# CVEs published 2026-04-15

194 CVEs were published on April 15, 2026: 20 critical, 82 high. Days are UTC.

- [CVE-2026-5363](https://cve.now/CVE-2026-5363.md): Use of weak cryptographic key in TP-Link Archer C7 (CVSS 5.4, TP-Link Systems Archer C7 v5 and)
- [CVE-2026-4880](https://cve.now/CVE-2026-4880.md): Barcode Scanner (+Mobile App) \<= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication (CVSS 9.8, ukrsolution Barcode Scanner (+Mobile App) – Inventory manag…)
- [CVE-2026-40245](https://cve.now/CVE-2026-40245.md): Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication (CVSS 7.5, free5gc · github.com/free5gc/udr)
- [CVE-2026-40193](https://cve.now/CVE-2026-40193.md): Maddy Mail Server: LDAP Filter Injection via Unsanitized Username (CVSS 8.2, foxcpp maddy · github.com/foxcpp/maddy)
- [CVE-2026-40947](https://cve.now/CVE-2026-40947.md): Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path. (CVSS 2.9, Yubico libfido2 · Yubico python-fido2 +1)
- [CVE-2026-40192](https://cve.now/CVE-2026-40192.md): Pillow is vulnerable to a FITS GZIP decompression bomb (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-40316](https://cve.now/CVE-2026-40316.md): OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow (CVSS 8.8, OWASP-BLT BLT)
- [CVE-2026-39350](https://cve.now/CVE-2026-39350.md): Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass (CVSS 5.4, istio · istio.io/istio)
- [CVE-2026-40179](https://cve.now/CVE-2026-40179.md): Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer (CVSS 5.3, prometheus · github.com/prometheus/prometheus)
- [CVE-2026-4949](https://cve.now/CVE-2026-4949.md): ProfilePress \<= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription (CVSS 4.3, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-6388](https://cve.now/CVE-2026-6388.md): Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation (CVSS 9.1, Red Hat OpenShift GitOps)
- [CVE-2026-1711](https://cve.now/CVE-2026-1711.md): Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8, Pegasystems Pega Infinity)
- [CVE-2026-1564](https://cve.now/CVE-2026-1564.md): Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 5.1, Pegasystems Pega Infinity)
- [CVE-2026-40261](https://cve.now/CVE-2026-40261.md): Composer has Command Injection via Malicious Perforce Reference (CVSS 8.8, composer · composer/composer)
- [CVE-2026-40176](https://cve.now/CVE-2026-40176.md): Composer is vulnerable to Command Injection via Malicious Perforce Repository (CVSS 7.8, composer · composer/composer)
- [CVE-2026-22676](https://cve.now/CVE-2026-22676.md): Barracuda RMM \< 2025.2.2 Privilege Escalation via Insecure Directory Permissions (CVSS 8.5, Barracuda Networks RMM)
- [CVE-2026-40173](https://cve.now/CVE-2026-40173.md): Dgraph: Unauthenticated pprof endpoint leaks admin auth token (CVSS 9.4, dgraph-io dgraph · github.com/dgraph-io/dgraph +3)
- [CVE-2026-40186](https://cve.now/CVE-2026-40186.md): ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements (CVSS 6.1, apostrophecms apostrophe · apostrophecms sanitize-html +1)
- [CVE-2026-39857](https://cve.now/CVE-2026-39857.md): Information Disclosure via \`choices\`/\`counts\` Query Parameters Bypassing publicApiProjection Field Restrictions (CVSS 5.3, apostrophecms apostrophe · apostrophe)
- [CVE-2026-35569](https://cve.now/CVE-2026-35569.md): ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS (CVSS 8.7, apostrophecms apostrophe · apostrophe)
- [CVE-2026-33889](https://cve.now/CVE-2026-33889.md): ApostropheCMS: Stored XSS via CSS Custom Property Injection in \`@apostrophecms/color-field\` Escaping Style Tag Context (CVSS 5.4, apostrophecms apostrophe · apostrophe)
- [CVE-2026-33888](https://cve.now/CVE-2026-33888.md): ApostropheCMS: publicApiProjection Bypass via \`project\` Query Builder in Piece-Type REST API (CVSS 5.3, apostrophecms apostrophe · apostrophe)
