# CVEs published 2026-04-06

254 CVEs were published on April 6, 2026: 23 critical, 98 high. Days are UTC.

- [CVE-2026-5705](https://cve.now/CVE-2026-5705.md): code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting (CVSS 5.3, code-projects Online Hotel Booking)
- [CVE-2026-5692](https://cve.now/CVE-2026-5692.md): Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection (CVSS 6.9, Totolink A7100RU)
- [CVE-2026-5691](https://cve.now/CVE-2026-5691.md): Totolink A7100RU cstecgi.cgi setFirewallType os command injection (CVSS 6.9, Totolink A7100RU)
- [CVE-2026-5690](https://cve.now/CVE-2026-5690.md): Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection (CVSS 6.9, Totolink A7100RU)
- [CVE-2026-5689](https://cve.now/CVE-2026-5689.md): Totolink A7100RU cstecgi.cgi setNtpCfg os command injection (CVSS 6.9, Totolink A7100RU)
- [CVE-2026-5688](https://cve.now/CVE-2026-5688.md): Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection (CVSS 6.9, Totolink A7100RU)
- [CVE-2026-5687](https://cve.now/CVE-2026-5687.md): Tenda CX12L NatStaticSetting fromNatStaticSetting stack-based overflow (CVSS 8.7, Tenda CX12L)
- [CVE-2026-35454](https://cve.now/CVE-2026-35454.md): Code Extension Marketplace has a Zip Slip Path Traversal (CVSS 8.7, coder code-marketplace · github.com/coder/code-marketplace)
- [CVE-2026-35452](https://cve.now/CVE-2026-35452.md): WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-35450](https://cve.now/CVE-2026-35450.md): WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-35449](https://cve.now/CVE-2026-35449.md): WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-5686](https://cve.now/CVE-2026-5686.md): Tenda CX12L RouteStatic fromRouteStatic stack-based overflow (CVSS 8.7, Tenda CX12L)
- [CVE-2026-35448](https://cve.now/CVE-2026-35448.md): WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php (CVSS 3.7, WWBN AVideo · wwbn/avideo)
- [CVE-2026-35444](https://cve.now/CVE-2026-35444.md): SDL\_image has a heap buffer overflow READ via unchecked colormap index in XCF loader (CVSS 7.1, libsdl-org SDL\_image)
- [CVE-2026-35471](https://cve.now/CVE-2026-35471.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs (CVSS 9.8, patrickhener goshs · github.com/patrickhener/goshs)
- [CVE-2026-35442](https://cve.now/CVE-2026-35442.md): Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries (CVSS 8.1, directus)
- [CVE-2026-35441](https://cve.now/CVE-2026-35441.md): Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits (CVSS 6.5, directus)
- [CVE-2026-35413](https://cve.now/CVE-2026-35413.md): Directus GraphQL Schema SDL Disclosure Setting (CVSS 5.3, directus)
- [CVE-2026-35412](https://cve.now/CVE-2026-35412.md): Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite (CVSS 7.1, directus)
- [CVE-2026-35411](https://cve.now/CVE-2026-35411.md): Directus is an Open Redirect in Admin 2FA Setup Page (CVSS 4.3, directus)
- [CVE-2026-35410](https://cve.now/CVE-2026-35410.md): Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow (CVSS 6.1, directus)
- [CVE-2026-5709](https://cve.now/CVE-2026-5709.md): AWS Research and Engineering Studio (RES) FileBrowser Command Injection (CVSS 8.8, AWS Research and Engineering Studio)
- [CVE-2026-35409](https://cve.now/CVE-2026-35409.md): Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import (CVSS 7.7, directus)
- [CVE-2026-35408](https://cve.now/CVE-2026-35408.md): Directus is Missing Cross-Origin Opener Policy (CVSS 8.7, directus)
- [CVE-2026-5685](https://cve.now/CVE-2026-5685.md): Tenda CX12L addressNat fromAddressNat stack-based overflow (CVSS 8.7, Tenda CX12L)
- [CVE-2026-5708](https://cve.now/CVE-2026-5708.md): Improper Control of User-Modifiable Attributes in RES CreateSession API (CVSS 8.8, AWS Research and Engineering Studio)
- [CVE-2026-5707](https://cve.now/CVE-2026-5707.md): Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES) (CVSS 8.8, AWS Research and Engineering Studio)
- [CVE-2026-35404](https://cve.now/CVE-2026-35404.md): Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect\_url Parameter (CVSS 4.7, openedx-platform)
- [CVE-2026-22675](https://cve.now/CVE-2026-22675.md): OCS Inventory NG Server Stored XSS via User-Agent (CVSS 5.1, OCS Inventory NG Server)
- [CVE-2026-35475](https://cve.now/CVE-2026-35475.md): WeGIA - Open Redirect - backup redirection — Unvalidated $\_GET\['redirect'\] (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-5684](https://cve.now/CVE-2026-5684.md): Tenda CX12L webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow (CVSS 8.6, Tenda CX12L)
- [CVE-2026-35474](https://cve.now/CVE-2026-35474.md): WeGIA - Open Redirect - atualizacao redirection - Unvalidated $\_GET\['redirect'\] (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-35473](https://cve.now/CVE-2026-35473.md): WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-35399](https://cve.now/CVE-2026-35399.md): WeGIA has Stored XSS in backup file names (CVSS 8.5, LabRedesCefetRJ WeGIA)
