# CVEs published 2026-04-07

275 CVEs were published on April 7, 2026: 45 critical, 116 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-4394](https://cve.now/CVE-2026-4394.md): Gravity Forms \<= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field (CVSS 6.1, Gravity Forms)
- [CVE-2026-4406](https://cve.now/CVE-2026-4406.md): Gravity Forms \<= 2.9.30 - Reflected Cross-Site Scripting via 'form\_ids' Parameter (CVSS 4.7, Gravity Forms)
- [CVE-2026-4401](https://cve.now/CVE-2026-4401.md): Download Monitor \<= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling (CVSS 5.4, wpchill Download Monitor)
- [CVE-2026-2263](https://cve.now/CVE-2026-2263.md): Hustle – Email Marketing, Lead Generation, Optins, Popups \<= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation (CVSS 5.3, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2026-1342](https://cve.now/CVE-2026-1342.md): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 8.5, IBM Verify Identity Access Container · IBM Security Veri… +2)
- [CVE-2026-5747](https://cve.now/CVE-2026-5747.md): Out-of-bounds Write in Firecracker virtio-pci Transport (CVSS 7.5, AWS Firecracker)
- [CVE-2025-20628](https://cve.now/CVE-2025-20628.md): Insufficient granularity of access control for Remote Connector Servers in client mode (CVSS 6.9, Ping Identity PingIDM)
- [CVE-2026-39936](https://cve.now/CVE-2026-39936.md): Stored XSS in Score due to usage of non-reserved data attributes (CVSS 6.9, The Wikimedia Foundation Mediawiki - Score Extension)
- [CVE-2026-39935](https://cve.now/CVE-2026-39935.md): XSS-via-i18n in localised wiki names (CVSS 6.9, The Wikimedia Foundation Mediawiki - CampaignEvents Extensi…)
- [CVE-2026-31790](https://cve.now/CVE-2026-31790.md): Incorrect Failure Handling in RSA KEM RSASVE Encapsulation (CVSS 7.5, OpenSSL)
- [CVE-2026-31789](https://cve.now/CVE-2026-31789.md): Heap Buffer Overflow in Hexadecimal Conversion (CVSS 5.8, OpenSSL)
- [CVE-2026-28390](https://cve.now/CVE-2026-28390.md): Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo (CVSS 7.5, OpenSSL)
- [CVE-2026-28389](https://cve.now/CVE-2026-28389.md): Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo (CVSS 7.5, OpenSSL)
- [CVE-2026-28388](https://cve.now/CVE-2026-28388.md): NULL Pointer Dereference When Processing a Delta CRL (CVSS 7.5, OpenSSL)
- [CVE-2026-28387](https://cve.now/CVE-2026-28387.md): Potential Use-after-free in DANE Client Code (CVSS 8.1, OpenSSL)
- [CVE-2026-28386](https://cve.now/CVE-2026-28386.md): Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support (CVSS 9.1, OpenSSL)
- [CVE-2026-39934](https://cve.now/CVE-2026-39934.md): Growth Experiments ReassignMenteesJob runs as an infinite loop (CVSS 6.9, The Wikimedia Foundation Mediawiki - GrowthExperiments Exte…)
- [CVE-2026-39933](https://cve.now/CVE-2026-39933.md): Multiple XSS vulnerabilities in GlobalWatchlist (CVSS 6.9, The Wikimedia Foundation Mediawiki - GlobalWatchlist Extens…)
- [CVE-2026-39937](https://cve.now/CVE-2026-39937.md): Global vanishing does not completely remove user email (CVSS 8.8, The Wikimedia Foundation Mediawiki - CentralAuth Extension)
- [CVE-2026-39847](https://cve.now/CVE-2026-39847.md): Emmett has a path traversal in internal assets handler (CVSS 9.1, emmett-framework emmett · emmett)
- [CVE-2026-39846](https://cve.now/CVE-2026-39846.md): SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions (CVSS 9.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-35406](https://cve.now/CVE-2026-35406.md): Aardvark-dns has incorrect error handling for malformed tcp packets (CVSS 6.2, containers aardvark-dns · netavark)
- [CVE-2026-34079](https://cve.now/CVE-2026-34079.md): Flatpak affected by arbitrary file deletion on the host filesystem (CVSS 8.7, flatpak)
- [CVE-2026-34078](https://cve.now/CVE-2026-34078.md): Flatpak has a complete sandbox escape leading to host file access and code execution in the host context (CVSS 9.3, flatpak)
- [CVE-2026-4065](https://cve.now/CVE-2026-4065.md): Smart Slider 3 \<= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation (CVSS 5.4, nextendweb Smart Slider)
- [CVE-2026-34781](https://cve.now/CVE-2026-34781.md): Electron crashes in clipboard.readImage() on malformed clipboard image data (CVSS 2.8, electron)
- [CVE-2026-34765](https://cve.now/CVE-2026-34765.md): Electron named window.open targets not scoped to the opener's browsing context (CVSS 6.0, electron)
- [CVE-2026-34582](https://cve.now/CVE-2026-34582.md): Botan has a TLS 1.3 certificate authentication bypass (CVSS 8.7, randombit botan)
- [CVE-2026-34580](https://cve.now/CVE-2026-34580.md): Botan has a certificate authentication bypass due to trust anchor confusion (CVSS 9.3, randombit botan)
- [CVE-2026-34371](https://cve.now/CVE-2026-34371.md): LibreChat Affected by Arbitrary File Write via \`execute\_code\` Artifact Filename Traversal (CVSS 6.3, danny-avila LibreChat)
- [CVE-2026-35568](https://cve.now/CVE-2026-35568.md): MCP Java-SDK has a DNS Rebinding Vulnerability (CVSS 7.6, modelcontextprotocol java-sdk · io.modelcontextprotocol.sdk…)
- [CVE-2026-35533](https://cve.now/CVE-2026-35533.md): mise has a local settings bypass config trust checks (CVSS 7.8, jdx mise · mise)
- [CVE-2026-34080](https://cve.now/CVE-2026-34080.md): xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception (CVSS 6.8, flatpak xdg-dbus-proxy)
