# CVEs published 2026-04-16

131 CVEs were published on April 16, 2026: 15 critical, 56 high. Days are UTC.

- [CVE-2026-40265](https://cve.now/CVE-2026-40265.md): Note Mark has Broken Access Control on Asset Download (CVSS 5.9, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-40263](https://cve.now/CVE-2026-40263.md): Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel (CVSS 3.7, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-40262](https://cve.now/CVE-2026-40262.md): Note Mark has Stored XSS via Unrestricted Asset Upload (CVSS 8.7, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-22734](https://cve.now/CVE-2026-22734.md): Cloud Foundry UAA SAML 2.0 Signature Bypass (CVSS 8.6, Cloud Foundry UUA)
- [CVE-2026-40260](https://cve.now/CVE-2026-40260.md): pypdf: Manipulated XMP metadata entity declarations can exhaust RAM (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-40922](https://cve.now/CVE-2026-40922.md): SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066) (CVSS 5.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-40322](https://cve.now/CVE-2026-40322.md): SiYuan: Mermaid \`javascript:\` Link Injection Leads to Stored XSS and Electron RCE (CVSS 9.1, siyuan-note siyuan)
- [CVE-2026-40318](https://cve.now/CVE-2026-40318.md): SiYuan: Publish Reader Path Traversal Delete via \`removeUnusedAttributeView\` (CVSS 8.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-40259](https://cve.now/CVE-2026-40259.md): SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API (CVSS 8.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2024-58343](https://cve.now/CVE-2024-58343.md): Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis\_client\_id (CVSS 4.3, Vision Helpdesk)
- [CVE-2026-40255](https://cve.now/CVE-2026-40255.md): @adonisjs/http-server has an Open Redirect vulnerability (CVSS 6.1, adonisjs http-server · adonisjs http-core +2)
- [CVE-2026-40253](https://cve.now/CVE-2026-40253.md): openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c (CVSS 6.8, opencryptoki)
- [CVE-2026-41113](https://cve.now/CVE-2026-41113.md): sagredo qmail before 2026.04.07 allows tls\_quit remote code execution because of popen in notlshosts\_auto in qmail-remote.c. (CVSS 8.1, sagredo qmail)
- [CVE-2026-40249](https://cve.now/CVE-2026-40249.md): free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors (CVSS 6.9, free5gc · github.com/free5gc/udr)
- [CVE-2026-40248](https://cve.now/CVE-2026-40248.md): free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions (CVSS 8.7, free5gc · github.com/free5gc/udr)
- [CVE-2026-40247](https://cve.now/CVE-2026-40247.md): free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions (CVSS 8.7, free5gc · github.com/free5gc/udr)
- [CVE-2026-40246](https://cve.now/CVE-2026-40246.md): free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions (CVSS 8.7, free5gc · github.com/free5gc/udr)
- [CVE-2026-40170](https://cve.now/CVE-2026-40170.md): ngtcp2 has a qlog transport parameter serialization stack buffer overflow (CVSS 7.5, ngtcp2)
- [CVE-2026-40308](https://cve.now/CVE-2026-40308.md): My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch\_to\_blog (CVSS 8.8, joedolson my-calendar · joedolson/my-calendar)
- [CVE-2026-39313](https://cve.now/CVE-2026-39313.md): MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport (CVSS 8.7, QuantGeekDev mcp-framework · mcp-framework)
- [CVE-2026-35469](https://cve.now/CVE-2026-35469.md): SpdyStream: DOS on CRI (CVSS 8.7, moby spdystream · github.com/moby/spdystream)
- [CVE-2026-34164](https://cve.now/CVE-2026-34164.md): Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService (CVSS 4.9, valtimo-platform valtimo · com.ritense.valtimo:inbox)
- [CVE-2026-33472](https://cve.now/CVE-2026-33472.md): Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass) (CVSS 4.8, cryptomator)
- [CVE-2026-40901](https://cve.now/CVE-2026-40901.md): DataEase: Quartz Deserialization → Remote Code Execution (CVSS 7.5, dataease)
- [CVE-2026-40900](https://cve.now/CVE-2026-40900.md): DataEase has SQL Injection via Stacked Queries (CVSS 8.7, dataease)
- [CVE-2026-40899](https://cve.now/CVE-2026-40899.md): DataEase has an Arbitrary File Read Vulnerability (CVSS 8.3, dataease)
