# CVEs published 2026-04-09

274 CVEs were published on April 9, 2026: 36 critical, 91 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-5991](https://cve.now/CVE-2026-5991.md): Tenda F451 WrlExtraSet formWrlExtraSet stack-based overflow (CVSS 8.7, Tenda F451)
- [CVE-2026-5990](https://cve.now/CVE-2026-5990.md): Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflow (CVSS 8.7, Tenda F451)
- [CVE-2026-5460](https://cve.now/CVE-2026-5460.md): Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3 (CVSS 6.3, wolfSSL)
- [CVE-2026-5448](https://cve.now/CVE-2026-5448.md): 1-2 Byte Buffer Overflow in wolfSSL\_X509\_notAfter/notBefore (CVSS 2.3, wolfSSL)
- [CVE-2026-5989](https://cve.now/CVE-2026-5989.md): Tenda F451 RouteStatic fromRouteStatic stack-based overflow (CVSS 8.7, Tenda F451)
- [CVE-2026-5392](https://cve.now/CVE-2026-5392.md): wolfSSL heap OOB read in PKCS7 SignedData streaming (CVSS 2.3, wolfSSL)
- [CVE-2026-5393](https://cve.now/CVE-2026-5393.md): OOB Read in DoTls13CertificateVerify with WOLFSSL\_DUAL\_ALG\_CERTS (CVSS 6.3, wolfSSL)
- [CVE-2026-5988](https://cve.now/CVE-2026-5988.md): Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow (CVSS 8.7, Tenda F451)
- [CVE-2026-34424](https://cve.now/CVE-2026-34424.md): Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit (CVSS 9.3, Nextendweb Smart Slider 3 Pro for WordPress · Nextendweb Sm…)
- [CVE-2026-5295](https://cve.now/CVE-2026-5295.md): Stack Buffer Overflow in wolfSSL PKCS7 wc\_PKCS7\_DecryptOri() via Oversized OID (CVSS 5.9, wolfSSL)
- [CVE-2026-5987](https://cve.now/CVE-2026-5987.md): Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine (CVSS 5.1, Sanluan PublicCMS)
- [CVE-2026-5503](https://cve.now/CVE-2026-5503.md): out-of-bounds write in TLSX\_EchChangeSNI via attacker-controlled publicName (CVSS 6.9, wolfSSL)
- [CVE-2026-5504](https://cve.now/CVE-2026-5504.md): PKCS7 CBC Padding Oracle — Plaintext Recovery (CVSS 6.3, wolfSSL)
- [CVE-2026-5986](https://cve.now/CVE-2026-5986.md): Zod jsVideoUrlParser util.js getTime redos (CVSS 6.9, Zod jsVideoUrlParser · js-video-url-parser)
- [CVE-2026-5507](https://cve.now/CVE-2026-5507.md): Session Cache Restore — Arbitrary Free via Deserialized Pointer (CVSS 4.1, wolfSSL)
- [CVE-2026-5985](https://cve.now/CVE-2026-5985.md): code-projects Simple IT Discussion Forum crud.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-5984](https://cve.now/CVE-2026-5984.md): D-Link DIR-605L POST Request formSetLog buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2026-5772](https://cve.now/CVE-2026-5772.md): MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation (CVSS 2.1, wolfSSL)
- [CVE-2026-5983](https://cve.now/CVE-2026-5983.md): D-Link DIR-605L POST Request formSetDDNS buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2026-5778](https://cve.now/CVE-2026-5778.md): Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path. (CVSS 2.1, wolfSSL)
- [CVE-2026-39848](https://cve.now/CVE-2026-39848.md): Dockyard's Unauthenticated Cron Endpoint in Dockyard Enables Container Enumeration and Database Manipulation (CVSS 6.5, 10ij dockyard)
- [CVE-2026-5264](https://cve.now/CVE-2026-5264.md): DTLS 1.3 ACK heap buffer overflow (CVSS 8.3, wolfSSL)
- [CVE-2026-40154](https://cve.now/CVE-2026-40154.md): PraisonAI Affected by Untrusted Remote Template Code Execution (CVSS 9.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-33791](https://cve.now/CVE-2026-33791.md): Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root (CVSS 6.7, Juniper Networks Junos OS)
- [CVE-2026-33790](https://cve.now/CVE-2026-33790.md): Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-33787](https://cve.now/CVE-2026-33787.md): Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashes (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2026-33785](https://cve.now/CVE-2026-33785.md): Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-33784](https://cve.now/CVE-2026-33784.md): JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access (CVSS 9.8, Juniper Networks JSI LWC)
- [CVE-2026-33783](https://cve.now/CVE-2026-33783.md): Junos OS Evolved: PTX Series: If SRTE tunnels provisioned via PCEP are present and specific gRPC queries are received evo-aftmand crashes (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-33781](https://cve.now/CVE-2026-33781.md): Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passed (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-33778](https://cve.now/CVE-2026-33778.md): Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashes (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-33776](https://cve.now/CVE-2026-33776.md): Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2026-33774](https://cve.now/CVE-2026-33774.md): Junos OS: MX Series: Firewall filters on lo0.\<non-0\> in the default routing instance are not in effect (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-33771](https://cve.now/CVE-2026-33771.md): CTP OS: Configuring password requirements does not work which permits the use of weak passwords (CVSS 7.4, Juniper Networks CTP OS)
- [CVE-2025-13914](https://cve.now/CVE-2025-13914.md): Apstra: SSH host key validation vulnerability for managed devices (CVSS 8.7, Juniper Networks Apstra)
