CVEs published April 16, 2026
131 CVEs were published on April 16, 2026: 15 critical, 56 high.
- Published
- 131
- Critical
- 15
- High
- 56
- Medium
- 55
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 68
Most affected products
- dataease
- 9
- free5gc · github.com/free5gc/udr
- 4
- Dell PowerScale OneFS
- 3
- Eaton IPP Software
- 3
- enchant97 note-mark · github.com/enchant97/note-mark/backend
- 3
- imprintnext Riaxe Product Customizer
- 3
- siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- 3
- WSO2 API Manager
- 3
- @fastify/middie
- 2
- @fastify/static
- 2
Critical 15
- CVE-2026-40322SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCEsiyuan-note siyuan
- CVE-2026-5426KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey valueDigital Knowledge KnowledgeDeliver
- CVE-2026-6270@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes@fastify/middie
- CVE-2026-31843goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Executiongoodoneuz pay-uz · goodoneuz/pay-uz
- CVE-2026-3596Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Actionimprintnext Riaxe Product Customizer
- CVE-2026-6350Openfind｜MailGates/MailAudit - Stack-based Buffer OverflowOpenfind MailGates · Openfind MailAudit
- CVE-2026-6349HGiga｜iSherlock - OS Command InjectionHGiga iSherlock-base-4.5 · HGiga iSherlock-audit-4.5 +2
- CVE-2026-6348Simopro Technology｜WinMatrix - Missing AuthenticationSimopro Technology WinMatrix
- CVE-2026-40504Creolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_execmarcobambini gravity
- CVE-2026-40959Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.Luanti
- CVE-2026-37338SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.
- CVE-2026-37339SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.
- CVE-2026-37340SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/edit_music.php.
- CVE-2026-37345SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php.
- CVE-2026-37347SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php.
High 56
- CVE-2026-40262Note Mark has Stored XSS via Unrestricted Asset Uploadenchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-22734Cloud Foundry UAA SAML 2.0 Signature BypassCloud Foundry UUA
- CVE-2026-40318SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-40259SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView APIsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-41113sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.sagredo qmail
- CVE-2026-40248free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptionsfree5gc · github.com/free5gc/udr
- CVE-2026-40247free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptionsfree5gc · github.com/free5gc/udr
- CVE-2026-40246free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptionsfree5gc · github.com/free5gc/udr
- CVE-2026-40170ngtcp2 has a qlog transport parameter serialization stack buffer overflowngtcp2
- CVE-2026-40308My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blogjoedolson my-calendar · joedolson/my-calendar
- CVE-2026-39313MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transportQuantGeekDev mcp-framework · mcp-framework
- CVE-2026-35469SpdyStream: DOS on CRImoby spdystream · github.com/moby/spdystream
- CVE-2026-40901DataEase: Quartz Deserialization → Remote Code Executiondataease
- CVE-2026-40900DataEase has SQL Injection via Stacked Queriesdataease
- CVE-2026-40899DataEase has an Arbitrary File Read Vulnerabilitydataease
- CVE-2026-33207DataEase SQL Injection Vulnerabilitydataease
- CVE-2026-33122DataEase has SQL Injection via Datasource Managementdataease
- CVE-2025-54502Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Serie… +49
- CVE-2026-6442Improper Command Detection Logic Allows RCE in Cortex Code Command-Line InterfaceSnowflake Cortex Code CLI
- CVE-2026-33121DataEase has SQL Injection via Datasource Save Flowdataease
- CVE-2026-33084DataEase has SQL Injection through its getFieldEnumObj Endpointdataease
- CVE-2026-33083DataEase has SQL Injection in Order By Clausedataease
- CVE-2026-33082DataEase: SQL Injection in v2 Dataset Exportdataease
- CVE-2026-41082In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.OCaml opam
- CVE-2026-2336Weak webstax_auth Cookie Authentication Allows Privilege EscalationMicrochip IStaX
- CVE-2026-3324Authentication BypassZohocorp ManageEngine Log360
- CVE-2026-6409Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted inputProtocol Buffers Protobuf-php · google/protobuf
- CVE-2026-33804@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option@fastify/middie
- CVE-2026-5785SQL InjectionZohocorp ManageEngine PAM360 · Zohocorp ManageEngine Passwo…
- CVE-2026-31987Apache Airflow: JWT token appearing in logsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-3489DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'designinvento DirectoryPress – Business Directory And Class…
- CVE-2026-23772Dell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an Improper Privilege Management vulnerability.Dell Storage Manager
- CVE-2024-2374XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of ServiceWSO2 API Manager · WSO2 Identity Server +2
- CVE-2025-14868Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletionshahinurislam Career Section
- CVE-2026-41035In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free.Samba rsync
- CVE-2026-3876Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcodespecialk Prismatic
- CVE-2026-1620Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template ParameterLivemesh Addons by Elementor
- CVE-2026-3861LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly LY LINE client for iOS
- CVE-2026-3614AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationacyba AcyMailing – An Ultimate Newsletter Plugin and Market…
- CVE-2026-3599Riaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_dataimprintnext Riaxe Product Customizer
- CVE-2026-5050Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulationjconti Payment Gateway for Redsys & WooCommerce Lite
- CVE-2026-22619Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code executEaton IPP software
- CVE-2023-3634Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible FunctionsFesto MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD · Festo M… +10
- CVE-2026-6351Openfind｜MailGates/MailAudit - CRLF InjectionOpenfind MailGates · Openfind MailAudit
- CVE-2026-41015radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP.radare2
- CVE-2026-40960Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment.Luanti
- CVE-2026-40502OpenHarness Remote Administrative Command Injection via Gateway HandlerHKUDS OpenHarness
- CVE-2026-40503OpenHarness Path Traversal Information Disclosure via /memory showHKUDS OpenHarness
- CVE-2026-30459An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset toke
- CVE-2026-30656A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option.