- [CVE-2026-35472](https://cve.now/CVE-2026-35472.md): WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-35398](https://cve.now/CVE-2026-35398.md): WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId\_Nome() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-35396](https://cve.now/CVE-2026-35396.md): WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-35395](https://cve.now/CVE-2026-35395.md): WeGIA has a SQL Injection in DespachoDAO.php via id\_memorando parameter (CVSS 8.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-35394](https://cve.now/CVE-2026-35394.md): Mobile Next has Arbitrary Android Intent Execution via mobile\_open\_url (CVSS 8.3, mobile-next mobile-mcp · @mobilenext/mobile-mcp)
- [CVE-2026-35393](https://cve.now/CVE-2026-35393.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload (CVSS 9.8, patrickhener goshs · github.com/patrickhener/goshs)
- [CVE-2026-35392](https://cve.now/CVE-2026-35392.md): goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload (CVSS 9.8, patrickhener goshs · github.com/patrickhener/goshs)
- [CVE-2026-34972](https://cve.now/CVE-2026-34972.md): OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision (CVSS 5.0, openfga · github.com/openfga/openfga)
- [CVE-2026-5683](https://cve.now/CVE-2026-5683.md): Tenda CX12L P2pListFilter fromP2pListFilter stack-based overflow (CVSS 5.1, Tenda CX12L)
- [CVE-2026-35391](https://cve.now/CVE-2026-35391.md): Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery (CVSS 8.7, bulwarkmail webmail)
- [CVE-2026-35390](https://cve.now/CVE-2026-35390.md): Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks (CVSS 5.3, bulwarkmail webmail)
- [CVE-2026-35389](https://cve.now/CVE-2026-35389.md): Bulwark Webmail S/MIME signature verification accepted self-signed certificates (CVSS 8.7, bulwarkmail webmail)
- [CVE-2026-35213](https://cve.now/CVE-2026-35213.md): Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing (CVSS 8.7, hapijs content · @hapi/content)
- [CVE-2026-35208](https://cve.now/CVE-2026-35208.md): lichess.org has an Unsanitized Stream Title Injection on /streamer (CVSS 5.3, lichess-org lila)
- [CVE-2026-35203](https://cve.now/CVE-2026-35203.md): ZLMediaKit VP9 RTP Parser Out-of-Bounds Read (CVSS 7.5, ZLMediaKit)
- [CVE-2026-35201](https://cve.now/CVE-2026-35201.md): Discount has an Out-of-bounds Read in rdiscount (CVSS 5.9, davidfstr rdiscount · rdiscount)
- [CVE-2026-35200](https://cve.now/CVE-2026-35200.md): Parse Server has a file upload Content-Type override via extension mismatch (CVSS 2.1, parse-community parse-server · parse-server)
- [CVE-2026-5682](https://cve.now/CVE-2026-5682.md): Meesho Online Shopping App com.meesho.supply endpoint risky encryption (CVSS 6.3, Meesho Online Shopping App)
- [CVE-2026-35199](https://cve.now/CVE-2026-35199.md): SymCrypt SymCryptXmssSign function - Heap overflow via 64-\>32-bit leaf-count truncation (CVSS 6.1, microsoft SymCrypt)
- [CVE-2026-35197](https://cve.now/CVE-2026-35197.md): Code injection in dye template expressions (CVSS 6.6, mattieb dye)
- [CVE-2026-35459](https://cve.now/CVE-2026-35459.md): pyLoad has SSRF fix bypass via HTTP redirect (CVSS 9.3, pyload · pyload-ng)
- [CVE-2026-35187](https://cve.now/CVE-2026-35187.md): pyLoad has SSRF in parse\_urls API endpoint via unvalidated URL parameter (CVSS 7.7, pyload · pyload-ng)
- [CVE-2026-35185](https://cve.now/CVE-2026-35185.md): HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses (CVSS 8.7, haxtheweb HAXiam)
- [CVE-2026-35184](https://cve.now/CVE-2026-35184.md): EcclesiaCRM has a Critical SQL Injection (CVSS 8.7, phili67 ecclesiacrm)
- [CVE-2026-5681](https://cve.now/CVE-2026-5681.md): itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection (CVSS 5.3, itsourcecode sanitize or validate this input)
- [CVE-2026-35183](https://cve.now/CVE-2026-35183.md): Brave CMS has an Insecure Direct Object Reference in Article Image Deletion (CVSS 7.1, Ajax30 BraveCMS-2.0)
- [CVE-2026-35182](https://cve.now/CVE-2026-35182.md): Missing Authorization Privilege Escalation (CVSS 8.8, Ajax30 BraveCMS-2.0)
- [CVE-2026-35181](https://cve.now/CVE-2026-35181.md): WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php (CVSS 4.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-35172](https://cve.now/CVE-2026-35172.md): Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation (CVSS 7.5, distribution · github.com/distribution/distribution +1)
- [CVE-2026-35180](https://cve.now/CVE-2026-35180.md): WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write (CVSS 4.3, WWBN AVideo)