- [CVE-2026-33207](https://cve.now/CVE-2026-33207.md): DataEase SQL Injection Vulnerability (CVSS 8.6, dataease)
- [CVE-2026-33122](https://cve.now/CVE-2026-33122.md): DataEase has SQL Injection via Datasource Management (CVSS 8.6, dataease)
- [CVE-2025-54502](https://cve.now/CVE-2025-54502.md): Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access ( (CVSS 7.1, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Serie… +49)
- [CVE-2025-54510](https://cve.now/CVE-2025-54510.md): A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privilege (CVSS 5.9, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +7)
- [CVE-2026-6442](https://cve.now/CVE-2026-6442.md): Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface (CVSS 8.3, Snowflake Cortex Code CLI)
- [CVE-2023-20585](https://cve.now/CVE-2023-20585.md): Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger (CVSS 5.6, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Series… +2)
- [CVE-2026-33121](https://cve.now/CVE-2026-33121.md): DataEase has SQL Injection via Datasource Save Flow (CVSS 8.7, dataease)
- [CVE-2026-33084](https://cve.now/CVE-2026-33084.md): DataEase has SQL Injection through its getFieldEnumObj Endpoint (CVSS 8.7, dataease)
- [CVE-2025-43937](https://cve.now/CVE-2025-43937.md): Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. (CVSS 6.6, Dell PowerScale OneFS)
- [CVE-2025-43935](https://cve.now/CVE-2025-43935.md): Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2025-43883](https://cve.now/CVE-2025-43883.md): Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability. (CVSS 4.1, Dell PowerScale OneFS)
- [CVE-2026-33083](https://cve.now/CVE-2026-33083.md): DataEase has SQL Injection in Order By Clause (CVSS 8.7, dataease)
- [CVE-2026-33082](https://cve.now/CVE-2026-33082.md): DataEase: SQL Injection in v2 Dataset Export (CVSS 8.7, dataease)
- [CVE-2026-41082](https://cve.now/CVE-2026-41082.md): In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. (CVSS 7.3, OCaml opam)
- [CVE-2026-27820](https://cve.now/CVE-2026-27820.md): zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption (CVSS 1.7, ruby zlib · zlib)
- [CVE-2026-24749](https://cve.now/CVE-2026-24749.md): Silverstripe Assets Module has a DBFile::getURL() permission bypass (CVSS 5.3, silverstripe-assets · silverstripe/assets)
- [CVE-2026-2336](https://cve.now/CVE-2026-2336.md): Weak webstax\_auth Cookie Authentication Allows Privilege Escalation (CVSS 8.7, Microchip IStaX)
- [CVE-2026-41080](https://cve.now/CVE-2026-41080.md): libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. (CVSS 2.9, libexpat project libexpat)
- [CVE-2025-36579](https://cve.now/CVE-2025-36579.md): Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. (CVSS 5.1, Dell Pro 14 Essential PV14250 · Dell Pro Micro / QCM1255 +69)
- [CVE-2026-5426](https://cve.now/CVE-2026-5426.md): KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value (CVSS 9.1, Digital Knowledge KnowledgeDeliver)
- [CVE-2026-3324](https://cve.now/CVE-2026-3324.md): Authentication Bypass (CVSS 8.2, Zohocorp ManageEngine Log360)
- [CVE-2026-6409](https://cve.now/CVE-2026-6409.md): Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input (CVSS 7.1, Protocol Buffers Protobuf-php · google/protobuf)
- [CVE-2026-2840](https://cve.now/CVE-2026-2840.md): Email Encoder – Protect Email Addresses and Phone Numbers \<= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb\_mailto Shortcode (CVSS 6.4, onlineoptimisation Email Encoder – Protect Email Addresses…)
- [CVE-2026-33804](https://cve.now/CVE-2026-33804.md): @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option (CVSS 7.4, @fastify/middie)
- [CVE-2026-5785](https://cve.now/CVE-2026-5785.md): SQL Injection (CVSS 8.1, Zohocorp ManageEngine PAM360 · Zohocorp ManageEngine Passwo…)
- [CVE-2026-6270](https://cve.now/CVE-2026-6270.md): @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes (CVSS 9.1, @fastify/middie)
- [CVE-2026-31987](https://cve.now/CVE-2026-31987.md): Apache Airflow: JWT token appearing in logs (CVSS 7.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-6410](https://cve.now/CVE-2026-6410.md): @fastify/static vulnerable to path traversal in directory listing (CVSS 5.3, @fastify/static)
