# CVEs published 2026-04-10

213 CVEs were published on April 10, 2026: 27 critical, 71 high. Days are UTC.

- [CVE-2026-40199](https://cve.now/CVE-2026-40199.md): Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass (CVSS 6.5, STIGTSP Net::CIDR::Lite)
- [CVE-2026-40198](https://cve.now/CVE-2026-40198.md): Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass (CVSS 7.5, STIGTSP Net::CIDR::Lite)
- [CVE-2026-33118](https://cve.now/CVE-2026-33118.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2026-33119](https://cve.now/CVE-2026-33119.md): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (CVSS 5.4, Microsoft Edge for Android)
- [CVE-2026-5724](https://cve.now/CVE-2026-5724.md): Missing Authentication on Streaming gRPC Replication Endpoint (CVSS 6.3, Temporal Technologies temporal · go.temporal.io/server)
- [CVE-2026-40252](https://cve.now/CVE-2026-40252.md): Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT (CVSS 5.3, labring FastGPT)
- [CVE-2026-40242](https://cve.now/CVE-2026-40242.md): Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint (CVSS 7.2, getarcaneapp arcane · github.com/getarcaneapp/arcane/backend)
- [CVE-2026-40194](https://cve.now/CVE-2026-40194.md): phpseclib has a variable-time HMAC comparison in SSH2::get\_binary\_packet() using != instead of hash\_equals() (CVSS 3.7, phpseclib · phpseclib/phpseclib)
- [CVE-2026-40191](https://cve.now/CVE-2026-40191.md): ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path (CVSS 6.8, craigjbass clearancekit)
- [CVE-2026-39922](https://cve.now/CVE-2026-39922.md): GeoNode SSRF via Service Registration (CVSS 5.3, GeoNode)
- [CVE-2026-39921](https://cve.now/CVE-2026-39921.md): GeoNode \< 4.4.5, 5.0.2 SSRF via Document Upload (CVSS 5.3, GeoNode)
- [CVE-2026-40190](https://cve.now/CVE-2026-40190.md): LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete \`\_\_proto\_\_\` Guard in Internal lodash \`set()\` (CVSS 5.6, langchain-ai langsmith-sdk · langsmith)
- [CVE-2026-40189](https://cve.now/CVE-2026-40189.md): goshs has a file-based ACL authorization bypass in goshs state-changing routes (CVSS 9.3, patrickhener goshs · github.com/patrickhener/goshs)
- [CVE-2026-40188](https://cve.now/CVE-2026-40188.md): goshs is Missing Write Protection for Parametric Data Values (CVSS 7.7, patrickhener goshs · github.com/patrickhener/goshs)
- [CVE-2026-40185](https://cve.now/CVE-2026-40185.md): Missing Authorization on Immich Trip Photo Routes in TREK (CVSS 7.1, mauriceboe TREK)
- [CVE-2026-40184](https://cve.now/CVE-2026-40184.md): Unauthenticated Access to Uploaded Files in TREK (CVSS 3.7, mauriceboe TREK)
- [CVE-2026-40180](https://cve.now/CVE-2026-40180.md): Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class (CVSS 7.7, quarkiverse quarkus-openapi-generator · io.quarkiverse.open…)
- [CVE-2026-40178](https://cve.now/CVE-2026-40178.md): ajenti.plugin.core has a race conditions in 2FA (CVSS 6.9, ajenti · ajenti-plugin-core)
- [CVE-2026-40177](https://cve.now/CVE-2026-40177.md): Password bypass when 2FA is activated (CVSS 9.3, ajenti · ajenti-plugin-core)
- [CVE-2026-40175](https://cve.now/CVE-2026-40175.md): Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (CVSS 4.8, axios)
- [CVE-2026-40168](https://cve.now/CVE-2026-40168.md): Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream (CVSS 8.2, gitroomhq postiz-app)
- [CVE-2026-32252](https://cve.now/CVE-2026-32252.md): Chartbrew Cross-Tenant Template Export and Secret Disclosure in \`GET /team/:team\_id/template/generate/:project\_id\` (CVSS 7.7, chartbrew)
- [CVE-2026-30232](https://cve.now/CVE-2026-30232.md): Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs (CVSS 7.8, chartbrew)
- [CVE-2026-27460](https://cve.now/CVE-2026-27460.md): Tandoor Recipes Affected by Denial of Service via Recipe Import (CVSS 6.5, TandoorRecipes recipes)
- [CVE-2026-33737](https://cve.now/CVE-2026-33737.md): Chamilo LMS has an XML External Entity (XXE) Injection (CVSS 5.3, chamilo-lms)
