# CVEs published 2026-04-11

39 CVEs were published on April 11, 2026: 4 critical, 22 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-6106](https://cve.now/CVE-2026-6106.md): 1Panel-dev MaxKB Public Chat static\_headers\_middleware.py StaticHeadersMiddleware cross site scripting (CVSS 5.1, 1Panel-dev MaxKB)
- [CVE-2026-6105](https://cve.now/CVE-2026-6105.md): perfree go-fastdfs-web doInstall InstallController.java improper authorization (CVSS 6.9, perfree go-fastdfs-web)
- [CVE-2026-31845](https://cve.now/CVE-2026-31845.md): Rukovoditel CRM Reflected XSS via zd\_echo Parameter in Zadarma Telephony API Endpoint (CVSS 9.3, Rukovoditel CRM)
- [CVE-2026-32146](https://cve.now/CVE-2026-32146.md): Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification (CVSS 8.3, Gleam)
- [CVE-2026-23900](https://cve.now/CVE-2026-23900.md): Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla (CVSS 6.5, phoca.cz - Phoca Maps for Joomla)
- [CVE-2026-5809](https://cve.now/CVE-2026-5809.md): wpForo Forum \<= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data\[body\]\[fileurl\]' Parameter (CVSS 7.1, tomdever wpForo Forum)
- [CVE-2026-34621](https://cve.now/CVE-2026-34621.md): Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) (CVSS 8.6, KEV, Adobe Acrobat DC · Adobe Acrobat Reader DC +1)
- [CVE-2026-3371](https://cve.now/CVE-2026-3371.md): Tutor LMS \<= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-4979](https://cve.now/CVE-2026-4979.md): UsersWP \<= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp\_crop' Parameter (CVSS 5.0, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-5144](https://cve.now/CVE-2026-5144.md): BuddyPress Groupblog \<= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR (CVSS 8.8, boonebgorges BuddyPress Groupblog)
- [CVE-2026-3498](https://cve.now/CVE-2026-3498.md): BlockArt Blocks \<= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute (CVSS 6.4, wpblockart BlockArt Blocks – Gutenberg Blocks, Page Builder…)
- [CVE-2026-4895](https://cve.now/CVE-2026-4895.md): Greenshift \<= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute (CVSS 6.4, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-5217](https://cve.now/CVE-2026-5217.md): Optimole \<= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter (CVSS 7.2, Optimole – Optimize Images in Real Time)
- [CVE-2026-5207](https://cve.now/CVE-2026-5207.md): LifterLMS \<= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter (CVSS 6.5, chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…)
- [CVE-2026-5226](https://cve.now/CVE-2026-5226.md): Optimole \<= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL (CVSS 6.1, Optimole – Optimize Images in Real Time)
- [CVE-2026-3358](https://cve.now/CVE-2026-3358.md): Tutor LMS \<= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment (CVSS 5.4, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-40354](https://cve.now/CVE-2026-40354.md): Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink (CVSS 2.9, Flatpak xdg-desktop-portal)
- [CVE-2026-3691](https://cve.now/CVE-2026-3691.md): OpenClaw Client PKCE Verifier Information Disclosure Vulnerability (CVSS 5.3, OpenClaw)
- [CVE-2026-3690](https://cve.now/CVE-2026-3690.md): OpenClaw Canvas Authentication Bypass Vulnerability (CVSS 7.4, OpenClaw)
- [CVE-2026-3689](https://cve.now/CVE-2026-3689.md): OpenClaw Canvas Path Traversal Information Disclosure Vulnerability (CVSS 6.5, OpenClaw)
- [CVE-2026-4158](https://cve.now/CVE-2026-4158.md): KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.3, KeePassXC)
- [CVE-2026-4157](https://cve.now/CVE-2026-4157.md): ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability (CVSS 7.5, ChargePoint Home Flex)
- [CVE-2026-4156](https://cve.now/CVE-2026-4156.md): ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, ChargePoint Home Flex)
- [CVE-2026-4155](https://cve.now/CVE-2026-4155.md): ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability (CVSS 7.5, ChargePoint Home Flex)
- [CVE-2026-4154](https://cve.now/CVE-2026-4154.md): GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-4153](https://cve.now/CVE-2026-4153.md): GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-4152](https://cve.now/CVE-2026-4152.md): GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-4151](https://cve.now/CVE-2026-4151.md): GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-4150](https://cve.now/CVE-2026-4150.md): GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-5059](https://cve.now/CVE-2026-5059.md): aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability (CVSS 9.8, aws-mcp-server · aws-mcp)
- [CVE-2026-5058](https://cve.now/CVE-2026-5058.md): aws-mcp-server Command Injection Remote Code Execution Vulnerability (CVSS 9.8, aws-mcp-server)
- [CVE-2026-5055](https://cve.now/CVE-2026-5055.md): NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, NoMachine)
- [CVE-2026-5054](https://cve.now/CVE-2026-5054.md): NoMachine External Control of File Path Local Privilege Escalation Vulnerability (CVSS 7.8, NoMachine)
- [CVE-2026-5053](https://cve.now/CVE-2026-5053.md): NoMachine External Control of File Path Arbitrary File Deletion Vulnerability (CVSS 7.1, NoMachine)
- [CVE-2026-5495](https://cve.now/CVE-2026-5495.md): Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Labcenter Electronics Proteus)
- [CVE-2026-5494](https://cve.now/CVE-2026-5494.md): Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Labcenter Electronics Proteus)
- [CVE-2026-5493](https://cve.now/CVE-2026-5493.md): Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Labcenter Electronics Proteus)
- [CVE-2026-5496](https://cve.now/CVE-2026-5496.md): Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Labcenter Electronics Proteus)
- [CVE-2026-4149](https://cve.now/CVE-2026-4149.md): Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability (CVSS 10.0, Sonos Era)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.