CVEs published April 6, 2026
254 CVEs were published on April 6, 2026: 23 critical, 98 high.
- Published
- 254
- Critical
- 23
- High
- 98
- Medium
- 125
- Low
- 7
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 113
Most affected products
- Qualcomm Snapdragon
- 17
- directus
- 8
- LabRedesCefetRJ WeGIA
- 8
- Belkin F9K1015
- 7
- Cyber-III Student-Management-System
- 7
- Totolink A7100RU
- 7
- feehi/cms
- 6
- Linux
- 6
- PHPGurukul Online Shopping Portal Project
- 6
- WWBN AVideo · wwbn/avideo
- 6
Critical 23
- CVE-2026-35471Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshspatrickhener goshs · github.com/patrickhener/goshs
- CVE-2026-35393Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadpatrickhener goshs · github.com/patrickhener/goshs
- CVE-2026-35392goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Uploadpatrickhener goshs · github.com/patrickhener/goshs
- CVE-2026-35459pyLoad has SSRF fix bypass via HTTP redirectpyload · pyload-ng
- CVE-2026-35178Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversionforceworkbench
- CVE-2026-35174Chyrp Lite has a Path Traversal to Remote Code Executionxenocrat chyrp-lite
- CVE-2026-35171Arbitrary Code Execution via Malicious Logging Configuration in Kedrokedro-org kedro · kedro
- CVE-2026-35050text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".oobabooga text-generation-webui
- CVE-2026-35047Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor EndpointAjax30 BraveCMS-2.0
- CVE-2026-35039fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)nearform fast-jwt · fast-jwt
- CVE-2026-35030LiteLLM has an authentication bypass via OIDC userinfo cache key collisionBerriAI litellm · litellm
- CVE-2026-34989CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-34977Aperi'Solve Affected by Unauthenticated RCE via JPSeek Analyzer CommandZeecka AperiSolve
- CVE-2026-34976Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorizationdgraph-io dgraph · github.com/dgraph-io/dgraph/v25 +3
- CVE-2026-34841Axios npm Supply Chain Incident Impacting @usebruno/cliusebruno bruno · @usebruno/cli
- CVE-2026-34950fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Keynearform fast-jwt · fast-jwt
- CVE-2026-34208SandboxJS: Sandbox integrity escapenyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-26026GLPI has a Server-Side Template Injection via Double-Compilationglpi-project glpi
- CVE-2026-31405media: dvb-net: fix OOB access in ULE extension header tablesLinux
- CVE-2025-54328An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330
- CVE-2025-58349An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330,
- CVE-2026-31059A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attacker
- CVE-2026-31151An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources
High 98
- CVE-2026-5687Tenda CX12L NatStaticSetting fromNatStaticSetting stack-based overflowTenda CX12L
- CVE-2026-35454Code Extension Marketplace has a Zip Slip Path Traversalcoder code-marketplace · github.com/coder/code-marketplace
- CVE-2026-5686Tenda CX12L RouteStatic fromRouteStatic stack-based overflowTenda CX12L
- CVE-2026-35444SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loaderlibsdl-org SDL_image
- CVE-2026-35442Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queriesdirectus
- CVE-2026-35412Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwritedirectus
- CVE-2026-5709AWS Research and Engineering Studio (RES) FileBrowser Command InjectionAWS Research and Engineering Studio
- CVE-2026-35409Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Importdirectus
- CVE-2026-35408Directus is Missing Cross-Origin Opener Policydirectus
- CVE-2026-5685Tenda CX12L addressNat fromAddressNat stack-based overflowTenda CX12L
- CVE-2026-5708Improper Control of User-Modifiable Attributes in RES CreateSession APIAWS Research and Engineering Studio
- CVE-2026-5707Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)AWS Research and Engineering Studio
- CVE-2026-5684Tenda CX12L webExcptypemanFilter fromwebExcptypemanFilter stack-based overflowTenda CX12L
- CVE-2026-35399WeGIA has Stored XSS in backup file namesLabRedesCefetRJ WeGIA
- CVE-2026-35395WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameterLabRedesCefetRJ WeGIA
- CVE-2026-35394Mobile Next has Arbitrary Android Intent Execution via mobile_open_urlmobile-next mobile-mcp · @mobilenext/mobile-mcp
- CVE-2026-35391Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgerybulwarkmail webmail
- CVE-2026-35389Bulwark Webmail S/MIME signature verification accepted self-signed certificatesbulwarkmail webmail
- CVE-2026-35213Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsinghapijs content · @hapi/content
- CVE-2026-35203ZLMediaKit VP9 RTP Parser Out-of-Bounds ReadZLMediaKit
- CVE-2026-35187pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameterpyload · pyload-ng
- CVE-2026-35185HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresseshaxtheweb HAXiam
- CVE-2026-35184EcclesiaCRM has a Critical SQL Injectionphili67 ecclesiacrm