- [CVE-2026-21726](https://cve.now/CVE-2026-21726.md): Loki Path Traversal - CVE-2021-36156 Bypass (CVSS 5.3, Grafana Loki · github.com/grafana/loki +1)
- [CVE-2026-6385](https://cve.now/CVE-2026-6385.md): Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser (CVSS 6.5, Red Hat Lightspeed Core · Red Hat AI Inference Server +2)
- [CVE-2025-41118](https://cve.now/CVE-2025-41118.md): Sensitive COS \`SecretKey\` exposed in plaintext via configuration API due to missing type protection (CVSS 9.1, Grafana Pyroscope · github.com/grafana/pyroscope)
- [CVE-2026-33877](https://cve.now/CVE-2026-33877.md): ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint (CVSS 3.7, apostrophecms apostrophe · apostrophe)
- [CVE-2026-6384](https://cve.now/CVE-2026-6384.md): Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing (CVSS 7.3, Red Hat Enterprise Linux)
- [CVE-2026-6364](https://cve.now/CVE-2026-6364.md): Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information fr (CVSS 6.5, Google Chrome)
- [CVE-2026-6319](https://cve.now/CVE-2026-6319.md): Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in s (CVSS 7.5, Google Chrome)
- [CVE-2026-6318](https://cve.now/CVE-2026-6318.md): Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-6363](https://cve.now/CVE-2026-6363.md): Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access v (CVSS 8.8, Google Chrome)
- [CVE-2026-6317](https://cve.now/CVE-2026-6317.md): Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2026-6362](https://cve.now/CVE-2026-6362.md): Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory acce (CVSS 4.3, Google Chrome)
- [CVE-2026-6361](https://cve.now/CVE-2026-6361.md): Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage (CVSS 8.3, Google Chrome)
- [CVE-2026-6316](https://cve.now/CVE-2026-6316.md): Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-6315](https://cve.now/CVE-2026-6315.md): Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage i (CVSS 8.8, Google Chrome)
- [CVE-2026-6314](https://cve.now/CVE-2026-6314.md): Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-6313](https://cve.now/CVE-2026-6313.md): Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer (CVSS 3.1, Google Chrome)
- [CVE-2026-6312](https://cve.now/CVE-2026-6312.md): Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the rend (CVSS 3.1, Google Chrome)
- [CVE-2026-6311](https://cve.now/CVE-2026-6311.md): Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the ren (CVSS 8.3, Google Chrome)
- [CVE-2026-6310](https://cve.now/CVE-2026-6310.md): Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-6360](https://cve.now/CVE-2026-6360.md): Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-6309](https://cve.now/CVE-2026-6309.md): Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-6308](https://cve.now/CVE-2026-6308.md): Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 7.5, Google Chrome)
- [CVE-2026-6307](https://cve.now/CVE-2026-6307.md): Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-6306](https://cve.now/CVE-2026-6306.md): Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-6305](https://cve.now/CVE-2026-6305.md): Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-6304](https://cve.now/CVE-2026-6304.md): Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-6303](https://cve.now/CVE-2026-6303.md): Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-6302](https://cve.now/CVE-2026-6302.md): Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-6301](https://cve.now/CVE-2026-6301.md): Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-6300](https://cve.now/CVE-2026-6300.md): Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-6359](https://cve.now/CVE-2026-6359.md): Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer proce (CVSS 8.8, Google Chrome)
