# CVEs published 2026-04-17

166 CVEs were published on April 17, 2026: 18 critical, 60 high. Days are UTC.

- [CVE-2026-40347](https://cve.now/CVE-2026-40347.md): Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data (CVSS 5.3, Kludex python-multipart · python-multipart)
- [CVE-2026-40346](https://cve.now/CVE-2026-40346.md): NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins (CVSS 6.4, @nocobase/plugin-workflow-request)
- [CVE-2026-40581](https://cve.now/CVE-2026-40581.md): ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion (CVSS 8.1, ChurchCRM CRM)
- [CVE-2026-40337](https://cve.now/CVE-2026-40337.md): Sentry kernel has incomplete ownership check for IRQ line manipulation (CVSS 5.1, camelot-os sentry-kernel)
- [CVE-2026-40341](https://cve.now/CVE-2026-40341.md): libgphoto2 has an OOB Read in ptp\_unpack\_EOS\_FocusInfoEx (CVSS 3.5, libgphoto2)
- [CVE-2026-40340](https://cve.now/CVE-2026-40340.md): libgphoto2 has OOB read in ptp\_unpack\_OI() in ptp-pack.c via malicious PTP ObjectInfo response (CVSS 6.1, libgphoto2)
- [CVE-2026-40339](https://cve.now/CVE-2026-40339.md): libgphoto2 has OOB read in ptp\_unpack\_Sony\_DPD() FormFlag parsing in ptp-pack.c (CVSS 5.2, libgphoto2)
- [CVE-2026-40338](https://cve.now/CVE-2026-40338.md): libgphoto2 has OOB read in ptp\_unpack\_Sony\_DPD() enumeration count parsing in ptp-pack.c (CVSS 5.2, libgphoto2)
- [CVE-2026-40485](https://cve.now/CVE-2026-40485.md): ChurchCRM: Username Enumeration via Differential Response in Public Login API (CVSS 5.3, ChurchCRM CRM)
- [CVE-2026-40336](https://cve.now/CVE-2026-40336.md): libgphoto2 has memory leak in ptp\_unpack\_Sony\_DPD() secondary enumeration list in ptp-pack.c (CVSS 2.4, libgphoto2)
- [CVE-2026-2262](https://cve.now/CVE-2026-2262.md): Easy Appointments \<= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API (CVSS 7.5, easyappointments Easy Appointments)
- [CVE-2026-40484](https://cve.now/CVE-2026-40484.md): ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function (CVSS 9.1, ChurchCRM CRM)
- [CVE-2026-40483](https://cve.now/CVE-2026-40483.md): ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field (CVSS 5.4, ChurchCRM CRM)
- [CVE-2026-40335](https://cve.now/CVE-2026-40335.md): libgphoto2 has OOB read in ptp\_unpack\_DPV() UINT128/INT128 handling in ptp-pack.c (CVSS 5.2, libgphoto2)
- [CVE-2026-40334](https://cve.now/CVE-2026-40334.md): libgphoto2 missing null termination in ptp\_unpack\_Canon\_FE() filename buffer in ptp-pack.c (CVSS 3.5, libgphoto2)
- [CVE-2026-40582](https://cve.now/CVE-2026-40582.md): ChurchCRM: Authentication Bypass in \`/api/public/user/login\` Allows Bypass of 2FA and Account Lockout (CVSS 9.1, ChurchCRM CRM)
- [CVE-2026-40333](https://cve.now/CVE-2026-40333.md): libgphoto2 has OOB read in ptp\_unpack\_EOS\_ImageFormat() and ptp\_unpack\_EOS\_CustomFuncEx() due to missing length parameter in ptp-pack.c (CVSS 6.1, libgphoto2)
- [CVE-2026-40480](https://cve.now/CVE-2026-40480.md): ChurchCRM has Missing Object-Level Authorization / IDOR in \`/api/person/{personId}\` (CVSS 7.1, ChurchCRM CRM)
- [CVE-2026-40324](https://cve.now/CVE-2026-40324.md): Hot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL Documents (CVSS 9.1, ChilliCream graphql-platform · HotChocolate.Language)
- [CVE-2026-40482](https://cve.now/CVE-2026-40482.md): ChurchCRM has Authenticated SQL Injection in \`/api/families/byCheckNumber/{scanString}\` (CVSS 7.1, ChurchCRM CRM)