- [CVE-2026-35179](https://cve.now/CVE-2026-35179.md): WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-35178](https://cve.now/CVE-2026-35178.md): Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion (CVSS 9.3, forceworkbench)
- [CVE-2026-5679](https://cve.now/CVE-2026-5679.md): Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection (CVSS 5.1, Totolink A3300R)
- [CVE-2026-35176](https://cve.now/CVE-2026-35176.md): openFPGALoader has a heap buffer overflow in POFParser::parseSection() via crafted .pof file (CVSS 7.1, trabucayre openFPGALoader)
- [CVE-2026-35170](https://cve.now/CVE-2026-35170.md): openFPGALoader has a heap buffer overflow in BitParser::parseHeader() via crafted .bit file (CVSS 7.1, trabucayre openFPGALoader)
- [CVE-2026-5678](https://cve.now/CVE-2026-5678.md): Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection (CVSS 6.9, Totolink A7100RU)
- [CVE-2026-5677](https://cve.now/CVE-2026-5677.md): Totolink A7100RU cstecgi.cgi CsteSystem os command injection (CVSS 6.9, Totolink A7100RU)
- [CVE-2026-0049](https://cve.now/CVE-2026-0049.md): In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. (CVSS 6.2, Google Android)
- [CVE-2025-48651](https://cve.now/CVE-2025-48651.md): In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validatio (CVSS 4.0, Google Android)
- [CVE-2026-5676](https://cve.now/CVE-2026-5676.md): Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication (CVSS 6.9, Totolink A8000R)
- [CVE-2026-5675](https://cve.now/CVE-2026-5675.md): itsourcecode Construction Management System Parameter borrowed\_tool.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2026-35177](https://cve.now/CVE-2026-35177.md): Path traversal issue with zip.vim in Vim (CVSS 4.1, vim)
- [CVE-2026-35175](https://cve.now/CVE-2026-35175.md): Ajenti has an authorization bypass during custom package installation (CVSS 7.2, ajenti · ajenti-panel)
- [CVE-2026-35174](https://cve.now/CVE-2026-35174.md): Chyrp Lite has a Path Traversal to Remote Code Execution (CVSS 9.1, xenocrat chyrp-lite)
- [CVE-2026-35173](https://cve.now/CVE-2026-35173.md): Chyrp Lite has an IDOR via Mass Assignment in Post Model (CVSS 6.5, xenocrat chyrp-lite)
- [CVE-2026-35171](https://cve.now/CVE-2026-35171.md): Arbitrary Code Execution via Malicious Logging Configuration in Kedro (CVSS 9.8, kedro-org kedro · kedro)
- [CVE-2026-5672](https://cve.now/CVE-2026-5672.md): code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-35167](https://cve.now/CVE-2026-35167.md): Kedro has a path traversal in versioned dataset loading via unsanitized version string (CVSS 7.1, kedro-org kedro · kedro)
- [CVE-2026-35470](https://cve.now/CVE-2026-35470.md): OpenSTAManager has a SQL Injection via righe Parameter in confronta\_righe Modals (CVSS 8.8, devcode-it openstamanager · devcode-it/openstamanager)
- [CVE-2026-35166](https://cve.now/CVE-2026-35166.md): Hugo does not properly escape some Markdown links (CVSS 5.3, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-35164](https://cve.now/CVE-2026-35164.md): Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint (CVSS 8.8, Ajax30 BraveCMS-2.0)
- [CVE-2026-35052](https://cve.now/CVE-2026-35052.md): D-Tale affected by Remote Code Execution through redis/shelf storage (CVSS 5.3, man-group dtale · dtale)
- [CVE-2026-35050](https://cve.now/CVE-2026-35050.md): text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -\> Save extention settings to user\_data/settings.yaml". (CVSS 9.1, oobabooga text-generation-webui)
- [CVE-2026-35209](https://cve.now/CVE-2026-35209.md): defu: Prototype pollution via \`\_\_proto\_\_\` key in defaults argument (CVSS 7.5, unjs defu · defu)
- [CVE-2026-35047](https://cve.now/CVE-2026-35047.md): Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint (CVSS 9.3, Ajax30 BraveCMS-2.0)
- [CVE-2026-35046](https://cve.now/CVE-2026-35046.md): Tandoor has a Stored CSS Injection via \<style\> Tag in Recipe Instructions (API-Level) (CVSS 5.4, TandoorRecipes recipes)
- [CVE-2026-35045](https://cve.now/CVE-2026-35045.md): Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification (CVSS 8.1, TandoorRecipes recipes)
- [CVE-2026-5671](https://cve.now/CVE-2026-5671.md): Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete\_batch.php cross site scripting (CVSS 5.3, Cyber-III Student-Management-System)
- [CVE-2026-35044](https://cve.now/CVE-2026-35044.md): BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation (CVSS 8.8, BentoML)
- [CVE-2026-35043](https://cve.now/CVE-2026-35043.md): BentoML: command injection in cloud deployment setup script (deployment.py) (CVSS 7.8, BentoML)
- [CVE-2026-35042](https://cve.now/CVE-2026-35042.md): fast-jwt accepts unknown \`crit\` header extensions (RFC 7515 §4.1.11 MUST violation) (CVSS 7.5, nearform fast-jwt · fast-jwt)