- [CVE-2026-6358](https://cve.now/CVE-2026-6358.md): Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read v (CVSS 8.8, Google Chrome)
- [CVE-2026-6299](https://cve.now/CVE-2026-6299.md): Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2026-6298](https://cve.now/CVE-2026-6298.md): Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information (CVSS 4.3, Google Chrome)
- [CVE-2026-6297](https://cve.now/CVE-2026-6297.md): Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform (CVSS 8.3, Google Chrome)
- [CVE-2026-6296](https://cve.now/CVE-2026-6296.md): Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via (CVSS 9.6, Google Chrome)
- [CVE-2026-40919](https://cve.now/CVE-2026-40919.md): Gimp: gimp: denial of service via specially crafted seattle filmworks file (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-40918](https://cve.now/CVE-2026-40918.md): Gimp: gimp: denial of service via crafted pvr image file (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-40917](https://cve.now/CVE-2026-40917.md): Gimp: gimp: application crashes or information disclosure via crafted icns image files (CVSS 5.0, Red Hat Enterprise Linux)
- [CVE-2026-40916](https://cve.now/CVE-2026-40916.md): Gimp: gimp: denial of service due to stack buffer overflow in tim image loader (CVSS 5.0, Red Hat Enterprise Linux)
- [CVE-2026-40915](https://cve.now/CVE-2026-40915.md): Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-21727](https://cve.now/CVE-2026-21727.md): Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org\_id=0 Record (CVSS 3.3, Grafana Correlations · github.com/grafana/grafana)
- [CVE-2026-5189](https://cve.now/CVE-2026-5189.md): Nexus Repository 3 - Hardcoded Credential in Internal Database Component (CVSS 9.2, Sonatype Nexus Repository)
- [CVE-2026-33667](https://cve.now/CVE-2026-33667.md): OpenProject: 2FA OTP Verification Missing Rate Limiting (CVSS 7.4, opf openproject)
- [CVE-2026-40256](https://cve.now/CVE-2026-40256.md): Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision (CVSS 5.0, WeblateOrg weblate · weblate)
- [CVE-2026-34632](https://cve.now/CVE-2026-34632.md): Photoshop Installer | CWE-427: Uncontrolled Search Path Element (CVSS 8.6, Adobe Photoshop Installer)
- [CVE-2026-6245](https://cve.now/CVE-2026-6245.md): Sssd: out-of-bounds read in the sssd (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-39845](https://cve.now/CVE-2026-39845.md): Weblate: SSRF via the webhook add-on using unprotected fetch\_url() (CVSS 4.1, WeblateOrg weblate · weblate)
- [CVE-2026-34393](https://cve.now/CVE-2026-34393.md): Weblate: Privilege escalation in the user API endpoint (CVSS 8.8, WeblateOrg weblate · weblate)
- [CVE-2026-34244](https://cve.now/CVE-2026-34244.md): Weblate: SSRF via Project-Level Machinery Configuration (CVSS 5.0, WeblateOrg weblate · weblate)
- [CVE-2026-6383](https://cve.now/CVE-2026-6383.md): Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation (CVSS 5.4, Red Hat OpenShift Virtualization · kubevirt.io/kubevirt)
- [CVE-2026-34242](https://cve.now/CVE-2026-34242.md): Weblate: Arbitrary File Read via Symlink (CVSS 7.7, WeblateOrg weblate · weblate)
- [CVE-2026-33440](https://cve.now/CVE-2026-33440.md): Weblate: Authenticated SSRF via redirect bypass of ALLOWED\_ASSET\_DOMAINS in screenshot URL uploads (CVSS 5.0, WeblateOrg weblate · weblate)
- [CVE-2026-33435](https://cve.now/CVE-2026-33435.md): Weblate: Remote code execution during backup restoration (CVSS 8.1, WeblateOrg weblate · weblate)
- [CVE-2026-4857](https://cve.now/CVE-2026-4857.md): SailPoint IdentityIQ Debug UI Incorrect Authorization (CVSS 8.4, SailPoint Technologies IdentityIQ)