- [CVE-2026-40323](https://cve.now/CVE-2026-40323.md): SP1 V6 Recursion Circuit Row-Count Binding Gap (CVSS 8.9, succinctlabs sp1 · sp1\_sdk +2)
- [CVE-2026-40481](https://cve.now/CVE-2026-40481.md): monetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation (CVSS 8.2, monetr · github.com/monetr/monetr)
- [CVE-2026-40486](https://cve.now/CVE-2026-40486.md): Kimai's User Preferences API allows standard users to modify restricted attributes: hourly\_rate, internal\_rate (CVSS 4.3, kimai · kimai/kimai)
- [CVE-2026-40479](https://cve.now/CVE-2026-40479.md): Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget (CVSS 5.4, kimai · kimai/kimai)
- [CVE-2026-2434](https://cve.now/CVE-2026-2434.md): Pz-LinkCard \<= 2.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, poporon Pz-LinkCard)
- [CVE-2026-40478](https://cve.now/CVE-2026-40478.md): Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf (CVSS 9.1, thymeleaf · org.thymeleaf:thymeleaf-spring5 +2)
- [CVE-2026-40477](https://cve.now/CVE-2026-40477.md): Improper restriction of the scope of accessible objects in Thymeleaf expressions (CVSS 9.1, thymeleaf · org.thymeleaf:thymeleaf-spring5 +2)
- [CVE-2026-40476](https://cve.now/CVE-2026-40476.md): graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation (CVSS 6.9, webonyx graphql-php · webonyx/graphql-php)
- [CVE-2026-5720](https://cve.now/CVE-2026-5720.md): miniupnpd Integer Underflow SOAPAction Header Parsing (CVSS 7.1, miniupnp project miniupnpd)
- [CVE-2026-40474](https://cve.now/CVE-2026-40474.md): wger has Broken Access Control in the Global Gym Configuration Update Endpoint (CVSS 7.6, wger-project wger · wger)
- [CVE-2026-40353](https://cve.now/CVE-2026-40353.md): wger: Stored XSS via Unescaped License Attribution Fields (CVSS 5.1, wger-project wger · wger)
- [CVE-2026-40258](https://cve.now/CVE-2026-40258.md): Gramps Web API has Zip Slip Path Traversal in Media Archive Import (CVSS 9.1, gramps-project gramps-web-api · gramps-webapi)
- [CVE-2026-29013](https://cve.now/CVE-2026-29013.md): libcoap Out-of-Bounds Read in OSCORE CBOR Unwrap Handling (CVSS 8.8, libcoap)
- [CVE-2026-40321](https://cve.now/CVE-2026-40321.md): DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload (CVSS 8.1, dnnsoftware Dnn.Platform · DotNetNuke.Core)
- [CVE-2026-40352](https://cve.now/CVE-2026-40352.md): FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover (CVSS 8.8, labring FastGPT)
- [CVE-2026-40306](https://cve.now/CVE-2026-40306.md): DNN has same HostGUID for all new installs (CVSS 6.9, dnnsoftware Dnn.Platform · DotNetNuke.Core)
- [CVE-2026-40305](https://cve.now/CVE-2026-40305.md): DNN has Force Friend Request Acceptance (CVSS 4.3, dnnsoftware Dnn.Platform · DotNetNuke.Core)
- [CVE-2026-40351](https://cve.now/CVE-2026-40351.md): FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass (CVSS 9.8, labring FastGPT)
- [CVE-2026-40304](https://cve.now/CVE-2026-40304.md): zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records (CVSS 5.3, openziti zrok · github.com/openziti/zrok +1)
- [CVE-2026-40303](https://cve.now/CVE-2026-40303.md): zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing (CVSS 7.5, openziti zrok · github.com/openziti/zrok +1)
- [CVE-2026-40196](https://cve.now/CVE-2026-40196.md): HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation (CVSS 8.1, sysadminsmedia homebox)
