CVEs published April 11, 2026
39 CVEs were published on April 11, 2026: 4 critical, 22 high. 1 is now in CISA KEV.
- Published
- 39
- Critical
- 4
- High
- 22
- Medium
- 12
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- GIMP
- 5
- Labcenter Electronics Proteus
- 4
- ChargePoint Home Flex
- 3
- NoMachine
- 3
- OpenClaw
- 3
- Optimole – Optimize Images in Real Time
- 2
- themeum Tutor LMS – eLearning and online course solution
- 2
- 1Panel-dev MaxKB
- 1
- Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- 1
- aws-mcp-server
- 1
Critical 4
- CVE-2026-31845Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API EndpointRukovoditel CRM
- CVE-2026-5059aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerabilityaws-mcp-server · aws-mcp
- CVE-2026-5058aws-mcp-server Command Injection Remote Code Execution Vulnerabilityaws-mcp-server
- CVE-2026-4149Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution VulnerabilitySonos Era
High 22
- CVE-2026-32146Improper Path Validation in Git Dependency Handling Allows Arbitrary File System ModificationGleam
- CVE-2026-5809wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parametertomdever wpForo Forum
- CVE-2026-34621Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-5144BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDORboonebgorges BuddyPress Groupblog
- CVE-2026-5217Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor ParameterOptimole – Optimize Images in Real Time
- CVE-2026-3690OpenClaw Canvas Authentication Bypass VulnerabilityOpenClaw
- CVE-2026-4158KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityKeePassXC
- CVE-2026-4157ChargePoint Home Flex revssh Service Command Injection Remote Code Execution VulnerabilityChargePoint Home Flex
- CVE-2026-4156ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution VulnerabilityChargePoint Home Flex
- CVE-2026-4155ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure VulnerabilityChargePoint Home Flex
- CVE-2026-4154GIMP XPM File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-4153GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-4152GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-4151GIMP ANI File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-4150GIMP PSD File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-5055NoMachine Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityNoMachine
- CVE-2026-5054NoMachine External Control of File Path Local Privilege Escalation VulnerabilityNoMachine
- CVE-2026-5053NoMachine External Control of File Path Arbitrary File Deletion VulnerabilityNoMachine
- CVE-2026-5495Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityLabcenter Electronics Proteus
- CVE-2026-5494Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityLabcenter Electronics Proteus
- CVE-2026-5493Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityLabcenter Electronics Proteus
- CVE-2026-5496Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution VulnerabilityLabcenter Electronics Proteus
Medium, low and unrated 13
- CVE-2026-61061Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting1Panel-dev MaxKB
- CVE-2026-6105perfree go-fastdfs-web doInstall InstallController.java improper authorizationperfree go-fastdfs-web
- CVE-2026-23900Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomlaphoca.cz - Phoca Maps for Joomla
- CVE-2026-3371Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modificationthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-4979UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameterstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2026-3498BlockArt Blocks <= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attributewpblockart BlockArt Blocks – Gutenberg Blocks, Page Builder…
- CVE-2026-4895Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attributewpsoul Greenshift – animation and page builder blocks
- CVE-2026-5207LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameterchrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- CVE-2026-5226Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URLOptimole – Optimize Images in Real Time
- CVE-2026-3358Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollmentthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-40354Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlinkFlatpak xdg-desktop-portal
- CVE-2026-3691OpenClaw Client PKCE Verifier Information Disclosure VulnerabilityOpenClaw
- CVE-2026-3689OpenClaw Canvas Path Traversal Information Disclosure VulnerabilityOpenClaw