- [CVE-2026-33220](https://cve.now/CVE-2026-33220.md): Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository (CVSS 6.8, WeblateOrg weblate · weblate)
- [CVE-2026-33214](https://cve.now/CVE-2026-33214.md): Weblate has improper access control for the translation memory API (CVSS 4.3, WeblateOrg weblate · weblate)
- [CVE-2026-33212](https://cve.now/CVE-2026-33212.md): Weblate: Improper access control for pending tasks in API (CVSS 3.1, WeblateOrg weblate · weblate)
- [CVE-2026-6290](https://cve.now/CVE-2026-6290.md): Velociraptor Query() Plugin Misapplies Permissions To Orgs (CVSS 8.0, Rapid7 Velociraptor · www.velocidex.com/golang/velociraptor)
- [CVE-2026-32631](https://cve.now/CVE-2026-32631.md): Git for Windows: \`git clone\` from manipulated repositories can leak NTLM hashes to arbitrary servers (CVSS 7.4, git-for-windows git)
- [CVE-2026-5758](https://cve.now/CVE-2026-5758.md): Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution (CVSS 6.5, Mafintosh Protocol-buffers-schema parser · protocol-buffers…)
- [CVE-2025-15610](https://cve.now/CVE-2025-15610.md): The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploited if the service i (CVSS 9.3, OpenText RightFax)
- [CVE-2025-63029](https://cve.now/CVE-2025-63029.md): WordPress WCFM Marketplace plugin \<= 3.7.1 - SQL Injection vulnerability (CVSS 7.6, WC Lovers WCFM Marketplace)
- [CVE-2026-6372](https://cve.now/CVE-2026-6372.md): WordPress Accept Cryptocurrencies with Plisio plugin \<= 2.0.5 - Payment Bypass vulnerability (CVSS 7.5, Accept Cryptocurrencies with Plisio)
- [CVE-2026-20136](https://cve.now/CVE-2026-20136.md): Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2026-20059](https://cve.now/CVE-2026-20059.md): Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unity Connection)
- [CVE-2026-20061](https://cve.now/CVE-2026-20061.md): Cisco Unity Connection SQL Injection Vulnerability (CVSS 4.3, Cisco Unity Connection)
- [CVE-2026-20060](https://cve.now/CVE-2026-20060.md): Cisco Unity Connection Open Redirect Vulnerability (CVSS 4.7, Cisco Unity Connection)
- [CVE-2026-20170](https://cve.now/CVE-2026-20170.md): A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to c (CVSS 6.1, Cisco Webex Contact Center)
- [CVE-2026-20184](https://cve.now/CVE-2026-20184.md): Cisco Webex Meetings Certificate Validation Vulnerability (CVSS 9.8, Cisco Webex Meetings)
- [CVE-2026-20180](https://cve.now/CVE-2026-20180.md): Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability (CVSS 9.9, Cisco Identity Services Engine Software)
- [CVE-2026-20152](https://cve.now/CVE-2026-20152.md): Cisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability (CVSS 5.3, Cisco Secure Web Appliance)
- [CVE-2026-20161](https://cve.now/CVE-2026-20161.md): Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability (CVSS 5.5, Cisco ThousandEyes Enterprise Agent)
- [CVE-2026-20186](https://cve.now/CVE-2026-20186.md): Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability (CVSS 9.9, Cisco Identity Services Engine Software)
- [CVE-2026-20148](https://cve.now/CVE-2026-20148.md): Cisco Identity Services Engine Path Traversal Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20147](https://cve.now/CVE-2026-20147.md): Cisco Identity Services Engine Remote Code Execution Vulnerability (CVSS 9.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20081](https://cve.now/CVE-2026-20081.md): Cisco Unity Connection Arbitrary File Download Vulnerability (CVSS 6.5, Cisco Unity Connection)
- [CVE-2026-20078](https://cve.now/CVE-2026-20078.md): Cisco Unity Connection Arbitrary File Download Vulnerability (CVSS 6.5, Cisco Unity Connection)
- [CVE-2026-20132](https://cve.now/CVE-2026-20132.md): Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2026-6370](https://cve.now/CVE-2026-6370.md): WordPress Mini Ajax Cart for WooCommerce plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, HashThemes Mini Ajax Cart for WooCommerce)
