CVEs published April 13, 2026
220 CVEs were published on April 13, 2026: 21 critical, 60 high.
- Published
- 220
- Critical
- 21
- High
- 60
- Medium
- 102
- Low
- 26
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 69
Most affected products
- Huawei HarmonyOS
- 15
- Linux
- 15
- ImageMagick · Magick.NET-Q16-AnyCPU +16
- 8
- Pandora FMS
- 8
- Samsung Mobile Devices
- 8
- Samsung Open Source Escargot
- 8
- code-projects Vehicle Showroom Management System
- 7
- Totolink A7100RU
- 7
- jqlang jq
- 6
- Pachno
- 6
Critical 21
- CVE-2026-22563A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play netUbiquiti UniFi Play PowerAmp · Ubiquiti UniFi Play Audio Po…
- CVE-2026-22562A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write fUbiquiti UniFi Play PowerAmp · Ubiquiti UniFi Play Audio Po…
- CVE-2026-22564An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthoriUbiquiti UniFi Play PowerAmp · Ubiquiti UniFi Play Audio Po…
- CVE-2026-40044Pachno 1.0.6 FileCache Deserialization Remote Code ExecutionPachno
- CVE-2026-40042Pachno 1.0.6 Wiki TextParser XML External Entity InjectionPachno
- CVE-2026-6195Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injectionTotolink A7100RU
- CVE-2026-6100Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressurePython Software Foundation CPython
- CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name fielddecidim · decidim-core
- CVE-2026-31414netfilter: nf_conntrack_expect: use expect->helperLinux
- CVE-2026-4810Remote Code Execution in Google Agent Development Kit (ADK)Google Cloud Agent Development Kit · google-adk
- CVE-2026-5085Solstice::Session versions through 1440 for Perl generates session ids insecurelyMCRAWFOR Solstice::Session
- CVE-2026-34865Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confiHuawei HarmonyOS
- CVE-2026-6156Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injectionTotolink A7100RU
- CVE-2026-6155Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injectionTotolink A7100RU
- CVE-2026-6154Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injectionTotolink A7100RU
- CVE-2026-6140Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injectionTotolink A7100RU
- CVE-2026-6139Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injectionTotolink A7100RU
- CVE-2026-6138Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injectionTotolink A7100RU
- CVE-2026-31048An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string
- CVE-2026-31282Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control.
- CVE-2026-31283In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address.
High 60
- CVE-2026-40164jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedjqlang jq
- CVE-2026-5086Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacksNERDVANA Crypt::SecretBuffer
- CVE-2026-4786Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()Python Software Foundation CPython
- CVE-2026-22566An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credeUbiquiti UniFi Play PowerAmp · Ubiquiti UniFi Play Audio Po…
- CVE-2026-22565An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop rUbiquiti UniFi Play PowerAmp · Ubiquiti UniFi Play Audio Po…
- CVE-2026-33908ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()ImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-33901ImageMagick has a Heap Buffer Overflow via MVG decoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-32272Craft Commerce: Blind SQL Injection via hasVariant/hasProductcraftcms commerce · craftcms/commerce
- CVE-2026-32271Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widgetcraftcms commerce · craftcms/commerce
- CVE-2026-32605Nimiq: Remote crash via off-by-one signer bounds check in proposal buffernimiq core-rs-albatross
- CVE-2026-6200Tenda F456 webtypelibrary formwebtypelibrary stack-based overflowTenda F456
- CVE-2026-6199Tenda F456 qossetting fromqossetting stack-based overflowTenda F456
- CVE-2026-6198Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflowTenda F456
- CVE-2026-40043Pachno 1.0.6 Authentication Bypass via runSwitchUser()pancho Pachno
- CVE-2026-40040Pachno 1.0.6 Unrestricted File Upload Remote Code ExecutionPachno
- CVE-2026-40039Pachno 1.0.6 Open Redirection via return_to ParameterPachno
- CVE-2026-6197Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflowTenda F456
- CVE-2026-32316jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflowjqlang jq
- CVE-2026-6196Tenda F456 exeCommand fromexeCommand stack-based overflowTenda F456
- CVE-2026-6194Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflowTotolink A3002MU
- CVE-2026-28291simple-git has Command Execution via Option-Parsing Bypasssteveukx git-js · simple-git
- CVE-2025-3756Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850ABB AC800M · ABB Symphony Plus SD Series +2
- CVE-2026-34188OS Command Injection in Event Response ExecutionPandora FMS
- CVE-2026-34186SQL Injection in Custom Fields leads to Database CompromisePandora FMS
- CVE-2026-30813SQL Injection in Module Search leads to Database CompromisePandora FMS
- CVE-2026-30811Missing Authorization in Configuration Ajax Endpoint leads to Information DisclosurePandora FMS
- CVE-2026-30809OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code ExecutionPandora FMS
- CVE-2026-30806OS Command Injection in Network Report leads to Remote Code ExecutionPandora FMS
- CVE-2026-30804Unrestricted File Upload in Extension Uploader leads to Remote Code ExecutionPandora FMS
