS 8.8, Montala ResourceSpace)
- [CVE-2019-25661](https://cve.now/CVE-2019-25661.md): Remote Process Explorer 1.0.0.16 Local Buffer Overflow DoS (CVSS 6.9, Lizardsystems Remote Process Explorer)
- [CVE-2019-25660](https://cve.now/CVE-2019-25660.md): LanHelper 1.74 Denial of Service via Buffer Overflow (CVSS 6.9, Hainsoft LanHelper)
- [CVE-2019-25659](https://cve.now/CVE-2019-25659.md): ASPRunner Professional 6.0.766 Local Buffer Overflow DoS (CVSS 6.9, Xlinesoft ASPRunner Professional)
- [CVE-2019-25658](https://cve.now/CVE-2019-25658.md): a-Mac Address Change 5.4 Local Buffer Overflow DoS (CVSS 6.8, Amac Mac Address Change)
- [CVE-2019-25657](https://cve.now/CVE-2019-25657.md): AnyBurn 4.3 x86 Denial of Service via Image Conversion (CVSS 6.8, AnyBurn x86)
- [CVE-2019-25656](https://cve.now/CVE-2019-25656.md): R i386 3.5.0 Local Buffer Overflow SEH (CVSS 8.6, R-Project R i386)
- [CVE-2026-5596](https://cve.now/CVE-2026-5596.md): griptape-ai griptape SqlTool tool.py sql injection (CVSS 5.3, griptape-ai griptape)
- [CVE-2018-25256](https://cve.now/CVE-2018-25256.md): IP TOOLS 2.50 Local Buffer Overflow Denial of Service (CVSS 6.8, Ks-Soft IP TOOLS)
- [CVE-2026-5595](https://cve.now/CVE-2026-5595.md): griptape-ai griptape FileManagerTool save\_memory\_artifacts\_to\_disk path traversal (CVSS 5.3, griptape-ai griptape)
- [CVE-2026-5594](https://cve.now/CVE-2026-5594.md): premAI-io premsql followup.py eval code injection (CVSS 5.3, premAI-io premsql)
- [CVE-2026-5587](https://cve.now/CVE-2026-5587.md): wbbeyourself MAC-SQL Refiner Agent agents.py \_execute\_sql sql injection (CVSS 5.3, wbbeyourself MAC-SQL)
- [CVE-2026-5586](https://cve.now/CVE-2026-5586.md): zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection (CVSS 5.3, zhongyu09 openchatbi)
- [CVE-2026-5585](https://cve.now/CVE-2026-5585.md): Tencent AI-Infra-Guard Task Detail Endpoint task\_manager.go information disclosure (CVSS 6.9, Tencent AI-Infra-Guard)
- [CVE-2026-5584](https://cve.now/CVE-2026-5584.md): Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection (CVSS 6.9, Fosowl agenticSeek)
- [CVE-2026-5583](https://cve.now/CVE-2026-5583.md): PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-5580](https://cve.now/CVE-2026-5580.md): CodeAstro Online Classroom Parameter addvideos.php sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-5579](https://cve.now/CVE-2026-5579.md): CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-5578](https://cve.now/CVE-2026-5578.md): CodeAstro Online Classroom Parameter addassessment.php sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-5577](https://cve.now/CVE-2026-5577.md): Song-Li cross\_browser details Endpoint uniquemachine\_app.py sql injection (CVSS 6.9, Song-Li cross\_browser)
- [CVE-2026-5576](https://cve.now/CVE-2026-5576.md): SourceCodester/jkev Record Management System Add Employee save\_emp.php unrestricted upload (CVSS 5.1, SourceCodester Record Management System · jkev Record Manag…)
- [CVE-2026-5575](https://cve.now/CVE-2026-5575.md): SourceCodester/jkev Record Management System Login index.php sql injection (CVSS 6.9, SourceCodester Record Management System · jkev Record Manag…)
- [CVE-2026-5574](https://cve.now/CVE-2026-5574.md): Technostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorization (CVSS 6.9, Technostrobe HI-LED-WR120-G2)
- [CVE-2026-5573](https://cve.now/CVE-2026-5573.md): Technostrobe HI-LED-WR120-G2 fs unrestricted upload (CVSS 6.9, Technostrobe HI-LED-WR120-G2)
- [CVE-2026-5572](https://cve.now/CVE-2026-5572.md): Technostrobe HI-LED-WR120-G2 cross-site request forgery (CVSS 5.3, Technostrobe HI-LED-WR120-G2)