- [CVE-2026-33797](https://cve.now/CVE-2026-33797.md): Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2026-33779](https://cve.now/CVE-2026-33779.md): Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-5982](https://cve.now/CVE-2026-5982.md): D-Link DIR-605L POST Request formAdvNetwork buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2026-33775](https://cve.now/CVE-2026-33775.md): Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-40151](https://cve.now/CVE-2026-40151.md): PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS (CVSS 5.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-33782](https://cve.now/CVE-2026-33782.md): Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously with subscriber logouts (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-33780](https://cve.now/CVE-2026-33780.md): Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-33773](https://cve.now/CVE-2026-33773.md): Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2026-33786](https://cve.now/CVE-2026-33786.md): Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2026-21916](https://cve.now/CVE-2026-21916.md): Junos OS: A low privileged user can escalate their privileges so that they can login as root (CVSS 7.3, Juniper Networks Junos OS)
- [CVE-2026-40153](https://cve.now/CVE-2026-40153.md): PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool (CVSS 7.4, MervinPraison PraisonAIAgents · praisonaiagents)
- [CVE-2026-33788](https://cve.now/CVE-2026-33788.md): Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs (CVSS 7.8, Juniper Networks Junos OS Evolved)
- [CVE-2026-35646](https://cve.now/CVE-2026-35646.md): OpenClaw \< 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation (CVSS 6.3, OpenClaw)
- [CVE-2026-35645](https://cve.now/CVE-2026-35645.md): OpenClaw \< 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession (CVSS 6.1, OpenClaw)
- [CVE-2026-35644](https://cve.now/CVE-2026-35644.md): OpenClaw \< 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots (CVSS 7.1, OpenClaw)
- [CVE-2026-35642](https://cve.now/CVE-2026-35642.md): OpenClaw \< 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass (CVSS 5.3, OpenClaw)
- [CVE-2026-35640](https://cve.now/CVE-2026-35640.md): OpenClaw \< 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing (CVSS 6.9, OpenClaw)
- [CVE-2026-35639](https://cve.now/CVE-2026-35639.md): OpenClaw \< 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation (CVSS 8.7, OpenClaw)
- [CVE-2026-35638](https://cve.now/CVE-2026-35638.md): OpenClaw \< 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI (CVSS 8.7, OpenClaw)
- [CVE-2026-35637](https://cve.now/CVE-2026-35637.md): OpenClaw \< 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM (CVSS 6.9, OpenClaw)
- [CVE-2026-35636](https://cve.now/CVE-2026-35636.md): OpenClaw 2026.3.11 \< 2026.3.25 - Session Isolation Bypass via sessionId Resolution (CVSS 7.1, OpenClaw)
- [CVE-2026-35635](https://cve.now/CVE-2026-35635.md): OpenClaw \< 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat (CVSS 6.3, OpenClaw)
- [CVE-2026-35634](https://cve.now/CVE-2026-35634.md): OpenClaw \< 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway (CVSS 5.1, OpenClaw)
- [CVE-2026-35633](https://cve.now/CVE-2026-35633.md): OpenClaw \< 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses (CVSS 6.9, OpenClaw)
- [CVE-2026-35632](https://cve.now/CVE-2026-35632.md): OpenClaw \< 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update (CVSS 6.9, OpenClaw)
- [CVE-2026-35631](https://cve.now/CVE-2026-35631.md): OpenClaw \< 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands (CVSS 7.1, OpenClaw)
- [CVE-2026-35629](https://cve.now/CVE-2026-35629.md): OpenClaw \< 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel Extensions (CVSS 5.3, OpenClaw)
- [CVE-2026-35628](https://cve.now/CVE-2026-35628.md): OpenClaw \< 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting (CVSS 6.3, OpenClaw)
- [CVE-2026-35627](https://cve.now/CVE-2026-35627.md): OpenClaw \< 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM Handling (CVSS 6.9, OpenClaw)
- [CVE-2026-35626](https://cve.now/CVE-2026-35626.md): OpenClaw \< 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook (CVSS 6.9, OpenClaw)
- [CVE-2026-35625](https://cve.now/CVE-2026-35625.md): OpenClaw \< 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect (CVSS 8.5, OpenClaw)
- [CVE-2026-35624](https://cve.now/CVE-2026-35624.md): OpenClaw \< 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk (CVSS 2.3, OpenClaw)
- [CVE-2026-35623](https://cve.now/CVE-2026-35623.md): OpenClaw \< 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting (CVSS 6.3, OpenClaw)
- [CVE-2026-35622](https://cve.now/CVE-2026-35622.md): OpenClaw \< 2026.3.22 - Improper Authentication Verification in Google Chat Webhook (CVSS 6.0, OpenClaw)
- [CVE-2026-35618](https://cve.now/CVE-2026-35618.md): OpenClaw \< 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification (CVSS 8.3, OpenClaw)
- [CVE-2026-35617](https://cve.now/CVE-2026-35617.md): OpenClaw \< 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName (CVSS 2.3, OpenClaw)
- [CVE-2026-34512](https://cve.now/CVE-2026-34512.md): OpenClaw \< 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint (CVSS 7.2, OpenClaw)