- [CVE-2026-33736](https://cve.now/CVE-2026-33736.md): Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure (CVSS 6.5, chamilo-lms)
- [CVE-2026-33710](https://cve.now/CVE-2026-33710.md): Chamilo LMS has Weak REST API Key Generation (Predictable) (CVSS 7.5, chamilo-lms)
- [CVE-2026-33708](https://cve.now/CVE-2026-33708.md): Chamilo LMS has REST API PII Exposure via get\_user\_info\_from\_username (CVSS 6.5, chamilo-lms)
- [CVE-2026-33707](https://cve.now/CVE-2026-33707.md): Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms (CVSS 9.4, chamilo-lms)
- [CVE-2026-33706](https://cve.now/CVE-2026-33706.md): Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher) (CVSS 7.1, chamilo-lms)
- [CVE-2026-33705](https://cve.now/CVE-2026-33705.md): Chamilo LMS has unauthenticated access to Twig template source files exposes application logic (CVSS 5.3, chamilo-lms)
- [CVE-2026-33704](https://cve.now/CVE-2026-33704.md): Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint (CVSS 7.1, chamilo-lms)
- [CVE-2026-33703](https://cve.now/CVE-2026-33703.md): Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens (CVSS 7.1, chamilo-lms)
- [CVE-2026-3446](https://cve.now/CVE-2026-3446.md): Base64 decoding stops at first padded quad by default (CVSS 6.0, Python Software Foundation CPython)
- [CVE-2026-33702](https://cve.now/CVE-2026-33702.md): Chamilo LMS has an Insecure Direct Object Reference (IDOR) (CVSS 7.1, chamilo-lms)
- [CVE-2026-33698](https://cve.now/CVE-2026-33698.md): Chamilo LMS affected by unauthenticated RCE in main/install folder (CVSS 9.3, chamilo-lms)
- [CVE-2026-33618](https://cve.now/CVE-2026-33618.md): Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings (CVSS 8.8, chamilo-lms)
- [CVE-2026-33141](https://cve.now/CVE-2026-33141.md): Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data (CVSS 6.5, chamilo-lms)
- [CVE-2026-32892](https://cve.now/CVE-2026-32892.md): OS Command Injection in Chamilo LMS 1.11.36 (CVSS 9.1, chamilo-lms)
- [CVE-2026-1502](https://cve.now/CVE-2026-1502.md): HTTP client proxy tunnel headers not validated for CR/LF (CVSS 5.7, Python Software Foundation CPython)
- [CVE-2026-32932](https://cve.now/CVE-2026-32932.md): Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit (CVSS 4.7, chamilo-lms)
- [CVE-2026-32931](https://cve.now/CVE-2026-32931.md): Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE (CVSS 7.5, chamilo-lms)
- [CVE-2026-32930](https://cve.now/CVE-2026-32930.md): Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check (CVSS 7.1, chamilo-lms)
- [CVE-2026-32894](https://cve.now/CVE-2026-32894.md): Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result (CVSS 7.1, chamilo-lms)
- [CVE-2026-32893](https://cve.now/CVE-2026-32893.md): Chamilo LMS has Reflected XSS via Unsanitized http\_build\_query() in Exercise Question List Pagination (CVSS 5.4, chamilo-lms)
- [CVE-2026-31941](https://cve.now/CVE-2026-31941.md): Server-Side Request Forgery (SSRF) in Chamilo LMS (CVSS 7.7, chamilo-lms)
- [CVE-2026-31940](https://cve.now/CVE-2026-31940.md): Session Fixation in Chamilo LMS (CVSS 7.5, chamilo-lms)
- [CVE-2026-5483](https://cve.now/CVE-2026-5483.md): Odh-dashboard: odh dashboard kubernetes service account exposure (CVSS 8.5, Red Hat OpenShift AI)
- [CVE-2026-31939](https://cve.now/CVE-2026-31939.md): Path Traversal (Arbitrary File Delete) in Chamilo LMS (CVSS 8.3, chamilo-lms)
- [CVE-2025-66447](https://cve.now/CVE-2025-66447.md): Chamilo LMS has validation-less redirect on login page (CVSS 0.0, chamilo-lms)
- [CVE-2026-40163](https://cve.now/CVE-2026-40163.md): Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read (CVSS 8.2, saltcorn · @saltcorn/server)
- [CVE-2026-40162](https://cve.now/CVE-2026-40162.md): Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble (CVSS 7.1, bugsink)
- [CVE-2026-22560](https://cve.now/CVE-2026-22560.md): An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parame (CVSS 5.3, Rocket.Chat)