- [CVE-2026-40302](https://cve.now/CVE-2026-40302.md): zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering (CVSS 6.1, openziti zrok · github.com/openziti/zrok +1)
- [CVE-2026-40155](https://cve.now/CVE-2026-40155.md): Auth0 Next.js SDK has Improper Proxy Cache Lookup (CVSS 5.4, nextjs-auth0 · @auth0/nextjs-auth0)
- [CVE-2026-40301](https://cve.now/CVE-2026-40301.md): rhukster/dom-sanitizer: SVG \<style\> tag allows CSS injection via unfiltered url() and @import directives (CVSS 4.7, rhukster dom-sanitizer · rhukster/dom-sanitizer)
- [CVE-2026-40299](https://cve.now/CVE-2026-40299.md): next-intl has an open redirect vulnerability (CVSS 6.9, amannn next-intl · next-intl)
- [CVE-2026-40293](https://cve.now/CVE-2026-40293.md): OpenFGA Playground Preshared Key Exposure (CVSS 6.5, openfga · github.com/openfga/openfga)
- [CVE-2026-35603](https://cve.now/CVE-2026-35603.md): Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows (CVSS 5.4, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2026-35402](https://cve.now/CVE-2026-35402.md): mcp-neo4j-cypher: SSRF and Data Modification via read\_only Mode Bypass Through CALL Procedures (CVSS 2.3, neo4j-contrib mcp-neo4j · mcp-neo4j-cypher)
- [CVE-2026-33436](https://cve.now/CVE-2026-33436.md): Stirling-PDF: Reflected XSS through crafted filename in file upload functionality (CVSS 3.1, Stirling-Tools Stirling-PDF)
- [CVE-2026-40286](https://cve.now/CVE-2026-40286.md): WeGIA has Cross-Site Scripting in Controle de Contribuição (CVSS 7.5, LabRedesCefetRJ WeGIA)
- [CVE-2026-23500](https://cve.now/CVE-2026-23500.md): Dolibarr: OS Command Injection (RCE) via MAIN\_ODT\_AS\_PDF configuration (CVSS 9.4, dolibarr · dolibarr/dolibarr)
- [CVE-2026-40285](https://cve.now/CVE-2026-40285.md): WeGIA has SQL Injection via Session Variable Override in DespachoControle.php (CVSS 8.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-40527](https://cve.now/CVE-2026-40527.md): radare2 Command Injection via DWARF Parameter Names (CVSS 8.5, radareorg radare2)
- [CVE-2026-40284](https://cve.now/CVE-2026-40284.md): WeGIA has stored XSS in listar\_despachos.php (CVSS 6.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-35512](https://cve.now/CVE-2026-35512.md): xrdp: Heap buffer overflow in EGFX channel (CVSS 8.7, neutrinolabs xrdp)
- [CVE-2026-40282](https://cve.now/CVE-2026-40282.md): WeGIA has stored XSS in intercorrencia\_visualizar.php (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2026-33689](https://cve.now/CVE-2026-33689.md): xrdp: Pre-authentication out-of-bounds reads in channel parsers (CVSS 8.7, neutrinolabs xrdp)
- [CVE-2026-33145](https://cve.now/CVE-2026-33145.md): xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman (CVSS 6.3, neutrinolabs xrdp)
- [CVE-2026-40283](https://cve.now/CVE-2026-40283.md): WeGIA has stored XSS in profile\_paciente.php (CVSS 6.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-32624](https://cve.now/CVE-2026-32624.md): xrdp: Heap buffer overflow in xrdp\_sec\_process\_logon\_info() via incorrect g\_strncat length calculation (CVSS 6.3, neutrinolabs xrdp)
- [CVE-2026-33516](https://cve.now/CVE-2026-33516.md): xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers (CVSS 7.7, neutrinolabs xrdp)
- [CVE-2026-32650](https://cve.now/CVE-2026-32650.md): Anviz CrossChex Standard Algorithm Downgrade (CVSS 7.5, Anviz CrossChex Standard)