- [CVE-2026-40152](https://cve.now/CVE-2026-40152.md): PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list\_files Bypasses Workspace Boundary (CVSS 5.3, MervinPraison PraisonAIAgents · praisonaiagents)
- [CVE-2026-21919](https://cve.now/CVE-2026-21919.md): Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting NETCONF sessions causes management unavailability (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-21915](https://cve.now/CVE-2026-21915.md): JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root (CVSS 6.7, Juniper Networks JSI LWC)
- [CVE-2026-21904](https://cve.now/CVE-2026-21904.md): Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection (CVSS 6.1, Juniper Networks Junos Space)
- [CVE-2026-40150](https://cve.now/CVE-2026-40150.md): PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web\_crawl Tool (CVSS 7.7, MervinPraison PraisonAIAgents · praisonaiagents)
- [CVE-2025-59969](https://cve.now/CVE-2025-59969.md): Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast packets will cause evo-aftmand / evo-pfemand to crash and restart (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-33793](https://cve.now/CVE-2026-33793.md): Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, a local low privileged user can compromise the system (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2026-40149](https://cve.now/CVE-2026-40149.md): PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls (CVSS 7.9, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40148](https://cve.now/CVE-2026-40148.md): PraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits (CVSS 6.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40117](https://cve.now/CVE-2026-40117.md): PraisonAIAgents Affected by Arbitrary File Read via read\_skill\_file Missing Workspace Boundary and Approval Gate (CVSS 6.2, MervinPraison PraisonAIAgents · praisonaiagents)
- [CVE-2026-40116](https://cve.now/CVE-2026-40116.md): PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40115](https://cve.now/CVE-2026-40115.md): PraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoS (CVSS 6.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40114](https://cve.now/CVE-2026-40114.md): PraisonAI has Server-Side Request Forgery via Unvalidated webhook\_url in Jobs API (CVSS 7.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40113](https://cve.now/CVE-2026-40113.md): PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars (CVSS 8.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40112](https://cve.now/CVE-2026-40112.md): PraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency) (CVSS 5.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-5263](https://cve.now/CVE-2026-5263.md): URI nameConstraints not enforced in ConfirmNameConstraints() (CVSS 7.0, wolfSSL)
- [CVE-2026-5981](https://cve.now/CVE-2026-5981.md): D-Link DIR-605L POST Request formAdvFirewall buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2026-40111](https://cve.now/CVE-2026-40111.md): PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) (CVSS 9.3, MervinPraison PraisonAIAgents · praisonaiagents)
- [CVE-2026-40109](https://cve.now/CVE-2026-40109.md): Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering (CVSS 3.1, fluxcd notification-controller · github.com/fluxcd/notifica…)
- [CVE-2026-40107](https://cve.now/CVE-2026-40107.md): SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-5446](https://cve.now/CVE-2026-5446.md): wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse (CVSS 6.0, wolfSSL)
- [CVE-2026-35206](https://cve.now/CVE-2026-35206.md): Helm Chart extraction output directory collapse via \`Chart.yaml\` name dot-segment (CVSS 4.8, helm · helm.sh/helm/v3 +1)
- [CVE-2026-5980](https://cve.now/CVE-2026-5980.md): D-Link DIR-605L POST Request formSetMACFilter buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2023-54364](https://cve.now/CVE-2023-54364.md): Joomla HikaShop 4.7.4 Reflected XSS via Product Filter (CVSS 5.1, Joomla HikaShop)
- [CVE-2023-54363](https://cve.now/CVE-2023-54363.md): Joomla Solidres 2.13.3 Reflected XSS via Multiple Parameters (CVSS 5.1, Joomla Solidres)
- [CVE-2023-54362](https://cve.now/CVE-2023-54362.md): Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword (CVSS 5.1, Virtuemart Cart)
- [CVE-2023-54361](https://cve.now/CVE-2023-54361.md): Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter\_keyword (CVSS 5.1, Thethinkery Joomla iProperty Real Estate)
- [CVE-2023-54360](https://cve.now/CVE-2023-54360.md): Joomla JLex Review 6.0.1 Reflected XSS via review\_id Parameter (CVSS 5.1, Jlexart Joomla JLex Review)
- [CVE-2023-54359](https://cve.now/CVE-2023-54359.md): WordPress adivaha Travel Plugin 2.3 SQL Injection via pid (CVSS 8.8, WordPress adivaha Travel Plugin)
- [CVE-2023-54358](https://cve.now/CVE-2023-54358.md): WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile (CVSS 5.1, WordPress adivaha Travel Plugin)
- [CVE-2026-5979](https://cve.now/CVE-2026-5979.md): D-Link DIR-605L POST Request formVirtualServ buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2026-5978](https://cve.now/CVE-2026-5978.md): Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-40093](https://cve.now/CVE-2026-40093.md): nimiq-blockchain is missing a wall-clock upper bound on block timestamps (CVSS 8.1, nimiq core-rs-albatross · nimiq-blockchain)