- [CVE-2026-40160](https://cve.now/CVE-2026-40160.md): PraisonAIAgents has SSRF via unvalidated URL in \`web\_crawl\` httpx fallback (CVSS 7.1, MervinPraison PraisonAIAgents · praisonaiagents)
- [CVE-2026-40159](https://cve.now/CVE-2026-40159.md): PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution (CVSS 5.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40158](https://cve.now/CVE-2026-40158.md): PraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai (CVSS 8.6, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40157](https://cve.now/CVE-2026-40157.md): PraisonAI affected by arbitrary file write via path traversal in \`praisonai recipe unpack\` (CVSS 9.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40156](https://cve.now/CVE-2026-40156.md): PraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic \`tools.py\` Loading (CVSS 7.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-40100](https://cve.now/CVE-2026-40100.md): FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK\_INTERNAL\_IP default (CVSS 5.3, labring FastGPT)
- [CVE-2026-40097](https://cve.now/CVE-2026-40097.md): Step CA affected by an index out of bounds panic in TPM attestation EKU validation (CVSS 3.7, smallstep certificates · github.com/smallstep/certificates)
- [CVE-2026-40074](https://cve.now/CVE-2026-40074.md): SvelteKit's invalidated redirect in handle hook causes Denial-of-Service (CVSS 6.3, sveltejs kit · @sveltejs/kit)
- [CVE-2026-40073](https://cve.now/CVE-2026-40073.md): SvelteKit has a BODY\_SIZE\_LIMIT bypass in @sveltejs/adapter-node (CVSS 8.2, sveltejs kit · @sveltejs/kit)
- [CVE-2026-40086](https://cve.now/CVE-2026-40086.md): Rembg has a Path Traversal via Custom Model Loading (CVSS 5.3, danielgatis rembg · rembg)
- [CVE-2026-40103](https://cve.now/CVE-2026-40103.md): Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35602](https://cve.now/CVE-2026-35602.md): Vikunja has a File Size Limit Bypass via Vikunja Import (CVSS 5.4, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35601](https://cve.now/CVE-2026-35601.md): Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output (CVSS 4.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35600](https://cve.now/CVE-2026-35600.md): Vikunja has HTML Injection via Task Titles in Overdue Email Notifications (CVSS 5.4, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35599](https://cve.now/CVE-2026-35599.md): Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35598](https://cve.now/CVE-2026-35598.md): Vikunja has Missing Authorization on CalDAV Task Read (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35670](https://cve.now/CVE-2026-35670.md): OpenClaw \< 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat (CVSS 6.0, OpenClaw)
- [CVE-2026-35669](https://cve.now/CVE-2026-35669.md): OpenClaw \< 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope (CVSS 8.7, OpenClaw)
- [CVE-2026-35668](https://cve.now/CVE-2026-35668.md): OpenClaw \< 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl Parameters (CVSS 7.1, OpenClaw)
- [CVE-2026-35667](https://cve.now/CVE-2026-35667.md): OpenClaw \< 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts (CVSS 6.9, OpenClaw)
- [CVE-2026-35666](https://cve.now/CVE-2026-35666.md): OpenClaw \< 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper (CVSS 7.7, OpenClaw)
- [CVE-2026-35665](https://cve.now/CVE-2026-35665.md): OpenClaw \< 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing (CVSS 6.9, OpenClaw)
- [CVE-2026-35664](https://cve.now/CVE-2026-35664.md): OpenClaw \< 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks (CVSS 6.9, OpenClaw)
- [CVE-2026-35663](https://cve.now/CVE-2026-35663.md): OpenClaw \< 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim (CVSS 8.7, OpenClaw)
- [CVE-2026-35662](https://cve.now/CVE-2026-35662.md): OpenClaw \< 2026.3.22 - Missing controlScope Enforcement in Send Action (CVSS 5.3, OpenClaw)
- [CVE-2026-35661](https://cve.now/CVE-2026-35661.md): OpenClaw \< 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass (CVSS 6.9, OpenClaw)