- [CVE-2026-4160](https://cve.now/CVE-2026-4160.md): Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder \<= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification (CVSS 5.3, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2026-6414](https://cve.now/CVE-2026-6414.md): @fastify/static vulnerable to route guard bypass via encoded path separators (CVSS 5.9, @fastify/static)
- [CVE-2026-31843](https://cve.now/CVE-2026-31843.md): goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution (CVSS 10.0, goodoneuz pay-uz · goodoneuz/pay-uz)
- [CVE-2025-15621](https://cve.now/CVE-2025-15621.md): Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication (CVSS 5.7, Sparx Systems Pty Sparx Enterprise Architect)
- [CVE-2026-3155](https://cve.now/CVE-2026-3155.md): OneSignal – Web Push Notifications \<= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post\_id' (CVSS 3.1, OneSignal – Web Push Notifications)
- [CVE-2026-3369](https://cve.now/CVE-2026-3369.md): Better Find and Replace – AI-Powered Suggestions \<= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title (CVSS 5.4, codesolz Better Find and Replace – AI-Powered Suggestions)
- [CVE-2026-3489](https://cve.now/CVE-2026-3489.md): DirectoryPress – Business Directory And Classified Ad Listing \<= 3.6.26 - Unauthenticated SQL Injection via 'packages' (CVSS 7.5, designinvento DirectoryPress – Business Directory And Class…)
- [CVE-2025-12624](https://cve.now/CVE-2025-12624.md): Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock (CVSS 6.0, WSO2 Identity Server)
- [CVE-2025-6024](https://cve.now/CVE-2025-6024.md): Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites (CVSS 6.1, WSO2 API Manager · WSO2 Identity Server)
- [CVE-2024-10242](https://cve.now/CVE-2024-10242.md): Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection (CVSS 6.1, WSO2 API Manager)
- [CVE-2024-8010](https://cve.now/CVE-2024-8010.md): XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files (CVSS 3.5, WSO2 API Manager)
- [CVE-2024-4867](https://cve.now/CVE-2024-4867.md): Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval (CVSS 5.4, WSO2 API Manager)
- [CVE-2026-23772](https://cve.now/CVE-2026-23772.md): Dell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an Improper Privilege Management vulnerability. (CVSS 7.3, Dell Storage Manager)
- [CVE-2024-2374](https://cve.now/CVE-2024-2374.md): XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service (CVSS 7.5, WSO2 API Manager · WSO2 Identity Server +2)
- [CVE-2026-0718](https://cve.now/CVE-2026-0718.md): Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX \<= 5.0.5 - Missing Authorization to Limited Post Meta Modification (CVSS 5.3, wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…)
- [CVE-2025-14868](https://cve.now/CVE-2025-14868.md): Career Section \<= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.8, shahinurislam Career Section)
- [CVE-2026-41035](https://cve.now/CVE-2026-41035.md): In rsync 3.0.1 through 3.4.1, receive\_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. (CVSS 7.4, Samba rsync)
- [CVE-2026-3876](https://cve.now/CVE-2026-3876.md): Prismatic \<= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic\_encoded' Pseudo-Shortcode (CVSS 7.2, specialk Prismatic)
- [CVE-2026-3355](https://cve.now/CVE-2026-3355.md): Customer Reviews for WooCommerce \<= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch' (CVSS 6.1, ivole Customer Reviews for WooCommerce)
- [CVE-2025-13364](https://cve.now/CVE-2025-13364.md): WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters \<= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put\_wpgm' Shortcode (CVSS 6.4, flippercode WP Maps – Store Locator,Google Maps,OpenStreetM…)
- [CVE-2026-3875](https://cve.now/CVE-2026-3875.md): BetterDocs \<= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, wpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…)
- [CVE-2026-3995](https://cve.now/CVE-2026-3995.md): OPEN-BRAIN \<= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting (CVSS 4.4, faridsaniee OPEN-BRAIN)