- [CVE-2026-5977](https://cve.now/CVE-2026-5977.md): Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5447](https://cve.now/CVE-2026-5447.md): Heap buffer overflow in CertFromX509() via AuthorityKeyIdentifier (CVSS 6.3, wolfSSL)
- [CVE-2026-4436](https://cve.now/CVE-2026-4436.md): GPL Odorizers GPL750 Missing Authentication for Critical Function (CVSS 8.6, GPL Odorizers GPL750)
- [CVE-2026-5976](https://cve.now/CVE-2026-5976.md): Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2025-13926](https://cve.now/CVE-2025-13926.md): Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security Decision (CVSS 9.8, Contemporary Controls BASControl20)
- [CVE-2026-5187](https://cve.now/CVE-2026-5187.md): Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL (CVSS 2.3, wolfSSL)
- [CVE-2026-5975](https://cve.now/CVE-2026-5975.md): Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-40088](https://cve.now/CVE-2026-40088.md): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai (CVSS 9.7, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40089](https://cve.now/CVE-2026-40089.md): Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client (CVSS 9.9, sonicverse-eu audiostreaming-stack)
- [CVE-2026-35577](https://cve.now/CVE-2026-35577.md): Missing Host Header Validation in Apollo MCP Server for Localhost Deployments (CVSS 6.8, apollographql apollo-mcp-server)
- [CVE-2026-34500](https://cve.now/CVE-2026-34500.md): Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVSS 6.5, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2026-34487](https://cve.now/CVE-2026-34487.md): Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-34486](https://cve.now/CVE-2026-34486.md): Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor (CVSS 7.5, KEV, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2026-40087](https://cve.now/CVE-2026-40087.md): LangChain has incomplete f-string validation in prompt templates (CVSS 5.3, langchain-ai langchain · langchain-core)
- [CVE-2026-34483](https://cve.now/CVE-2026-34483.md): Apache Tomcat: Incomplete escaping of JSON access logs (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-5194](https://cve.now/CVE-2026-5194.md): wolfSSL ECDSA Certificate Verification (CVSS 9.3, wolfSSL)
- [CVE-2026-5974](https://cve.now/CVE-2026-5974.md): FoundationAgents MetaGPT terminal.py Bash.run os command injection (CVSS 6.9, FoundationAgents MetaGPT · metagpt)
- [CVE-2026-40077](https://cve.now/CVE-2026-40077.md): Beszel has an IDOR in hub API endpoints that read system ID from URL parameter (CVSS 3.5, henrygd beszel · github.com/henrygd/beszel)
- [CVE-2026-32990](https://cve.now/CVE-2026-32990.md): Apache Tomcat: Fix for CVE-2025-66614 is incomplete (CVSS 5.3, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-29146](https://cve.now/CVE-2026-29146.md): Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2026-29145](https://cve.now/CVE-2026-29145.md): Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVSS 9.1, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2026-29129](https://cve.now/CVE-2026-29129.md): Apache Tomcat: TLS cipher order is not preserved (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-5973](https://cve.now/CVE-2026-5973.md): FoundationAgents MetaGPT common.py get\_mime\_type os command injection (CVSS 6.9, FoundationAgents MetaGPT · metagpt)
- [CVE-2026-25854](https://cve.now/CVE-2026-25854.md): Apache Tomcat: Occasionally open redirect (CVSS 6.1, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-24880](https://cve.now/CVE-2026-24880.md): Apache Tomcat: Request smuggling via invalid chunk extension (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2026-39977](https://cve.now/CVE-2026-39977.md): flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files (CVSS 7.1, flatpak-builder)
- [CVE-2026-34734](https://cve.now/CVE-2026-34734.md): HDF5: H5T\_\_conv\_struct Use After Free (CVSS 7.8, HDFGroup hdf5)
- [CVE-2026-5972](https://cve.now/CVE-2026-5972.md): FoundationAgents MetaGPT terminal.py Terminal.run\_command os command injection (CVSS 6.9, FoundationAgents MetaGPT · metagpt)
- [CVE-2026-35063](https://cve.now/CVE-2026-35063.md): Missing Authorization in OpenPLC\_V3 (CVSS 8.7, OpenPLC\_V3)
- [CVE-2026-35556](https://cve.now/CVE-2026-35556.md): Plaintext storage of a password in OpenPLC\_V3 (CVSS 9.2, OpenPLC\_V3)
- [CVE-2026-35195](https://cve.now/CVE-2026-35195.md): Wasmtime has an out-of-bounds write or crash when transcoding component model strings (CVSS 6.1, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-28205](https://cve.now/CVE-2026-28205.md): Initialization of a resource with an insecure default in OpenPLC\_V3 (CVSS 9.2, OpenPLC\_V3)