- [CVE-2026-34045](https://cve.now/CVE-2026-34045.md): Podman Desktop WebView Server Exposed (CVSS 8.2, podman-desktop)
- [CVE-2026-33439](https://cve.now/CVE-2026-33439.md): Pre-Authentication Remote Code Execution via \`jato.clientSession\` Deserialization in OpenAM (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-32712](https://cve.now/CVE-2026-32712.md): Open Source Point of Sale has Stored XSS in Customer Name (Sales) (CVSS 5.4, opensourcepos)
- [CVE-2026-29181](https://cve.now/CVE-2026-29181.md): OpenTelemetry-Go multi-value \`baggage\` header extraction causes excessive allocations (remote dos amplification) (CVSS 7.5, open-telemetry opentelemetry-go · go.opentelemetry.io/otel)
- [CVE-2026-27949](https://cve.now/CVE-2026-27949.md): Plane Exposes User Email (PII and part of credential) in GET Parameter (CVSS 2.0, makeplane plane)
- [CVE-2026-39401](https://cve.now/CVE-2026-39401.md): Privilege Escalation via update\_event Job Output in Cronicle (CVSS 5.3, jhuckaby Cronicle)
- [CVE-2026-39400](https://cve.now/CVE-2026-39400.md): Stored XSS via Job HTML/Table Output in Cronicle (CVSS 5.3, jhuckaby Cronicle)
- [CVE-2026-39397](https://cve.now/CVE-2026-39397.md): @delmaredigital/payload-puc is missing authorization on /api/puck/\* CRUD endpoints allows unauthenticated access to Puck-registered collections (CVSS 9.4, delmaredigital payload-puck · @delmaredigital/payload-puck)
- [CVE-2026-39395](https://cve.now/CVE-2026-39395.md): Cosign's verify-blob-attestation reports false positive when payload parsing fails (CVSS 4.3, sigstore cosign · github.com/sigstore/cosign +2)
- [CVE-2026-5741](https://cve.now/CVE-2026-5741.md): suvarchal docker-mcp-server HTTP index.ts pull\_image os command injection (CVSS 6.9, suvarchal docker-mcp-server)
- [CVE-2026-39356](https://cve.now/CVE-2026-39356.md): SQL Injection via escapeName() in all Drizzle ORM SQL dialects (CVSS 7.5, drizzle-team drizzle-orm · drizzle-orm)
- [CVE-2025-14859](https://cve.now/CVE-2025-14859.md): Semtech LR11xx Secure Boot Bypass (CVSS 7.0, Semtech LR1110 · Semtech LR1120 +1)
- [CVE-2025-14858](https://cve.now/CVE-2025-14858.md): Semtech LR11xx Encrypted Firmware Disclosure (CVSS 5.1, Semtech LR1110 · Semtech LR1120 +1)
- [CVE-2025-14857](https://cve.now/CVE-2025-14857.md): Semtech LR11xx Memory Write Access Control Bypass (CVSS 5.4, Semtech LR1110 · Semtech LR1120 +1)
- [CVE-2026-32864](https://cve.now/CVE-2026-32864.md): Out-of-Bounds Read in mgcore\_SH\_25\_3!aligned\_free() (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39382](https://cve.now/CVE-2026-39382.md): dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output (CVSS 9.3, dbt-labs dbt-core)
- [CVE-2026-32863](https://cve.now/CVE-2026-32863.md): Out-of-Bounds Read in sentry\_transaction\_context\_set\_operation() (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39381](https://cve.now/CVE-2026-39381.md): Parse Server's Endpoint \`/sessions/me\` bypasses \`\_Session\` \`protectedFields\` (CVSS 5.3, parse-community parse-server · parse-server)
- [CVE-2026-32862](https://cve.now/CVE-2026-32862.md): Out-of-Bounds Write in ResFileFactory::InitResourceMgr() (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39380](https://cve.now/CVE-2026-39380.md): Open Source Point of Sale has Stored XSS in Stock Location (Configuration) (CVSS 5.4, opensourcepos)
- [CVE-2026-39837](https://cve.now/CVE-2026-39837.md): Stored XSS through the dynamic table format in Cargo (CVSS 6.3, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-32861](https://cve.now/CVE-2026-32861.md): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvclass file (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39376](https://cve.now/CVE-2026-39376.md): FastFeedParser has an infinite redirect loop DoS via meta-refresh chain (CVSS 7.5, kagisearch fastfeedparser · fastfeedparser)
- [CVE-2026-39841](https://cve.now/CVE-2026-39841.md): Stored XSS through list fields on Cargo's page values and Special:CargoTables (CVSS 6.3, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-32860](https://cve.now/CVE-2026-32860.md): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvlib file (CVSS 7.8, NI LabVIEW)
- [CVE-2026-39374](https://cve.now/CVE-2026-39374.md): Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint (CVSS 6.5, makeplane plane)
- [CVE-2026-39840](https://cve.now/CVE-2026-39840.md): CSS injection in multiple Cargo display formats (CVSS 5.1, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-39373](https://cve.now/CVE-2026-39373.md): JWCrypto: JWE ZIP decompression bomb (CVSS 5.3, latchset jwcrypto · jwcrypto)
- [CVE-2026-39839](https://cve.now/CVE-2026-39839.md): Stored XSS through URLs in Cargo's map format (CVSS 6.3, Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-39371](https://cve.now/CVE-2026-39371.md): RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests (CVSS 8.1, redwoodjs sdk · rwsdk)
- [CVE-2026-39370](https://cve.now/CVE-2026-39370.md): WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732) (CVSS 7.1, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-39369](https://cve.now/CVE-2026-39369.md): WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs (CVSS 7.6, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-39368](https://cve.now/CVE-2026-39368.md): WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services (CVSS 6.5, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-39367](https://cve.now/CVE-2026-39367.md): WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page (CVSS 5.4, WWBN AVideo · wwbn/avideo)