- [CVE-2026-35039](https://cve.now/CVE-2026-35039.md): fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) (CVSS 9.1, nearform fast-jwt · fast-jwt)
- [CVE-2026-35037](https://cve.now/CVE-2026-35037.md): Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata (CVSS 7.2, lin-snow Ech0 · github.com/lin-snow/ech0)
- [CVE-2026-35036](https://cve.now/CVE-2026-35036.md): Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature (CVSS 7.5, lin-snow Ech0 · github.com/lin-snow/ech0)
- [CVE-2026-35035](https://cve.now/CVE-2026-35035.md): CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS (CVSS 7.2, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-35030](https://cve.now/CVE-2026-35030.md): LiteLLM has an authentication bypass via OIDC userinfo cache key collision (CVSS 9.4, BerriAI litellm · litellm)
- [CVE-2026-5670](https://cve.now/CVE-2026-5670.md): Cyber-III Student-Management-System upload.php move\_uploaded\_file unrestricted upload (CVSS 5.3, Cyber-III Student-Management-System)
- [CVE-2026-35029](https://cve.now/CVE-2026-35029.md): LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint (CVSS 8.7, BerriAI litellm · litellm)
- [CVE-2026-34992](https://cve.now/CVE-2026-34992.md): Missing Encryption of Sensitive Data in antrea.io/antrea (CVSS 7.1, antrea-io antrea · antrea.io/antrea)
- [CVE-2026-5669](https://cve.now/CVE-2026-5669.md): Cyber-III Student-Management-System Parameter login.php sql injection (CVSS 6.9, Cyber-III Student-Management-System)
- [CVE-2026-34989](https://cve.now/CVE-2026-34989.md): CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (CVSS 9.4, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-34986](https://cve.now/CVE-2026-34986.md): Go JOSE affect by a panic in JWE decryption (CVSS 7.5, go-jose · github.com/go-jose/go-jose/v4 +2)
- [CVE-2026-34981](https://cve.now/CVE-2026-34981.md): whisperX REST API: SSRF in download\_from\_url() — URL validation happens after HTTP request, extension bypass via .mp3 (CVSS 5.8, pavelzbornik whisperX-FastAPI)
- [CVE-2026-34977](https://cve.now/CVE-2026-34977.md): Aperi'Solve Affected by Unauthenticated RCE via JPSeek Analyzer Command (CVSS 9.3, Zeecka AperiSolve)
- [CVE-2026-5668](https://cve.now/CVE-2026-5668.md): Cyber-III Student-Management-System add%20notice.php cross site scripting (CVSS 4.8, Cyber-III Student-Management-System)
- [CVE-2026-34976](https://cve.now/CVE-2026-34976.md): Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization (CVSS 10.0, dgraph-io dgraph · github.com/dgraph-io/dgraph/v25 +3)
- [CVE-2026-34975](https://cve.now/CVE-2026-34975.md): Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers (CVSS 8.5, useplunk plunk)
- [CVE-2026-34841](https://cve.now/CVE-2026-34841.md): Axios npm Supply Chain Incident Impacting @usebruno/cli (CVSS 9.8, usebruno bruno · @usebruno/cli)
- [CVE-2026-34783](https://cve.now/CVE-2026-34783.md): Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites (CVSS 8.1, MontFerret ferret · github.com/MontFerret/ferret/v2 +1)
- [CVE-2026-34969](https://cve.now/CVE-2026-34969.md): Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback (CVSS 2.3, nhost · github.com/nhost/nhost)
- [CVE-2026-34951](https://cve.now/CVE-2026-34951.md): Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions (CVSS 5.1, forceworkbench)
- [CVE-2026-34950](https://cve.now/CVE-2026-34950.md): fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key (CVSS 9.1, nearform fast-jwt · fast-jwt)
- [CVE-2026-34940](https://cve.now/CVE-2026-34940.md): KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods (CVSS 8.7, kubeai-project kubeai · github.com/kubeai-project/kubeai)
- [CVE-2026-34764](https://cve.now/CVE-2026-34764.md): Electron has a use-after-free in offscreen shared texture release() callback (CVSS 2.3, electron)
- [CVE-2026-34756](https://cve.now/CVE-2026-34756.md): vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded \`n\` Parameter in OpenAI API Server (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-34755](https://cve.now/CVE-2026-34755.md): vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-34753](https://cve.now/CVE-2026-34753.md): vLLM affected by Server-Side Request Forgery (SSRF) in \`download\_bytes\_from\_url \` (CVSS 5.4, vllm-project vllm · vllm)
- [CVE-2026-21382](https://cve.now/CVE-2026-21382.md): Buffer Copy Without Checking Size of Input in Power Management IC (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21381](https://cve.now/CVE-2026-21381.md): Buffer Over-read in WLAN Firmware (CVSS 7.6, Qualcomm Snapdragon)