- [CVE-2026-1572](https://cve.now/CVE-2026-1572.md): Livemesh Addons by Elementor \<= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2026-1620](https://cve.now/CVE-2026-1620.md): Livemesh Addons by Elementor \<= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter (CVSS 8.8, Livemesh Addons by Elementor)
- [CVE-2026-41034](https://cve.now/CVE-2026-41034.md): ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and oth (CVSS 5.0, Ascensio ONLYOFFICE DocumentServer)
- [CVE-2026-3861](https://cve.now/CVE-2026-3861.md): LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly (CVSS 7.1, LY LINE client for iOS)
- [CVE-2026-41030](https://cve.now/CVE-2026-41030.md): In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges. (CVSS 6.2, Ascensio ONLYOFFICE DesktopEditors)
- [CVE-2026-3581](https://cve.now/CVE-2026-3581.md): Basic Google Maps Placemarks \<= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update (CVSS 5.3, iandunn Basic Google Maps Placemarks)
- [CVE-2026-3773](https://cve.now/CVE-2026-3773.md): Accessibility Suite by Ability, Inc \<= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan\_id' Parameter (CVSS 6.5, onlineada Accessibility Suite by Ability, Inc)
- [CVE-2026-3614](https://cve.now/CVE-2026-3614.md): AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, acyba AcyMailing – An Ultimate Newsletter Plugin and Market…)
- [CVE-2026-3599](https://cve.now/CVE-2026-3599.md): Riaxe Product Customizer \<= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product\_data (CVSS 7.5, imprintnext Riaxe Product Customizer)
- [CVE-2026-5050](https://cve.now/CVE-2026-5050.md): Payment Gateway for Redsys & WooCommerce Lite \<= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation (CVSS 7.5, jconti Payment Gateway for Redsys & WooCommerce Lite)
- [CVE-2026-3551](https://cve.now/CVE-2026-3551.md): Custom New User Notification \<= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting (CVSS 4.4, rafasashi Custom New User Notification)
- [CVE-2026-3595](https://cve.now/CVE-2026-3595.md): Riaxe Product Customizer \<= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user\_id' Parameter (CVSS 5.3, imprintnext Riaxe Product Customizer)
- [CVE-2026-3596](https://cve.now/CVE-2026-3596.md): Riaxe Product Customizer \<= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action (CVSS 9.8, imprintnext Riaxe Product Customizer)
- [CVE-2026-22619](https://cve.now/CVE-2026-22619.md): Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execut (CVSS 7.8, Eaton IPP software)
- [CVE-2026-22618](https://cve.now/CVE-2026-22618.md): A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecur (CVSS 5.9, Eaton IPP software)
- [CVE-2026-22617](https://cve.now/CVE-2026-22617.md): Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the c (CVSS 5.7, Eaton IPP Software)
- [CVE-2023-5872](https://cve.now/CVE-2023-5872.md): Wago: Vulnerability in Smart Designer Web-Application (CVSS 4.3, Wago Smart Designer)
- [CVE-2026-22616](https://cve.now/CVE-2026-22616.md): Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffi (CVSS 6.5, Eaton IPP Software)
- [CVE-2026-22615](https://cve.now/CVE-2026-22615.md): Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privil (CVSS 6.0, Eaton IPP Software)
- [CVE-2023-3634](https://cve.now/CVE-2023-3634.md): Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions (CVSS 8.8, Festo MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD · Festo M… +10)
- [CVE-2026-40118](https://cve.now/CVE-2026-40118.md): UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability. (CVSS 6.3, Arcserve UDP Console)
- [CVE-2026-5070](https://cve.now/CVE-2026-5070.md): Vantage \<= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content (CVSS 6.4, siteorigin Vantage)
- [CVE-2026-3878](https://cve.now/CVE-2026-3878.md): WP Docs \<= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs\_options\[icon\_size\]' (CVSS 6.4, fahadmahmood WP Docs)
- [CVE-2026-4032](https://cve.now/CVE-2026-4032.md): CodeColorer \<= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode (CVSS 6.1, kpumuk CodeColorer)
- [CVE-2026-6351](https://cve.now/CVE-2026-6351.md): Openfind｜MailGates/MailAudit - CRLF Injection (CVSS 8.7, Openfind MailGates · Openfind MailAudit)
- [CVE-2026-41015](https://cve.now/CVE-2026-41015.md): radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. (CVSS 7.4, radare2)