- [CVE-2026-35660](https://cve.now/CVE-2026-35660.md): OpenClaw \< 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset (CVSS 7.2, OpenClaw)
- [CVE-2026-35659](https://cve.now/CVE-2026-35659.md): OpenClaw \< 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery (CVSS 5.1, OpenClaw)
- [CVE-2026-35658](https://cve.now/CVE-2026-35658.md): OpenClaw \< 2026.3.2 - Filesystem Boundary Bypass in Image Tool (CVSS 6.0, OpenClaw)
- [CVE-2026-35597](https://cve.now/CVE-2026-35597.md): Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout (CVSS 5.9, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35657](https://cve.now/CVE-2026-35657.md): OpenClaw \< 2026.3.25 - Authorization Bypass in HTTP Session History Route (CVSS 7.1, OpenClaw)
- [CVE-2026-35656](https://cve.now/CVE-2026-35656.md): OpenClaw \< 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter (CVSS 6.3, OpenClaw)
- [CVE-2026-35655](https://cve.now/CVE-2026-35655.md): OpenClaw \< 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution (CVSS 6.9, OpenClaw)
- [CVE-2026-35654](https://cve.now/CVE-2026-35654.md): OpenClaw \< 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke (CVSS 6.9, OpenClaw)
- [CVE-2026-35653](https://cve.now/CVE-2026-35653.md): OpenClaw \< 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request (CVSS 7.2, OpenClaw)
- [CVE-2026-35652](https://cve.now/CVE-2026-35652.md): OpenClaw \< 2026.3.22 - Unauthorized Action Execution via Callback Dispatch (CVSS 6.9, OpenClaw)
- [CVE-2026-35651](https://cve.now/CVE-2026-35651.md): OpenClaw 2026.2.13 \< 2026.3.25 - ANSI Escape Sequence Injection in Approval Prompt (CVSS 5.3, OpenClaw)
- [CVE-2026-35650](https://cve.now/CVE-2026-35650.md): OpenClaw \< 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization (CVSS 7.7, OpenClaw)
- [CVE-2026-35649](https://cve.now/CVE-2026-35649.md): OpenClaw \< 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist (CVSS 6.3, OpenClaw)
- [CVE-2026-35648](https://cve.now/CVE-2026-35648.md): OpenClaw \< 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions (CVSS 2.3, OpenClaw)
- [CVE-2026-35647](https://cve.now/CVE-2026-35647.md): OpenClaw \< 2026.3.25 - Direct Message Policy Bypass via Verification Notices (CVSS 6.9, OpenClaw)
- [CVE-2026-35643](https://cve.now/CVE-2026-35643.md): OpenClaw \< 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface (CVSS 8.6, OpenClaw)
- [CVE-2026-35641](https://cve.now/CVE-2026-35641.md): OpenClaw \< 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation (CVSS 8.4, OpenClaw)
- [CVE-2026-35621](https://cve.now/CVE-2026-35621.md): OpenClaw \< 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence (CVSS 7.1, OpenClaw)
- [CVE-2026-35620](https://cve.now/CVE-2026-35620.md): OpenClaw \< 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands (CVSS 5.3, OpenClaw)
- [CVE-2026-35619](https://cve.now/CVE-2026-35619.md): OpenClaw \< 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint (CVSS 5.3, OpenClaw)
- [CVE-2026-35596](https://cve.now/CVE-2026-35596.md): Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35595](https://cve.now/CVE-2026-35595.md): Vikunja Affected by Privilege Escalation via Project Reparenting (CVSS 8.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-35594](https://cve.now/CVE-2026-35594.md): Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-40228](https://cve.now/CVE-2026-40228.md): In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is exec (CVSS 2.9, systemd)
- [CVE-2026-40023](https://cve.now/CVE-2026-40023.md): Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters (CVSS 6.3, Apache Software Foundation Apache Log4cxx)
- [CVE-2026-34727](https://cve.now/CVE-2026-34727.md): Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path (CVSS 7.4, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-40021](https://cve.now/CVE-2026-40021.md): Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters (CVSS 6.3, Apache Software Foundation Apache Log4net · log4net)