- [CVE-2026-39366](https://cve.now/CVE-2026-39366.md): WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php (CVSS 6.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-39838](https://cve.now/CVE-2026-39838.md): ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS (CVSS 6.9, Wikimedia Foundation MediaWiki - ProofreadPage Extension)
- [CVE-2026-5739](https://cve.now/CVE-2026-5739.md): PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection (CVSS 6.9, PowerJob · tech.powerjob:powerjob-server-starter)
- [CVE-2026-39365](https://cve.now/CVE-2026-39365.md): Vite has a Path Traversal in Optimized Deps \`.map\` Handling (CVSS 6.3, vitejs vite · vitejs vite-plus +1)
- [CVE-2026-39364](https://cve.now/CVE-2026-39364.md): Vite has a \`server.fs.deny\` bypass with queries (CVSS 8.2, vitejs vite · vitejs vite-plus +1)
- [CVE-2026-39363](https://cve.now/CVE-2026-39363.md): Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket (CVSS 8.2, vitejs vite · vitejs vite-plus +1)
- [CVE-2026-39322](https://cve.now/CVE-2026-39322.md): PolarLearn: Any password authenticates banned accounts and grants API access (CVSS 9.2, polarnl PolarLearn)
- [CVE-2026-39361](https://cve.now/CVE-2026-39361.md): OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate\_enrichment\_url (CVSS 7.7, openobserve)
- [CVE-2026-39360](https://cve.now/CVE-2026-39360.md): RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration (CVSS 5.3, rustfs)
- [CVE-2026-39355](https://cve.now/CVE-2026-39355.md): Genealogy is Missing Authorization in \`TeamController::transferOwnership()\` Allows Any Authenticated User to Hijack Any Team (Broken Access Control) (CVSS 10.0, MGeurts genealogy)
- [CVE-2026-39354](https://cve.now/CVE-2026-39354.md): Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask (CVSS 6.5, Erudika scoold)
- [CVE-2026-39351](https://cve.now/CVE-2026-39351.md): Frappe allows unrestricted Doctype access via API exploit (CVSS 6.9, frappe)
- [CVE-2026-5736](https://cve.now/CVE-2026-5736.md): PowerJob detailPlus Endpoint InstanceController.java sql injection (CVSS 6.9, PowerJob · tech.powerjob:powerjob-server-starter)
- [CVE-2026-5762](https://cve.now/CVE-2026-5762.md): ReportIncident DiscussionTools integration causes slow requests (CVSS 5.3, Wikimedia Foundation MediaWiki - ReportIncident Extension)
- [CVE-2026-22711](https://cve.now/CVE-2026-22711.md): Stored XSS through system messages in WikiLove (CVSS 6.9, The Wikimedia Foundation Mediawiki - Wikilove Extension)
- [CVE-2026-39349](https://cve.now/CVE-2026-39349.md): OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure (CVSS 2.1, orangehrm)
- [CVE-2026-39348](https://cve.now/CVE-2026-39348.md): OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments (CVSS 5.3, orangehrm)
- [CVE-2026-39347](https://cve.now/CVE-2026-39347.md): OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion (CVSS 5.1, orangehrm)
- [CVE-2026-39346](https://cve.now/CVE-2026-39346.md): OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding (CVSS 5.3, orangehrm)
- [CVE-2026-39345](https://cve.now/CVE-2026-39345.md): OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader (CVSS 4.6, orangehrm)
- [CVE-2026-39324](https://cve.now/CVE-2026-39324.md): Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization (CVSS 9.3, rack-session)
- [CVE-2026-39321](https://cve.now/CVE-2026-39321.md): Parse Server has a login timing side-channel reveals user existence (CVSS 6.3, parse-community parse-server · parse-server)
- [CVE-2026-39337](https://cve.now/CVE-2026-39337.md): ChurchCRM Affected by Unauthenticated RCE in Install Wizard (CVSS 10.0, ChurchCRM CRM)
- [CVE-2026-39319](https://cve.now/CVE-2026-39319.md): ChurchCRM has a Second Order SQLI via FundRaiserEditor.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39344](https://cve.now/CVE-2026-39344.md): Reflected XSS the login page through the 'username' parameter (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39343](https://cve.now/CVE-2026-39343.md): ChurchCRM has a SQL Injection in Event Type Editor (Admin) (CVSS 7.2, ChurchCRM CRM)
- [CVE-2026-39342](https://cve.now/CVE-2026-39342.md): ChurchCRM has a SQL injection searchwhat parameter via QueryView.php (CVSS 9.4, ChurchCRM CRM)
- [CVE-2026-39341](https://cve.now/CVE-2026-39341.md): SQL injection in ChurchCRM.0 (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39340](https://cve.now/CVE-2026-39340.md): ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39339](https://cve.now/CVE-2026-39339.md): ChurchCRM has an API Authentication Bypass (CVSS 9.1, ChurchCRM CRM)
- [CVE-2026-39338](https://cve.now/CVE-2026-39338.md): ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration (CVSS 8.6, ChurchCRM CRM)
- [CVE-2026-39336](https://cve.now/CVE-2026-39336.md): ChurchCRM has Stored XSS from unescaped config values in HTML attributes (CVSS 6.1, ChurchCRM CRM)
- [CVE-2026-39334](https://cve.now/CVE-2026-39334.md): ChurchCRM has a Blind SQL injection in SettingsIndividual.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39333](https://cve.now/CVE-2026-39333.md): ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php (CVSS 8.7, ChurchCRM CRM)