- [CVE-2026-21380](https://cve.now/CVE-2026-21380.md): Use After Free in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21378](https://cve.now/CVE-2026-21378.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21376](https://cve.now/CVE-2026-21376.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21375](https://cve.now/CVE-2026-21375.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21374](https://cve.now/CVE-2026-21374.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21373](https://cve.now/CVE-2026-21373.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21372](https://cve.now/CVE-2026-21372.md): Heap-Based Buffer Overflow in Power Management IC (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21371](https://cve.now/CVE-2026-21371.md): Buffer Over-read in WinBlast Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21367](https://cve.now/CVE-2026-21367.md): Buffer Over-read in WLAN Firmware (CVSS 7.6, Qualcomm Snapdragon)
- [CVE-2025-47400](https://cve.now/CVE-2025-47400.md): Buffer Over-read in Computer Vision (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2025-47392](https://cve.now/CVE-2025-47392.md): Integer Overflow or Wraparound in GPS (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2025-47391](https://cve.now/CVE-2025-47391.md): Stack-based Buffer Overflow in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47390](https://cve.now/CVE-2025-47390.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47389](https://cve.now/CVE-2025-47389.md): Buffer Copy Without Checking Size of Input in Automotive Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47374](https://cve.now/CVE-2025-47374.md): Use After Free in Camera Driver (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-14032](https://cve.now/CVE-2024-14032.md): Twitch Studio LauncherHelper XPC Missing Authorization to Root File Write (CVSS 8.5, Twitch Studio)
- [CVE-2026-34589](https://cve.now/CVE-2026-34589.md): OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write (CVSS 8.4, AcademySoftwareFoundation openexr · openexr)
- [CVE-2026-34588](https://cve.now/CVE-2026-34588.md): OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write (CVSS 8.6, AcademySoftwareFoundation openexr · openexr)
- [CVE-2026-34444](https://cve.now/CVE-2026-34444.md): Lupa has a Sandbox escape and RCE due to incomplete attribute\_filter enforcement in getattr / setattr (CVSS 7.9, scoder lupa · lupa)
- [CVE-2026-5666](https://cve.now/CVE-2026-5666.md): code-projects Online FIR System SQL Database Backup File complaints.sql sensitive information (CVSS 6.9, code-projects Online FIR System)
- [CVE-2026-33405](https://cve.now/CVE-2026-33405.md): Pi-hole has a Stored HTML Injection in queries.js (CVSS 3.1, pi-hole web)
- [CVE-2026-34380](https://cve.now/CVE-2026-34380.md): OpenEXR has a signed integer overflow (undefined behavior) in undo\_pxr24\_impl may allow bounds-check bypass in PXR24 decompression (CVSS 5.9, AcademySoftwareFoundation openexr)
- [CVE-2026-34379](https://cve.now/CVE-2026-34379.md): OpenEXR has a misaligned write in LossyDctDecoder\_execute leading to undefined behavior (DWA/DWAB decompression) (CVSS 7.1, AcademySoftwareFoundation openexr)
- [CVE-2026-34378](https://cve.now/CVE-2026-34378.md): OpenEXR has a signed integer overflow in generic\_unpack() when parsing EXR files with crafted negative dataWindow.min.x (CVSS 6.5, AcademySoftwareFoundation openexr)
- [CVE-2026-5704](https://cve.now/CVE-2026-5704.md): Tar: tar: hidden file injection via crafted archives (CVSS 5.0, Red Hat Enterprise Linux · Red Hat Discovery +2)
- [CVE-2026-34982](https://cve.now/CVE-2026-34982.md): Vim modeline bypass via various options affects Vim \< 9.2.0276 (CVSS 8.2, vim)
- [CVE-2026-5665](https://cve.now/CVE-2026-5665.md): code-projects Online FIR System Login checklogin.php sql injection (CVSS 6.9, code-projects Online FIR System)
- [CVE-2026-34217](https://cve.now/CVE-2026-34217.md): SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler (CVSS 6.9, nyariv SandboxJS · @nyariv/sandboxjs)
- [CVE-2026-34211](https://cve.now/CVE-2026-34211.md): SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser (CVSS 6.9, nyariv SandboxJS · @nyariv/sandboxjs)
- [CVE-2026-34208](https://cve.now/CVE-2026-34208.md): SandboxJS: Sandbox integrity escape (CVSS 10.0, nyariv SandboxJS · @nyariv/sandboxjs)
- [CVE-2026-34148](https://cve.now/CVE-2026-34148.md): Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution (CVSS 7.5, @fedify fedify · @fedify vocab-runtime +2)
- [CVE-2026-33727](https://cve.now/CVE-2026-33727.md): Pi-hole has a Local Privilege Escalation (post-compromise, pihole -\> root). (CVSS 6.4, pi-hole)
- [CVE-2026-33752](https://cve.now/CVE-2026-33752.md): Redirect-based SSRF leading to internal network access in curl\_cffi (with TLS impersonation bypass) (CVSS 8.6, lexiforest curl\_cffi · curl-cffi)
- [CVE-2026-33540](https://cve.now/CVE-2026-33540.md): Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm (CVSS 7.5, distribution · github.com/distribution/distribution/v3 +1)