- [CVE-2026-34481](https://cve.now/CVE-2026-34481.md): Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout (CVSS 6.3, Apache Software Foundation Apache Log4j JSON Template Layou…)
- [CVE-2026-34480](https://cve.now/CVE-2026-34480.md): Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters (CVSS 6.9, Apache Software Foundation Apache Log4j Core · org.apache.l…)
- [CVE-2026-34479](https://cve.now/CVE-2026-34479.md): Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters (CVSS 6.9, Apache Software Foundation Apache Log4j 1 to Log4j 2 bridge…)
- [CVE-2026-34478](https://cve.now/CVE-2026-34478.md): Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility (CVSS 6.9, Apache Software Foundation Apache Log4j Core · org.apache.l…)
- [CVE-2026-34477](https://cve.now/CVE-2026-34477.md): Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass (CVSS 6.3, Apache Software Foundation Apache Log4j Core · org.apache.l…)
- [CVE-2026-29043](https://cve.now/CVE-2026-29043.md): HDF5 H5T\_\_ref\_mem\_setnull Heap Buffer Overflow (CVSS 5.5, HDFGroup hdf5)
- [CVE-2026-40227](https://cve.now/CVE-2026-40227.md): In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element. (CVSS 6.2, systemd)
- [CVE-2026-40226](https://cve.now/CVE-2026-40226.md): In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. (CVSS 6.4, systemd)
- [CVE-2026-40225](https://cve.now/CVE-2026-40225.md): In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output. (CVSS 6.4, systemd)
- [CVE-2026-40224](https://cve.now/CVE-2026-40224.md): In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace. (CVSS 6.7, systemd)
- [CVE-2026-29002](https://cve.now/CVE-2026-29002.md): CouchCMS Privilege Escalation via f\_k\_levels\_list Parameter (CVSS 8.6, CouchCMS)
- [CVE-2026-40223](https://cve.now/CVE-2026-40223.md): In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=\<unset\> unit exists and is running. (CVSS 4.7, systemd)
- [CVE-2026-40217](https://cve.now/CVE-2026-40217.md): LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test\_custom\_code URI. (CVSS 8.8, BerriAI LiteLLM · litellm)
- [CVE-2026-6069](https://cve.now/CVE-2026-6069.md): CVE-2026-6069 (CVSS 7.5, NASM)
- [CVE-2026-6068](https://cve.now/CVE-2026-6068.md): CVE-2026-6068 (CVSS 6.5, NASM)
- [CVE-2026-6067](https://cve.now/CVE-2026-6067.md): CVE-2026-6067 (CVSS 7.5, NASM)
- [CVE-2025-58920](https://cve.now/CVE-2025-58920.md): WordPress Cerato theme \<= 2.2.18 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Zootemplate Cerato)
- [CVE-2025-58913](https://cve.now/CVE-2025-58913.md): WordPress VideoPro theme \<= 2.3.8.1 - Local File Inclusion vulnerability (CVSS 8.1, CactusThemes VideoPro)
- [CVE-2025-5804](https://cve.now/CVE-2025-5804.md): WordPress Case Theme User \< 1.0.4 - Local File Inclusion Vulnerability (CVSS 7.5, Case Themes Case Theme User)
- [CVE-2026-33092](https://cve.now/CVE-2026-33092.md): Local privilege escalation due to improper handling of environment variables. (CVSS 7.8, Acronis True Image OEM · Acronis True Image)
- [CVE-2026-5412](https://cve.now/CVE-2026-5412.md): Juju CloudSpec API could leak senstive information (CVSS 9.9, Canonical Juju · github.com/juju/juju)
- [CVE-2026-5774](https://cve.now/CVE-2026-5774.md): Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map (CVSS 6.1, Canonical Juju · github.com/juju/juju)
- [CVE-2026-5777](https://cve.now/CVE-2026-5777.md): Security Misconfiguration Vulnerability in Atom 3x Projector (CVSS 8.7, EGate Atom 3X Projector)
- [CVE-2026-39304](https://cve.now/CVE-2026-39304.md): Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM (CVSS 7.5, Apache Software Foundation Apache ActiveMQ Client · Apac… +6)
- [CVE-2026-31412](https://cve.now/CVE-2026-31412.md): usb: gadget: f\_mass\_storage: Fix potential integer overflow in check\_command\_size\_in\_blocks() (no CVSS, Linux)
- [CVE-2026-4162](https://cve.now/CVE-2026-4162.md): Gravity SMTP \<= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall (CVSS 7.1, RocketGenius Gravity SMTP)