- CVE-2026-6186UTT HiPER 1200GW formNatStaticMap strcpy buffer overflowUTT HiPER 1200GW
- CVE-2026-1462Safe Mode Bypass in keras-team/keraskeras-team/keras · keras
- CVE-2026-33858Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APIApache Software Foundation Apache Airflow · apache-airflow
- CVE-2025-66236Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UIApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-31426ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()Linux
- CVE-2026-31419net: bonding: fix use-after-free in bond_xmit_broadcast()Linux
- CVE-2026-31417net/x25: Fix overflow when accumulating packetsLinux
- CVE-2026-34476Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP ServerApache Software Foundation Apache SkyWalking MCP · github.c…
- CVE-2026-6204LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config librenms · librenms/librenms
- CVE-2026-35337Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential HandlingApache Software Foundation Apache Storm Client · org.apache…
- CVE-2026-0234Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integrationPalo Alto Networks Cortex XSOAR Microsoft Teams Marketplace…
- CVE-2026-5936Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services APIFoxit Software Foxit PDF Services API
- CVE-2026-40436ZTE ZXEDM iEMS product has a password reset vulnerabilityZTE ZXEDM iEMS
- CVE-2026-6168TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflowTOTOLINK A7000R
- CVE-2026-3830Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLiProduct Filter for WooCommerce by WBW
- CVE-2026-25208Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4Samsung Open Source Escargot
- CVE-2026-25207Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4bSamsung Open Source Escargot
- CVE-2026-25205Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash Samsung Open Source Escargot
- CVE-2026-34856UAF vulnerability in the communication module.Huawei HarmonyOS
- CVE-2026-34853Permission bypass vulnerability in the LBS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-6157Totolink A800R app.so setAppEasyWizardConfig buffer overflowTotolink A800R
- CVE-2025-51414In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload funct
- CVE-2025-66769A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA pac
- CVE-2025-69624Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert().
- CVE-2025-69627Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc
- CVE-2026-29955The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection.
- CVE-2026-30997An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Servi
- CVE-2026-30998An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a De
- CVE-2026-30999A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a craft
- CVE-2026-31281Totara LMS v19.1.5 and before is vulnerable to HTML Injection.
- CVE-2026-36948Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.
Medium, low and unrated 139
- CVE-2026-34069nimiq-consensus panics via RequestMacroChain micro-block locatornimiq core-rs-albatross · nimiq-consensus
- CVE-2026-33948jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Inputjqlang jq
- CVE-2026-6203User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameterwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-39979jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffersjqlang jq
- CVE-2026-39956jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosurejqlang jq
- CVE-2026-33947jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()jqlang jq
- CVE-2026-40312ImageMagick: Off-by-One in MSL decoder could result in crashImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-40311ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing valuesImageMagick · Magick.NET-Q16-AnyCPU +15
- CVE-2026-40310ImageMagick: Heap out-of-bounds write in JP2 encoderImageMagick · Magick.NET-Q16-AnyCPU +15
- CVE-2026-40183ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit floatImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-40169ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encodersImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-6224nocobase plugin-workflow-javascript Vm.js createSafeConsole sandboxnocobase plugin-workflow-javascript
- CVE-2026-34238ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit buildsImageMagick · Magick.NET-Q16-AnyCPU +5
- CVE-2026-33905ImageMagick has an Out-of-Bounds read via -sample operationImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-6220HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgeryHummerRisk
- CVE-2026-33902ImageMagick: Stack Overflow via Recursive FX Expression ParsingImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-33900ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit buildsImageMagick · Magick.NET-Q16-AnyCPU +5
- CVE-2026-33899ImageMagick: Heap BufferOverflow write of single zero byte when parsing XMLImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-6219aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injectionaandrew-me ytDownloader
- CVE-2026-33740EspoCRM: Email importEml can import and delete another user's attachment by raw fileIdespocrm
- CVE-2026-33659EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Accessespocrm
- CVE-2026-6218aandrew-me ytDownloader Error Details Panel createTextNode cross site scriptingaandrew-me ytDownloader
- CVE-2026-6216DbGate SVG Icon String FontIcon.svelte cross site scriptingDbGate · dbgate-web