- [CVE-2026-39332](https://cve.now/CVE-2026-39332.md): ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php (CVSS 8.7, ChurchCRM CRM)
- [CVE-2026-39331](https://cve.now/CVE-2026-39331.md): ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-39330](https://cve.now/CVE-2026-39330.md): ChurchCRM has a Blind SQL injection in PropertyAssign.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39329](https://cve.now/CVE-2026-39329.md): ChurchCRM has a Blind SQL injection in EventNames.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39328](https://cve.now/CVE-2026-39328.md): ChurchCRM has Stored XSS in Social Profile Fields (CVSS 8.9, ChurchCRM CRM)
- [CVE-2026-39327](https://cve.now/CVE-2026-39327.md): ChurchCRM has a SQL injection in MemberRoleChange.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39326](https://cve.now/CVE-2026-39326.md): ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39325](https://cve.now/CVE-2026-39325.md): ChurchCRM has a Blind SQL injection in SettingsUser.php (CVSS 7.2, ChurchCRM CRM)
- [CVE-2026-39318](https://cve.now/CVE-2026-39318.md): ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2026-39335](https://cve.now/CVE-2026-39335.md): ChurchCRM has Stored XSS via Unescaped data-\* Attributes in Group/Family Controls (CVSS 6.1, ChurchCRM CRM)
- [CVE-2026-24175](https://cve.now/CVE-2026-24175.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header t (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24174](https://cve.now/CVE-2026-24174.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the s (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24173](https://cve.now/CVE-2026-24173.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the s (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24147](https://cve.now/CVE-2026-24147.md): NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading (CVSS 4.8, NVIDIA Triton Inference Server)
- [CVE-2026-24146](https://cve.now/CVE-2026-24146.md): NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a serv (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-35576](https://cve.now/CVE-2026-35576.md): ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php (CVSS 8.7, ChurchCRM CRM)
- [CVE-2026-24156](https://cve.now/CVE-2026-24156.md): NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. (CVSS 7.3, NVIDIA DALI)
- [CVE-2026-22682](https://cve.now/CVE-2026-22682.md): OpenHarness Improper Access Control via File Tools (CVSS 8.4, HKUDS OpenHarness)
- [CVE-2026-35575](https://cve.now/CVE-2026-35575.md): ChurchCRM has Stored XSS in Group Name (CVSS 8.0, ChurchCRM CRM)
- [CVE-2026-22680](https://cve.now/CVE-2026-22680.md): OpenViking \< 0.3.3 Missing Authorization via Task Polling (CVSS 6.9, Volcengine OpenViking · openviking)
- [CVE-2026-35572](https://cve.now/CVE-2026-35572.md): SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts (CVSS 7.0, ChurchCRM CRM)
- [CVE-2026-35573](https://cve.now/CVE-2026-35573.md): ChurchCRM has a Path traversal leads to RCE (CVSS 9.1, ChurchCRM CRM)
- [CVE-2026-35574](https://cve.now/CVE-2026-35574.md): ChurchCRM has a Stored XSS in Person Profile - Add a Note (CVSS 7.3, ChurchCRM CRM)
- [CVE-2026-39316](https://cve.now/CVE-2026-39316.md): CUPS has a use-after-free in \`cupsdDeleteTemporaryPrinters\` via dangling subscription pointer (CVSS 4.0, OpenPrinting cups)
- [CVE-2026-39314](https://cve.now/CVE-2026-39314.md): CUPS has an integer underflow in \`\_ppdCreateFromIPP\` causes root cupsd crash via negative \`job-password-supported\` (CVSS 4.0, OpenPrinting cups)
- [CVE-2026-35610](https://cve.now/CVE-2026-35610.md): PolarLearn has a Server Action Admin Bypass in Account Management Actions (CVSS 8.8, polarnl PolarLearn)
- [CVE-2026-39312](https://cve.now/CVE-2026-39312.md): Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition (CVSS 7.5, SoftEtherVPN)
- [CVE-2026-23696](https://cve.now/CVE-2026-23696.md): Windmill \< 1.603.3 File Ownership Handling SQLi RCE (CVSS 9.4, Windmill Labs Windmill CE · Windmill Labs Windmill EE)
- [CVE-2026-22683](https://cve.now/CVE-2026-22683.md): Windmill \< 1.615.0 Operator Role Missing Authorization Checks RCE (CVSS 8.7, Windmill Labs Windmill CE · Windmill Labs Windmill EE)
- [CVE-2026-39307](https://cve.now/CVE-2026-39307.md): PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction (CVSS 8.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39308](https://cve.now/CVE-2026-39308.md): PraisonAI recipe registry publish path traversal allows out-of-root file write (CVSS 7.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39306](https://cve.now/CVE-2026-39306.md): PraisonAI recipe registry pull path traversal writes files outside the chosen output directory (CVSS 7.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39305](https://cve.now/CVE-2026-39305.md): Arbitrary File Write / Path Traversal in Action Orchestrator (CVSS 9.0, MervinPraison PraisonAI · praisonai)
- [CVE-2026-35615](https://cve.now/CVE-2026-35615.md): PraisonAI has a Path Traversal in FileTools (CVSS 9.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-32588](https://cve.now/CVE-2026-32588.md): Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing (CVSS 6.5, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2026-35614](https://cve.now/CVE-2026-35614.md): Frappe has a SQL injection in bulk\_update (CVSS 9.3, frappe)