- [CVE-2026-5571](https://cve.now/CVE-2026-5571.md): Technostrobe HI-LED-WR120-G2 Configuration Data fs information disclosure (CVSS 6.9, Technostrobe HI-LED-WR120-G2)
- [CVE-2026-5570](https://cve.now/CVE-2026-5570.md): Technostrobe HI-LED-WR120-G2 LoginCB index\_config improper authentication (CVSS 6.9, Technostrobe HI-LED-WR120-G2)
- [CVE-2026-5569](https://cve.now/CVE-2026-5569.md): Technostrobe HI-LED-WR120-G2 Endpoint access control (CVSS 6.9, Technostrobe HI-LED-WR120-G2)
- [CVE-2026-5568](https://cve.now/CVE-2026-5568.md): Akaunting Invoice/Billing cross site scripting (CVSS 5.1, Akaunting)
- [CVE-2026-5567](https://cve.now/CVE-2026-5567.md): Tenda M3 Destination setAdvPolicyData buffer overflow (CVSS 8.7, Tenda M3)
- [CVE-2026-5599](https://cve.now/CVE-2026-5599.md): API allows deletion of users of other instance (CVSS 7.3, pretix Venueless)
- [CVE-2026-5566](https://cve.now/CVE-2026-5566.md): UTT HiPER 1250GW formNatStaticMap strcpy buffer overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-5565](https://cve.now/CVE-2026-5565.md): code-projects Simple Laundry System Parameter delmemberinfo.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-5564](https://cve.now/CVE-2026-5564.md): code-projects Simple Laundry System Parameter searchguest.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-5563](https://cve.now/CVE-2026-5563.md): AutohomeCorp frostmourne Alarm Preview previewData httpTest sql injection (CVSS 5.3, AutohomeCorp frostmourne)
- [CVE-2026-5562](https://cve.now/CVE-2026-5562.md): provectus kafka-ui Endpoint testexecutions validateAccess code injection (CVSS 6.9, provectus kafka-ui)
- [CVE-2026-5561](https://cve.now/CVE-2026-5561.md): Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injection (CVSS 5.3, Campcodes Complete POS Management and Inventory System)
- [CVE-2026-5560](https://cve.now/CVE-2026-5560.md): PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-5559](https://cve.now/CVE-2026-5559.md): AntaresMugisho PyBlade AST Validation sandbox.py \_is\_safe\_ast special elements used in a template engine (CVSS 5.3, AntaresMugisho PyBlade · pyblade)
- [CVE-2026-5558](https://cve.now/CVE-2026-5558.md): PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-5557](https://cve.now/CVE-2026-5557.md): badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass (CVSS 5.3, badlogic pi-mono)
- [CVE-2026-5556](https://cve.now/CVE-2026-5556.md): badlogic pi-mono loader.ts discoverAndLoadExtensions code injection (CVSS 5.3, badlogic pi-mono)
- [CVE-2026-5555](https://cve.now/CVE-2026-5555.md): code-projects Concert Ticket Reservation System Parameter login.php sql injection (CVSS 6.9, code-projects Concert Ticket Reservation System)
- [CVE-2026-5554](https://cve.now/CVE-2026-5554.md): code-projects Concert Ticket Reservation System Parameter process\_search.php sql injection (CVSS 6.9, code-projects Concert Ticket Reservation System)
- [CVE-2026-5553](https://cve.now/CVE-2026-5553.md): itsourcecode Online Cellphone System Parameter available.php sql injection (CVSS 5.3, itsourcecode Online Cellphone System)
- [CVE-2026-5552](https://cve.now/CVE-2026-5552.md): PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-5551](https://cve.now/CVE-2026-5551.md): itsourcecode Free Hotel Reservation System Parameter login.php sql injection (CVSS 6.9, itsourcecode Free Hotel Reservation System)
- [CVE-2026-5550](https://cve.now/CVE-2026-5550.md): Tenda AC10 httpd fromSysToolChangePwd stack-based overflow (CVSS 8.7, Tenda AC10)