- CVE-2026-35183Brave CMS has an Insecure Direct Object Reference in Article Image DeletionAjax30 BraveCMS-2.0
- CVE-2026-35182Missing Authorization Privilege EscalationAjax30 BraveCMS-2.0
- CVE-2026-35172Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationdistribution · github.com/distribution/distribution +1
- CVE-2026-35176openFPGALoader has a heap buffer overflow in POFParser::parseSection() via crafted .pof filetrabucayre openFPGALoader
- CVE-2026-35170openFPGALoader has a heap buffer overflow in BitParser::parseHeader() via crafted .bit filetrabucayre openFPGALoader
- CVE-2026-35175Ajenti has an authorization bypass during custom package installationajenti · ajenti-panel
- CVE-2026-35167Kedro has a path traversal in versioned dataset loading via unsanitized version stringkedro-org kedro · kedro
- CVE-2026-35470OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modalsdevcode-it openstamanager · devcode-it/openstamanager
- CVE-2026-35164Brave CMS Sffected by Unrestricted File Upload via CKEditor EndpointAjax30 BraveCMS-2.0
- CVE-2026-35209defu: Prototype pollution via `__proto__` key in defaults argumentunjs defu · defu
- CVE-2026-35045Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized ModificationTandoorRecipes recipes
- CVE-2026-35044BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generationBentoML
- CVE-2026-35043BentoML: command injection in cloud deployment setup script (deployment.py)BentoML
- CVE-2026-35042fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)nearform fast-jwt · fast-jwt
- CVE-2026-35037Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadatalin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-35036Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Featurelin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-35035CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSSci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-35029LiteLLM affected by privilege escalation via unrestricted proxy configuration endpointBerriAI litellm · litellm
- CVE-2026-34992Missing Encryption of Sensitive Data in antrea.io/antreaantrea-io antrea · antrea.io/antrea
- CVE-2026-34986Go JOSE affect by a panic in JWE decryptiongo-jose · github.com/go-jose/go-jose/v4 +2
- CVE-2026-34975Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headersuseplunk plunk
- CVE-2026-34783Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websitesMontFerret ferret · github.com/MontFerret/ferret/v2 +1
- CVE-2026-34940KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model podskubeai-project kubeai · github.com/kubeai-project/kubeai
- CVE-2026-21382Buffer Copy Without Checking Size of Input in Power Management ICQualcomm Snapdragon
- CVE-2026-21381Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2026-21380Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2026-21378Buffer Over-read in CameraQualcomm Snapdragon
- CVE-2026-21376Buffer Over-read in CameraQualcomm Snapdragon
- CVE-2026-21375Buffer Over-read in CameraQualcomm Snapdragon
- CVE-2026-21374Buffer Over-read in CameraQualcomm Snapdragon
- CVE-2026-21373Buffer Over-read in CameraQualcomm Snapdragon
- CVE-2026-21372Heap-Based Buffer Overflow in Power Management ICQualcomm Snapdragon
- CVE-2026-21371Buffer Over-read in WinBlast DriverQualcomm Snapdragon
- CVE-2026-21367Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2025-47400Buffer Over-read in Computer VisionQualcomm Snapdragon
- CVE-2025-47392Integer Overflow or Wraparound in GPSQualcomm Snapdragon
- CVE-2025-47391Stack-based Buffer Overflow in Camera DriverQualcomm Snapdragon
- CVE-2025-47390Buffer Over-read in CameraQualcomm Snapdragon
- CVE-2025-47389Buffer Copy Without Checking Size of Input in Automotive PlatformQualcomm Snapdragon
- CVE-2024-14032Twitch Studio LauncherHelper XPC Missing Authorization to Root File WriteTwitch Studio
- CVE-2026-34589OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds WriteAcademySoftwareFoundation openexr · openexr
- CVE-2026-34588OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/WriteAcademySoftwareFoundation openexr · openexr
- CVE-2026-34444Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattrscoder lupa · lupa
- CVE-2026-34379OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)AcademySoftwareFoundation openexr
- CVE-2026-34982Vim modeline bypass via various options affects Vim < 9.2.0276vim
- CVE-2026-34148Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution@fedify fedify · @fedify vocab-runtime +2
- CVE-2026-33752Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)lexiforest curl_cffi · curl-cffi
- CVE-2026-33540Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realmdistribution · github.com/distribution/distribution/v3 +1
- CVE-2026-33510DOM-Based XSS in Homarr /auth/login Redirecthomarr-labs homarr
- CVE-2026-34885WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-29047GLPI has an Authenticated SQL Injection via log exportsglpi-project glpi
- CVE-2026-26263GLPI has an Unauthenticated SQL Injection via Search engineglpi-project glpi
