CVEs published April 12, 2026
57 CVEs were published on April 12, 2026: 8 critical, 28 high.
- Published
- 57
- Critical
- 8
- High
- 28
- Medium
- 21
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Tenda F451
- 10
- Totolink A7100RU
- 7
- AstrBotDevs AstrBot
- 3
- FoundationAgents MetaGPT · metagpt
- 3
- 1Panel-dev MaxKB
- 2
- libexif project libexif
- 2
- varnish-software Varnish Cache
- 2
- zhayujie chatgpt-on-wechat CowAgent
- 2
- Across DR-810
- 1
- Adianti Framework
- 1
Critical 8
- CVE-2026-6132Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injectionTotolink A7100RU
- CVE-2026-6131Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injectionTotolink A7100RU
- CVE-2019-25709CF Image Hosting Script 1.6.5 Unauthorized Database AccessDavidtavarez CF Image Hosting Script
- CVE-2026-6116Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injectionTotolink A7100RU
- CVE-2026-6115Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injectionTotolink A7100RU
- CVE-2026-6114Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injectionTotolink A7100RU
- CVE-2026-6113Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injectionTotolink A7100RU
- CVE-2026-6112Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injectionTotolink A7100RU
High 28
- CVE-2026-6137Tenda F451 AdvSetWan fromAdvSetWan stack-based overflowTenda F451
- CVE-2026-6136Tenda F451 L7Im frmL7ImForm stack-based overflowTenda F451
- CVE-2026-6135Tenda F451 SetIpBind fromSetIpBind stack-based overflowTenda F451
- CVE-2026-6134Tenda F451 qossetting fromqossetting stack-based overflowTenda F451
- CVE-2026-6133Tenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflowTenda F451
- CVE-2026-40393In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depenmesa3d Mesa
- CVE-2019-25713MyT-PM 1.5.1 SQL Injection via Charge[group_total] ParameterMyT Project Management
- CVE-2019-25710Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid ParameterDolibarr ERP-CRM · dolibarr/dolibarr
- CVE-2019-25707eBrigade ERP 4.5 SQL Injection via pdf.phpeBrigade ERP
- CVE-2019-25706Across DR-810 ROM-0 Unauthenticated File DisclosureAcross DR-810
- CVE-2019-25705Echo Mirage 3.1 Stack Buffer Overflow via Rules Action FieldSourceforge Echo Mirage
- CVE-2019-25703ImpressCMS 1.3.11 SQL Injection via bid ParameterImpressCMS
- CVE-2019-25701Easy Video to iPod Converter 1.6.20 Local Buffer Overflow SEHDivxtodvd Easy Video to iPod Converter
- CVE-2019-25699Newsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameterNewsbull Haber Script
- CVE-2019-25697CMSsite 1.0 SQL Injection via category.phpVictorAlagwu CMSsite
- CVE-2019-25695R 3.4.4 Local Buffer Overflow Windows XP SP3r-project R
- CVE-2019-25693ResourceSpace 8.6 SQL Injection via collection_edit.phpResourceSpace
- CVE-2019-25691Faleemi Desktop Software 1.8 Local Buffer Overflow SEH DEP BypassFaleemi Desktop Software
- CVE-2019-25689HTML5 Video Player 1.2.5 Local Buffer Overflow Non-SEHHtml5Videoplayer HTML5 Video Player
- CVE-2018-25258RGui 3.5.0 Local Buffer Overflow SEH DEP BypassR-Project RGui
- CVE-2018-25257Adianti Framework 5.5.0 and 5.6.0 SQL Injection via ProfileAdianti Framework
- CVE-2026-6124Tenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflowTenda F451
- CVE-2026-6123Tenda F451 httpd addressNat fromAddressNat stack-based overflowTenda F451
- CVE-2026-6122Tenda F451 httpd L7Prot frmL7ProtForm stack-based overflowTenda F451
- CVE-2026-6121Tenda F451 httpd WrlclientSet stack-based overflowTenda F451
- CVE-2026-6120Tenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflowTenda F451
- CVE-2026-31413bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_ORLinux
- CVE-2026-1116Cross-site Scripting (XSS) in parisneo/lollmsparisneo/lollms · lollms
Medium, low and unrated 21
- CVE-2026-6130chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injectionchatboxai chatbox
- CVE-2026-6129zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authenticationzhayujie chatgpt-on-wechat CowAgent
- CVE-2026-40396Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger.varnish-software Varnish Cache
- CVE-2026-40395Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL.varnish-software Varnish Enterprise
- CVE-2026-40394Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certvarnish-software Varnish Cache
- CVE-2026-40386In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crashlibexif project libexif
- CVE-2026-40385In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes libexif project libexif
- CVE-2019-25712BlueAuditor 1.7.2.0 Buffer Overflow Denial of Service via Registration KeyNSauditor BlueAuditor
- CVE-2019-25711SpotFTP Password Recover 2.4.2 Denial of Service via Name FieldNSauditor SpotFTP Password Recover
- CVE-2019-25708Heatmiser Wifi Thermostat 1.7 Cross-Site Request ForgeryHeatmiser Wifi Thermostat
- CVE-2017-20239MDwiki Cross-Site Scripting via Location Hash ParameterDynalon MDwiki
- CVE-2026-6126zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authenticationzhayujie chatgpt-on-wechat CowAgent
- CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionDromara warm-flow · org.dromara.warm:warm-flow-plugin-modes…
- CVE-2026-6119AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgeryAstrBotDevs AstrBot
- CVE-2026-6118AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injectionAstrBotDevs AstrBot
- CVE-2026-6117AstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandboxAstrBotDevs AstrBot
- CVE-2026-6111FoundationAgents MetaGPT common.py decode_image server-side request forgeryFoundationAgents MetaGPT · metagpt
- CVE-2026-6110FoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injectionFoundationAgents MetaGPT · metagpt
- CVE-2026-6109FoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgeryFoundationAgents MetaGPT · metagpt
- CVE-2026-61081Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection1Panel-dev MaxKB
- CVE-2026-61071Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting1Panel-dev MaxKB