- [CVE-2026-35186](https://cve.now/CVE-2026-35186.md): Wasmtime has an improperly masked return value from \`table.grow\` with Winch compiler backend (CVSS 6.1, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34988](https://cve.now/CVE-2026-34988.md): Wasmtime leaks data between pooling allocator instances (CVSS 2.3, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34987](https://cve.now/CVE-2026-34987.md): Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access (CVSS 9.0, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34983](https://cve.now/CVE-2026-34983.md): Wasmtime has a use-after-free bug after cloning \`wasmtime::Linker\` (CVSS 1.0, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34971](https://cve.now/CVE-2026-34971.md): Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift (CVSS 9.0, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34946](https://cve.now/CVE-2026-34946.md): Wasmtime's host panics when Winch compiler executes \`table.fill\` (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34945](https://cve.now/CVE-2026-34945.md): Wasmtime leaks host data with 64-bit tables and Winch (CVSS 2.3, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34944](https://cve.now/CVE-2026-34944.md): Wasmtime segfault or unused out-of-sandbox load with \`f64x2.splat\` operator on x86-64 (CVSS 4.1, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34943](https://cve.now/CVE-2026-34943.md): Wasmtime panics when lifting \`flags\` component value (CVSS 5.6, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-39912](https://cve.now/CVE-2026-39912.md): v2board / Xboard Authentication Token Exposure via loginWithMailLink (CVSS 9.1, v2board · cedar2025 Xboard)
- [CVE-2026-34942](https://cve.now/CVE-2026-34942.md): Wasmtime panics when transcoding misaligned utf-16 strings (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-34941](https://cve.now/CVE-2026-34941.md): Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding (CVSS 6.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-1584](https://cve.now/CVE-2026-1584.md): Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder (CVSS 7.5, gnutls · Red Hat Hardened Images +2)
- [CVE-2026-5971](https://cve.now/CVE-2026-5971.md): FoundationAgents MetaGPT XML action\_node.py ActionNode.xml\_fill eval injection (CVSS 6.9, FoundationAgents MetaGPT · metagpt)
- [CVE-2026-39911](https://cve.now/CVE-2026-39911.md): Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCE (CVSS 8.7, hashgraph guardian)
- [CVE-2026-39315](https://cve.now/CVE-2026-39315.md): Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() (CVSS 6.1, unjs unhead · unhead)
- [CVE-2026-5329](https://cve.now/CVE-2026-5329.md): Rapid7 Velociraptor Improper Input Validation in Client Message Handler (CVSS 8.5, Rapid7 Velociraptor)
- [CVE-2026-35207](https://cve.now/CVE-2026-35207.md): deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server (CVSS 5.4, linuxdeepin dde-control-center · linuxdeepin deepin-deepini…)
- [CVE-2026-40072](https://cve.now/CVE-2026-40072.md): web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling (CVSS 1.7, ethereum web3.py · web3)
- [CVE-2026-40071](https://cve.now/CVE-2026-40071.md): pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions (CVSS 5.4, pyload · pyload-ng)
- [CVE-2026-40070](https://cve.now/CVE-2026-40070.md): bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire\_certificate (direct and issuance paths) (CVSS 8.1, sgbett bsv-ruby-sdk · sgbett bsv-sdk +3)
- [CVE-2026-40069](https://cve.now/CVE-2026-40069.md): bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts (CVSS 7.5, sgbett bsv-ruby-sdk · bsv-sdk)
- [CVE-2026-39987](https://cve.now/CVE-2026-39987.md): marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass (CVSS 9.3, KEV, marimo-team marimo · marimo)
- [CVE-2026-39961](https://cve.now/CVE-2026-39961.md): Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource (CVSS 6.8, aiven-operator · github.com/aiven/aiven-operator)
- [CVE-2026-39985](https://cve.now/CVE-2026-39985.md): LORIS has an open redirect field on login (CVSS 4.3, aces Loris)
- [CVE-2026-39983](https://cve.now/CVE-2026-39983.md): FTP Command Injection via CRLF in basic-ftp (CVSS 8.6, patrickjuchli basic-ftp · basic-ftp)
- [CVE-2026-39981](https://cve.now/CVE-2026-39981.md): AGiXT has a Path Traversal in safe\_join() (CVSS 8.8, Josh-XT AGiXT · agixt)
- [CVE-2026-5970](https://cve.now/CVE-2026-5970.md): FoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check\_solution code injection (CVSS 6.9, FoundationAgents MetaGPT · metagpt)
- [CVE-2026-39980](https://cve.now/CVE-2026-39980.md): OpenCTI affected by RCE via notifier template (CVSS 9.1, OpenCTI-Platform opencti · pycti)
- [CVE-2026-39976](https://cve.now/CVE-2026-39976.md): Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens (CVSS 7.1, laravel passport · laravel/passport)
- [CVE-2026-39974](https://cve.now/CVE-2026-39974.md): n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode (CVSS 8.5, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-39972](https://cve.now/CVE-2026-39972.md): Mercure has a Topic Selector Cache Key Collision (CVSS 7.1, dunglas mercure · github.com/dunglas/mercure)
- [CVE-2026-39962](https://cve.now/CVE-2026-39962.md): LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable (CVSS 8.8, MISP)
- [CVE-2026-5962](https://cve.now/CVE-2026-5962.md): Tenda CH22 httpd R7WebsSecurityHandlerfunction path traversal (CVSS 6.9, Tenda CH22)
- [CVE-2026-39959](https://cve.now/CVE-2026-39959.md): Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service (CVSS 7.1, Tmds.DBus · Tmds.DBus.Protocol)