- [CVE-2026-5549](https://cve.now/CVE-2026-5549.md): Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded key (CVSS 6.9, Tenda AC10)
- [CVE-2026-5548](https://cve.now/CVE-2026-5548.md): Tenda AC10 httpd fromSysToolChangePwd stack-based overflow (CVSS 8.7, Tenda AC10)
- [CVE-2026-5547](https://cve.now/CVE-2026-5547.md): Tenda AC10 httpd formAddMacfilterRule os command injection (CVSS 5.3, Tenda AC10)
- [CVE-2026-5546](https://cve.now/CVE-2026-5546.md): Campcodes Complete Online Learning Management System Crud\_model.php add\_lesson unrestricted upload (CVSS 5.3, Campcodes Complete Online Learning Management System)
- [CVE-2026-5544](https://cve.now/CVE-2026-5544.md): UTT HiPER 1250GW formRemoteControl stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-5543](https://cve.now/CVE-2026-5543.md): PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection (CVSS 5.3, PHPGurukul User Registration & Login and User Management Sy…)
- [CVE-2026-5542](https://cve.now/CVE-2026-5542.md): code-projects Simple Laundry System Parameter modstaffinfo.php cross site scripting (CVSS 5.3, code-projects Simple Laundry System)
- [CVE-2026-5541](https://cve.now/CVE-2026-5541.md): code-projects Simple Laundry System Parameter modmemberinfo.php cross site scripting (CVSS 5.3, code-projects Simple Laundry System)
- [CVE-2026-5540](https://cve.now/CVE-2026-5540.md): code-projects Simple Laundry System Parameter modifymember.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-5590](https://cve.now/CVE-2026-5590.md): net: ip/tcp: Null pointer dereference can be triggered by a race condition (CVSS 6.4, zephyrproject-rtos Zephyr)
- [CVE-2026-5539](https://cve.now/CVE-2026-5539.md): code-projects Simple Laundry System Parameter modifymember.php cross site scripting (CVSS 5.3, code-projects Simple Laundry System)
- [CVE-2026-5538](https://cve.now/CVE-2026-5538.md): QingdaoU OnlineJudge judge\_server\_heartbeat Endpoint JudgeServer.service\_url server-side request forgery (CVSS 5.3, QingdaoU OnlineJudge)
- [CVE-2026-5537](https://cve.now/CVE-2026-5537.md): halex CourseSEL HTTP GET Parameter IndexController.class.php check\_sel sql injection (CVSS 5.3, halex CourseSEL)
- [CVE-2026-5536](https://cve.now/CVE-2026-5536.md): FedML-AI FedML gRPC server grpc\_server.py sendMessage deserialization (CVSS 6.9, FedML-AI FedML)
- [CVE-2026-5535](https://cve.now/CVE-2026-5535.md): FedML-AI FedML MQTT Message FileUtils.java path traversal (CVSS 5.3, FedML-AI FedML)
- [CVE-2026-5534](https://cve.now/CVE-2026-5534.md): itsourcecode Online Enrollment System Parameter index.php sql injection (CVSS 6.9, itsourcecode Online Enrollment System)
- [CVE-2026-5533](https://cve.now/CVE-2026-5533.md): badlogic pi-mono SVG Artifact SvgArtifact.ts cross site scripting (CVSS 5.3, badlogic pi-mono)
- [CVE-2026-5532](https://cve.now/CVE-2026-5532.md): ScrapeGraphAI scrapegraph-ai GenerateCodeNode generate\_code\_node.py create\_sandbox\_and\_execute os command injection (CVSS 5.3, ScrapeGraphAI scrapegraph-ai)
- [CVE-2026-5531](https://cve.now/CVE-2026-5531.md): SourceCodester Student Result Management System HTTP GET Request login\_credentials.txt cleartext storage in file (CVSS 6.9, SourceCodester Student Result Management System)
- [CVE-2026-5530](https://cve.now/CVE-2026-5530.md): Ollama Model Pull API download.go server-side request forgery (CVSS 5.3, Ollama)
- [CVE-2026-5529](https://cve.now/CVE-2026-5529.md): Dromara lamp-cloud DefUserController pageUser improper authorization (CVSS 5.3, Dromara lamp-cloud)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.