CVEs published April 10, 2026
213 CVEs were published on April 10, 2026: 27 critical, 71 high.
- Published
- 213
- Critical
- 27
- High
- 71
- Medium
- 106
- Low
- 8
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 138
Most affected products
- OpenClaw
- 30
- chamilo-lms
- 23
- go-vikunja vikunja · code.vikunja.io/api
- 11
- Totolink A7100RU
- 10
- systemd
- 6
- wolfSSL
- 6
- code-projects Vehicle Showroom Management System
- 5
- MervinPraison PraisonAI · praisonai
- 4
- Apache Software Foundation Apache Log4j Core · org.apache.l…
- 3
- Checkmk
- 3
Critical 27
- CVE-2026-40189goshs has a file-based ACL authorization bypass in goshs state-changing routespatrickhener goshs · github.com/patrickhener/goshs
- CVE-2026-40177Password bypass when 2FA is activatedajenti · ajenti-plugin-core
- CVE-2026-33707Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lmschamilo-lms
- CVE-2026-33698Chamilo LMS affected by unauthenticated RCE in main/install folderchamilo-lms
- CVE-2026-32892OS Command Injection in Chamilo LMS 1.11.36chamilo-lms
- CVE-2026-40157PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`MervinPraison PraisonAI · praisonai
- CVE-2026-5412Juju CloudSpec API could leak senstive informationCanonical Juju · github.com/juju/juju
- CVE-2026-6057Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code ExecutionFalkorDB Browser
- CVE-2026-6029Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injectionTotolink A7100RU
- CVE-2026-1115Stored XSS in parisneo/lollmsparisneo/lollms · lollms
- CVE-2026-6028Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injectionTotolink A7100RU
- CVE-2026-6027Totolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injectionTotolink A7100RU
- CVE-2026-6026Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injectionTotolink A7100RU
- CVE-2026-6025Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injectionTotolink A7100RU
- CVE-2026-5997Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injectionTotolink A7100RU
- CVE-2026-5996Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injectionTotolink A7100RU
- CVE-2026-5995Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injectionTotolink A7100RU
- CVE-2026-5994Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injectionTotolink A7100RU
- CVE-2026-5993Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injectionTotolink A7100RU
- CVE-2025-44560owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.
- CVE-2026-23781An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.
- CVE-2026-29861PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php.
- CVE-2026-36232A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0.
- CVE-2026-36233A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0.
- CVE-2026-36234itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter.
- CVE-2026-36235A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0.
- CVE-2026-36236SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update_password.php via the new_password parameter.
High 71
- CVE-2026-40198Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypassSTIGTSP Net::CIDR::Lite
- CVE-2026-40242Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpointgetarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2026-40188goshs is Missing Write Protection for Parametric Data Valuespatrickhener goshs · github.com/patrickhener/goshs
- CVE-2026-40185Missing Authorization on Immich Trip Photo Routes in TREKmauriceboe TREK
- CVE-2026-40180Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper classquarkiverse quarkus-openapi-generator · io.quarkiverse.open…
- CVE-2026-40168Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/streamgitroomhq postiz-app
- CVE-2026-32252Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`chartbrew
- CVE-2026-30232Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLschartbrew
- CVE-2026-33710Chamilo LMS has Weak REST API Key Generation (Predictable)chamilo-lms
- CVE-2026-33706Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)chamilo-lms
- CVE-2026-33704Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpointchamilo-lms
- CVE-2026-33703Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokenschamilo-lms
- CVE-2026-33702Chamilo LMS has an Insecure Direct Object Reference (IDOR)chamilo-lms
- CVE-2026-33618Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settingschamilo-lms
- CVE-2026-32931Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCEchamilo-lms
- CVE-2026-32930Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Checkchamilo-lms
- CVE-2026-32894Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Resultchamilo-lms
- CVE-2026-31941Server-Side Request Forgery (SSRF) in Chamilo LMSchamilo-lms
- CVE-2026-31940Session Fixation in Chamilo LMSchamilo-lms
- CVE-2026-5483Odh-dashboard: odh dashboard kubernetes service account exposureRed Hat OpenShift AI