- [CVE-2026-33510](https://cve.now/CVE-2026-33510.md): DOM-Based XSS in Homarr /auth/login Redirect (CVSS 8.8, homarr-labs homarr)
- [CVE-2026-34897](https://cve.now/CVE-2026-34897.md): WordPress Media LIbrary Assistant plugin \<= 3.34 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, David Lingren Media LIbrary Assistant)
- [CVE-2026-33406](https://cve.now/CVE-2026-33406.md): Pi-hole has a Stored HTML attribute injection (CVSS 5.4, pi-hole web)
- [CVE-2026-33404](https://cve.now/CVE-2026-33404.md): Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard (CVSS 3.4, pi-hole web)
- [CVE-2026-33403](https://cve.now/CVE-2026-33403.md): Pi-hole has a Reflected XSS / HTML injection in taillog.js (CVSS 6.1, pi-hole web)
- [CVE-2026-34885](https://cve.now/CVE-2026-34885.md): WordPress Media LIbrary Assistant plugin \<= 3.34 - SQL Injection vulnerability (CVSS 8.5, David Lingren Media LIbrary Assistant)
- [CVE-2026-32602](https://cve.now/CVE-2026-32602.md): Homarr has a Race Condition in Invite Token Registration (TOCTOU) (CVSS 4.2, homarr-labs homarr)
- [CVE-2026-29047](https://cve.now/CVE-2026-29047.md): GLPI has an Authenticated SQL Injection via log exports (CVSS 7.2, glpi-project glpi)
- [CVE-2026-26263](https://cve.now/CVE-2026-26263.md): GLPI has an Unauthenticated SQL Injection via Search engine (CVSS 8.1, glpi-project glpi)
- [CVE-2026-26027](https://cve.now/CVE-2026-26027.md): GLPI has an Unauthenticated Stored XSS via inventory (CVSS 7.5, glpi-project glpi)
- [CVE-2026-26026](https://cve.now/CVE-2026-26026.md): GLPI has a Server-Side Template Injection via Double-Compilation (CVSS 9.1, glpi-project glpi)
- [CVE-2026-25932](https://cve.now/CVE-2026-25932.md): GLPI has Stored XSS in Supplier 'Website' field (CVSS 7.2, glpi-project glpi)
- [CVE-2026-5663](https://cve.now/CVE-2026-5663.md): OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection (CVSS 6.9, OFFIS DCMTK)
- [CVE-2026-5661](https://cve.now/CVE-2026-5661.md): Free5GC NGSetupRequest denial of service (CVSS 6.9, Free5GC)
- [CVE-2026-5660](https://cve.now/CVE-2026-5660.md): itsourcecode Construction Management System Parameter borrowed\_equip.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2026-5659](https://cve.now/CVE-2026-5659.md): pytries datrie trie File datrie.pyx Trie.\_\_setstate\_\_ deserialization (CVSS 5.3, pytries datrie)
- [CVE-2026-3524](https://cve.now/CVE-2026-3524.md): Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check (CVSS 8.3, Mattermost)
- [CVE-2026-5650](https://cve.now/CVE-2026-5650.md): code-projects Online Application System for Admission oas.sql sensitive information (CVSS 6.9, code-projects Online Application System for Admission)
- [CVE-2026-5649](https://cve.now/CVE-2026-5649.md): code-projects Online Application System for Admission Endpoint admsnform.php sql injection (CVSS 5.3, code-projects Online Application System for Admission)
- [CVE-2026-5648](https://cve.now/CVE-2026-5648.md): code-projects Simple Laundry System Parameter userfinishregister.php sql injection (CVSS 6.9, code-projects Simple Laundry System)
- [CVE-2026-5647](https://cve.now/CVE-2026-5647.md): code-projects Online Shoe Store Add Product admin\_feature.php cross site scripting (CVSS 4.8, code-projects Online Shoe Store)
- [CVE-2026-5646](https://cve.now/CVE-2026-5646.md): code-projects Easy Blog Site login.php sql injection (CVSS 6.9, code-projects Easy Blog Site)
- [CVE-2026-5645](https://cve.now/CVE-2026-5645.md): projectworlds Car Rental System Parameter pay.php sql injection (CVSS 6.9, projectworlds Car Rental System)
- [CVE-2026-5644](https://cve.now/CVE-2026-5644.md): Cyber-III Student-Management-System batch-notice.php cross site scripting (CVSS 4.8, Cyber-III Student-Management-System)
- [CVE-2026-5643](https://cve.now/CVE-2026-5643.md): Cyber-III Student-Management-System Admin Add Endpoint notice.php cross site scripting (CVSS 4.8, Cyber-III Student-Management-System)
- [CVE-2026-5642](https://cve.now/CVE-2026-5642.md): Cyber-III Student-Management-System HTTP POST Request update.php improper authorization (CVSS 6.9, Cyber-III Student-Management-System)
- [CVE-2026-5673](https://cve.now/CVE-2026-5673.md): Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing (CVSS 5.6, Red Hat Enterprise Linux)
- [CVE-2026-5641](https://cve.now/CVE-2026-5641.md): PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-5640](https://cve.now/CVE-2026-5640.md): PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-5639](https://cve.now/CVE-2026-5639.md): PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-37977](https://cve.now/CVE-2026-37977.md): Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim (CVSS 3.7, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-5638](https://cve.now/CVE-2026-5638.md): HerikLyma CPPWebFramework path traversal (CVSS 6.9, HerikLyma CPPWebFramework)