- [CVE-2026-40434](https://cve.now/CVE-2026-40434.md): Anviz CrossChex Standard Improper Verification of Source of a Communication Channel (CVSS 8.1, Anviz CrossChex Standard)
- [CVE-2026-35682](https://cve.now/CVE-2026-35682.md): Anviz CX2 Lite Command Injection (CVSS 8.8, Anviz CX2 Lite Firmware)
- [CVE-2026-32623](https://cve.now/CVE-2026-32623.md): xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly (CVSS 7.7, neutrinolabs xrdp)
- [CVE-2026-40066](https://cve.now/CVE-2026-40066.md): Anviz Products Download of Code Without Integrity Check (CVSS 8.8, Anviz CX7 Firmware · Anviz CX2 Lite Firmware)
- [CVE-2026-35546](https://cve.now/CVE-2026-35546.md): Anviz Products Missing Authentication for Critical Function (CVSS 9.8, Anviz CX7 Firmware · Anviz CX2 Lite Firmware)
- [CVE-2026-40461](https://cve.now/CVE-2026-40461.md): Anviz Products Missing Authentication for Critical Function (CVSS 7.5, Anviz CX7 Firmware · Anviz CX2 Lite Firmware)
- [CVE-2026-32648](https://cve.now/CVE-2026-32648.md): Anviz Products Missing Authorization (CVSS 5.3, Anviz CX7 Firmware · Anviz CX2 Lite Firmware)
- [CVE-2026-33569](https://cve.now/CVE-2026-33569.md): Anviz Products Cleartext Transmission of Sensitive Information (CVSS 6.5, Anviz CX7 Firmware · Anviz CX2 Lite Firmware)
- [CVE-2026-32105](https://cve.now/CVE-2026-32105.md): xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode (CVSS 9.3, neutrinolabs xrdp)
- [CVE-2026-32107](https://cve.now/CVE-2026-32107.md): xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails (CVSS 8.8, neutrinolabs xrdp)
- [CVE-2026-31927](https://cve.now/CVE-2026-31927.md): Anviz CX7 Firmware Relative Path Traversal (CVSS 4.9, Anviz CX7 Firmware)
- [CVE-2026-40342](https://cve.now/CVE-2026-40342.md): Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution (CVSS 10.0, FirebirdSQL firebird)
- [CVE-2026-32324](https://cve.now/CVE-2026-32324.md): Anviz CX7 Firmware Use of Hard-coded Cryptographic Key (CVSS 7.7, Anviz CX7 Firmware)
- [CVE-2026-35061](https://cve.now/CVE-2026-35061.md): Anviz Products Missing Authorization (CVSS 5.3, Anviz CX7 Firmware)
- [CVE-2026-33093](https://cve.now/CVE-2026-33093.md): Anviz Products Missing Authorization (CVSS 5.3, Anviz CX7 Firmware)
- [CVE-2026-35215](https://cve.now/CVE-2026-35215.md): Firebird: DoS via malicious slice descriptor in slice packet (CVSS 7.5, FirebirdSQL firebird)
- [CVE-2026-34232](https://cve.now/CVE-2026-34232.md): Firebird: DoS via \`op\_response\` packet from client (CVSS 7.5, FirebirdSQL firebird)
- [CVE-2026-33337](https://cve.now/CVE-2026-33337.md): Firebird has a buffer overflow when parsing corrupted slice packets (CVSS 7.5, FirebirdSQL firebird)
- [CVE-2026-6437](https://cve.now/CVE-2026-6437.md): AWS EFS CSI Driver Mount Option Injection (CVSS 6.5, Amazon AWS EFS CSI Driver · github.com/kubernetes-sigs/aws-…)
- [CVE-2026-28224](https://cve.now/CVE-2026-28224.md): Firebird Null Pointer Dereference via CryptCallback causes DOS (CVSS 8.2, FirebirdSQL firebird)
- [CVE-2026-28214](https://cve.now/CVE-2026-28214.md): Firebird server hangs when using specific clumplet on batch creation (CVSS 6.0, FirebirdSQL firebird)
- [CVE-2026-40525](https://cve.now/CVE-2026-40525.md): OpenViking \< 0.3.9 Authentication Bypass via VikingBot OpenAPI (CVSS 9.1, volcengine OpenViking · openviking)