- CVE-2026-31939Path Traversal (Arbitrary File Delete) in Chamilo LMSchamilo-lms
- CVE-2026-40163Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory readsaltcorn · @saltcorn/server
- CVE-2026-40162Bugsink affected by authenticated arbitrary file write in artifactbundle/assemblebugsink
- CVE-2026-40160PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallbackMervinPraison PraisonAIAgents · praisonaiagents
- CVE-2026-40158PraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonaiMervinPraison PraisonAI · praisonai
- CVE-2026-40156PraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` LoadingMervinPraison PraisonAI · praisonai
- CVE-2026-40073SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-nodesveltejs kit · @sveltejs/kit
- CVE-2026-35669OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication ScopeOpenClaw
- CVE-2026-35668OpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl ParametersOpenClaw
- CVE-2026-35666OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch WrapperOpenClaw
- CVE-2026-35663OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-ClaimOpenClaw
- CVE-2026-35660OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session ResetOpenClaw
- CVE-2026-35657OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History RouteOpenClaw
- CVE-2026-35653OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.requestOpenClaw
- CVE-2026-35650OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationOpenClaw
- CVE-2026-35643OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterfaceOpenClaw
- CVE-2026-35641OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook InstallationOpenClaw
- CVE-2026-35621OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist PersistenceOpenClaw
- CVE-2026-35595Vikunja Affected by Privilege Escalation via Project Reparentinggo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-34727Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Pathgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-29002CouchCMS Privilege Escalation via f_k_levels_list ParameterCouchCMS
- CVE-2026-40217LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.BerriAI LiteLLM · litellm
- CVE-2026-6069CVE-2026-6069NASM
- CVE-2026-6067CVE-2026-6067NASM
- CVE-2025-58920WordPress Cerato theme <= 2.2.18 - Reflected Cross Site Scripting (XSS) vulnerabilityZootemplate Cerato
- CVE-2025-58913WordPress VideoPro theme <= 2.3.8.1 - Local File Inclusion vulnerabilityCactusThemes VideoPro
- CVE-2025-5804WordPress Case Theme User < 1.0.4 - Local File Inclusion VulnerabilityCase Themes Case Theme User
- CVE-2026-33092Local privilege escalation due to improper handling of environment variables.Acronis True Image OEM · Acronis True Image
- CVE-2026-5777Security Misconfiguration Vulnerability in Atom 3x ProjectorEGate Atom 3X Projector
- CVE-2026-39304Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMApache Software Foundation Apache ActiveMQ Client · Apac… +6
- CVE-2026-4162Gravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin UninstallRocketGenius Gravity SMTP
- CVE-2021-47961A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence Synology SSL VPN Client
- CVE-2026-22750SSL bundle configuration silently bypassed in Spring Cloud GatewayVMware Spring Cloud Gateway · org.springframework.cloud:spr…
- CVE-2026-28704Emocheck insecurely loads Dynamic Link Libraries (DLLs).Japan Computer Emergency Response Team Coordination Center…
- CVE-2026-5477Prefix-substitution forgery via integer overflow in wolfCrypt CMACwolfSSL
- CVE-2026-6016Tenda AC9 POST Request WizardHandle decodePwd stack-based overflowTenda AC9
- CVE-2026-6015Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflowTenda AC9
- CVE-2026-6014D-Link DIR-513 POST Request formAdvanceSetup buffer overflowD-Link DIR-513
- CVE-2026-6013D-Link DIR-513 POST Request formSetRoute buffer overflowD-Link DIR-513
- CVE-2026-6012D-Link DIR-513 POST Request formSetPassword buffer overflowD-Link DIR-513
- CVE-2026-5500Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication BypasswolfSSL
- CVE-2026-5501Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf CertificateswolfSSL
- CVE-2026-5466wc_VerifyEccsiHash missing sanity checkwolfSSL
- CVE-2026-5479wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tagwolfSSL
- CVE-2026-4351Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' ParameterPerfmatters
- CVE-2026-3360Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-25203Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: lSamsung Electronics MagicINFO 9 Server
- CVE-2026-5992Tenda F451 P2pListFilter fromP2pListFilter stack-based overflowTenda F451
- CVE-2026-23780An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.
- CVE-2026-23782An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.