- CVE-2026-26027GLPI has an Unauthenticated Stored XSS via inventoryglpi-project glpi
- CVE-2026-25932GLPI has Stored XSS in Supplier 'Website' fieldglpi-project glpi
- CVE-2026-3524Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission CheckMattermost
- CVE-2026-31409ksmbd: unset conn->binding on failed binding requestLinux
- CVE-2026-31408Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_holdLinux
- CVE-2026-31407netfilter: conntrack: add missing netlink policy validationsLinux
- CVE-2026-31406xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()Linux
- CVE-2026-5629Belkin F9K1015 formSetFirewall stack-based overflowBelkin F9K1015
- CVE-2026-5628Belkin F9K1015 Setting formSetSystemSettings stack-based overflowBelkin F9K1015
- CVE-2026-5614Belkin F9K1015 formSetPassword stack-based overflowBelkin F9K1015
- CVE-2026-5613Belkin F9K1015 formReboot stack-based overflowBelkin F9K1015
- CVE-2026-5612Belkin F9K1015 formWlEncrypt stack-based overflowBelkin F9K1015
- CVE-2026-5611Belkin F9K1015 formCrossBandSwitch stack-based overflowBelkin F9K1015
- CVE-2026-5610Belkin F9K1015 formWISP5G stack-based overflowBelkin F9K1015
- CVE-2026-5609Tenda i12 Parameter wifiSSIDset formwrlSSIDset stack-based overflowTenda i12
- CVE-2026-5608Belkin F9K1122 formWlanSetup stack-based overflowBelkin F9K1122
- CVE-2025-54324An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330
- CVE-2025-54601An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-54602An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-57834An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980, 850, 990, 1080, 2100, 1280, 2200, 1330, 1380
- CVE-2025-57835An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330
- CVE-2025-59440An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 133
- CVE-2026-30078OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type.
Medium, low and unrated 133
- CVE-2026-5705code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scriptingcode-projects Online Hotel Booking
- CVE-2026-5692Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injectionTotolink A7100RU
- CVE-2026-5691Totolink A7100RU cstecgi.cgi setFirewallType os command injectionTotolink A7100RU
- CVE-2026-5690Totolink A7100RU cstecgi.cgi setRemoteCfg os command injectionTotolink A7100RU
- CVE-2026-5689Totolink A7100RU cstecgi.cgi setNtpCfg os command injectionTotolink A7100RU
- CVE-2026-5688Totolink A7100RU cstecgi.cgi setDdnsCfg os command injectionTotolink A7100RU
- CVE-2026-35452WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.phpWWBN AVideo · wwbn/avideo
- CVE-2026-35450WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-35449WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.phpWWBN AVideo · wwbn/avideo
- CVE-2026-35448WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.phpWWBN AVideo · wwbn/avideo
- CVE-2026-35441Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limitsdirectus
- CVE-2026-35413Directus GraphQL Schema SDL Disclosure Settingdirectus
- CVE-2026-35411Directus is an Open Redirect in Admin 2FA Setup Pagedirectus
- CVE-2026-35410Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flowdirectus
- CVE-2026-35404Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameteropenedx-platform
- CVE-2026-22675OCS Inventory NG Server Stored XSS via User-AgentOCS Inventory NG Server
- CVE-2026-35475WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect']LabRedesCefetRJ WeGIA
- CVE-2026-35474WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect']LabRedesCefetRJ WeGIA
- CVE-2026-35473WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage']LabRedesCefetRJ WeGIA
- CVE-2026-35472WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage']LabRedesCefetRJ WeGIA
- CVE-2026-35398WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage']LabRedesCefetRJ WeGIA
- CVE-2026-35396WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage']LabRedesCefetRJ WeGIA
- CVE-2026-34972OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collisionopenfga · github.com/openfga/openfga
- CVE-2026-5683Tenda CX12L P2pListFilter fromP2pListFilter stack-based overflowTenda CX12L
- CVE-2026-35390Content-Security-Policy was set to Report-Only mode, failing to block XSS attacksbulwarkmail webmail
- CVE-2026-35208lichess.org has an Unsanitized Stream Title Injection on /streamerlichess-org lila
- CVE-2026-35201Discount has an Out-of-bounds Read in rdiscountdavidfstr rdiscount · rdiscount
- CVE-2026-35200Parse Server has a file upload Content-Type override via extension mismatchparse-community parse-server · parse-server
- CVE-2026-5682Meesho Online Shopping App com.meesho.supply endpoint risky encryptionMeesho Online Shopping App
- CVE-2026-35199SymCrypt SymCryptXmssSign function - Heap overflow via 64->32-bit leaf-count truncationmicrosoft SymCrypt
- CVE-2026-35197Code injection in dye template expressionsmattieb dye
- CVE-2026-5681itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injectionitsourcecode sanitize or validate this input
- CVE-2026-35181WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-35180WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File WriteWWBN AVideo
