CVEs published April 9, 2026
274 CVEs were published on April 9, 2026: 36 critical, 91 high. 2 are now in CISA KEV.
- Published
- 274
- Critical
- 36
- High
- 91
- Medium
- 129
- Low
- 18
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 167
Most affected products
- OpenClaw
- 25
- Juniper Networks Junos OS
- 18
- wolfSSL
- 16
- bytecodealliance wasmtime · wasmtime
- 12
- MervinPraison PraisonAI · praisonai
- 10
- Orthanc DICOM Server
- 9
- Totolink A7100RU
- 9
- code-projects Simple IT Discussion Forum
- 6
- D-Link DIR-605L
- 6
- Apache Software Foundation Apache Tomcat · org.apache.to… +2
- 5
Critical 36
- CVE-2026-34424Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access ToolkitNextendweb Smart Slider 3 Pro for WordPress · Nextendweb Sm…
- CVE-2026-40154PraisonAI Affected by Untrusted Remote Template Code ExecutionMervinPraison PraisonAI · praisonai
- CVE-2026-33784JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged accessJuniper Networks JSI LWC
- CVE-2026-40111PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)MervinPraison PraisonAIAgents · praisonaiagents
- CVE-2026-5978Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injectionTotolink A7100RU
- CVE-2026-5977Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injectionTotolink A7100RU
- CVE-2026-5976Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injectionTotolink A7100RU
- CVE-2025-13926Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security DecisionContemporary Controls BASControl20
- CVE-2026-5975Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injectionTotolink A7100RU
- CVE-2026-40088Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonaiMervinPraison PraisonAI · praisonai
- CVE-2026-40089Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API clientsonicverse-eu audiostreaming-stack
- CVE-2026-5194wolfSSL ECDSA Certificate VerificationwolfSSL
- CVE-2026-29145Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabledApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-35556Plaintext storage of a password in OpenPLC_V3OpenPLC_V3
- CVE-2026-28205Initialization of a resource with an insecure default in OpenPLC_V3OpenPLC_V3
- CVE-2026-34987Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory accessbytecodealliance wasmtime · wasmtime
- CVE-2026-34971Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Craneliftbytecodealliance wasmtime · wasmtime
- CVE-2026-39912v2board / Xboard Authentication Token Exposure via loginWithMailLinkv2board · cedar2025 Xboard
- CVE-2026-39987marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypassmarimo-team marimo · marimo
- CVE-2026-39980OpenCTI affected by RCE via notifier templateOpenCTI-Platform opencti · pycti
- CVE-2026-5442Heap Buffer Overflow in DICOM Image Decoder via VR UL DimensionsOrthanc DICOM Server
- CVE-2026-5443Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)Orthanc DICOM Server
- CVE-2026-5445Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)Orthanc DICOM Server
- CVE-2025-57735Apache Airflow: Airflow Logout Not Invalidating JWTApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-34179Update of type field in restricted TLS certificate allows privilege escalation to cluster adminCanonical lxd · github.com/canonical/lxd
- CVE-2026-34178Importing a crafted backup leads to project restriction bypassCanonical lxd · github.com/canonical/lxd
- CVE-2026-34177VM lowlevel restriction bypass via raw.apparmor and raw.qemu.confCanonical lxd · github.com/canonical/lxd
- CVE-2026-5854Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injectionTotolink A7100RU
- CVE-2026-5853Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injectionTotolink A7100RU
- CVE-2026-5852Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injectionTotolink A7100RU
- CVE-2026-5851Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injectionTotolink A7100RU
- CVE-2026-5850Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injectionTotolink A7100RU
- CVE-2026-1830Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Uploaddavidfcarr Quick Playground
- CVE-2025-50228Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
- CVE-2026-30479A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a craft
- CVE-2026-31170An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pa
High 91