- CVE-2026-40200An issue was discovered in musl libc 0.7.10 through 1.2.6.musl-libc musl
Medium, low and unrated 115
- CVE-2026-40199Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypassSTIGTSP Net::CIDR::Lite
- CVE-2026-33118Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-33119Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2026-5724Missing Authentication on Streaming gRPC Replication EndpointTemporal Technologies temporal · go.temporal.io/server
- CVE-2026-40252Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPTlabring FastGPT
- CVE-2026-40194phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()phpseclib · phpseclib/phpseclib
- CVE-2026-40191ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source pathcraigjbass clearancekit
- CVE-2026-39922GeoNode SSRF via Service RegistrationGeoNode
- CVE-2026-39921GeoNode < 4.4.5, 5.0.2 SSRF via Document UploadGeoNode
- CVE-2026-40190LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`langchain-ai langsmith-sdk · langsmith
- CVE-2026-40184Unauthenticated Access to Uploaded Files in TREKmauriceboe TREK
- CVE-2026-40178ajenti.plugin.core has a race conditions in 2FAajenti · ajenti-plugin-core
- CVE-2026-40175Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chainaxios
- CVE-2026-27460Tandoor Recipes Affected by Denial of Service via Recipe ImportTandoorRecipes recipes
- CVE-2026-33737Chamilo LMS has an XML External Entity (XXE) Injectionchamilo-lms
- CVE-2026-33736Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposurechamilo-lms
- CVE-2026-33708Chamilo LMS has REST API PII Exposure via get_user_info_from_usernamechamilo-lms
- CVE-2026-33705Chamilo LMS has unauthenticated access to Twig template source files exposes application logicchamilo-lms
- CVE-2026-3446Base64 decoding stops at first padded quad by defaultPython Software Foundation CPython
- CVE-2026-33141Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Datachamilo-lms
- CVE-2026-1502HTTP client proxy tunnel headers not validated for CR/LFPython Software Foundation CPython
- CVE-2026-32932Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Editchamilo-lms
- CVE-2026-32893Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Paginationchamilo-lms
- CVE-2025-66447Chamilo LMS has validation-less redirect on login pagechamilo-lms
- CVE-2026-22560An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameRocket.Chat
- CVE-2026-40159PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess ExecutionMervinPraison PraisonAI · praisonai
- CVE-2026-40100FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP defaultlabring FastGPT
- CVE-2026-40097Step CA affected by an index out of bounds panic in TPM attestation EKU validationsmallstep certificates · github.com/smallstep/certificates
- CVE-2026-40074SvelteKit's invalidated redirect in handle hook causes Denial-of-Servicesveltejs kit · @sveltejs/kit
- CVE-2026-40086Rembg has a Path Traversal via Custom Model Loadingdanielgatis rembg · rembg
- CVE-2026-40103Vikunja's Scoped API tokens with projects.background permission can delete project backgroundsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35602Vikunja has a File Size Limit Bypass via Vikunja Importgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35601Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Outputgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35600Vikunja has HTML Injection via Task Titles in Overdue Email Notificationsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35599Vikunja has an Algorithmic Complexity DoS in Repeating Task Handlergo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35598Vikunja has Missing Authorization on CalDAV Task Readgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35670OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology ChatOpenClaw
- CVE-2026-35667OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.tsOpenClaw
- CVE-2026-35665OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body ParsingOpenClaw
- CVE-2026-35664OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card CallbacksOpenClaw
- CVE-2026-35662OpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send ActionOpenClaw
- CVE-2026-35661OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization BypassOpenClaw
- CVE-2026-35659OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD DiscoveryOpenClaw
- CVE-2026-35658OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image ToolOpenClaw
- CVE-2026-35597Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockoutgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35656OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate LimiterOpenClaw
- CVE-2026-35655OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission ResolutionOpenClaw
- CVE-2026-35654OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback InvokeOpenClaw
- CVE-2026-35652OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback DispatchOpenClaw
- CVE-2026-35651OpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval PromptOpenClaw
- CVE-2026-35649OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty AllowlistOpenClaw
- CVE-2026-35648OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node ActionsOpenClaw
- CVE-2026-35647OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification NoticesOpenClaw
- CVE-2026-35620OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat CommandsOpenClaw
- CVE-2026-35619OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models EndpointOpenClaw
- CVE-2026-35596Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Buggo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-35594Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradego-vikunja vikunja · code.vikunja.io/api
- CVE-2026-40228In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is execsystemd
- CVE-2026-40023Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden charactersApache Software Foundation Apache Log4cxx