- CVE-2026-37336SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.
- CVE-2026-37337SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.
- CVE-2026-37341SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_category.php.
- CVE-2026-37342SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_parked_details.php.
- CVE-2026-37343SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_user.php.
- CVE-2026-37344SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_location.php.
Medium, low and unrated 60
- CVE-2026-40265Note Mark has Broken Access Control on Asset Downloadenchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-40263Note Mark: Username Enumeration via Login Endpoint Timing Side-Channelenchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-40260pypdf: Manipulated XMP metadata entity declarations can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2026-40922SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2024-58343Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_idVision Helpdesk
- CVE-2026-40255@adonisjs/http-server has an Open Redirect vulnerabilityadonisjs http-server · adonisjs http-core +2
- CVE-2026-40253openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.copencryptoki
- CVE-2026-40249free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errorsfree5gc · github.com/free5gc/udr
- CVE-2026-34164Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingServicevaltimo-platform valtimo · com.ritense.valtimo:inbox
- CVE-2026-33472Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)cryptomator
- CVE-2025-54510A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privilegeAMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +7
- CVE-2023-20585Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Series… +2
- CVE-2025-43937Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability.Dell PowerScale OneFS
- CVE-2025-43935Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability.Dell PowerScale OneFS
- CVE-2025-43883Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability.Dell PowerScale OneFS
- CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionruby zlib · zlib
- CVE-2026-24749Silverstripe Assets Module has a DBFile::getURL() permission bypasssilverstripe-assets · silverstripe/assets
- CVE-2026-41080libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.libexpat project libexpat
- CVE-2025-36579Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability.Dell Pro 14 Essential PV14250 · Dell Pro Micro / QCM1255 +69
- CVE-2026-2840Email Encoder – Protect Email Addresses and Phone Numbers <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcodeonlineoptimisation Email Encoder – Protect Email Addresses…
- CVE-2026-6410@fastify/static vulnerable to path traversal in directory listing@fastify/static
- CVE-2026-4160Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modificationtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2026-6414@fastify/static vulnerable to route guard bypass via encoded path separators@fastify/static
- CVE-2025-15621Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authenticationSparx Systems Pty Sparx Enterprise Architect
- CVE-2026-3155OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'OneSignal – Web Push Notifications
- CVE-2026-3369Better Find and Replace – AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Titlecodesolz Better Find and Replace – AI-Powered Suggestions
- CVE-2025-12624Improper Token Invalidation in WSO2 Identity Server Allows Access After Account LockWSO2 Identity Server
- CVE-2025-6024Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious WebsitesWSO2 API Manager · WSO2 Identity Server
- CVE-2024-10242Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and RedirectionWSO2 API Manager
- CVE-2024-8010XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary FilesWSO2 API Manager
- CVE-2024-4867Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalWSO2 API Manager
- CVE-2026-0718Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modificationwpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- CVE-2026-3355Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'ivole Customer Reviews for WooCommerce
- CVE-2025-13364WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcodeflippercode WP Maps – Store Locator,Google Maps,OpenStreetM…
- CVE-2026-3875BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeswpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…
- CVE-2026-3995OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Settingfaridsaniee OPEN-BRAIN
- CVE-2026-1572Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin SettingsLivemesh Addons by Elementor
- CVE-2026-41034ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and othAscensio ONLYOFFICE DocumentServer
- CVE-2026-41030In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.Ascensio ONLYOFFICE DesktopEditors
- CVE-2026-3581Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Updateiandunn Basic Google Maps Placemarks
- CVE-2026-3773Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameteronlineada Accessibility Suite by Ability, Inc
- CVE-2026-3551Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Settingrafasashi Custom New User Notification
- CVE-2026-3595Riaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameterimprintnext Riaxe Product Customizer
- CVE-2026-22618A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecurEaton IPP software
- CVE-2026-22617Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cEaton IPP Software
- CVE-2023-5872Wago: Vulnerability in Smart Designer Web-ApplicationWago Smart Designer
- CVE-2026-22616Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffiEaton IPP Software
- CVE-2026-22615Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privilEaton IPP Software
- CVE-2026-40118UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability.Arcserve UDP Console
- CVE-2026-5070Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Contentsiteorigin Vantage
- CVE-2026-3878WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'fahadmahmood WP Docs
- CVE-2026-4032CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcodekpumuk CodeColorer
- CVE-2026-3885WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcodegn_themes Shortcodes Ultimate – Content Elements
- CVE-2026-3428A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve prASUS Member Center
- CVE-2026-1880An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due ASUS DriverHub
- CVE-2026-40962FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.cFFmpeg
- CVE-2026-3299WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcodefuttta WP YouTube Lyte
- CVE-2026-40505MuPDF < 1.27 mutool ANSI Injection via MetadataArtifex Software MuPDF
- CVE-2026-37100An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / v
- CVE-2026-37346SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=.