CVEs published April 7, 2026
275 CVEs were published on April 7, 2026: 45 critical, 116 high. 1 is now in CISA KEV.
- Published
- 275
- Critical
- 45
- High
- 116
- Medium
- 106
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 200
Most affected products
- ChurchCRM CRM
- 28
- runZero Platform
- 11
- OpenSSL
- 7
- LibRaw
- 6
- pi-hole FTL
- 6
- djangoproject Django · django
- 5
- filebrowser · github.com/filebrowser/filebrowser/v2 +1
- 5
- MervinPraison PraisonAI · praisonai
- 5
- Mozilla Firefox · Mozilla Thunderbird
- 5
- NI LabVIEW
- 5
Critical 45
- CVE-2026-28386Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 SupportOpenSSL
- CVE-2026-39847Emmett has a path traversal in internal assets handleremmett-framework emmett · emmett
- CVE-2026-39846SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captionssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-34078Flatpak has a complete sandbox escape leading to host file access and code execution in the host contextflatpak
- CVE-2026-34580Botan has a certificate authentication bypass due to trust anchor confusionrandombit botan
- CVE-2026-33439Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMOpenIdentityPlatform OpenAM · org.openidentityplatform.open…
- CVE-2026-39397@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collectionsdelmaredigital payload-puck · @delmaredigital/payload-puck
- CVE-2026-39382dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Outputdbt-labs dbt-core
- CVE-2026-39322PolarLearn: Any password authenticates banned accounts and grants API accesspolarnl PolarLearn
- CVE-2026-39355Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)MGeurts genealogy
- CVE-2026-39324Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationrack-session
- CVE-2026-39337ChurchCRM Affected by Unauthenticated RCE in Install WizardChurchCRM CRM
- CVE-2026-39342ChurchCRM has a SQL injection searchwhat parameter via QueryView.phpChurchCRM CRM
- CVE-2026-39339ChurchCRM has an API Authentication BypassChurchCRM CRM
- CVE-2026-35573ChurchCRM has a Path traversal leads to RCEChurchCRM CRM
- CVE-2026-23696Windmill < 1.603.3 File Ownership Handling SQLi RCEWindmill Labs Windmill CE · Windmill Labs Windmill EE
- CVE-2026-39305Arbitrary File Write / Path Traversal in Action OrchestratorMervinPraison PraisonAI · praisonai
- CVE-2026-35615PraisonAI has a Path Traversal in FileToolsMervinPraison PraisonAI · praisonai
- CVE-2026-35614Frappe has a SQL injection in bulk_updatefrappe
- CVE-2026-4631Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injectionRed Hat Enterprise Linux
- CVE-2026-35580Emissary has GitHub Actions Shell Injection via Workflow InputsNationalSecurityAgency emissary · gov.nsa.emissary:emissary
- CVE-2026-33816CVE-2026-33816 in github.com/jackc/pgxgithub.com/jackc/pgx/v5/pgproto3 · github.com/jackc/pgx/v5
- CVE-2026-33815CVE-2026-33815 in github.com/jackc/pgxgithub.com/jackc/pgx/v5/pgproto3 · github.com/jackc/pgx/v5
- CVE-2026-35490changedetection.io has an Authentication Bypass via Decorator Orderingdgtlmoon changedetection.io · changedetection-io
- CVE-2026-4277Privilege abuse in GenericInlineModelAdmindjangoproject Django · django
- CVE-2026-20911A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b.LibRaw
- CVE-2026-21413A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b.LibRaw
- CVE-2026-20889A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b.LibRaw
- CVE-2026-5627Path Traversal in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2026-22679Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug EndpointWeaver Network Co. E-cology
- CVE-2021-4473Tianxin Internet Behavior Management System Command Injection via toQuery.phpBeijing Topsec Network Security Technology Co. Tianxin Inte…
- CVE-2026-5731Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-39666omd: Local privilege escalation when executing omd commands as rootCheckmk
- CVE-2026-1114Improper Access Control via Weak JWT Token in parisneo/lollmsparisneo/lollms · lollms
- CVE-2026-0740Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File UploadSaturdayDrive Ninja Forms - File Uploads
- CVE-2024-36057Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution.
- CVE-2024-36058The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the PO
- CVE-2025-52908An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580
- CVE-2025-52909An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580
- CVE-2025-62818An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380,
- CVE-2025-69515An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsifie
- CVE-2025-71058Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate
- CVE-2026-30079In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure.