- [CVE-2025-15636](https://cve.now/CVE-2025-15636.md): WordPress YouTube Showcase plugin \<= 3.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, emarket-design YouTube Showcase)
- [CVE-2025-15635](https://cve.now/CVE-2025-15635.md): WordPress Smart Online Order for Clover plugin \<= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ZAYTECH Smart Online Order for Clover)
- [CVE-2025-53444](https://cve.now/CVE-2025-53444.md): WordPress Userpro plugin \< 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, DeluxeThemes Userpro)
- [CVE-2026-5387](https://cve.now/CVE-2026-5387.md): AVEVA Pipeline Simulation Missing Authorization (CVSS 9.3, AVEVA Pipeline Simulation)
- [CVE-2026-20205](https://cve.now/CVE-2026-20205.md): Sensitive Information Disclosure in ''\_internal'' index in Splunk MCP Server app (CVSS 7.2, Splunk MCP Server)
- [CVE-2026-20203](https://cve.now/CVE-2026-20203.md): Improper Access Control in Data Model Acceleration in Splunk Enterprise (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20204](https://cve.now/CVE-2026-20204.md): Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise (CVSS 7.1, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20202](https://cve.now/CVE-2026-20202.md): Improper Input Validation during User Account Creation in Splunk Enterprise (CVSS 6.6, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-12141](https://cve.now/CVE-2025-12141.md): Grafana Alerting Editors can edit destination of webhooks they did not create (CVSS 1.3, Grafana Alerting)
- [CVE-2026-4682](https://cve.now/CVE-2026-4682.md): Certain HP DeskJet All In One (AIO) Devices – Potential Remote Code Execution & Potential Buffer Overflow (CVSS 8.7, HP DeskJet 2800e All-in-One Printer series · HP DeskJet… +4)
- [CVE-2026-4667](https://cve.now/CVE-2026-4667.md): HP System Optimizer - Escalation of Privilege (CVSS 7.3, HP OMEN Gaming Hub)
- [CVE-2026-25219](https://cve.now/CVE-2026-25219.md): Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-4145](https://cve.now/CVE-2026-4145.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticat (CVSS 8.5, Lenovo Software Fix)
- [CVE-2026-4135](https://cve.now/CVE-2026-4135.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allo (CVSS 5.2, Lenovo Software Fix)
- [CVE-2026-4134](https://cve.now/CVE-2026-4134.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allo (CVSS 7.0, Lenovo Software Fix)
- [CVE-2026-1636](https://cve.now/CVE-2026-1636.md): A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authentica (CVSS 5.4, Lenovo Service Bridge)
- [CVE-2026-0827](https://cve.now/CVE-2026-0827.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareScanAddin used in Len (CVSS 6.9, Lenovo Diagnostics · Lenovo Vantage)
- [CVE-2026-1852](https://cve.now/CVE-2026-1852.md): Product Pricing Table by WooBeWoo \<= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion (CVSS 6.1, woobeewoo Product Pricing Table by WooBeWoo)
- [CVE-2026-3590](https://cve.now/CVE-2026-3590.md): Race Condition in Guest Magic Link Authentication Allows Token Reuse (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-30778](https://cve.now/CVE-2026-30778.md): Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. (CVSS 7.5, Apache Software Foundation Apache SkyWalking · org.apache.s…)
- [CVE-2026-40786](https://cve.now/CVE-2026-40786.md): WordPress MyRewards plugin \<= 5.7.3 - Broken Access Control vulnerability (CVSS 4.3, Long Watch Studio MyRewards)
- [CVE-2026-40784](https://cve.now/CVE-2026-40784.md): WordPress FluentBoards plugin \<= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 8.1, Mahmudul Hasan Arif FluentBoards)
- [CVE-2026-40778](https://cve.now/CVE-2026-40778.md): WordPress Majestic Support plugin \<= 1.1.2 - Broken Access Control vulnerability (CVSS 5.3, Majestic Support)