- [CVE-2026-27890](https://cve.now/CVE-2026-27890.md): Firebird has Pre-Auth DOS when Processing Out of Order CNCT\_specific\_data Segments (CVSS 8.2, FirebirdSQL firebird)
- [CVE-2026-28212](https://cve.now/CVE-2026-28212.md): Firebird has potential server crash via null pointer dereference when processing op\_slice packet (CVSS 7.5, FirebirdSQL firebird)
- [CVE-2025-65104](https://cve.now/CVE-2025-65104.md): Firebird: Information leak vulnerability in firebird3 client when used with newer server (CVSS 7.9, FirebirdSQL firebird)
- [CVE-2026-5718](https://cve.now/CVE-2026-5718.md): Drag and Drop Multiple File Upload for Contact Form 7 \<= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass (CVSS 8.1, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2026-5710](https://cve.now/CVE-2026-5710.md): Drag and Drop Multiple File Upload for Contact Form 7 \<= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field (CVSS 7.5, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2026-40320](https://cve.now/CVE-2026-40320.md): Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck (CVSS 5.4, Giskard-AI giskard-oss · giskard-checks)
- [CVE-2026-40319](https://cve.now/CVE-2026-40319.md): Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check (CVSS 1.0, Giskard-AI giskard-oss · giskard-checks)
- [CVE-2026-40518](https://cve.now/CVE-2026-40518.md): ByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode (CVSS 7.1, bytedance deer-flow)
- [CVE-2026-3464](https://cve.now/CVE-2026-3464.md): WP Customer Area \<= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax\_attach\_file (CVSS 8.8, aguilatechnologies WP Customer Area)
- [CVE-2026-21733](https://cve.now/CVE-2026-21733.md): GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so) (CVSS 7.3, Imagination Technologies Graphics DDK)
- [CVE-2026-40516](https://cve.now/CVE-2026-40516.md): OpenHarness SSRF via web\_fetch and web\_search (CVSS 7.8, HKUDS OpenHarness)
- [CVE-2026-40515](https://cve.now/CVE-2026-40515.md): OpenHarness Permission Bypass via grep and glob root argument (CVSS 8.7, HKUDS OpenHarness)
- [CVE-2026-21709](https://cve.now/CVE-2026-21709.md): A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement. (CVSS 6.7, Veeam Backup and Replication · Veeam Software Appliance)
- [CVE-2026-6497](https://cve.now/CVE-2026-6497.md): prasathmani TinyFileManager File Upload filemanager.php server-side request forgery (CVSS 5.3, prasathmani TinyFileManager)
- [CVE-2026-6284](https://cve.now/CVE-2026-6284.md): Horner Automation Cscape and XL4, XL7 PLC Weak password requirements (CVSS 9.3, Horner Automation Cscape · Horner Automation XL7 PLC +1)
- [CVE-2026-6496](https://cve.now/CVE-2026-6496.md): prasathmani TinyFileManager POST Parameter filemanager.php path traversal (CVSS 5.3, prasathmani TinyFileManager)
- [CVE-2026-41153](https://cve.now/CVE-2026-41153.md): In JetBrains Junie before 252.549.29 command execution was possible via malicious project file (CVSS 5.8, JetBrains Junie)
- [CVE-2026-6493](https://cve.now/CVE-2026-6493.md): lukevella rallly Reset Password reset-password-form.tsx cross site scripting (CVSS 5.1, lukevella rallly)
- [CVE-2026-6492](https://cve.now/CVE-2026-6492.md): arnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosure (CVSS 6.9, arnobt78 Hotel Booking Management System)