- [CVE-2021-47961](https://cve.now/CVE-2021-47961.md): A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence (CVSS 8.1, Synology SSL VPN Client)
- [CVE-2021-47960](https://cve.now/CVE-2021-47960.md): A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to (CVSS 6.5, Synology SSL VPN Client)
- [CVE-2026-6057](https://cve.now/CVE-2026-6057.md): Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution (CVSS 9.8, FalkorDB Browser)
- [CVE-2026-6042](https://cve.now/CVE-2026-6042.md): musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity (CVSS 4.8, musl libc)
- [CVE-2026-6038](https://cve.now/CVE-2026-6038.md): code-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injection (CVSS 6.9, code-projects Vehicle Showroom Management System)
- [CVE-2026-33457](https://cve.now/CVE-2026-33457.md): Potential livestatus injection in prediction graph page (CVSS 5.3, Checkmk)
- [CVE-2026-33456](https://cve.now/CVE-2026-33456.md): Potential livestatus injection in notification test (CVSS 5.1, Checkmk)
- [CVE-2026-33455](https://cve.now/CVE-2026-33455.md): Livestatus injection in monitoring quicksearch (CVSS 5.3, Checkmk)
- [CVE-2026-6037](https://cve.now/CVE-2026-6037.md): code-projects Vehicle Showroom Management System AddVehicleFunction.php sql injection (CVSS 6.9, code-projects Vehicle Showroom Management System)
- [CVE-2026-6036](https://cve.now/CVE-2026-6036.md): code-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injection (CVSS 6.9, code-projects Vehicle Showroom Management System)
- [CVE-2026-6035](https://cve.now/CVE-2026-6035.md): code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting (CVSS 5.3, code-projects Vehicle Showroom Management System)
- [CVE-2026-6034](https://cve.now/CVE-2026-6034.md): code-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scripting (CVSS 5.3, code-projects Vehicle Showroom Management System)
- [CVE-2026-5525](https://cve.now/CVE-2026-5525.md): Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS (CVSS 6.0, Notepad++ Project Notepad++)
- [CVE-2026-22750](https://cve.now/CVE-2026-22750.md): SSL bundle configuration silently bypassed in Spring Cloud Gateway (CVSS 7.5, VMware Spring Cloud Gateway · org.springframework.cloud:spr…)
- [CVE-2026-6033](https://cve.now/CVE-2026-6033.md): CodeAstro Online Classroom updatedetailsfromstudent.php sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-6032](https://cve.now/CVE-2026-6032.md): code-projects Simple Laundry System checkcheckout.php cross site scripting (CVSS 5.3, code-projects Simple Laundry System)
- [CVE-2026-6031](https://cve.now/CVE-2026-6031.md): code-projects Simple IT Discussion Forum add-category-function.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-6030](https://cve.now/CVE-2026-6030.md): itsourcecode Construction Management System del1.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2026-6029](https://cve.now/CVE-2026-6029.md): Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-1115](https://cve.now/CVE-2026-1115.md): Stored XSS in parisneo/lollms (CVSS 9.6, parisneo/lollms · lollms)
- [CVE-2026-6028](https://cve.now/CVE-2026-6028.md): Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-6027](https://cve.now/CVE-2026-6027.md): Totolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-4432](https://cve.now/CVE-2026-4432.md): YITH WooCommerce Wishlist \< 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR (CVSS 6.5, YITH WooCommerce Wishlist)
- [CVE-2025-14545](https://cve.now/CVE-2025-14545.md): YML for Yandex Market \< 5.0.26 - Shop Manager+ RCE via Feed Generation (CVSS 6.5, YML for Yandex Market)
- [CVE-2026-28704](https://cve.now/CVE-2026-28704.md): Emocheck insecurely loads Dynamic Link Libraries (DLLs). (CVSS 7.8, Japan Computer Emergency Response Team Coordination Center…)
- [CVE-2026-6026](https://cve.now/CVE-2026-6026.md): Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-6025](https://cve.now/CVE-2026-6025.md): Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-6024](https://cve.now/CVE-2026-6024.md): Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversal (CVSS 6.9, Tenda i6)