- [CVE-2026-40764](https://cve.now/CVE-2026-40764.md): WordPress Contact Form by WPForms plugin \<= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.1, Syed Balkhi Contact Form by WPForms)
- [CVE-2026-40763](https://cve.now/CVE-2026-40763.md): WordPress Royal Elementor Addons plugin \<= 1.7.1056 - Broken Access Control vulnerability (CVSS 5.3, WP Royal Royal Elementor Addons)
- [CVE-2026-40745](https://cve.now/CVE-2026-40745.md): WordPress Element Pack Elementor Addons plugin \<= 8.4.2 - SQL Injection vulnerability (CVSS 7.6, bdthemes Element Pack Elementor Addons)
- [CVE-2026-40744](https://cve.now/CVE-2026-40744.md): WordPress Beaver Builder plugin \<= 2.10.1.2 - SQL Injection vulnerability (CVSS 8.5, Beaver Builder)
- [CVE-2026-40742](https://cve.now/CVE-2026-40742.md): WordPress Nelio AB Testing plugin \<= 8.2.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, Nelio Software Nelio AB Testing)
- [CVE-2026-40740](https://cve.now/CVE-2026-40740.md): WordPress Tutor LMS plugin \<= 3.9.7 - Broken Access Control vulnerability (CVSS 5.4, Themeum Tutor LMS)
- [CVE-2026-40737](https://cve.now/CVE-2026-40737.md): WordPress COMPE plugin \<= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, VillaTheme COMPE)
- [CVE-2026-40734](https://cve.now/CVE-2026-40734.md): WordPress Categories Images plugin \<= 3.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zahlan Categories Images)
- [CVE-2026-40730](https://cve.now/CVE-2026-40730.md): WordPress ThemeGrill Demo Importer plugin \<= 2.0.0.6 - Broken Access Control vulnerability (CVSS 5.3, ThemeGrill Demo Importer)
- [CVE-2026-40729](https://cve.now/CVE-2026-40729.md): WordPress 3D viewer – Embed 3D Models plugin \<= 1.8.5 - Broken Access Control vulnerability (CVSS 4.3, bPlugins 3D viewer – Embed 3D Models)
- [CVE-2026-40728](https://cve.now/CVE-2026-40728.md): WordPress Magazine Blocks plugin \<= 1.8.3 - Broken Access Control vulnerability (CVSS 4.3, BlockArt Magazine Blocks)
- [CVE-2026-28741](https://cve.now/CVE-2026-28741.md): CSRF Protection Bypass Allows Updating a User's Authentication Method (CVSS 6.8, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-33805](https://cve.now/CVE-2026-33805.md): @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers (CVSS 9.0, @fastify/reply-from · @fastify/http-proxy)
- [CVE-2026-27769](https://cve.now/CVE-2026-27769.md): Connected Workspaces: Malicious remote server can manipulate arbitrary user's status (CVSS 2.7, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-33807](https://cve.now/CVE-2026-33807.md): @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes (CVSS 9.1, @fastify/express)
- [CVE-2024-33618](https://cve.now/CVE-2024-33618.md): Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk sp (CVSS 7.5, Bosch BVMS · Bosch DIVAR IP all-in-one 7000 R3 +2)
- [CVE-2026-33808](https://cve.now/CVE-2026-33808.md): @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) (CVSS 9.1, @fastify/express)
- [CVE-2026-3505](https://cve.now/CVE-2026-3505.md): Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · org.bouncycastle:b… +6)
- [CVE-2026-5588](https://cve.now/CVE-2026-5588.md): PKIX draft CompositeVerifier accepts empty signature sequence as valid. (CVSS 6.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +8)
- [CVE-2026-5598](https://cve.now/CVE-2026-5598.md): Non-constant time comparisons risk private key leakage in FrodoKEM. (CVSS 8.9, Legion of the Bouncy Castle BC-JAVA · org.bouncycastle:b… +2)
- [CVE-2026-0636](https://cve.now/CVE-2026-0636.md): LDAP Injection Vulnerability in LDAPStoreHelper.java (CVSS 5.5, Legion of the Bouncy Castle BC-JAVA · org.bouncycastle:b… +2)