- CVE-2026-40021Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden charactersApache Software Foundation Apache Log4net · log4net
- CVE-2026-34481Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayoutApache Software Foundation Apache Log4j JSON Template Layou…
- CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2026-34479Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersApache Software Foundation Apache Log4j 1 to Log4j 2 bridge…
- CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibilityApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2026-34477Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypassApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2026-29043HDF5 H5T__ref_mem_setnull Heap Buffer OverflowHDFGroup hdf5
- CVE-2026-40227In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.systemd
- CVE-2026-40226In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.systemd
- CVE-2026-40225In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.systemd
- CVE-2026-40224In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.systemd
- CVE-2026-40223In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.systemd
- CVE-2026-6068CVE-2026-6068NASM
- CVE-2026-5774Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token MapCanonical Juju · github.com/juju/juju
- CVE-2026-31412usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()Linux
- CVE-2021-47960A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to Synology SSL VPN Client
- CVE-2026-6042musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexitymusl libc
- CVE-2026-6038code-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-33457Potential livestatus injection in prediction graph pageCheckmk
- CVE-2026-33456Potential livestatus injection in notification testCheckmk
- CVE-2026-33455Livestatus injection in monitoring quicksearchCheckmk
- CVE-2026-6037code-projects Vehicle Showroom Management System AddVehicleFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6036code-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6035code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scriptingcode-projects Vehicle Showroom Management System
- CVE-2026-6034code-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scriptingcode-projects Vehicle Showroom Management System
- CVE-2026-5525Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoSNotepad++ Project Notepad++
- CVE-2026-6033CodeAstro Online Classroom updatedetailsfromstudent.php sql injectionCodeAstro Online Classroom
- CVE-2026-6032code-projects Simple Laundry System checkcheckout.php cross site scriptingcode-projects Simple Laundry System
- CVE-2026-6031code-projects Simple IT Discussion Forum add-category-function.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-6030itsourcecode Construction Management System del1.php sql injectionitsourcecode Construction Management System
- CVE-2026-4432YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDORYITH WooCommerce Wishlist
- CVE-2025-14545YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed GenerationYML for Yandex Market
- CVE-2026-6024Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversalTenda i6
- CVE-2026-4482Insight Agent Private Key Information Disclosure via Inherited File PermissionsRapid7 Insight Agent
- CVE-2026-6011OpenClaw assertPublicHostname web-fetch.ts server-side request forgeryOpenClaw
- CVE-2026-2305AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom FieldsAddFunc Head & Footer Code
- CVE-2026-6010CodeAstro Online Classroom takeassessment2.php sql injectionCodeAstro Online Classroom
- CVE-2026-5188Integer underflow in X.509 SAN parsing in wolfSSLwolfSSL
- CVE-2026-6007itsourcecode Construction Management System del.php sql injectionitsourcecode Construction Management System
- CVE-2026-6006code-projects Patient Record Management System edit_hpatient.php sql injectioncode-projects Patient Record Management System
- CVE-2026-6005code-projects Patient Record Management System hematology_print.php sql injectioncode-projects Patient Record Management System
- CVE-2026-6004code-projects Simple IT Discussion Forum delete-category.php sql injectioncode-projects Simple IT Discussion Forum
- CVE-2026-6003code-projects Simple IT Discussion Forum user.php cross site scriptingcode-projects Simple IT Discussion Forum
- CVE-2026-6000code-projects Online Library Management System SQL Database Backup File library.sql information disclosurecode-projects Online Library Management System
- CVE-2026-5999JeecgBoot SysAnnouncementController improper authorizationJeecgBoot
- CVE-2026-5998zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversalzhayujie chatgpt-on-wechat CowAgent
- CVE-2026-4305Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameterwproyal Royal WordPress Backup, Restore & Migration Plugin…
- CVE-2026-4977UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameterstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2026-1924Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Resetarubadev Aruba HiSpeed Cache
- CVE-2026-1263Webling <= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameterusystemsgmbh Webling
- CVE-2026-4057Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removalcodename065 Download Manager
- CVE-2026-2712WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulationdavidanderson WP-Optimize – Cache, Compress images, Minify…
- CVE-2026-4664Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameterivole Customer Reviews for WooCommerce
- CVE-2026-31262Cross Site Scripting vulnerability in Altenar Sportsbook Software Platform (SB2) v.2.0 allows a remote attacker to obtain sensitive informat
- CVE-2026-33551An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.OpenStack Keystone · keystone
- CVE-2026-40212OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.wrOpenStack Skyline