- [CVE-2026-6350](https://cve.now/CVE-2026-6350.md): Openfind｜MailGates/MailAudit - Stack-based Buffer Overflow (CVSS 9.3, Openfind MailGates · Openfind MailAudit)
- [CVE-2026-3885](https://cve.now/CVE-2026-3885.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su\_box Shortcode (CVSS 6.4, gn\_themes Shortcodes Ultimate – Content Elements)
- [CVE-2026-6349](https://cve.now/CVE-2026-6349.md): HGiga｜iSherlock - OS Command Injection (CVSS 9.3, HGiga iSherlock-base-4.5 · HGiga iSherlock-audit-4.5 +2)
- [CVE-2026-3428](https://cve.now/CVE-2026-3428.md): A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve pr (CVSS 5.4, ASUS Member Center)
- [CVE-2026-1880](https://cve.now/CVE-2026-1880.md): An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due (CVSS 5.4, ASUS DriverHub)
- [CVE-2026-6348](https://cve.now/CVE-2026-6348.md): Simopro Technology｜WinMatrix - Missing Authentication (CVSS 9.3, Simopro Technology WinMatrix)
- [CVE-2026-40962](https://cve.now/CVE-2026-40962.md): FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c (CVSS 4.9, FFmpeg)
- [CVE-2026-3299](https://cve.now/CVE-2026-3299.md): WP YouTube Lyte \<= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode (CVSS 6.4, futtta WP YouTube Lyte)
- [CVE-2026-40505](https://cve.now/CVE-2026-40505.md): MuPDF \< 1.27 mutool ANSI Injection via Metadata (CVSS 4.8, Artifex Software MuPDF)
- [CVE-2026-40504](https://cve.now/CVE-2026-40504.md): Creolabs Gravity \< 0.9.6 Heap Buffer Overflow via gravity\_vm\_exec (CVSS 9.3, marcobambini gravity)
- [CVE-2026-40960](https://cve.now/CVE-2026-40960.md): Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. (CVSS 8.1, Luanti)
- [CVE-2026-40959](https://cve.now/CVE-2026-40959.md): Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod. (CVSS 9.3, Luanti)
- [CVE-2026-40502](https://cve.now/CVE-2026-40502.md): OpenHarness Remote Administrative Command Injection via Gateway Handler (CVSS 8.7, HKUDS OpenHarness)
- [CVE-2026-40503](https://cve.now/CVE-2026-40503.md): OpenHarness Path Traversal Information Disclosure via /memory show (CVSS 7.1, HKUDS OpenHarness)
- [CVE-2026-30459](https://cve.now/CVE-2026-30459.md): An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset toke (CVSS 7.1)
- [CVE-2026-30656](https://cve.now/CVE-2026-30656.md): A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp\_pli option. (CVSS 7.5)
- [CVE-2026-37100](https://cve.now/CVE-2026-37100.md): An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / v (CVSS 6.5)
- [CVE-2026-37336](https://cve.now/CVE-2026-37336.md): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view\_music.php. (CVSS 7.3)
- [CVE-2026-37337](https://cve.now/CVE-2026-37337.md): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view\_playlist.php. (CVSS 7.3)
- [CVE-2026-37338](https://cve.now/CVE-2026-37338.md): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view\_user.php. (CVSS 9.4)
- [CVE-2026-37339](https://cve.now/CVE-2026-37339.md): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view\_genre.php. (CVSS 9.8)
- [CVE-2026-37340](https://cve.now/CVE-2026-37340.md): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/edit\_music.php. (CVSS 9.8)
- [CVE-2026-37341](https://cve.now/CVE-2026-37341.md): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage\_category.php. (CVSS 7.2)
- [CVE-2026-37342](https://cve.now/CVE-2026-37342.md): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view\_parked\_details.php. (CVSS 7.2)
- [CVE-2026-37343](https://cve.now/CVE-2026-37343.md): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage\_user.php. (CVSS 7.2)
- [CVE-2026-37344](https://cve.now/CVE-2026-37344.md): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage\_location.php. (CVSS 7.2)
- [CVE-2026-37345](https://cve.now/CVE-2026-37345.md): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage\_park.php. (CVSS 9.8)
- [CVE-2026-37346](https://cve.now/CVE-2026-37346.md): SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view\_account.php?emp\_id=. (CVSS 4.7)
- [CVE-2026-37347](https://cve.now/CVE-2026-37347.md): SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view\_employee.php. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.