- [CVE-2026-27315](https://cve.now/CVE-2026-27315.md): Apache Cassandra: cqlsh history sensitive information leak (CVSS 5.5, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2026-35613](https://cve.now/CVE-2026-35613.md): Path traversal in coursevault-preview due to improper base-directory boundary validation (CVSS 5.1, moritzmyrz coursevault-preview · coursevault-preview)
- [CVE-2026-35611](https://cve.now/CVE-2026-35611.md): Addressable has a Regular Expression Denial of Service in Addressable templates (CVSS 7.5, sporkmonger addressable · addressable)
- [CVE-2026-35608](https://cve.now/CVE-2026-35608.md): QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript execution (CVSS 5.3, RoastSlav quickdrop)
- [CVE-2025-14821](https://cve.now/CVE-2025-14821.md): Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows (CVSS 7.8, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-27314](https://cve.now/CVE-2026-27314.md): Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass (CVSS 8.8, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2026-35607](https://cve.now/CVE-2026-35607.md): File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands (CVSS 8.1, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-4631](https://cve.now/CVE-2026-4631.md): Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection (CVSS 9.8, Red Hat Enterprise Linux)
- [CVE-2026-35606](https://cve.now/CVE-2026-35606.md): File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check (CVSS 5.3, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2025-14944](https://cve.now/CVE-2025-14944.md): Backup Migration \<= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage (CVSS 5.3, inisev BackupBliss – Backup & Migration with Free Cloud Sto…)
- [CVE-2026-35605](https://cve.now/CVE-2026-35605.md): File Browser has an access rule bypass via HasPrefix without trailing separator in path matching (CVSS 6.3, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-35604](https://cve.now/CVE-2026-35604.md): File Browser share links remain accessible after Share/Download permissions are revoked (CVSS 8.2, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-35585](https://cve.now/CVE-2026-35585.md): File Browser has a Command Injection via Hook Runner (CVSS 7.5, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-35592](https://cve.now/CVE-2026-35592.md): pyLoad has an Incomplete Tar Path Traversal Fix in UnTar.\_safe\_extractall via os.path.commonprefix Bypass (CVSS 5.3, pyload · pyload-ng)
- [CVE-2026-35586](https://cve.now/CVE-2026-35586.md): Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng (CVSS 6.8, pyload · pyload-ng)
- [CVE-2026-35584](https://cve.now/CVE-2026-35584.md): FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration (CVSS 6.9, freescout-help-desk freescout)
- [CVE-2026-39384](https://cve.now/CVE-2026-39384.md): FreeScout Customer Merge Cross-Mailbox Authorization Bypass (CVSS 7.6, freescout-help-desk freescout)
- [CVE-2026-35523](https://cve.now/CVE-2026-35523.md): Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol (CVSS 7.5, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-35583](https://cve.now/CVE-2026-35583.md): Emissary has a Path Traversal via Blacklist Bypass in Configuration API (CVSS 5.3, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35581](https://cve.now/CVE-2026-35581.md): Emissary has a Command Injection via PLACE\_NAME Configuration in Executrix (CVSS 7.2, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35580](https://cve.now/CVE-2026-35580.md): Emissary has GitHub Actions Shell Injection via Workflow Inputs (CVSS 9.1, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35534](https://cve.now/CVE-2026-35534.md): ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection (CVSS 7.6, ChurchCRM CRM)
- [CVE-2026-35571](https://cve.now/CVE-2026-35571.md): Emissary has Stored XSS via Navigation Template Link Injection (CVSS 4.8, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-35526](https://cve.now/CVE-2026-35526.md): Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions (CVSS 7.5, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-4931](https://cve.now/CVE-2026-4931.md): CVE-2026-4931 (CVSS 6.8, Marginal Smart Contract)
- [CVE-2026-35521](https://cve.now/CVE-2026-35521.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-33816](https://cve.now/CVE-2026-33816.md): CVE-2026-33816 in github.com/jackc/pgx (CVSS 9.8, github.com/jackc/pgx/v5/pgproto3 · github.com/jackc/pgx/v5)
- [CVE-2026-33815](https://cve.now/CVE-2026-33815.md): CVE-2026-33815 in github.com/jackc/pgx (CVSS 9.8, github.com/jackc/pgx/v5/pgproto3 · github.com/jackc/pgx/v5)
- [CVE-2026-35520](https://cve.now/CVE-2026-35520.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-35519](https://cve.now/CVE-2026-35519.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-1079](https://cve.now/CVE-2026-1079.md): A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. (CVSS 6.0, Pegasystems Pega Browser Extension)
- [CVE-2026-35518](https://cve.now/CVE-2026-35518.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-35517](https://cve.now/CVE-2026-35517.md): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection (CVSS 8.8, pi-hole FTL)