- CVE-2026-31271megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality.
- CVE-2026-31272MRCMS 3.1.2 contains an access control vulnerability.
High 116
- CVE-2026-1342Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access Container · IBM Security Veri… +2
- CVE-2026-5747Out-of-bounds Write in Firecracker virtio-pci TransportAWS Firecracker
- CVE-2026-31790Incorrect Failure Handling in RSA KEM RSASVE EncapsulationOpenSSL
- CVE-2026-28390Possible NULL Dereference When Processing CMS KeyTransportRecipientInfoOpenSSL
- CVE-2026-28389Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfoOpenSSL
- CVE-2026-28388NULL Pointer Dereference When Processing a Delta CRLOpenSSL
- CVE-2026-28387Potential Use-after-free in DANE Client CodeOpenSSL
- CVE-2026-39937Global vanishing does not completely remove user emailThe Wikimedia Foundation Mediawiki - CentralAuth Extension
- CVE-2026-34079Flatpak affected by arbitrary file deletion on the host filesystemflatpak
- CVE-2026-34582Botan has a TLS 1.3 certificate authentication bypassrandombit botan
- CVE-2026-35568MCP Java-SDK has a DNS Rebinding Vulnerabilitymodelcontextprotocol java-sdk · io.modelcontextprotocol.sdk…
- CVE-2026-35533mise has a local settings bypass config trust checksjdx mise · mise
- CVE-2026-34045Podman Desktop WebView Server Exposedpodman-desktop
- CVE-2026-29181OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)open-telemetry opentelemetry-go · go.opentelemetry.io/otel
- CVE-2026-39356SQL Injection via escapeName() in all Drizzle ORM SQL dialectsdrizzle-team drizzle-orm · drizzle-orm
- CVE-2025-14859Semtech LR11xx Secure Boot BypassSemtech LR1110 · Semtech LR1120 +1
- CVE-2026-32864Out-of-Bounds Read in mgcore_SH_25_3!aligned_free()NI LabVIEW
- CVE-2026-32863Out-of-Bounds Read in sentry_transaction_context_set_operation()NI LabVIEW
- CVE-2026-32862Out-of-Bounds Write in ResFileFactory::InitResourceMgr()NI LabVIEW
- CVE-2026-32861Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvclass fileNI LabVIEW
- CVE-2026-39376FastFeedParser has an infinite redirect loop DoS via meta-refresh chainkagisearch fastfeedparser · fastfeedparser
- CVE-2026-32860Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvlib fileNI LabVIEW
- CVE-2026-39371RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requestsredwoodjs sdk · rwsdk
- CVE-2026-39370WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)WWBN AVideo · WWBN/AVideo
- CVE-2026-39369WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLsWWBN AVideo · WWBN/AVideo
- CVE-2026-39364Vite has a `server.fs.deny` bypass with queriesvitejs vite · vitejs vite-plus +1
- CVE-2026-39363Vite Affected by Arbitrary File Read via Vite Dev Server WebSocketvitejs vite · vitejs vite-plus +1
- CVE-2026-39361OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_urlopenobserve
- CVE-2026-39319ChurchCRM has a Second Order SQLI via FundRaiserEditor.phpChurchCRM CRM
- CVE-2026-39344Reflected XSS the login page through the 'username' parameterChurchCRM CRM
- CVE-2026-39343ChurchCRM has a SQL Injection in Event Type Editor (Admin)ChurchCRM CRM
- CVE-2026-39341SQL injection in ChurchCRM.0ChurchCRM CRM
- CVE-2026-39340ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer SubstitutionChurchCRM CRM
- CVE-2026-39338ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session ExfiltrationChurchCRM CRM
- CVE-2026-39334ChurchCRM has a Blind SQL injection in SettingsIndividual.phpChurchCRM CRM
- CVE-2026-39333ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.phpChurchCRM CRM
- CVE-2026-39332ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.phpChurchCRM CRM
- CVE-2026-39331ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary FamiliesChurchCRM CRM
- CVE-2026-39330ChurchCRM has a Blind SQL injection in PropertyAssign.phpChurchCRM CRM
- CVE-2026-39329ChurchCRM has a Blind SQL injection in EventNames.phpChurchCRM CRM
- CVE-2026-39328ChurchCRM has Stored XSS in Social Profile FieldsChurchCRM CRM
- CVE-2026-39327ChurchCRM has a SQL injection in MemberRoleChange.phpChurchCRM CRM
- CVE-2026-39326ChurchCRM has a Blind SQL injection in PropertyTypeEditor.phpChurchCRM CRM
- CVE-2026-39325ChurchCRM has a Blind SQL injection in SettingsUser.phpChurchCRM CRM
- CVE-2026-39318ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.phpChurchCRM CRM
- CVE-2026-24175NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header tNVIDIA Triton Inference Server
- CVE-2026-24174NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sNVIDIA Triton Inference Server
- CVE-2026-24173NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sNVIDIA Triton Inference Server
- CVE-2026-24146NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a servNVIDIA Triton Inference Server