- [CVE-2026-39958](https://cve.now/CVE-2026-39958.md): oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection (CVSS 5.2, AOSC-Dev oma)
- [CVE-2026-5961](https://cve.now/CVE-2026-5961.md): code-projects Simple IT Discussion Forum topic-details.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-39957](https://cve.now/CVE-2026-39957.md): Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users (CVSS 2.3, LycheeOrg Lychee)
- [CVE-2026-39943](https://cve.now/CVE-2026-39943.md): Directus exposes sensitive fields in revision history (CVSS 6.5, directus)
- [CVE-2026-39942](https://cve.now/CVE-2026-39942.md): Directus has a Path Traversal and Broken Access Control in File Management API (CVSS 8.5, directus)
- [CVE-2026-39856](https://cve.now/CVE-2026-39856.md): osslsigncode has an Out-of-Bounds Read via Unvalidated Section Bounds in PE Page Hash Calculation (CVSS 5.5, mtrojnar osslsigncode)
- [CVE-2026-39855](https://cve.now/CVE-2026-39855.md): osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read (CVSS 5.5, mtrojnar osslsigncode)
- [CVE-2026-40046](https://cve.now/CVE-2026-40046.md): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated (CVSS 7.5, Apache Software Foundation Apache ActiveMQ · org.apache.… +2)
- [CVE-2026-33005](https://cve.now/CVE-2026-33005.md): Apache OpenMeetings: Insufficient checks in FileWebService (CVSS 4.3, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2026-33266](https://cve.now/CVE-2026-33266.md): Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt (CVSS 7.5, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2026-34020](https://cve.now/CVE-2026-34020.md): Apache OpenMeetings: Login Credentials Passed via GET Query Parameters (CVSS 7.5, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2026-39853](https://cve.now/CVE-2026-39853.md): osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification (CVSS 7.8, mtrojnar osslsigncode)
- [CVE-2026-39843](https://cve.now/CVE-2026-39843.md): Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching (CVSS 7.7, makeplane plane)
- [CVE-2026-39941](https://cve.now/CVE-2026-39941.md): ChurchCRM has an XSS vulnerability (CVSS 5.3, ChurchCRM CRM)
- [CVE-2026-5960](https://cve.now/CVE-2026-5960.md): code-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosure (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2026-35205](https://cve.now/CVE-2026-35205.md): Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install (CVSS 8.4, helm · helm.sh/helm/v4)
- [CVE-2025-14551](https://cve.now/CVE-2025-14551.md): Senstive information disclosure was affecting subiquity (CVSS 2.7, Canonical Ubuntu · subiquity)
- [CVE-2026-35204](https://cve.now/CVE-2026-35204.md): Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory (CVSS 8.4, helm · helm.sh/helm/v4)
- [CVE-2025-15480](https://cve.now/CVE-2025-15480.md): Senstive information disclosure was affecting ubuntu-desktop-provision (CVSS 2.7, Canonical Ubuntu)
- [CVE-2026-35041](https://cve.now/CVE-2026-35041.md): ReDoS in fast-jwt when using RegExp in allowed\* leading to CPU exhaustion during token verification (CVSS 4.2, nearform fast-jwt · fast-jwt)
- [CVE-2026-35040](https://cve.now/CVE-2026-35040.md): fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) (CVSS 5.3, nearform fast-jwt · fast-jwt)
- [CVE-2026-4878](https://cve.now/CVE-2026-4878.md): Libcap: libcap: privilege escalation via toctou race condition in cap\_set\_file() (CVSS 6.7, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +9)
- [CVE-2026-5439](https://cve.now/CVE-2026-5439.md): Memory Exhaustion via Forged ZIP Metadata (CVSS 7.5, Orthanc DICOM Server)
- [CVE-2026-5437](https://cve.now/CVE-2026-5437.md): Out-of-Bounds Read in DicomStreamReader (CVSS 7.5, Orthanc DICOM Server)
- [CVE-2026-5438](https://cve.now/CVE-2026-5438.md): Gzip Decompression Bomb via Content-Encoding Header (CVSS 7.5, Orthanc DICOM Server)
- [CVE-2026-5440](https://cve.now/CVE-2026-5440.md): Memory Exhaustion via Unbounded Content-Length (CVSS 7.5, Orthanc DICOM Server)
- [CVE-2026-5442](https://cve.now/CVE-2026-5442.md): Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions (CVSS 9.8, Orthanc DICOM Server)
- [CVE-2026-5443](https://cve.now/CVE-2026-5443.md): Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode) (CVSS 9.8, Orthanc DICOM Server)
- [CVE-2026-5445](https://cve.now/CVE-2026-5445.md): Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable) (CVSS 9.1, Orthanc DICOM Server)
- [CVE-2026-5444](https://cve.now/CVE-2026-5444.md): Heap Buffer Overflow in PAM Image Buffer Allocation (CVSS 7.1, Orthanc DICOM Server)
- [CVE-2026-5441](https://cve.now/CVE-2026-5441.md): Out-of-Bounds Read in DicomImageDecoder (PMSCT\_RLE1 Decompression) (CVSS 7.1, Orthanc DICOM Server)
- [CVE-2026-34757](https://cve.now/CVE-2026-34757.md): LIBPNG has a yse-after-free in png\_set\_PLTE, png\_set\_tRNS and png\_set\_hIST leading to corrupted chunk data and potential heap information disclosure (CVSS 5.1, pnggroup libpng)
- [CVE-2026-34578](https://cve.now/CVE-2026-34578.md): OPNsense has an LDAP Injection via Unsanitized Username in Authentication (CVSS 8.2, opnsense core)