- CVE-2026-5991Tenda F451 WrlExtraSet formWrlExtraSet stack-based overflowTenda F451
- CVE-2026-5990Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflowTenda F451
- CVE-2026-5989Tenda F451 RouteStatic fromRouteStatic stack-based overflowTenda F451
- CVE-2026-5988Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflowTenda F451
- CVE-2026-5984D-Link DIR-605L POST Request formSetLog buffer overflowD-Link DIR-605L
- CVE-2026-5983D-Link DIR-605L POST Request formSetDDNS buffer overflowD-Link DIR-605L
- CVE-2026-5264DTLS 1.3 ACK heap buffer overflowwolfSSL
- CVE-2026-33790Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart.Juniper Networks Junos OS
- CVE-2026-33785Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenarioJuniper Networks Junos OS
- CVE-2026-33778Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashesJuniper Networks Junos OS
- CVE-2026-33771CTP OS: Configuring password requirements does not work which permits the use of weak passwordsJuniper Networks CTP OS
- CVE-2025-13914Apstra: SSH host key validation vulnerability for managed devicesJuniper Networks Apstra
- CVE-2026-33797Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP resetJuniper Networks Junos OS
- CVE-2026-5982D-Link DIR-605L POST Request formAdvNetwork buffer overflowD-Link DIR-605L
- CVE-2026-21916Junos OS: A low privileged user can escalate their privileges so that they can login as rootJuniper Networks Junos OS
- CVE-2026-40153PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell ToolMervinPraison PraisonAIAgents · praisonaiagents
- CVE-2026-33788Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCsJuniper Networks Junos OS Evolved
- CVE-2026-35644OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway SnapshotsOpenClaw
- CVE-2026-35639OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope ValidationOpenClaw
- CVE-2026-35638OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UIOpenClaw
- CVE-2026-35636OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId ResolutionOpenClaw
- CVE-2026-35631OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat CommandsOpenClaw
- CVE-2026-35625OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth ReconnectOpenClaw
- CVE-2026-35618OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 VerificationOpenClaw
- CVE-2026-34512OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill EndpointOpenClaw
- CVE-2026-40150PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl ToolMervinPraison PraisonAIAgents · praisonaiagents
- CVE-2026-33793Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, a local low privileged user can compromise the systemJuniper Networks Junos OS
- CVE-2026-40149PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety ControlsMervinPraison PraisonAI · praisonai
- CVE-2026-40116PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate LimitsMervinPraison PraisonAI · praisonai
- CVE-2026-40114PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs APIMervinPraison PraisonAI · praisonai
- CVE-2026-40113PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsMervinPraison PraisonAI · praisonai
- CVE-2026-5263URI nameConstraints not enforced in ConfirmNameConstraints()wolfSSL
- CVE-2026-5981D-Link DIR-605L POST Request formAdvFirewall buffer overflowD-Link DIR-605L
- CVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Renderingsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-5980D-Link DIR-605L POST Request formSetMACFilter buffer overflowD-Link DIR-605L
- CVE-2023-54359WordPress adivaha Travel Plugin 2.3 SQL Injection via pidWordPress adivaha Travel Plugin
- CVE-2026-5979D-Link DIR-605L POST Request formVirtualServ buffer overflowD-Link DIR-605L
- CVE-2026-40093nimiq-blockchain is missing a wall-clock upper bound on block timestampsnimiq core-rs-albatross · nimiq-blockchain
- CVE-2026-4436GPL Odorizers GPL750 Missing Authentication for Critical FunctionGPL Odorizers GPL750
- CVE-2026-34487Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer tokenApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-34483Apache Tomcat: Incomplete escaping of JSON access logsApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-29146Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-29129Apache Tomcat: TLS cipher order is not preservedApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-24880Apache Tomcat: Request smuggling via invalid chunk extensionApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-39977flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence filesflatpak-builder