- CVE-2026-35576ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpChurchCRM CRM
- CVE-2026-24156NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data.NVIDIA DALI
- CVE-2026-22682OpenHarness Improper Access Control via File ToolsHKUDS OpenHarness
- CVE-2026-35575ChurchCRM has Stored XSS in Group NameChurchCRM CRM
- CVE-2026-35572SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hostsChurchCRM CRM
- CVE-2026-35574ChurchCRM has a Stored XSS in Person Profile - Add a NoteChurchCRM CRM
- CVE-2026-35610PolarLearn has a Server Action Admin Bypass in Account Management Actionspolarnl PolarLearn
- CVE-2026-39312Pre-Auth EAP-TLS DoS on SoftEther VPN Developer EditionSoftEtherVPN
- CVE-2026-22683Windmill < 1.615.0 Operator Role Missing Authorization Checks RCEWindmill Labs Windmill CE · Windmill Labs Windmill EE
- CVE-2026-39307PraisonAI has an Arbitrary File Write (Zip Slip) in Templates ExtractionMervinPraison PraisonAI · praisonai
- CVE-2026-39308PraisonAI recipe registry publish path traversal allows out-of-root file writeMervinPraison PraisonAI · praisonai
- CVE-2026-39306PraisonAI recipe registry pull path traversal writes files outside the chosen output directoryMervinPraison PraisonAI · praisonai
- CVE-2026-35611Addressable has a Regular Expression Denial of Service in Addressable templatessporkmonger addressable · addressable
- CVE-2025-14821Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windowsRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypassApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2026-35607File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commandsfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-35604File Browser share links remain accessible after Share/Download permissions are revokedfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-35585File Browser has a Command Injection via Hook Runnerfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-39384FreeScout Customer Merge Cross-Mailbox Authorization Bypassfreescout-help-desk freescout
- CVE-2026-35523Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocolstrawberry-graphql strawberry · strawberry-graphql
- CVE-2026-35581Emissary has a Command Injection via PLACE_NAME Configuration in ExecutrixNationalSecurityAgency emissary · gov.nsa.emissary:emissary
- CVE-2026-35534ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionChurchCRM CRM
- CVE-2026-35526Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptionsstrawberry-graphql strawberry · strawberry-graphql
- CVE-2026-35521Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injectionpi-hole FTL
- CVE-2026-35520Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injectionpi-hole FTL
- CVE-2026-35519Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injectionpi-hole FTL
- CVE-2026-35518Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injectionpi-hole FTL
- CVE-2026-35517Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injectionpi-hole FTL
- CVE-2025-24818An OS Command Injection vulnerability in Nokia MantaRay NMNokia MantaRay NM
- CVE-2025-24817An OS Command Injection vulnerability in Nokia MantaRay NMNokia MantaRay NM
- CVE-2026-1078An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.Pegasystems Pega Robot Studio
- CVE-2026-35489Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`TandoorRecipes recipes
- CVE-2026-35488Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) usersTandoorRecipes recipes
- CVE-2026-35486text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validationoobabooga text-generation-webui
- CVE-2026-35485text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authenticationoobabooga text-generation-webui
- CVE-2026-35464pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code executionpyload · pyload-ng
- CVE-2026-35463pyLoad has Improper Neutralization of Special Elements used in an OS Commandpyload · pyload-ng
- CVE-2026-4740Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validationRed Hat multicluster engine for Kubernetes · open-cluster-m…
- CVE-2026-35458Gotenberg has a ReDoS via extraHttpHeaders scope featuregotenberg · github.com/gotenberg/gotenberg/v7 +1
- CVE-2026-33034Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypassdjangoproject Django · django
- CVE-2026-35457libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustionrust-libp2p · libp2p-rendezvous
- CVE-2026-3902ASGI header spoofing via underscore/hyphen conflationdjangoproject Django · django
- CVE-2026-35405libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous serversrust-libp2p · libp2p-rendezvous
- CVE-2026-5373runZero Platform superuser privilege escalationrunZero Platform
- CVE-2026-24660A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b.LibRaw