- [CVE-2025-62718](https://cve.now/CVE-2025-62718.md): Axios has a NO\_PROXY Hostname Normalization Bypass that Leads to SSRF (CVSS 6.3, axios)
- [CVE-2026-5959](https://cve.now/CVE-2026-5959.md): GL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authentication (CVSS 7.5, GL.iNet GL-RM1 · GL.iNet GL-RM10 +2)
- [CVE-2026-4116](https://cve.now/CVE-2026-4116.md): Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/C (CVSS 7.2, SonicWall SMA1000)
- [CVE-2026-4114](https://cve.now/CVE-2026-4114.md): Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP a (CVSS 6.6, SonicWall SMA1000)
- [CVE-2026-4113](https://cve.now/CVE-2026-4113.md): An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN us (CVSS 7.2, SonicWall SMA1000)
- [CVE-2026-4112](https://cve.now/CVE-2026-4112.md): Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote (CVSS 7.2, SonicWall SMA1000)
- [CVE-2026-4660](https://cve.now/CVE-2026-4660.md): Go-getter may allow to arbitrary filesystem reads through git operations (CVSS 7.5, HashiCorp Tooling · github.com/hashicorp/go-getter)
- [CVE-2026-2519](https://cve.now/CVE-2026-2519.md): Online Scheduling and Appointment Booking System – Bookly \<= 27.0 - Unauthenticated Price Manipulation via 'tips' (CVSS 5.3, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-3005](https://cve.now/CVE-2026-3005.md): List category posts \<= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode (CVSS 6.4, fernandobt List category posts)
- [CVE-2025-57735](https://cve.now/CVE-2025-57735.md): Apache Airflow: Airflow Logout Not Invalidating JWT (CVSS 9.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-1490](https://cve.now/CVE-2024-1490.md): Wago: Vulnerability in WBM through Open VPN (CVSS 7.2, WAGO CC100 · WAGO PFC100 G1 +6)
- [CVE-2026-24661](https://cve.now/CVE-2026-24661.md): Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint (CVSS 3.7, Mattermost · github.com/mattermost/mattermost-plugin-msteams)
- [CVE-2026-21388](https://cve.now/CVE-2026-21388.md): Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint (CVSS 3.7, Mattermost · github.com/mattermost/mattermost-plugin-msteams)
- [CVE-2026-34185](https://cve.now/CVE-2026-34185.md): SQL Injection in AlanWeb SCADA (CVSS 8.7, Control System AlanWeb SCADA)
- [CVE-2026-34184](https://cve.now/CVE-2026-34184.md): Missing Authorization inAlanWeb SCADA (CVSS 8.8, Control System AlanWeb SCADA)
- [CVE-2026-4901](https://cve.now/CVE-2026-4901.md): Insertion of Sesitive Information into Log File in AlanWeb SCADA (CVSS 6.9, Control System AlanWeb SCADA)
- [CVE-2025-62188](https://cve.now/CVE-2025-62188.md): Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. (CVSS 7.5, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2026-34179](https://cve.now/CVE-2026-34179.md): Update of type field in restricted TLS certificate allows privilege escalation to cluster admin (CVSS 9.1, Canonical lxd · github.com/canonical/lxd)
- [CVE-2026-34178](https://cve.now/CVE-2026-34178.md): Importing a crafted backup leads to project restriction bypass (CVSS 9.1, Canonical lxd · github.com/canonical/lxd)
- [CVE-2026-34177](https://cve.now/CVE-2026-34177.md): VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf (CVSS 9.1, Canonical lxd · github.com/canonical/lxd)
- [CVE-2026-34538](https://cve.now/CVE-2026-34538.md): Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-5854](https://cve.now/CVE-2026-5854.md): Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5853](https://cve.now/CVE-2026-5853.md): Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5852](https://cve.now/CVE-2026-5852.md): Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5851](https://cve.now/CVE-2026-5851.md): Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5850](https://cve.now/CVE-2026-5850.md): Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5849](https://cve.now/CVE-2026-5849.md): Tenda i12 HTTP path traversal (CVSS 6.9, Tenda i12)
- [CVE-2026-5848](https://cve.now/CVE-2026-5848.md): jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection (CVSS 5.1, jeecgboot JimuReport)
- [CVE-2026-5847](https://cve.now/CVE-2026-5847.md): code-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosure (CVSS 5.3, code-projects Movie Ticketing System)
- [CVE-2026-5844](https://cve.now/CVE-2026-5844.md): D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection (CVSS 8.6, D-Link DIR-882)
- [CVE-2026-5842](https://cve.now/CVE-2026-5842.md): decolua 9router Administrative API Endpoint api authorization (CVSS 6.9, decolua 9router · 9router)
- [CVE-2026-5841](https://cve.now/CVE-2026-5841.md): Tenda i3 HTTP R7WebsSecurityHandler path traversal (CVSS 6.9, Tenda i3)
- [CVE-2026-5840](https://cve.now/CVE-2026-5840.md): PHPGurukul News Portal Project check\_availability.php sql injection (CVSS 5.1, PHPGurukul News Portal Project)
- [CVE-2026-5839](https://cve.now/CVE-2026-5839.md): PHPGurukul News Portal Project add-subcategory.php sql injection (CVSS 5.1, PHPGurukul News Portal Project)
- [CVE-2026-5838](https://cve.now/CVE-2026-5838.md): PHPGurukul News Portal Project add-subadmins.php sql injection (CVSS 5.1, PHPGurukul News Portal Project)