- CVE-2026-34734HDF5: H5T__conv_struct Use After FreeHDFGroup hdf5
- CVE-2026-35063Missing Authorization in OpenPLC_V3OpenPLC_V3
- CVE-2026-1584Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk bindergnutls · Red Hat Hardened Images +2
- CVE-2026-39911Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCEhashgraph guardian
- CVE-2026-5329Rapid7 Velociraptor Improper Input Validation in Client Message HandlerRapid7 Velociraptor
- CVE-2026-40070bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)sgbett bsv-ruby-sdk · sgbett bsv-sdk +3
- CVE-2026-40069bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcastssgbett bsv-ruby-sdk · bsv-sdk
- CVE-2026-39983FTP Command Injection via CRLF in basic-ftppatrickjuchli basic-ftp · basic-ftp
- CVE-2026-39981AGiXT has a Path Traversal in safe_join()Josh-XT AGiXT · agixt
- CVE-2026-39976Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokenslaravel passport · laravel/passport
- CVE-2026-39974n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP modeczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-39972Mercure has a Topic Selector Cache Key Collisiondunglas mercure · github.com/dunglas/mercure
- CVE-2026-39962LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variableMISP
- CVE-2026-39959Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of serviceTmds.DBus · Tmds.DBus.Protocol
- CVE-2026-39942Directus has a Path Traversal and Broken Access Control in File Management APIdirectus
- CVE-2026-40046Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validatedApache Software Foundation Apache ActiveMQ · org.apache.… +2
- CVE-2026-33266Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and SaltApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2026-34020Apache OpenMeetings: Login Credentials Passed via GET Query ParametersApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2026-39853osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verificationmtrojnar osslsigncode
- CVE-2026-39843Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetchingmakeplane plane
- CVE-2026-35205Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin installhelm · helm.sh/helm/v4
- CVE-2026-35204Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directoryhelm · helm.sh/helm/v4
- CVE-2026-5439Memory Exhaustion via Forged ZIP MetadataOrthanc DICOM Server
- CVE-2026-5437Out-of-Bounds Read in DicomStreamReaderOrthanc DICOM Server
- CVE-2026-5438Gzip Decompression Bomb via Content-Encoding HeaderOrthanc DICOM Server
- CVE-2026-5440Memory Exhaustion via Unbounded Content-LengthOrthanc DICOM Server
- CVE-2026-5444Heap Buffer Overflow in PAM Image Buffer AllocationOrthanc DICOM Server
- CVE-2026-5441Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)Orthanc DICOM Server
- CVE-2026-34578OPNsense has an LDAP Injection via Unsanitized Username in Authenticationopnsense core
- CVE-2026-5959GL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authenticationGL.iNet GL-RM1 · GL.iNet GL-RM10 +2
- CVE-2026-4116Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/CSonicWall SMA1000
- CVE-2026-4113An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN usSonicWall SMA1000
- CVE-2026-4112Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote SonicWall SMA1000
- CVE-2026-4660Go-getter may allow to arbitrary filesystem reads through git operationsHashiCorp Tooling · github.com/hashicorp/go-getter
- CVE-2024-1490Wago: Vulnerability in WBM through Open VPNWAGO CC100 · WAGO PFC100 G1 +6
- CVE-2026-34185SQL Injection in AlanWeb SCADAControl System AlanWeb SCADA
- CVE-2026-34184Missing Authorization inAlanWeb SCADAControl System AlanWeb SCADA
- CVE-2025-62188Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.Apache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2026-5844D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injectionD-Link DIR-882
- CVE-2026-5830Tenda AC15 SysToolChangePwd websGetVar stack-based overflowTenda AC15
- CVE-2026-4326Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'webilia Vertex Addons for Elementor
- CVE-2025-70364An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server.