- CVE-2026-35179WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.phpWWBN AVideo · wwbn/avideo
- CVE-2026-5679Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injectionTotolink A3300R
- CVE-2026-5678Totolink A7100RU cstecgi.cgi setScheduleCfg os command injectionTotolink A7100RU
- CVE-2026-5677Totolink A7100RU cstecgi.cgi CsteSystem os command injectionTotolink A7100RU
- CVE-2026-0049In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion.Google Android
- CVE-2025-48651In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validatioGoogle Android
- CVE-2026-5676Totolink A8000R cstecgi.cgi setLanguageCfg missing authenticationTotolink A8000R
- CVE-2026-5675itsourcecode Construction Management System Parameter borrowed_tool.php sql injectionitsourcecode Construction Management System
- CVE-2026-35177Path traversal issue with zip.vim in Vimvim
- CVE-2026-35173Chyrp Lite has an IDOR via Mass Assignment in Post Modelxenocrat chyrp-lite
- CVE-2026-5672code-projects Simple IT Discussion Forum Parameter edit-category.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-35166Hugo does not properly escape some Markdown linksgohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-35052D-Tale affected by Remote Code Execution through redis/shelf storageman-group dtale · dtale
- CVE-2026-35046Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)TandoorRecipes recipes
- CVE-2026-5671Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scriptingCyber-III Student-Management-System
- CVE-2026-5670Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted uploadCyber-III Student-Management-System
- CVE-2026-5669Cyber-III Student-Management-System Parameter login.php sql injectionCyber-III Student-Management-System
- CVE-2026-34981whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3pavelzbornik whisperX-FastAPI
- CVE-2026-5668Cyber-III Student-Management-System add%20notice.php cross site scriptingCyber-III Student-Management-System
- CVE-2026-34969Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callbacknhost · github.com/nhost/nhost
- CVE-2026-34951Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessionsforceworkbench
- CVE-2026-34764Electron has a use-after-free in offscreen shared texture release() callbackelectron
- CVE-2026-34756vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Servervllm-project vllm · vllm
- CVE-2026-34755vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processingvllm-project vllm · vllm
- CVE-2026-34753vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `vllm-project vllm · vllm
- CVE-2025-47374Use After Free in Camera DriverQualcomm Snapdragon
- CVE-2026-5666code-projects Online FIR System SQL Database Backup File complaints.sql sensitive informationcode-projects Online FIR System
- CVE-2026-33405Pi-hole has a Stored HTML Injection in queries.jspi-hole web
- CVE-2026-34380OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompressionAcademySoftwareFoundation openexr
- CVE-2026-34378OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.xAcademySoftwareFoundation openexr
- CVE-2026-5704Tar: tar: hidden file injection via crafted archivesRed Hat Enterprise Linux · Red Hat Discovery +2
- CVE-2026-5665code-projects Online FIR System Login checklogin.php sql injectioncode-projects Online FIR System
- CVE-2026-34217SandboxJS has a Sandbox Escape via Prop Object Leak in New Handlernyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-34211SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parsernyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-33727Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).pi-hole
- CVE-2026-34897WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-33406Pi-hole has a Stored HTML attribute injectionpi-hole web
- CVE-2026-33404Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboardpi-hole web
- CVE-2026-33403Pi-hole has a Reflected XSS / HTML injection in taillog.jspi-hole web
- CVE-2026-32602Homarr has a Race Condition in Invite Token Registration (TOCTOU)homarr-labs homarr
- CVE-2026-5663OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injectionOFFIS DCMTK
- CVE-2026-5661Free5GC NGSetupRequest denial of serviceFree5GC
- CVE-2026-5660itsourcecode Construction Management System Parameter borrowed_equip.php sql injectionitsourcecode Construction Management System
- CVE-2026-5659pytries datrie trie File datrie.pyx Trie.__setstate__ deserializationpytries datrie
- CVE-2026-5650code-projects Online Application System for Admission oas.sql sensitive informationcode-projects Online Application System for Admission
- CVE-2026-5649code-projects Online Application System for Admission Endpoint admsnform.php sql injectioncode-projects Online Application System for Admission
- CVE-2026-5648code-projects Simple Laundry System Parameter userfinishregister.php sql injectioncode-projects Simple Laundry System
- CVE-2026-5647code-projects Online Shoe Store Add Product admin_feature.php cross site scriptingcode-projects Online Shoe Store