- [CVE-2026-5742](https://cve.now/CVE-2026-5742.md): UsersWP \<= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution (CVSS 6.4, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-4336](https://cve.now/CVE-2026-4336.md): Ultimate FAQ Accordion Plugin \<= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content (CVSS 6.4, rustaurius Ultimate FAQ Accordion Plugin)
- [CVE-2026-1830](https://cve.now/CVE-2026-1830.md): Quick Playground \<= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload (CVSS 9.8, davidfcarr Quick Playground)
- [CVE-2026-5837](https://cve.now/CVE-2026-5837.md): PHPGurukul News Portal Project news-details.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2026-5836](https://cve.now/CVE-2026-5836.md): code-projects Online Shoe Store admin\_product.php cross site scripting (CVSS 4.8, code-projects Online Shoe Store)
- [CVE-2026-5835](https://cve.now/CVE-2026-5835.md): code-projects Online Shoe Store admin\_football.php cross site scripting (CVSS 4.8, code-projects Online Shoe Store)
- [CVE-2026-5834](https://cve.now/CVE-2026-5834.md): code-projects Online Shoe Store admin\_running.php cross site scripting (CVSS 4.8, code-projects Online Shoe Store)
- [CVE-2026-3568](https://cve.now/CVE-2026-3568.md): MStore API \<= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2026-3574](https://cve.now/CVE-2026-3574.md): Experto Dashboard for WooCommerce \<= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting (CVSS 4.4, uxdexperts Experto Dashboard for WooCommerce)
- [CVE-2026-4429](https://cve.now/CVE-2026-4429.md): OSM \<= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker\_name' Shortcode Attribute (CVSS 6.4, photoweblog OSM – OpenStreetMap)
- [CVE-2026-5357](https://cve.now/CVE-2026-5357.md): Download Manager \<= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, codename065 Download Manager)
- [CVE-2026-4124](https://cve.now/CVE-2026-4124.md): Ziggeo \<= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo\_ajax' AJAX Action (CVSS 5.4, oliverfriedmann Ziggeo)
- [CVE-2026-5833](https://cve.now/CVE-2026-5833.md): awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection (CVSS 4.8, awwaiid mcp-server-taskwarrior · mcp-server-taskwarrior)
- [CVE-2026-5832](https://cve.now/CVE-2026-5832.md): atototo api-lab-mcp HTTP http-server.ts test\_http\_endpoint server-side request forgery (CVSS 6.9, atototo api-lab-mcp · api-lab-mcp)
- [CVE-2026-5831](https://cve.now/CVE-2026-5831.md): Agions taskflow-ai terminal\_execute handlers.ts os command injection (CVSS 5.3, Agions taskflow-ai · taskflow-ai)
- [CVE-2026-5830](https://cve.now/CVE-2026-5830.md): Tenda AC15 SysToolChangePwd websGetVar stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2026-4326](https://cve.now/CVE-2026-4326.md): Vertex Addons for Elementor \<= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb\_activate\_required\_plugins' (CVSS 8.8, webilia Vertex Addons for Elementor)
- [CVE-2026-5829](https://cve.now/CVE-2026-5829.md): code-projects Simple IT Discussion Forum content.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-5828](https://cve.now/CVE-2026-5828.md): code-projects Simple IT Discussion Forum addcomment.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-5827](https://cve.now/CVE-2026-5827.md): code-projects Simple IT Discussion Forum question-function.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-5826](https://cve.now/CVE-2026-5826.md): code-projects Simple IT Discussion Forum edit-category.php cross site scripting (CVSS 5.3, code-projects Simple IT Discussion Forum)
- [CVE-2026-5825](https://cve.now/CVE-2026-5825.md): code-projects Simple Laundry System delmemberinfo.php cross site scripting (CVSS 5.3, code-projects Simple Laundry System)
- [CVE-2025-45806](https://cve.now/CVE-2025-45806.md): A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTM (CVSS 6.1)
- [CVE-2025-50228](https://cve.now/CVE-2025-50228.md): Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules. (CVSS 9.1)
- [CVE-2025-63238](https://cve.now/CVE-2025-63238.md): A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter i (CVSS 6.1)
- [CVE-2025-70364](https://cve.now/CVE-2025-70364.md): An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server. (CVSS 8.8)
- [CVE-2025-70365](https://cve.now/CVE-2025-70365.md): A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in admin (CVSS 5.4)
- [CVE-2025-70797](https://cve.now/CVE-2025-70797.md): Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box\[title\] and (CVSS 6.1)
- [CVE-2025-70810](https://cve.now/CVE-2025-70810.md): Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function an (CVSS 8.8)
- [CVE-2025-70811](https://cve.now/CVE-2025-70811.md): Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Pan (CVSS 4.3)
- [CVE-2026-29923](https://cve.now/CVE-2026-29923.md): The pstrip64.sys driver in EnTech Taiwan PowerStrip \<=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL reque (CVSS 7.8)
- [CVE-2026-30478](https://cve.now/CVE-2026-30478.md): A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a c (CVSS 8.8)
- [CVE-2026-30479](https://cve.now/CVE-2026-30479.md): A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a craft (CVSS 9.1)
- [CVE-2026-31170](https://cve.now/CVE-2026-31170.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the stun-pa (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.