- CVE-2025-70810Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function an
- CVE-2026-29923The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL reque
- CVE-2026-30478A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a c
Medium, low and unrated 147
- CVE-2026-5460Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3wolfSSL
- CVE-2026-54481-2 Byte Buffer Overflow in wolfSSL_X509_notAfter/notBeforewolfSSL
- CVE-2026-5392wolfSSL heap OOB read in PKCS7 SignedData streamingwolfSSL
- CVE-2026-5393OOB Read in DoTls13CertificateVerify with WOLFSSL_DUAL_ALG_CERTSwolfSSL
- CVE-2026-5295Stack Buffer Overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri() via Oversized OIDwolfSSL
- CVE-2026-5987Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engineSanluan PublicCMS
- CVE-2026-5503out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicNamewolfSSL
- CVE-2026-5504PKCS7 CBC Padding Oracle — Plaintext RecoverywolfSSL
- CVE-2026-5986Zod jsVideoUrlParser util.js getTime redosZod jsVideoUrlParser · js-video-url-parser
- CVE-2026-5507Session Cache Restore — Arbitrary Free via Deserialized PointerwolfSSL
- CVE-2026-5985code-projects Simple IT Discussion Forum crud.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-5772MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname ValidationwolfSSL
- CVE-2026-5778Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path.wolfSSL
- CVE-2026-39848Dockyard's Unauthenticated Cron Endpoint in Dockyard Enables Container Enumeration and Database Manipulation10ij dockyard
- CVE-2026-33791Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as rootJuniper Networks Junos OS
- CVE-2026-33787Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashesJuniper Networks Junos OS
- CVE-2026-33783Junos OS Evolved: PTX Series: If SRTE tunnels provisioned via PCEP are present and specific gRPC queries are received evo-aftmand crashesJuniper Networks Junos OS Evolved
- CVE-2026-33781Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passedJuniper Networks Junos OS
- CVE-2026-33776Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive informationJuniper Networks Junos OS
- CVE-2026-33774Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effectJuniper Networks Junos OS
- CVE-2026-33779Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communicationJuniper Networks Junos OS
- CVE-2026-33775Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgdJuniper Networks Junos OS
- CVE-2026-40151PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOSMervinPraison PraisonAI · praisonai
- CVE-2026-33782Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously with subscriber logoutsJuniper Networks Junos OS
- CVE-2026-33780Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2aldJuniper Networks Junos OS
- CVE-2026-33773Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not appliedJuniper Networks Junos OS
- CVE-2026-33786Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashesJuniper Networks Junos OS
- CVE-2026-35646OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token ValidationOpenClaw
- CVE-2026-35645OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSessionOpenClaw
- CVE-2026-35642OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention BypassOpenClaw
- CVE-2026-35640OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request ParsingOpenClaw
- CVE-2026-35637OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DMOpenClaw
- CVE-2026-35635OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology ChatOpenClaw
- CVE-2026-35634OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas GatewayOpenClaw
- CVE-2026-35633OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error ResponsesOpenClaw
- CVE-2026-35632OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updateOpenClaw
- CVE-2026-35629OpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel ExtensionsOpenClaw
- CVE-2026-35628OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate LimitingOpenClaw
- CVE-2026-35627OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM HandlingOpenClaw
- CVE-2026-35626OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call WebhookOpenClaw
- CVE-2026-35624OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud TalkOpenClaw
- CVE-2026-35623OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate LimitingOpenClaw
- CVE-2026-35622OpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat WebhookOpenClaw
- CVE-2026-35617OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayNameOpenClaw
- CVE-2026-40152PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace BoundaryMervinPraison PraisonAIAgents · praisonaiagents
- CVE-2026-21919Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting NETCONF sessions causes management unavailabilityJuniper Networks Junos OS
- CVE-2026-21915JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to rootJuniper Networks JSI LWC
- CVE-2026-21904Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injectionJuniper Networks Junos Space
- CVE-2025-59969Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast packets will cause evo-aftmand / evo-pfemand to crash and restartJuniper Networks Junos OS Evolved