- CVE-2026-5646code-projects Easy Blog Site login.php sql injectioncode-projects Easy Blog Site
- CVE-2026-5645projectworlds Car Rental System Parameter pay.php sql injectionprojectworlds Car Rental System
- CVE-2026-5644Cyber-III Student-Management-System batch-notice.php cross site scriptingCyber-III Student-Management-System
- CVE-2026-5643Cyber-III Student-Management-System Admin Add Endpoint notice.php cross site scriptingCyber-III Student-Management-System
- CVE-2026-5642Cyber-III Student-Management-System HTTP POST Request update.php improper authorizationCyber-III Student-Management-System
- CVE-2026-5673Libtheora: libtheora: denial of service or information disclosure via malformed avi file processingRed Hat Enterprise Linux
- CVE-2026-5641PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-5640PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-5639PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-37977Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claimRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-5638HerikLyma CPPWebFramework path traversalHerikLyma CPPWebFramework
- CVE-2026-5637projectworlds Car Rental System Parameter message_admin.php sql injectionprojectworlds Car Rental System
- CVE-2026-5636PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-5635PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2026-31410ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATIONLinux
- CVE-2026-5634projectworlds Car Rental Project Parameter book_car.php sql injectionprojectworlds Car Rental Project
- CVE-2026-5633assafelovic gpt-researcher ws Endpoint server-side request forgeryassafelovic gpt-researcher
- CVE-2026-5632assafelovic gpt-researcher HTTP REST API Endpoint missing authenticationassafelovic gpt-researcher
- CVE-2026-5631assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injectionassafelovic gpt-researcher
- CVE-2026-5630assafelovic gpt-researcher Report API app.py cross site scriptingassafelovic gpt-researcher
- CVE-2026-5625assafelovic gpt-researcher WebSocket researcher.py cross site scriptingassafelovic gpt-researcher
- CVE-2026-5624ProjectSend upload.php cross-site request forgeryProjectSend
- CVE-2026-5623hcengineering Huly Platform Import Endpoint index.ts server-side request forgeryhcengineering Huly Platform
- CVE-2026-5622hcengineering Huly Platform JWT Token token.ts hard-coded keyhcengineering Huly Platform
- CVE-2026-5621ChrisChinchilla Vale-MCP HTTP index.ts os command injectionChrisChinchilla Vale-MCP
- CVE-2026-5620itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injectionitsourcecode Construction Management System
- CVE-2026-5619Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injectionBraffolk mcp-summarization-functions
- CVE-2026-5618kalcaddle kodbox shareMake/shareCheck server-side request forgerykalcaddle kodbox
- CVE-2026-5616JeecgBoot AI Chat JeecgBizToolsProvider.java missing authenticationJeecgBoot
- CVE-2026-5615givanz Vvvebjs File Upload Endpoint upload.php cross site scriptinggivanz Vvvebjs
- CVE-2026-5607imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgeryimprvhub mcp-browser-agent
- CVE-2026-5606PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2025-61166An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL.
- CVE-2026-30613An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth Enabled Software Version: 1.1.9 due to i
- CVE-2026-31053A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record().
- CVE-2026-31058UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the timeRangeName parameter of the formConfigDnsFil
- CVE-2026-31060UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the notes parameter of the formGroupConfig function
- CVE-2026-31061UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the timestart parameter of the ConfigAdvideo functi
- CVE-2026-31062UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the filename parameter of the formFtpServerDirConfig func
- CVE-2026-31063UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the pools parameter of the formArpBindConfig functi
- CVE-2026-31065UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formConfigCliForEngineerO
- CVE-2026-31066UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the selDateType parameter of the formTaskEdit funct
- CVE-2026-31067A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows att
- CVE-2026-31150Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's da
- CVE-2026-31153A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTML
- CVE-2026-31313An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execfeehi/cms
- CVE-2026-31350An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTfeehi/cms
- CVE-2026-31351An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execfeehi/cms
- CVE-2026-31352An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execufeehi/cms
- CVE-2026-31353An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbifeehi/cms
- CVE-2026-31354Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to efeehi/cms