- [CVE-2026-35516](https://cve.now/CVE-2026-35516.md): LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection (CVSS 5.0, Kovah LinkAce)
- [CVE-2025-24819](https://cve.now/CVE-2025-24819.md): A Relative Path Traversal vulnerability in Nokia MantaRay NM (CVSS 5.7, Nokia MantaRay NM)
- [CVE-2025-24818](https://cve.now/CVE-2025-24818.md): An OS Command Injection vulnerability in Nokia MantaRay NM (CVSS 8.0, Nokia MantaRay NM)
- [CVE-2025-24817](https://cve.now/CVE-2025-24817.md): An OS Command Injection vulnerability in Nokia MantaRay NM (CVSS 8.0, Nokia MantaRay NM)
- [CVE-2026-35515](https://cve.now/CVE-2026-35515.md): @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (CVSS 6.3, nestjs nest · @nestjs/core)
- [CVE-2026-1078](https://cve.now/CVE-2026-1078.md): An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. (CVSS 7.2, Pegasystems Pega Robot Studio)
- [CVE-2026-35492](https://cve.now/CVE-2026-35492.md): Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write (CVSS 6.5, kedro-org kedro-plugins · kedro-datasets)
- [CVE-2026-35491](https://cve.now/CVE-2026-35491.md): Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration (CVSS 6.1, pi-hole FTL)
- [CVE-2026-5745](https://cve.now/CVE-2026-5745.md): Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-35490](https://cve.now/CVE-2026-35490.md): changedetection.io has an Authentication Bypass via Decorator Ordering (CVSS 9.8, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2026-35489](https://cve.now/CVE-2026-35489.md): Tandoor Recipes — \`amount\`/\`unit\` bypass serializer in \`food/{id}/shopping/\` (CVSS 7.3, TandoorRecipes recipes)
- [CVE-2026-35488](https://cve.now/CVE-2026-35488.md): Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users (CVSS 8.1, TandoorRecipes recipes)
- [CVE-2026-35487](https://cve.now/CVE-2026-35487.md): text-generation-webui has a Path Traversal in load\_prompt() — .txt file read without authentication (CVSS 5.3, oobabooga text-generation-webui)
- [CVE-2026-35486](https://cve.now/CVE-2026-35486.md): text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation (CVSS 7.5, oobabooga text-generation-webui)
- [CVE-2026-35485](https://cve.now/CVE-2026-35485.md): text-generation-webui has a Path Traversal in load\_grammar() — arbitrary file read without authentication (CVSS 7.5, oobabooga text-generation-webui)
- [CVE-2026-35484](https://cve.now/CVE-2026-35484.md): text-generation-webui has a Path Traversal in load\_preset() — .yaml file read without authentication (CVSS 5.3, oobabooga text-generation-webui)
- [CVE-2026-35483](https://cve.now/CVE-2026-35483.md): text-generation-webui has a Path Traversal in load\_template() — .jinja/.yaml/.yml file read without authentication (CVSS 5.3, oobabooga text-generation-webui)
- [CVE-2026-35480](https://cve.now/CVE-2026-35480.md): go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers (CVSS 6.2, go-ipld-prime · github.com/ipld/go-ipld-prime)
- [CVE-2026-35464](https://cve.now/CVE-2026-35464.md): pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage\_folder enables arbitrary file write to Flask session store and code execution (CVSS 7.5, pyload · pyload-ng)
- [CVE-2026-35463](https://cve.now/CVE-2026-35463.md): pyLoad has Improper Neutralization of Special Elements used in an OS Command (CVSS 8.8, pyload · pyload-ng)
- [CVE-2026-4740](https://cve.now/CVE-2026-4740.md): Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation (CVSS 8.2, Red Hat multicluster engine for Kubernetes · open-cluster-m…)
- [CVE-2026-35462](https://cve.now/CVE-2026-35462.md): Papra Does Not Reject Expired API Keys (CVSS 4.3, papra-hq papra)
- [CVE-2026-35461](https://cve.now/CVE-2026-35461.md): Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL (CVSS 5.0, papra-hq papra)
- [CVE-2026-35460](https://cve.now/CVE-2026-35460.md): Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name (CVSS 4.3, papra-hq papra)
- [CVE-2026-35458](https://cve.now/CVE-2026-35458.md): Gotenberg has a ReDoS via extraHttpHeaders scope feature (CVSS 8.7, gotenberg · github.com/gotenberg/gotenberg/v7 +1)
- [CVE-2026-33034](https://cve.now/CVE-2026-33034.md): Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass (CVSS 7.5, djangoproject Django · django)
- [CVE-2026-33033](https://cve.now/CVE-2026-33033.md): Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (CVSS 6.5, djangoproject Django · django)
- [CVE-2026-4292](https://cve.now/CVE-2026-4292.md): Privilege abuse in ModelAdmin.list\_editable (CVSS 2.7, djangoproject Django · django)
- [CVE-2026-4277](https://cve.now/CVE-2026-4277.md): Privilege abuse in GenericInlineModelAdmin (CVSS 9.8, djangoproject Django · django)
- [CVE-2026-35457](https://cve.now/CVE-2026-35457.md): libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion (CVSS 8.2, rust-libp2p · libp2p-rendezvous)
- [CVE-2026-3902](https://cve.now/CVE-2026-3902.md): ASGI header spoofing via underscore/hyphen conflation (CVSS 7.5, djangoproject Django · django)
- [CVE-2026-35405](https://cve.now/CVE-2026-35405.md): libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers (CVSS 7.5, rust-libp2p · libp2p-rendezvous)
- [CVE-2026-5384](https://cve.now/CVE-2026-5384.md): runZero Platform incorrect credential scope (CVSS 5.8, runZero Platform)
- [CVE-2026-5383](https://cve.now/CVE-2026-5383.md): runZero Explorer missing authorization check (CVSS 4.4, runZero Explorer)