- [CVE-2026-6491](https://cve.now/CVE-2026-6491.md): libvips nip2 vips7compat.c im\_minpos\_vec heap-based overflow (CVSS 4.8, libvips)
- [CVE-2026-40459](https://cve.now/CVE-2026-40459.md): LDAP Injection in PAC4J (CVSS 8.7, PAC4J)
- [CVE-2026-40458](https://cve.now/CVE-2026-40458.md): Cross-Site Request Forgery in PAC4J (CVSS 7.0, PAC4J · org.pac4j:pac4j-core)
- [CVE-2026-6490](https://cve.now/CVE-2026-6490.md): QueryMine sms GET Request Parameter deletecourse.php sql injection (CVSS 6.9, QueryMine sms)
- [CVE-2026-6489](https://cve.now/CVE-2026-6489.md): QueryMine sms Background Management addteacher.php unrestricted upload (CVSS 5.3, QueryMine sms)
- [CVE-2026-6488](https://cve.now/CVE-2026-6488.md): QueryMine sms GET Request Parameter editcourse.php sql injection (CVSS 5.3, QueryMine sms)
- [CVE-2026-6487](https://cve.now/CVE-2026-6487.md): Qihui jtbc5 CMS Code Endpoint manage.php path traversal (CVSS 5.3, Qihui jtbc5 CMS)
- [CVE-2026-6507](https://cve.now/CVE-2026-6507.md): Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing (CVSS 7.5, dnsmasq · Red Hat Enterprise Linux +1)
- [CVE-2026-6486](https://cve.now/CVE-2026-6486.md): classroombookings User Display Name layout.php read cross site scripting (CVSS 5.1, classroombookings)
- [CVE-2026-23777](https://cve.now/CVE-2026-23777.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver (CVSS 4.3, Dell PowerProtect Data Domain)
- [CVE-2026-28263](https://cve.now/CVE-2026-28263.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver (CVSS 5.9, Dell PowerProtect Data Domain)
- [CVE-2025-46606](https://cve.now/CVE-2025-46606.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper rest (CVSS 6.2, Dell PowerProtect Data Domain)
- [CVE-2025-46605](https://cve.now/CVE-2025-46605.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain a session fixati (CVSS 6.2, Dell PowerProtect Data Domain)
- [CVE-2025-46641](https://cve.now/CVE-2025-46641.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper auth (CVSS 6.6, Dell PowerProtect Data Domain)
- [CVE-2025-46607](https://cve.now/CVE-2025-46607.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper auth (CVSS 6.6, Dell PowerProtect Data Domain)
- [CVE-2026-35073](https://cve.now/CVE-2026-35073.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2 (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-35074](https://cve.now/CVE-2026-35074.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2 (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-35072](https://cve.now/CVE-2026-35072.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2 (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-5131](https://cve.now/CVE-2026-5131.md): Server-Side Request Forgery in GREENmod (CVSS 6.9, Nomios Poland GREENmod)
- [CVE-2026-35153](https://cve.now/CVE-2026-35153.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2 (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-6483](https://cve.now/CVE-2026-6483.md): Wavlink WL-WN530H4 internet.cgi snprintf os command injection (CVSS 8.6, Wavlink WL-WN530H4)
- [CVE-2026-23779](https://cve.now/CVE-2026-23779.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-23776](https://cve.now/CVE-2026-23776.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2025-15625](https://cve.now/CVE-2025-15625.md): Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server (CVSS 9.5, Sparx Systems Pty Sparx Pro Cloud Server)