- [CVE-2026-5477](https://cve.now/CVE-2026-5477.md): Prefix-substitution forgery via integer overflow in wolfCrypt CMAC (CVSS 8.2, wolfSSL)
- [CVE-2026-6016](https://cve.now/CVE-2026-6016.md): Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow (CVSS 8.7, Tenda AC9)
- [CVE-2026-6015](https://cve.now/CVE-2026-6015.md): Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow (CVSS 8.7, Tenda AC9)
- [CVE-2026-6014](https://cve.now/CVE-2026-6014.md): D-Link DIR-513 POST Request formAdvanceSetup buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2026-4482](https://cve.now/CVE-2026-4482.md): Insight Agent Private Key Information Disclosure via Inherited File Permissions (CVSS 6.8, Rapid7 Insight Agent)
- [CVE-2026-6013](https://cve.now/CVE-2026-6013.md): D-Link DIR-513 POST Request formSetRoute buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2026-6012](https://cve.now/CVE-2026-6012.md): D-Link DIR-513 POST Request formSetPassword buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2026-6011](https://cve.now/CVE-2026-6011.md): OpenClaw assertPublicHostname web-fetch.ts server-side request forgery (CVSS 6.3, OpenClaw)
- [CVE-2026-2305](https://cve.now/CVE-2026-2305.md): AddFunc Head & Footer Code \<= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields (CVSS 6.4, AddFunc Head & Footer Code)
- [CVE-2026-6010](https://cve.now/CVE-2026-6010.md): CodeAstro Online Classroom takeassessment2.php sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-5188](https://cve.now/CVE-2026-5188.md): Integer underflow in X.509 SAN parsing in wolfSSL (CVSS 2.3, wolfSSL)
- [CVE-2026-6007](https://cve.now/CVE-2026-6007.md): itsourcecode Construction Management System del.php sql injection (CVSS 5.3, itsourcecode Construction Management System)
- [CVE-2026-5500](https://cve.now/CVE-2026-5500.md): Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass (CVSS 8.7, wolfSSL)
- [CVE-2026-5501](https://cve.now/CVE-2026-5501.md): Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates (CVSS 8.6, wolfSSL)
- [CVE-2026-5466](https://cve.now/CVE-2026-5466.md): wc\_VerifyEccsiHash missing sanity check (CVSS 7.6, wolfSSL)
- [CVE-2026-6006](https://cve.now/CVE-2026-6006.md): code-projects Patient Record Management System edit\_hpatient.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2026-6005](https://cve.now/CVE-2026-6005.md): code-projects Patient Record Management System hematology\_print.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2026-5479](https://cve.now/CVE-2026-5479.md): wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag (CVSS 7.6, wolfSSL)
- [CVE-2026-6004](https://cve.now/CVE-2026-6004.md): code-projects Simple IT Discussion Forum delete-category.php sql injection (CVSS 6.9, code-projects Simple IT Discussion Forum)
- [CVE-2026-6003](https://cve.now/CVE-2026-6003.md): code-projects Simple IT Discussion Forum user.php cross site scripting (CVSS 4.8, code-projects Simple IT Discussion Forum)
- [CVE-2026-6000](https://cve.now/CVE-2026-6000.md): code-projects Online Library Management System SQL Database Backup File library.sql information disclosure (CVSS 5.3, code-projects Online Library Management System)
- [CVE-2026-5999](https://cve.now/CVE-2026-5999.md): JeecgBoot SysAnnouncementController improper authorization (CVSS 5.3, JeecgBoot)
- [CVE-2026-5998](https://cve.now/CVE-2026-5998.md): zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal (CVSS 6.9, zhayujie chatgpt-on-wechat CowAgent)
- [CVE-2026-4305](https://cve.now/CVE-2026-4305.md): Royal WordPress Backup & Restore Plugin \<= 1.0.16 - Reflected Cross-Site Scripting via 'wpr\_pending\_template' Parameter (CVSS 6.1, wproyal Royal WordPress Backup, Restore & Migration Plugin…)
- [CVE-2026-4977](https://cve.now/CVE-2026-4977.md): UsersWP \<= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter (CVSS 4.3, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-1924](https://cve.now/CVE-2026-1924.md): Aruba HiSpeed Cache \<= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset (CVSS 4.3, arubadev Aruba HiSpeed Cache)