- CVE-2026-40148PraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsMervinPraison PraisonAI · praisonai
- CVE-2026-40117PraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval GateMervinPraison PraisonAIAgents · praisonaiagents
- CVE-2026-40115PraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoSMervinPraison PraisonAI · praisonai
- CVE-2026-40112PraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)MervinPraison PraisonAI · praisonai
- CVE-2026-40109Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggeringfluxcd notification-controller · github.com/fluxcd/notifica…
- CVE-2026-5446wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reusewolfSSL
- CVE-2026-35206Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segmenthelm · helm.sh/helm/v3 +1
- CVE-2023-54364Joomla HikaShop 4.7.4 Reflected XSS via Product FilterJoomla HikaShop
- CVE-2023-54363Joomla Solidres 2.13.3 Reflected XSS via Multiple ParametersJoomla Solidres
- CVE-2023-54362Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keywordVirtuemart Cart
- CVE-2023-54361Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keywordThethinkery Joomla iProperty Real Estate
- CVE-2023-54360Joomla JLex Review 6.0.1 Reflected XSS via review_id ParameterJlexart Joomla JLex Review
- CVE-2023-54358WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobileWordPress adivaha Travel Plugin
- CVE-2026-5447Heap buffer overflow in CertFromX509() via AuthorityKeyIdentifierwolfSSL
- CVE-2026-5187Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSLwolfSSL
- CVE-2026-35577Missing Host Header Validation in Apollo MCP Server for Localhost Deploymentsapollographql apollo-mcp-server
- CVE-2026-34500Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2026-40087LangChain has incomplete f-string validation in prompt templateslangchain-ai langchain · langchain-core
- CVE-2026-5974FoundationAgents MetaGPT terminal.py Bash.run os command injectionFoundationAgents MetaGPT · metagpt
- CVE-2026-40077Beszel has an IDOR in hub API endpoints that read system ID from URL parameterhenrygd beszel · github.com/henrygd/beszel
- CVE-2026-32990Apache Tomcat: Fix for CVE-2025-66614 is incompleteApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-5973FoundationAgents MetaGPT common.py get_mime_type os command injectionFoundationAgents MetaGPT · metagpt
- CVE-2026-25854Apache Tomcat: Occasionally open redirectApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-5972FoundationAgents MetaGPT terminal.py Terminal.run_command os command injectionFoundationAgents MetaGPT · metagpt
- CVE-2026-35195Wasmtime has an out-of-bounds write or crash when transcoding component model stringsbytecodealliance wasmtime · wasmtime
- CVE-2026-35186Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backendbytecodealliance wasmtime · wasmtime
- CVE-2026-34988Wasmtime leaks data between pooling allocator instancesbytecodealliance wasmtime · wasmtime
- CVE-2026-34983Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`bytecodealliance wasmtime · wasmtime
- CVE-2026-34946Wasmtime's host panics when Winch compiler executes `table.fill`bytecodealliance wasmtime · wasmtime
- CVE-2026-34945Wasmtime leaks host data with 64-bit tables and Winchbytecodealliance wasmtime · wasmtime
- CVE-2026-34944Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64bytecodealliance wasmtime · wasmtime
- CVE-2026-34943Wasmtime panics when lifting `flags` component valuebytecodealliance wasmtime · wasmtime
- CVE-2026-34942Wasmtime panics when transcoding misaligned utf-16 stringsbytecodealliance wasmtime · wasmtime
- CVE-2026-34941Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcodingbytecodealliance wasmtime · wasmtime
- CVE-2026-5971FoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injectionFoundationAgents MetaGPT · metagpt
- CVE-2026-39315Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()unjs unhead · unhead
- CVE-2026-35207deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote serverlinuxdeepin dde-control-center · linuxdeepin deepin-deepini…
- CVE-2026-40072web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handlingethereum web3.py · web3
- CVE-2026-40071pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actionspyload · pyload-ng
- CVE-2026-39961Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSourceaiven-operator · github.com/aiven/aiven-operator
- CVE-2026-39985LORIS has an open redirect field on loginaces Loris
- CVE-2026-5970FoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check_solution code injectionFoundationAgents MetaGPT · metagpt
- CVE-2026-5962Tenda CH22 httpd R7WebsSecurityHandlerfunction path traversalTenda CH22
- CVE-2026-39958oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF InjectionAOSC-Dev oma
- CVE-2026-5961code-projects Simple IT Discussion Forum topic-details.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-39957Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized usersLycheeOrg Lychee
- CVE-2026-39943Directus exposes sensitive fields in revision historydirectus
- CVE-2026-39856osslsigncode has an Out-of-Bounds Read via Unvalidated Section Bounds in PE Page Hash Calculationmtrojnar osslsigncode