- [CVE-2026-5382](https://cve.now/CVE-2026-5382.md): runZero Platform MCP endpoint information leak (CVSS 3.0, runZero Platform)
- [CVE-2026-5381](https://cve.now/CVE-2026-5381.md): runZero Platform task information leak (CVSS 2.2, runZero Platform)
- [CVE-2026-5380](https://cve.now/CVE-2026-5380.md): runZero Platform cleartext secret exposure (CVSS 5.3, runZero Platform)
- [CVE-2026-5379](https://cve.now/CVE-2026-5379.md): runZero Platform MCP certification information leak (CVSS 3.0, runZero Platform)
- [CVE-2026-5378](https://cve.now/CVE-2026-5378.md): runZero Platform user creation leak (CVSS 5.8, runZero Platform)
- [CVE-2026-5376](https://cve.now/CVE-2026-5376.md): runZero Platform session timeout failure (CVSS 5.9, runZero Platform)
- [CVE-2026-5375](https://cve.now/CVE-2026-5375.md): runZero Platform API credential information leak (CVSS 2.7, runZero Platform)
- [CVE-2026-5374](https://cve.now/CVE-2026-5374.md): runZero Platform MCP information leak (CVSS 5.8, runZero Platform)
- [CVE-2026-5373](https://cve.now/CVE-2026-5373.md): runZero Platform superuser privilege escalation (CVSS 8.1, runZero Platform)
- [CVE-2026-5372](https://cve.now/CVE-2026-5372.md): runZero Platform SQL injection in saved queries (CVSS 6.4, runZero Platform)
- [CVE-2026-20911](https://cve.now/CVE-2026-20911.md): A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. (CVSS 9.8, LibRaw)
- [CVE-2026-21413](https://cve.now/CVE-2026-21413.md): A heap-based buffer overflow vulnerability exists in the lossless\_jpeg\_load\_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. (CVSS 9.8, LibRaw)
- [CVE-2026-20889](https://cve.now/CVE-2026-20889.md): A heap-based buffer overflow vulnerability exists in the x3f\_thumb\_loader functionality of LibRaw Commit d20315b. (CVSS 9.8, LibRaw)
- [CVE-2026-24660](https://cve.now/CVE-2026-24660.md): A heap-based buffer overflow vulnerability exists in the x3f\_load\_huffman functionality of LibRaw Commit d20315b. (CVSS 8.1, LibRaw)
- [CVE-2026-24450](https://cve.now/CVE-2026-24450.md): An integer overflow vulnerability exists in the uncompressed\_fp\_dng\_load\_raw functionality of LibRaw Commit 8dc68e2. (CVSS 8.1, LibRaw)
- [CVE-2026-20884](https://cve.now/CVE-2026-20884.md): An integer overflow vulnerability exists in the deflate\_dng\_load\_raw functionality of LibRaw Commit 8dc68e2. (CVSS 8.1, LibRaw)
- [CVE-2026-35554](https://cve.now/CVE-2026-35554.md): Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition (CVSS 8.7, Apache Software Foundation Apache Kafka Clients · org.apach…)
- [CVE-2026-5627](https://cve.now/CVE-2026-5627.md): Path Traversal in mintplex-labs/anything-llm (CVSS 9.1, mintplex-labs/anything-llm)
- [CVE-2026-33866](https://cve.now/CVE-2026-33866.md): Authorization Bypass in MLflow AJAX Endpoint (CVSS 5.3, Mlflow)
- [CVE-2026-33865](https://cve.now/CVE-2026-33865.md): Stored XSS via unsafe YAML parsing in MLflow (CVSS 5.1, Mlflow)
- [CVE-2026-22679](https://cve.now/CVE-2026-22679.md): Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint (CVSS 9.3, Weaver Network Co. E-cology)
- [CVE-2021-4473](https://cve.now/CVE-2021-4473.md): Tianxin Internet Behavior Management System Command Injection via toQuery.php (CVSS 9.3, Beijing Topsec Network Security Technology Co. Tianxin Inte…)
- [CVE-2026-5735](https://cve.now/CVE-2026-5735.md): Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5734](https://cve.now/CVE-2026-5734.md): Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5733](https://cve.now/CVE-2026-5733.md): Incorrect boundary conditions in the Graphics: WebGPU component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5732](https://cve.now/CVE-2026-5732.md): Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5731](https://cve.now/CVE-2026-5731.md): Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-22666](https://cve.now/CVE-2026-22666.md): Dolibarr ERP/CRM \< 23.0.2 Authenticated RCE via dol\_eval\_standard() (CVSS 8.6, Dolibarr ERP/CRM)
- [CVE-2026-28808](https://cve.now/CVE-2026-28808.md): ScriptAlias CGI targets bypass directory auth in inets httpd (mod\_auth vs mod\_cgi path mismatch) (CVSS 8.3, Erlang OTP)
- [CVE-2026-32144](https://cve.now/CVE-2026-32144.md): OCSP designated-responder authorization bypass via missing signature verification (CVSS 7.6, Erlang OTP)
- [CVE-2026-23818](https://cve.now/CVE-2026-23818.md): Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem (CVSS 8.8, Hewlett Packard Enterprise (HPE) Private 5G Core)
- [CVE-2025-39666](https://cve.now/CVE-2025-39666.md): omd: Local privilege escalation when executing omd commands as root (CVSS 9.3, Checkmk)
- [CVE-2026-3466](https://cve.now/CVE-2026-3466.md): Cross-site scripting in dashlet title (CVSS 8.5, Checkmk)
- [CVE-2026-31842](https://cve.now/CVE-2026-31842.md): Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling (CVSS 8.7, Tinyproxy Project Tinyproxy)
- [CVE-2026-4420](https://cve.now/CVE-2026-4420.md): Stored XSS via Page Creating functionality in Bludit (CVSS 5.1, Bludit)
- [CVE-2026-34903](https://cve.now/CVE-2026-34903.md): WordPress Ocean Extra plugin \<= 2.5.3 - Broken Access Control vulnerability (CVSS 5.4, OceanWP Ocean Extra)
- [CVE-2026-34899](https://cve.now/CVE-2026-34899.md): WordPress LTL Freight Quotes – Worldwide Express Edition plugin \<= 5.2.1 - Broken Access Control vulnerability (CVSS 5.3, Eniture technology LTL Freight Quotes – Worldwide Express E…)