- [CVE-2026-4351](https://cve.now/CVE-2026-4351.md): Perfmatters \<= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter (CVSS 8.1, Perfmatters)
- [CVE-2026-1263](https://cve.now/CVE-2026-1263.md): Webling \<= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter (CVSS 6.4, usystemsgmbh Webling)
- [CVE-2026-4057](https://cve.now/CVE-2026-4057.md): Download Manager \<= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal (CVSS 4.3, codename065 Download Manager)
- [CVE-2026-3360](https://cve.now/CVE-2026-3360.md): Tutor LMS \<= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order\_id' Parameter (CVSS 7.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-2712](https://cve.now/CVE-2026-2712.md): WP-Optimize \<= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation (CVSS 5.4, davidanderson WP-Optimize – Cache, Compress images, Minify…)
- [CVE-2026-4664](https://cve.now/CVE-2026-4664.md): Customer Reviews for WooCommerce \<= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter (CVSS 5.3, ivole Customer Reviews for WooCommerce)
- [CVE-2026-25203](https://cve.now/CVE-2026-25203.md): Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: l (CVSS 7.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2026-5997](https://cve.now/CVE-2026-5997.md): Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5996](https://cve.now/CVE-2026-5996.md): Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5995](https://cve.now/CVE-2026-5995.md): Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5994](https://cve.now/CVE-2026-5994.md): Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5993](https://cve.now/CVE-2026-5993.md): Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection (CVSS 9.3, Totolink A7100RU)
- [CVE-2026-5992](https://cve.now/CVE-2026-5992.md): Tenda F451 P2pListFilter fromP2pListFilter stack-based overflow (CVSS 8.7, Tenda F451)
- [CVE-2025-44560](https://cve.now/CVE-2025-44560.md): owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking. (CVSS 9.8)
- [CVE-2026-23780](https://cve.now/CVE-2026-23780.md): An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. (CVSS 8.8)
- [CVE-2026-23781](https://cve.now/CVE-2026-23781.md): An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. (CVSS 9.8)
- [CVE-2026-23782](https://cve.now/CVE-2026-23782.md): An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. (CVSS 7.5)
- [CVE-2026-29861](https://cve.now/CVE-2026-29861.md): PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php. (CVSS 9.8)
- [CVE-2026-31262](https://cve.now/CVE-2026-31262.md): Cross Site Scripting vulnerability in Altenar Sportsbook Software Platform (SB2) v.2.0 allows a remote attacker to obtain sensitive informat (CVSS 6.1)
- [CVE-2026-33551](https://cve.now/CVE-2026-33551.md): An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. (CVSS 3.5, OpenStack Keystone · keystone)
- [CVE-2026-36232](https://cve.now/CVE-2026-36232.md): A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. (CVSS 9.8)
- [CVE-2026-36233](https://cve.now/CVE-2026-36233.md): A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. (CVSS 9.8)
- [CVE-2026-36234](https://cve.now/CVE-2026-36234.md): itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter. (CVSS 9.8)
- [CVE-2026-36235](https://cve.now/CVE-2026-36235.md): A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. (CVSS 9.8)
- [CVE-2026-36236](https://cve.now/CVE-2026-36236.md): SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update\_password.php via the new\_password parameter. (CVSS 9.8)
- [CVE-2026-40200](https://cve.now/CVE-2026-40200.md): An issue was discovered in musl libc 0.7.10 through 1.2.6. (CVSS 8.1, musl-libc musl)
- [CVE-2026-40212](https://cve.now/CVE-2026-40212.md): OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.wr (CVSS 5.4, OpenStack Skyline)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.