- CVE-2026-24450An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2.LibRaw
- CVE-2026-20884An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2.LibRaw
- CVE-2026-35554Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race ConditionApache Software Foundation Apache Kafka Clients · org.apach…
- CVE-2026-5735Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2Mozilla Firefox · Mozilla Thunderbird
- CVE-2026-5734Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2Mozilla Firefox · Mozilla Thunderbird
- CVE-2026-5733Incorrect boundary conditions in the Graphics: WebGPU componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-5732Incorrect boundary conditions, integer overflow in the Graphics: Text componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()Dolibarr ERP/CRM
- CVE-2026-28808ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)Erlang OTP
- CVE-2026-32144OCSP designated-responder authorization bypass via missing signature verificationErlang OTP
- CVE-2026-23818Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-PremHewlett Packard Enterprise (HPE) Private 5G Core
- CVE-2026-3466Cross-site scripting in dashlet titleCheckmk
- CVE-2026-31842Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handlingTinyproxy Project Tinyproxy
- CVE-2026-34904WordPress Simple Social Media Share Buttons plugin <= 6.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityAnalytify Simple Social Media Share Buttons
- CVE-2026-34896WordPress Under Construction, Coming Soon & Maintenance Mode plugin <= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerabilityAnalytify Under Construction, Coming Soon & Maintenance Mode
- CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansApache Software Foundation Apache ActiveMQ Broker · Apac… +3
- CVE-2026-5465Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameterameliabooking Booking for Appointments and Events Calendar…
- CVE-2025-65115Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DMHitachi JP1/IT Desktop Management 2 - Manager · Hitachi… +7
- CVE-2026-20433In Modem, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20432In Modem, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2025-56015In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.genieacs
- CVE-2026-30460Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
Medium, low and unrated 114
- CVE-2026-4394Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-FieldGravity Forms
- CVE-2026-4406Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterGravity Forms
- CVE-2026-4401Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disablingwpchill Download Monitor
- CVE-2026-2263Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulationwpmudev Hustle – Email Marketing, Lead Generation, Optins,…
- CVE-2025-20628Insufficient granularity of access control for Remote Connector Servers in client modePing Identity PingIDM
- CVE-2026-39936Stored XSS in Score due to usage of non-reserved data attributesThe Wikimedia Foundation Mediawiki - Score Extension
- CVE-2026-39935XSS-via-i18n in localised wiki namesThe Wikimedia Foundation Mediawiki - CampaignEvents Extensi…
- CVE-2026-31789Heap Buffer Overflow in Hexadecimal ConversionOpenSSL
- CVE-2026-39934Growth Experiments ReassignMenteesJob runs as an infinite loopThe Wikimedia Foundation Mediawiki - GrowthExperiments Exte…
- CVE-2026-39933Multiple XSS vulnerabilities in GlobalWatchlistThe Wikimedia Foundation Mediawiki - GlobalWatchlist Extens…
- CVE-2026-35406Aardvark-dns has incorrect error handling for malformed tcp packetscontainers aardvark-dns · netavark
- CVE-2026-4065Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulationnextendweb Smart Slider
- CVE-2026-34781Electron crashes in clipboard.readImage() on malformed clipboard image dataelectron
- CVE-2026-34765Electron named window.open targets not scoped to the opener's browsing contextelectron
- CVE-2026-34371LibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversaldanny-avila LibreChat
- CVE-2026-34080xdg-dbus-proxy has an eavesdrop filter bypass allowing message interceptionflatpak xdg-dbus-proxy
- CVE-2026-32712Open Source Point of Sale has Stored XSS in Customer Name (Sales)opensourcepos
- CVE-2026-27949Plane Exposes User Email (PII and part of credential) in GET Parametermakeplane plane
- CVE-2026-39401Privilege Escalation via update_event Job Output in Croniclejhuckaby Cronicle
- CVE-2026-39400Stored XSS via Job HTML/Table Output in Croniclejhuckaby Cronicle
- CVE-2026-39395Cosign's verify-blob-attestation reports false positive when payload parsing failssigstore cosign · github.com/sigstore/cosign +2
- CVE-2026-5741suvarchal docker-mcp-server HTTP index.ts pull_image os command injectionsuvarchal docker-mcp-server