- [CVE-2026-5637](https://cve.now/CVE-2026-5637.md): projectworlds Car Rental System Parameter message\_admin.php sql injection (CVSS 6.9, projectworlds Car Rental System)
- [CVE-2026-5636](https://cve.now/CVE-2026-5636.md): PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-5635](https://cve.now/CVE-2026-5635.md): PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2026-31410](https://cve.now/CVE-2026-31410.md): ksmbd: use volume UUID in FS\_OBJECT\_ID\_INFORMATION (no CVSS, Linux)
- [CVE-2026-31409](https://cve.now/CVE-2026-31409.md): ksmbd: unset conn-\>binding on failed binding request (CVSS 8.8, Linux)
- [CVE-2026-31408](https://cve.now/CVE-2026-31408.md): Bluetooth: SCO: Fix use-after-free in sco\_recv\_frame() due to missing sock\_hold (CVSS 8.8, Linux)
- [CVE-2026-31407](https://cve.now/CVE-2026-31407.md): netfilter: conntrack: add missing netlink policy validations (CVSS 7.1, Linux)
- [CVE-2026-31406](https://cve.now/CVE-2026-31406.md): xfrm: Fix work re-schedule after cancel in xfrm\_nat\_keepalive\_net\_fini() (CVSS 7.8, Linux)
- [CVE-2026-31405](https://cve.now/CVE-2026-31405.md): media: dvb-net: fix OOB access in ULE extension header tables (CVSS 9.8, Linux)
- [CVE-2026-5634](https://cve.now/CVE-2026-5634.md): projectworlds Car Rental Project Parameter book\_car.php sql injection (CVSS 6.9, projectworlds Car Rental Project)
- [CVE-2026-5633](https://cve.now/CVE-2026-5633.md): assafelovic gpt-researcher ws Endpoint server-side request forgery (CVSS 6.9, assafelovic gpt-researcher)
- [CVE-2026-5632](https://cve.now/CVE-2026-5632.md): assafelovic gpt-researcher HTTP REST API Endpoint missing authentication (CVSS 6.9, assafelovic gpt-researcher)
- [CVE-2026-5631](https://cve.now/CVE-2026-5631.md): assafelovic gpt-researcher ws Endpoint server\_utils.py extract\_command\_data code injection (CVSS 6.9, assafelovic gpt-researcher)
- [CVE-2026-5630](https://cve.now/CVE-2026-5630.md): assafelovic gpt-researcher Report API app.py cross site scripting (CVSS 5.3, assafelovic gpt-researcher)
- [CVE-2026-5629](https://cve.now/CVE-2026-5629.md): Belkin F9K1015 formSetFirewall stack-based overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2026-5628](https://cve.now/CVE-2026-5628.md): Belkin F9K1015 Setting formSetSystemSettings stack-based overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2026-5625](https://cve.now/CVE-2026-5625.md): assafelovic gpt-researcher WebSocket researcher.py cross site scripting (CVSS 5.3, assafelovic gpt-researcher)
- [CVE-2026-5624](https://cve.now/CVE-2026-5624.md): ProjectSend upload.php cross-site request forgery (CVSS 5.3, ProjectSend)
- [CVE-2026-5623](https://cve.now/CVE-2026-5623.md): hcengineering Huly Platform Import Endpoint index.ts server-side request forgery (CVSS 5.3, hcengineering Huly Platform)
- [CVE-2026-5622](https://cve.now/CVE-2026-5622.md): hcengineering Huly Platform JWT Token token.ts hard-coded key (CVSS 6.3, hcengineering Huly Platform)
- [CVE-2026-5621](https://cve.now/CVE-2026-5621.md): ChrisChinchilla Vale-MCP HTTP index.ts os command injection (CVSS 4.8, ChrisChinchilla Vale-MCP)
- [CVE-2026-5620](https://cve.now/CVE-2026-5620.md): itsourcecode Construction Management System Parameter borrowed\_equip\_report.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2026-5619](https://cve.now/CVE-2026-5619.md): Braffolk mcp-summarization-functions summarize\_command mcp-server.ts os command injection (CVSS 4.8, Braffolk mcp-summarization-functions)
- [CVE-2026-5618](https://cve.now/CVE-2026-5618.md): kalcaddle kodbox shareMake/shareCheck server-side request forgery (CVSS 6.3, kalcaddle kodbox)
- [CVE-2026-5616](https://cve.now/CVE-2026-5616.md): JeecgBoot AI Chat JeecgBizToolsProvider.java missing authentication (CVSS 6.9, JeecgBoot)
- [CVE-2026-5615](https://cve.now/CVE-2026-5615.md): givanz Vvvebjs File Upload Endpoint upload.php cross site scripting (CVSS 5.3, givanz Vvvebjs)
- [CVE-2026-5614](https://cve.now/CVE-2026-5614.md): Belkin F9K1015 formSetPassword stack-based overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2026-5613](https://cve.now/CVE-2026-5613.md): Belkin F9K1015 formReboot stack-based overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2026-5612](https://cve.now/CVE-2026-5612.md): Belkin F9K1015 formWlEncrypt stack-based overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2026-5611](https://cve.now/CVE-2026-5611.md): Belkin F9K1015 formCrossBandSwitch stack-based overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2026-5610](https://cve.now/CVE-2026-5610.md): Belkin F9K1015 formWISP5G stack-based overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2026-5609](https://cve.now/CVE-2026-5609.md): Tenda i12 Parameter wifiSSIDset formwrlSSIDset stack-based overflow (CVSS 8.7, Tenda i12)