- CVE-2026-32270Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous paymentscraftcms commerce · craftcms/commerce
- CVE-2026-33657EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post fieldespocrm
- CVE-2026-6215DbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgeryDbGate
- CVE-2026-33534EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationespocrm
- CVE-2026-6202code-projects Easy Blog Site post.php sql injectioncode-projects Easy Blog Site
- CVE-2026-6201CodeAstro Online Job Portal Delete Job Posting job-delete.php access controlCodeAstro Online Job Portal
- CVE-2026-40041Pachno 1.0.6 Cross-Site Request Forgery via State-Changing EndpointsPachno
- CVE-2026-40038Pachno 1.0.6 Stored Cross-Site Scripting via Multiple ParametersPachno
- CVE-2026-6193PHPGurukul Daily Expense Tracking System register.php sql injectionPHPGurukul Daily Expense Tracking System
- CVE-2026-6192uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflowuclouvain openjpeg
- CVE-2026-39940ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.phpChurchCRM CRM
- CVE-2026-6191itsourcecode Construction Management System equipments.php sql injectionitsourcecode Construction Management System
- CVE-2026-6190itsourcecode Construction Management System employees.php sql injectionitsourcecode Construction Management System
- CVE-2026-6189SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2025-31991HCL DevOps Velocity is susceptible to brute-force attacksHCLSoftware Velocity
- CVE-2026-30812Stored Cross-Site Scripting in Event Comments via Filter BypassPandora FMS
- CVE-2026-6188SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-6231bson_validate may skip validation when processing certain inputsMongoDB C Driver
- CVE-2026-6187SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-6184code-projects Simple Content Management System welcome.php cross site scriptingcode-projects Simple Content Management System
- CVE-2026-6183code-projects Simple Content Management System index.php sql injectioncode-projects Simple Content Management System
- CVE-2026-6182code-projects Simple Content Management System login.php sql injectioncode-projects Simple Content Management System
- CVE-2026-31428netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOADLinux
- CVE-2026-31427netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdpLinux
- CVE-2026-31425rds: ib: reject FRMR registration before IB connection is establishedLinux
- CVE-2026-31424netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARPLinux
- CVE-2026-31423net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()Linux
- CVE-2026-31422net/sched: cls_flow: fix NULL pointer dereference on shared blocksLinux
- CVE-2026-31421net/sched: cls_fw: fix NULL pointer dereference on shared blocksLinux
- CVE-2026-31420bridge: mrp: reject zero test interval to avoid OOM panicLinux
- CVE-2026-31418netfilter: ipset: drop logically empty buckets in mtype_delLinux
- CVE-2026-31416netfilter: nfnetlink_log: account for netlink header sizeLinux
- CVE-2026-31415ipv6: avoid overflows in ip6_datagram_send_ctl()Linux
- CVE-2026-2728LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page.librenms · librenms/librenms
- CVE-2025-156321Panel-dev MaxKB MdPreview chat.ts cross site scripting1Panel-dev MaxKB
- CVE-2026-35565Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UIApache Software Foundation Apache Storm UI · org.apache.sto…
- CVE-2026-0232Cortex XDR Agent: Local Administrator can disable the agent on WindowsPalo Alto Networks Cortex XDR Agent
- CVE-2026-0233Autonomous Digital Experience Manager: Improper validation of ADEM certificatePalo Alto Networks Autonomous Digital Experience Manager
- CVE-2026-6167code-projects Faculty Management System subject-print.php sql injectioncode-projects Faculty Management System
- CVE-2026-34866Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confiHuawei HarmonyOS
- CVE-2026-6166code-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2025-15441Form Maker < 1.15.38 - SQL InjectionForm Maker by 10Web
- CVE-2026-6165code-projects Vehicle Showroom Management System Login_check.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6164code-projects Lost and Found Thing Management addcat.php sql injectioncode-projects Lost and Found Thing Management
- CVE-2026-6163code-projects Lost and Found Thing Management catageory.php sql injectioncode-projects Lost and Found Thing Management
- CVE-2026-21010Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.Samsung Mobile Devices
- CVE-2026-21008Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.Samsung Mobile Devices
- CVE-2026-40447Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115aSamsung Open Source Escargot
- CVE-2026-21014Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data.Samsung Mobile Samsung Camera
- CVE-2026-21013Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information.Samsung Mobile Galaxy Wearable
- CVE-2026-21012External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privSamsung Mobile Devices
- CVE-2026-21011Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend USamsung Mobile Devices
- CVE-2026-21009Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.Samsung Mobile Devices
- CVE-2026-21007Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.Samsung Mobile Devices
- CVE-2026-21006Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents.Samsung Mobile Devices