- [CVE-2026-34904](https://cve.now/CVE-2026-34904.md): WordPress Simple Social Media Share Buttons plugin \<= 6.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.5, Analytify Simple Social Media Share Buttons)
- [CVE-2026-34896](https://cve.now/CVE-2026-34896.md): WordPress Under Construction, Coming Soon & Maintenance Mode plugin \<= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.5, Analytify Under Construction, Coming Soon & Maintenance Mode)
- [CVE-2026-33227](https://cve.now/CVE-2026-33227.md): Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory (CVSS 4.3, Apache Software Foundation Apache ActiveMQ Client · Apac… +7)
- [CVE-2026-28810](https://cve.now/CVE-2026-28810.md): Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver (CVSS 6.3, Erlang OTP)
- [CVE-2026-34197](https://cve.now/CVE-2026-34197.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans (CVSS 8.8, KEV, Apache Software Foundation Apache ActiveMQ Broker · Apac… +3)
- [CVE-2026-3177](https://cve.now/CVE-2026-3177.md): Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More \<= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook (CVSS 5.3, smub Charitable – Donation Plugin for WordPress – Fundraisi…)
- [CVE-2026-5465](https://cve.now/CVE-2026-5465.md): Amelia \<= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter (CVSS 8.8, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2026-1114](https://cve.now/CVE-2026-1114.md): Improper Access Control via Weak JWT Token in parisneo/lollms (CVSS 9.8, parisneo/lollms · lollms)
- [CVE-2026-4079](https://cve.now/CVE-2026-4079.md): SQL Chart Builder \< 2.3.8 - Unauthenticated SQL Injection (CVSS 6.5, SQL Chart Builder)
- [CVE-2026-1900](https://cve.now/CVE-2026-1900.md): Link Whisper Free \< 0.9.1 - Unauthenticated Settings and User Meta Update (CVSS 6.5, Link Whisper Free)
- [CVE-2025-15611](https://cve.now/CVE-2025-15611.md): Popup Box AYS Pro \< 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF (CVSS 5.4, Popup Box)
- [CVE-2025-65116](https://cve.now/CVE-2025-65116.md): Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM (CVSS 5.5, Hitachi JP1/IT Desktop Management 2 - Manager · Hitachi… +7)
- [CVE-2026-1839](https://cve.now/CVE-2026-1839.md): Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers (CVSS 6.5, huggingface/transformers · transformers)
- [CVE-2025-65115](https://cve.now/CVE-2025-65115.md): Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM (CVSS 8.8, Hitachi JP1/IT Desktop Management 2 - Manager · Hitachi… +7)
- [CVE-2026-0740](https://cve.now/CVE-2026-0740.md): Ninja Forms - File Upload \<= 3.3.26 - Unauthenticated Arbitrary File Upload (CVSS 9.8, SaturdayDrive Ninja Forms - File Uploads)
- [CVE-2026-20446](https://cve.now/CVE-2026-20446.md): In sec boot, there is a possible out of bounds write due to an integer overflow. (CVSS 4.3, MediaTek chipset)
- [CVE-2026-20433](https://cve.now/CVE-2026-20433.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, MediaTek chipset)
- [CVE-2026-20432](https://cve.now/CVE-2026-20432.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.0, MediaTek chipset)
- [CVE-2026-20431](https://cve.now/CVE-2026-20431.md): In Modem, there is a possible system crash due to a logic error. (CVSS 6.5, MediaTek chipset)
- [CVE-2026-5719](https://cve.now/CVE-2026-5719.md): itsourcecode Construction Management System borrowedtool.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2025-13044](https://cve.now/CVE-2025-13044.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.2, IBM Concert)
- [CVE-2024-36057](https://cve.now/CVE-2024-36057.md): Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. (CVSS 9.8)
- [CVE-2024-36058](https://cve.now/CVE-2024-36058.md): The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the PO (CVSS 9.8)
- [CVE-2025-52908](https://cve.now/CVE-2025-52908.md): An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580 (CVSS 9.8)
- [CVE-2025-52909](https://cve.now/CVE-2025-52909.md): An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580 (CVSS 9.8)
- [CVE-2025-56015](https://cve.now/CVE-2025-56015.md): In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint. (CVSS 7.5, genieacs)
- [CVE-2025-62818](https://cve.now/CVE-2025-62818.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, (CVSS 9.8)
- [CVE-2025-69515](https://cve.now/CVE-2025-69515.md): An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsifie (CVSS 9.1)
- [CVE-2025-70844](https://cve.now/CVE-2025-70844.md): yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1, kantorge/yaffa)
- [CVE-2025-71058](https://cve.now/CVE-2025-71058.md): Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate (CVSS 9.1)
- [CVE-2026-30079](https://cve.now/CVE-2026-30079.md): In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. (CVSS 9.8)
- [CVE-2026-30460](https://cve.now/CVE-2026-30460.md): Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module. (CVSS 8.8)
- [CVE-2026-31271](https://cve.now/CVE-2026-31271.md): megagao production\_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. (CVSS 9.8)
- [CVE-2026-31272](https://cve.now/CVE-2026-31272.md): MRCMS 3.1.2 contains an access control vulnerability. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.