- [CVE-2025-14813](https://cve.now/CVE-2025-14813.md): GOSTCTR implementation unable to process more than 255 blocks correctly (CVSS 9.3, Legion of the Bouncy Castle BC-JAVA · org.bouncycastle:… +13)
- [CVE-2025-52641](https://cve.now/CVE-2025-52641.md): Internal Filesystem Exploration vulnerability (CVSS 2.9, HCL AION)
- [CVE-2026-3643](https://cve.now/CVE-2026-3643.md): Accessibly \<= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API (CVSS 7.2, onthemapmarketing Accessibly – WordPress Website Accessibil…)
- [CVE-2026-4011](https://cve.now/CVE-2026-4011.md): Power Charts \<= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, dgwyer Power Charts – Responsive Beautiful Charts & Graphs)
- [CVE-2026-3998](https://cve.now/CVE-2026-3998.md): WM JqMath \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute (CVSS 6.4, webmindpt WM JqMath)
- [CVE-2026-1782](https://cve.now/CVE-2026-1782.md): MetForm Pro \<= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation' (CVSS 5.3, Wpmet MetForm Pro)
- [CVE-2026-3649](https://cve.now/CVE-2026-3649.md): Katalogportal-pdf-sync Widget \<= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal\_shortcodePrinter' AJAX Action (CVSS 5.3, colbeinformatik Katalogportal-pdf-sync Widget)
- [CVE-2026-4091](https://cve.now/CVE-2026-4091.md): OPEN-BRAIN \<= 0.5.0 - Cross-Site Request Forgery (CVSS 6.1, faridsaniee OPEN-BRAIN)
- [CVE-2026-3461](https://cve.now/CVE-2026-3461.md): Visa Acceptance Solutions \<= 2.1.0 - Unauthenticated Authentication Bypass via Billing Email (CVSS 9.8, visaacceptancesolutions Visa Acceptance Solutions)
- [CVE-2026-3642](https://cve.now/CVE-2026-3642.md): e-shot \<= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX (CVSS 5.3, forfront e-shot)
- [CVE-2026-4005](https://cve.now/CVE-2026-4005.md): Coachific Shortcode \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute (CVSS 6.4, Coachific Shortcode)
- [CVE-2026-4002](https://cve.now/CVE-2026-4002.md): Petje.af \<= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf\_disconnect' AJAX Action (CVSS 4.3, petjeaf Petje.af)
- [CVE-2026-3659](https://cve.now/CVE-2026-3659.md): WP Circliful \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, bappidgreat WP Circliful)
- [CVE-2025-40899](https://cve.now/CVE-2025-40899.md): Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0 (CVSS 7.1, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40897](https://cve.now/CVE-2025-40897.md): Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-5694](https://cve.now/CVE-2026-5694.md): Quick Interest Slider \<= 3.1.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, aerin Quick Interest Slider)
- [CVE-2026-5617](https://cve.now/CVE-2026-5617.md): Login as User \<= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup\_original\_admin' Cookie (CVSS 8.8, royalnavneet Login as User – Switch User & WooCommerce Logi…)
- [CVE-2026-5717](https://cve.now/CVE-2026-5717.md): VI: Include Post By \<= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class\_container' Shortcode Attribute (CVSS 6.4, knighthawk VI: Include Post By)
- [CVE-2026-5088](https://cve.now/CVE-2026-5088.md): Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts (CVSS 7.5, JDEGUEST Apache::API::Password)
- [CVE-2026-6293](https://cve.now/CVE-2026-6293.md): Inquiry form to posts or pages \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq\_header' Parameter (CVSS 4.3, udamadu Inquiry form to posts or pages)
- [CVE-2026-40719](https://cve.now/CVE-2026-40719.md): Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver address cannot be resolv (CVSS 7.5, MaraDNS)
- [CVE-2026-5160](https://cve.now/CVE-2026-5160.md): Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper or (CVSS 5.1, github.com/yuin/goldmark/renderer/html · github.com/yuin/go…)
- [CVE-2026-26291](https://cve.now/CVE-2026-26291.md): Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. (CVSS 5.4, GROWI)