- CVE-2026-6162PHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scriptingPHPGurukul Company Visitor Management System
- CVE-2026-21003Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the reSamsung Mobile Devices
- CVE-2026-40446Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.ThisSamsung Open Source Escargot
- CVE-2026-25209Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc5Samsung Open Source Escargot
- CVE-2026-6161code-projects Simple ChatBox Endpoint insert.php sql injectioncode-projects Simple ChatBox
- CVE-2026-25206Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc5Samsung Open Source Escargot
- CVE-2026-6160code-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosurecode-projects Simple ChatBox
- CVE-2026-6159code-projects Simple ChatBox Endpoint insert.php cross site scriptingcode-projects Simple ChatBox
- CVE-2026-34864Boundary-unlimited vulnerability in the application read module.Huawei HarmonyOS
- CVE-2026-34863Out-of-bounds write vulnerability in the file system.Huawei HarmonyOS
- CVE-2026-34862Race condition vulnerability in the power consumption statistics module.Huawei HarmonyOS
- CVE-2026-34861Race condition vulnerability in the thermal management module.Huawei HarmonyOS
- CVE-2026-34859UAF vulnerability in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-34858UAF vulnerability in the communication module.Huawei HarmonyOS
- CVE-2026-34857UAF vulnerability in the communication module.Huawei HarmonyOS
- CVE-2026-35553Bluetooth ACPI Drivers provided by Dynabook Inc.Dynabook TOSRFEC.SYS · Dynabook DRFEC.SYS
- CVE-2026-34855Out-of-bounds write vulnerability in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-34854UAF vulnerability in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-6158Totolink N300RH upgrade.so setUpgradeUboot os command injectionTotolink N300RH
- CVE-2026-34849UAF vulnerability in the screen management module.Huawei HarmonyOS
- CVE-2026-28553Vulnerability of improper permission control in the theme setting module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-34867Double free vulnerability in the multi-mode input system.Huawei HarmonyOS
- CVE-2026-34860Access control vulnerability in the memo module.Huawei HarmonyOS
- CVE-2026-34852Stack overflow vulnerability in the media platform.Huawei HarmonyOS
- CVE-2026-34851Race condition vulnerability in the event notification module.Huawei HarmonyOS
- CVE-2026-34850Race condition vulnerability in the notification service.Huawei HarmonyOS
- CVE-2026-6153code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6152code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6179Stored Cross Site Scripting in NightWolf Penetration Testing PlatformFPT Software NightWolf Penetration Testing Platform
- CVE-2026-6151code-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6150code-projects Simple Laundry System checkupdatestatus.php cross site scriptingcode-projects Simple Laundry System
- CVE-2026-6149code-projects Vehicle Showroom Management System BookVehicleFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6148code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injectioncode-projects Vehicle Showroom Management System
- CVE-2026-6143farion1231 cc-switch ProxyServer server.rs cross-domain policyfarion1231 cc-switch
- CVE-2026-6142tushar-2223 Hotel Management System roomdelete.php sql injectiontushar-2223 Hotel Management System
- CVE-2026-25204Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process aSamsung Open Source Escargot
- CVE-2026-6141danielmiessler Personal_AI_Infrastructure parse_url.ts os command injectiondanielmiessler Personal_AI_Infrastructure
- CVE-2025-63743Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated
- CVE-2025-70936Vtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module.
- CVE-2026-26460A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0.
- CVE-2026-29628A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service
- CVE-2026-31280An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service
- CVE-2026-33555An issue was discovered in HAProxy before 3.3.6.HAProxy
- CVE-2026-36872Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php.
- CVE-2026-36873Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php.
- CVE-2026-36874Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php.
- CVE-2026-36919Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-updat
- CVE-2026-36920Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions
- CVE-2026-36922Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php.
- CVE-2026-36923Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php.
- CVE-2026-36937Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php.
- CVE-2026-36938Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php.
- CVE-2026-36941Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php.
- CVE-2026-36942Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php.
- CVE-2026-36943Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_
- CVE-2026-36944Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_deta
- CVE-2026-36945Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_
- CVE-2026-36946Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_
- CVE-2026-36947Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_s
- CVE-2026-36950Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php.
- CVE-2026-36952Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php.