- CVE-2026-39855osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Readmtrojnar osslsigncode
- CVE-2026-33005Apache OpenMeetings: Insufficient checks in FileWebServiceApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2026-39941ChurchCRM has an XSS vulnerabilityChurchCRM CRM
- CVE-2026-5960code-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosurecode-projects Patient Record Management System
- CVE-2025-14551Senstive information disclosure was affecting subiquityCanonical Ubuntu · subiquity
- CVE-2025-15480Senstive information disclosure was affecting ubuntu-desktop-provisionCanonical Ubuntu
- CVE-2026-35041ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verificationnearform fast-jwt · fast-jwt
- CVE-2026-35040fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)nearform fast-jwt · fast-jwt
- CVE-2026-4878Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()Red Hat Enterprise Linux · Red Hat OpenShift Container P… +9
- CVE-2026-34757LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosurepnggroup libpng
- CVE-2025-62718Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFaxios
- CVE-2026-4114Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP aSonicWall SMA1000
- CVE-2026-2519Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'ladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-3005List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcodefernandobt List category posts
- CVE-2026-24661Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook EndpointMattermost · github.com/mattermost/mattermost-plugin-msteams
- CVE-2026-21388Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook EndpointMattermost · github.com/mattermost/mattermost-plugin-msteams
- CVE-2026-4901Insertion of Sesitive Information into Log File in AlanWeb SCADAControl System AlanWeb SCADA
- CVE-2026-34538Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-5849Tenda i12 HTTP path traversalTenda i12
- CVE-2026-5848jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injectionjeecgboot JimuReport
- CVE-2026-5847code-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosurecode-projects Movie Ticketing System
- CVE-2026-5842decolua 9router Administrative API Endpoint api authorizationdecolua 9router · 9router
- CVE-2026-5841Tenda i3 HTTP R7WebsSecurityHandler path traversalTenda i3
- CVE-2026-5840PHPGurukul News Portal Project check_availability.php sql injectionPHPGurukul News Portal Project
- CVE-2026-5839PHPGurukul News Portal Project add-subcategory.php sql injectionPHPGurukul News Portal Project
- CVE-2026-5838PHPGurukul News Portal Project add-subadmins.php sql injectionPHPGurukul News Portal Project
- CVE-2026-5742UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitutionstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2026-4336Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Contentrustaurius Ultimate FAQ Accordion Plugin
- CVE-2026-5837PHPGurukul News Portal Project news-details.php sql injectionPHPGurukul News Portal Project
- CVE-2026-5836code-projects Online Shoe Store admin_product.php cross site scriptingcode-projects Online Shoe Store
- CVE-2026-5835code-projects Online Shoe Store admin_football.php cross site scriptingcode-projects Online Shoe Store
- CVE-2026-5834code-projects Online Shoe Store admin_running.php cross site scriptingcode-projects Online Shoe Store
- CVE-2026-3568MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Updateinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2026-3574Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Settinguxdexperts Experto Dashboard for WooCommerce
- CVE-2026-4429OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attributephotoweblog OSM – OpenStreetMap
- CVE-2026-5357Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributescodename065 Download Manager
- CVE-2026-4124Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Actionoliverfriedmann Ziggeo
- CVE-2026-5833awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injectionawwaiid mcp-server-taskwarrior · mcp-server-taskwarrior
- CVE-2026-5832atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgeryatototo api-lab-mcp · api-lab-mcp
- CVE-2026-5831Agions taskflow-ai terminal_execute handlers.ts os command injectionAgions taskflow-ai · taskflow-ai
- CVE-2026-5829code-projects Simple IT Discussion Forum content.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-5828code-projects Simple IT Discussion Forum addcomment.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-5827code-projects Simple IT Discussion Forum question-function.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-5826code-projects Simple IT Discussion Forum edit-category.php cross site scriptingcode-projects Simple IT Discussion Forum
- CVE-2026-5825code-projects Simple Laundry System delmemberinfo.php cross site scriptingcode-projects Simple Laundry System
- CVE-2025-45806A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTM
- CVE-2025-63238A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter i
- CVE-2025-70365A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in admin
- CVE-2025-70797Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and
- CVE-2025-70811Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Pan