- [CVE-2026-5608](https://cve.now/CVE-2026-5608.md): Belkin F9K1122 formWlanSetup stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2026-5607](https://cve.now/CVE-2026-5607.md): imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery (CVSS 5.3, imprvhub mcp-browser-agent)
- [CVE-2026-5606](https://cve.now/CVE-2026-5606.md): PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal Project)
- [CVE-2025-54324](https://cve.now/CVE-2025-54324.md): An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330 (CVSS 7.5)
- [CVE-2025-54328](https://cve.now/CVE-2025-54328.md): An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330 (CVSS 10.0)
- [CVE-2025-54601](https://cve.now/CVE-2025-54601.md): An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480 (CVSS 7.0)
- [CVE-2025-54602](https://cve.now/CVE-2025-54602.md): An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480 (CVSS 7.0)
- [CVE-2025-57834](https://cve.now/CVE-2025-57834.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980, 850, 990, 1080, 2100, 1280, 2200, 1330, 1380 (CVSS 7.5)
- [CVE-2025-57835](https://cve.now/CVE-2025-57835.md): An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330 (CVSS 7.5)
- [CVE-2025-58349](https://cve.now/CVE-2025-58349.md): An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, (CVSS 9.1)
- [CVE-2025-59440](https://cve.now/CVE-2025-59440.md): An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 133 (CVSS 7.5)
- [CVE-2025-61166](https://cve.now/CVE-2025-61166.md): An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL. (CVSS 6.1)
- [CVE-2026-30078](https://cve.now/CVE-2026-30078.md): OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type. (CVSS 7.5)
- [CVE-2026-30613](https://cve.now/CVE-2026-30613.md): An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth Enabled Software Version: 1.1.9 due to i (CVSS 4.6)
- [CVE-2026-31053](https://cve.now/CVE-2026-31053.md): A double free vulnerability exists in librz/bin/format/le/le.c in the function le\_load\_fixup\_record(). (CVSS 6.2)
- [CVE-2026-31058](https://cve.now/CVE-2026-31058.md): UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the timeRangeName parameter of the formConfigDnsFil (CVSS 4.5)
- [CVE-2026-31059](https://cve.now/CVE-2026-31059.md): A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attacker (CVSS 9.8)
- [CVE-2026-31060](https://cve.now/CVE-2026-31060.md): UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the notes parameter of the formGroupConfig function (CVSS 4.5)
- [CVE-2026-31061](https://cve.now/CVE-2026-31061.md): UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the timestart parameter of the ConfigAdvideo functi (CVSS 4.5)
- [CVE-2026-31062](https://cve.now/CVE-2026-31062.md): UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the filename parameter of the formFtpServerDirConfig func (CVSS 4.5)
- [CVE-2026-31063](https://cve.now/CVE-2026-31063.md): UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the pools parameter of the formArpBindConfig functi (CVSS 4.5)
- [CVE-2026-31065](https://cve.now/CVE-2026-31065.md): UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formConfigCliForEngineerO (CVSS 4.5)
- [CVE-2026-31066](https://cve.now/CVE-2026-31066.md): UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the selDateType parameter of the formTaskEdit funct (CVSS 4.5)
- [CVE-2026-31067](https://cve.now/CVE-2026-31067.md): A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows att (CVSS 6.8)
- [CVE-2026-31150](https://cve.now/CVE-2026-31150.md): Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's da (CVSS 4.3)
- [CVE-2026-31151](https://cve.now/CVE-2026-31151.md): An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources (CVSS 9.8)
- [CVE-2026-31153](https://cve.now/CVE-2026-31153.md): A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTML (CVSS 5.4)
- [CVE-2026-31313](https://cve.now/CVE-2026-31313.md): An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to exec (CVSS 5.4, feehi/cms)
- [CVE-2026-31350](https://cve.now/CVE-2026-31350.md): An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HT (CVSS 5.4, feehi/cms)
- [CVE-2026-31351](https://cve.now/CVE-2026-31351.md): An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to exec (CVSS 4.8, feehi/cms)
- [CVE-2026-31352](https://cve.now/CVE-2026-31352.md): An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execu (CVSS 5.4, feehi/cms)
- [CVE-2026-31353](https://cve.now/CVE-2026-31353.md): An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbi (CVSS 5.4, feehi/cms)
- [CVE-2026-31354](https://cve.now/CVE-2026-31354.md): Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to e (CVSS 5.4, feehi/cms)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.