- CVE-2025-14858Semtech LR11xx Encrypted Firmware DisclosureSemtech LR1110 · Semtech LR1120 +1
- CVE-2025-14857Semtech LR11xx Memory Write Access Control BypassSemtech LR1110 · Semtech LR1120 +1
- CVE-2026-39381Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`parse-community parse-server · parse-server
- CVE-2026-39380Open Source Point of Sale has Stored XSS in Stock Location (Configuration)opensourcepos
- CVE-2026-39837Stored XSS through the dynamic table format in CargoWikimedia Foundation Mediawiki - Cargo Extension
- CVE-2026-39841Stored XSS through list fields on Cargo's page values and Special:CargoTablesWikimedia Foundation Mediawiki - Cargo Extension
- CVE-2026-39374Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpointmakeplane plane
- CVE-2026-39840CSS injection in multiple Cargo display formatsWikimedia Foundation Mediawiki - Cargo Extension
- CVE-2026-39373JWCrypto: JWE ZIP decompression bomblatchset jwcrypto · jwcrypto
- CVE-2026-39839Stored XSS through URLs in Cargo's map formatWikimedia Foundation Mediawiki - Cargo Extension
- CVE-2026-39368WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesWWBN AVideo · WWBN/AVideo
- CVE-2026-39367WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG PageWWBN AVideo · wwbn/avideo
- CVE-2026-39366WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.phpWWBN AVideo · wwbn/avideo
- CVE-2026-39838ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSSWikimedia Foundation MediaWiki - ProofreadPage Extension
- CVE-2026-5739PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injectionPowerJob · tech.powerjob:powerjob-server-starter
- CVE-2026-39365Vite has a Path Traversal in Optimized Deps `.map` Handlingvitejs vite · vitejs vite-plus +1
- CVE-2026-39360RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationrustfs
- CVE-2026-39354Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/askErudika scoold
- CVE-2026-39351Frappe allows unrestricted Doctype access via API exploitfrappe
- CVE-2026-5736PowerJob detailPlus Endpoint InstanceController.java sql injectionPowerJob · tech.powerjob:powerjob-server-starter
- CVE-2026-5762ReportIncident DiscussionTools integration causes slow requestsWikimedia Foundation MediaWiki - ReportIncident Extension
- CVE-2026-22711Stored XSS through system messages in WikiLoveThe Wikimedia Foundation Mediawiki - Wikilove Extension
- CVE-2026-39349OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosureorangehrm
- CVE-2026-39348OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachmentsorangehrm
- CVE-2026-39347OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completionorangehrm
- CVE-2026-39346OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encodingorangehrm
- CVE-2026-39345OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loaderorangehrm
- CVE-2026-39321Parse Server has a login timing side-channel reveals user existenceparse-community parse-server · parse-server
- CVE-2026-39336ChurchCRM has Stored XSS from unescaped config values in HTML attributesChurchCRM CRM
- CVE-2026-39335ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family ControlsChurchCRM CRM
- CVE-2026-24147NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading NVIDIA Triton Inference Server
- CVE-2026-22680OpenViking < 0.3.3 Missing Authorization via Task PollingVolcengine OpenViking · openviking
- CVE-2026-39316CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointerOpenPrinting cups
- CVE-2026-39314CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`OpenPrinting cups
- CVE-2026-32588Apache Cassandra: Authenticated DoS via ALTER ROLE Password HashingApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2026-27315Apache Cassandra: cqlsh history sensitive information leakApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2026-35613Path traversal in coursevault-preview due to improper base-directory boundary validationmoritzmyrz coursevault-preview · coursevault-preview
- CVE-2026-35608QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript executionRoastSlav quickdrop
- CVE-2026-35606File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download checkfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2025-14944Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storageinisev BackupBliss – Backup & Migration with Free Cloud Sto…
- CVE-2026-35605File Browser has an access rule bypass via HasPrefix without trailing separator in path matchingfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-35592pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypasspyload · pyload-ng
- CVE-2026-35586Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ngpyload · pyload-ng
- CVE-2026-35584FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumerationfreescout-help-desk freescout