- [CVE-2026-5397](https://cve.now/CVE-2026-5397.md): Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application (CVSS 7.8, OMRON SOCIAL SOLUTIONS CO. PowerAttendant Standard Edition)
- [CVE-2026-1555](https://cve.now/CVE-2026-1555.md): WebStack \<= 1.2024 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Owen WebStack)
- [CVE-2026-6328](https://cve.now/CVE-2026-6328.md): XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets (CVSS 8.3, XQUIC Project XQUIC)
- [CVE-2026-40499](https://cve.now/CVE-2026-40499.md): radare2 \< 6.1.4 Command Injection via PDB Parser print\_gvars() (CVSS 8.4, radareorg radare2)
- [CVE-2026-1509](https://cve.now/CVE-2026-1509.md): Avada (Fusion) Builder \<= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution (CVSS 5.4, themefusion Avada (Fusion) Builder)
- [CVE-2026-1541](https://cve.now/CVE-2026-1541.md): Avada (Fusion) Builder \<= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference (CVSS 4.3, themefusion Avada (Fusion) Builder)
- [CVE-2026-4812](https://cve.now/CVE-2026-4812.md): Advanced Custom Fields (ACF®) \<= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters (CVSS 5.3, wpengine Advanced Custom Fields)
- [CVE-2026-2834](https://cve.now/CVE-2026-2834.md): Age Verification & Identity Verification by Token of Trust \<= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter (CVSS 7.2, tokenoftrust Age Verification & Identity Verification by To…)
- [CVE-2025-54550](https://cve.now/CVE-2025-54550.md): Apache Airflow: RCE by race condition in example\_xcom dag (CVSS 8.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-33806](https://cve.now/CVE-2026-33806.md): fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header (CVSS 7.5, fastify)
- [CVE-2026-40105](https://cve.now/CVE-2026-40105.md): XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2026-40104](https://cve.now/CVE-2026-40104.md): XWiki's REST APIs can list all pages/spaces, leading to unavailability (CVSS 6.9, org.xwiki.platform:xwiki-platform-oldcore · org.xwiki.platf…)
- [CVE-2024-53412](https://cve.now/CVE-2024-53412.md): Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achie (CVSS 8.4, github.com/NietThijmen/ShoppingCart)
- [CVE-2025-67841](https://cve.now/CVE-2025-67841.md): Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue. (CVSS 7.5)
- [CVE-2026-30364](https://cve.now/CVE-2026-30364.md): CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function. (CVSS 7.5)
- [CVE-2026-30461](https://cve.now/CVE-2026-30461.md): Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Ins (CVSS 8.3)
- [CVE-2026-30615](https://cve.now/CVE-2026-30615.md): A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. (CVSS 8.0)
- [CVE-2026-30616](https://cve.now/CVE-2026-30616.md): Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. (CVSS 7.3)
- [CVE-2026-30617](https://cve.now/CVE-2026-30617.md): LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. (CVSS 8.6)
- [CVE-2026-30624](https://cve.now/CVE-2026-30624.md): Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. (CVSS 8.6)
- [CVE-2026-30625](https://cve.now/CVE-2026-30625.md): Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. (CVSS 9.8, upsonic)
- [CVE-2026-30993](https://cve.now/CVE-2026-30993.md): Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. (CVSS 9.8)
- [CVE-2026-30994](https://cve.now/CVE-2026-30994.md): Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive informati (CVSS 7.5)
- [CVE-2026-30995](https://cve.now/CVE-2026-30995.md): Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador\_ver.php endpoint. (CVSS 8.6)
- [CVE-2026-30996](https://cve.now/CVE-2026-30996.md): An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and r (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.