- CVE-2026-35583Emissary has a Path Traversal via Blacklist Bypass in Configuration APINationalSecurityAgency emissary · gov.nsa.emissary:emissary
- CVE-2026-35571Emissary has Stored XSS via Navigation Template Link InjectionNationalSecurityAgency emissary · gov.nsa.emissary:emissary
- CVE-2026-4931CVE-2026-4931Marginal Smart Contract
- CVE-2026-1079A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.Pegasystems Pega Browser Extension
- CVE-2026-35516LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta ProtectionKovah LinkAce
- CVE-2025-24819A Relative Path Traversal vulnerability in Nokia MantaRay NMNokia MantaRay NM
- CVE-2026-35515@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')nestjs nest · @nestjs/core
- CVE-2026-35492Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file writekedro-org kedro-plugins · kedro-datasets
- CVE-2026-35491Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configurationpi-hole FTL
- CVE-2026-5745Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchiveRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-35487text-generation-webui has a Path Traversal in load_prompt() — .txt file read without authenticationoobabooga text-generation-webui
- CVE-2026-35484text-generation-webui has a Path Traversal in load_preset() — .yaml file read without authenticationoobabooga text-generation-webui
- CVE-2026-35483text-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authenticationoobabooga text-generation-webui
- CVE-2026-35480go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headersgo-ipld-prime · github.com/ipld/go-ipld-prime
- CVE-2026-35462Papra Does Not Reject Expired API Keyspapra-hq papra
- CVE-2026-35461Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URLpapra-hq papra
- CVE-2026-35460Papra has an HTML Injection in Transactional Emails via Unescaped User Display Namepapra-hq papra
- CVE-2026-33033Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploaddjangoproject Django · django
- CVE-2026-4292Privilege abuse in ModelAdmin.list_editabledjangoproject Django · django
- CVE-2026-5384runZero Platform incorrect credential scoperunZero Platform
- CVE-2026-5383runZero Explorer missing authorization checkrunZero Explorer
- CVE-2026-5382runZero Platform MCP endpoint information leakrunZero Platform
- CVE-2026-5381runZero Platform task information leakrunZero Platform
- CVE-2026-5380runZero Platform cleartext secret exposurerunZero Platform
- CVE-2026-5379runZero Platform MCP certification information leakrunZero Platform
- CVE-2026-5378runZero Platform user creation leakrunZero Platform
- CVE-2026-5376runZero Platform session timeout failurerunZero Platform
- CVE-2026-5375runZero Platform API credential information leakrunZero Platform
- CVE-2026-5374runZero Platform MCP information leakrunZero Platform
- CVE-2026-5372runZero Platform SQL injection in saved queriesrunZero Platform
- CVE-2026-33866Authorization Bypass in MLflow AJAX EndpointMlflow
- CVE-2026-33865Stored XSS via unsafe YAML parsing in MLflowMlflow
- CVE-2026-4420Stored XSS via Page Creating functionality in BluditBludit
- CVE-2026-34903WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerabilityOceanWP Ocean Extra
- CVE-2026-34899WordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.2.1 - Broken Access Control vulnerabilityEniture technology LTL Freight Quotes – Worldwide Express E…
- CVE-2026-33227Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath DirectoryApache Software Foundation Apache ActiveMQ Client · Apac… +7
- CVE-2026-28810Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in ResolverErlang OTP
- CVE-2026-3177Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhooksmub Charitable – Donation Plugin for WordPress – Fundraisi…
- CVE-2026-4079SQL Chart Builder < 2.3.8 - Unauthenticated SQL InjectionSQL Chart Builder
- CVE-2026-1900Link Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta UpdateLink Whisper Free
- CVE-2025-15611Popup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRFPopup Box
- CVE-2025-65116Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DMHitachi JP1/IT Desktop Management 2 - Manager · Hitachi… +7
- CVE-2026-1839Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformershuggingface/transformers · transformers
- CVE-2026-20446In sec boot, there is a possible out of bounds write due to an integer overflow.MediaTek chipset
- CVE-2026-20431In Modem, there is a possible system crash due to a logic error.MediaTek chipset
- CVE-2026-5719itsourcecode Construction Management System borrowedtool.php sql injectionitsourcecode Construction Management System
- CVE-2025-13044Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-70844yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS).kantorge/yaffa