- [CVE-2025-15624](https://cve.now/CVE-2025-15624.md): Plaintext Storage of a Password in Sparx Pro Cloud Server. (CVSS 9.3, Sparx Systems Pty Sparx Pro Cloud Server)
- [CVE-2025-15623](https://cve.now/CVE-2025-15623.md): Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user (CVSS 9.3, Sparx Systems Pty Sparx Pro Cloud Server)
- [CVE-2025-15622](https://cve.now/CVE-2025-15622.md): Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret (CVSS 6.2, Sparx Systems Pty Sparx Enterprise Architect)
- [CVE-2026-23778](https://cve.now/CVE-2026-23778.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-6439](https://cve.now/CVE-2026-6439.md): VideoZen \<= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field (CVSS 4.4, jconti VideoZen)
- [CVE-2026-23775](https://cve.now/CVE-2026-23775.md): Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 rele (CVSS 7.6, Dell PowerProtect Data Domain appliances)
- [CVE-2026-6494](https://cve.now/CVE-2026-6494.md): Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input (CVSS 5.3, Red Hat Ansible Automation Platform)
- [CVE-2025-36568](https://cve.now/CVE-2025-36568.md): Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8. (CVSS 7.8, Dell PowerProtect Data Domain BoostFS)
- [CVE-2026-33392](https://cve.now/CVE-2026-33392.md): In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass (CVSS 7.2, JetBrains YouTrack)
- [CVE-2026-6451](https://cve.now/CVE-2026-6451.md): CMS für Motorrad Werkstätten \<= 1.0.0 - Cross-Site Request Forgery (CVSS 4.3, tholstkabelbwde Plugin: CMS für Motorrad Werkstätten)
- [CVE-2026-40002](https://cve.now/CVE-2026-40002.md): ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. (CVSS 5.0, ZTE Red Magic 11 Pro)
- [CVE-2026-23853](https://cve.now/CVE-2026-23853.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver (CVSS 8.4, Dell PowerProtect Data Domain)
- [CVE-2026-6441](https://cve.now/CVE-2026-6441.md): Canto \<= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification (CVSS 4.3, flightbycanto Canto)
- [CVE-2026-4659](https://cve.now/CVE-2026-4659.md): Unlimited Elements For Elementor \<= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal (CVSS 7.5, unitecms Unlimited Elements For Elementor)
- [CVE-2026-6443](https://cve.now/CVE-2026-6443.md): Essentialplugin Plugins (Various Versions) - Injected Backdoor (CVSS 9.8, essentialplugin Accordion and Accordion Slider · essent… +20)
- [CVE-2026-6421](https://cve.now/CVE-2026-6421.md): Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path (CVSS 7.3, Mobatek MobaXterm Home Edition)
- [CVE-2026-5797](https://cve.now/CVE-2026-5797.md): Quiz and Survey Master (QSM) \<= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields (CVSS 5.3, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2026-6482](https://cve.now/CVE-2026-6482.md): Local Privilege Escalation via OpenSSL configuration file in Insight Agent (CVSS 8.5, Rapid7 Insight Agent)
- [CVE-2026-35496](https://cve.now/CVE-2026-35496.md): A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-l (CVSS 2.7, CubeCart Limited CubeCart)
- [CVE-2026-34018](https://cve.now/CVE-2026-34018.md): An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the p (CVSS 6.3, CubeCart Limited CubeCart)
- [CVE-2026-21719](https://cve.now/CVE-2026-21719.md): An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute (CVSS 7.2, CubeCart Limited CubeCart)
- [CVE-2026-5502](https://cve.now/CVE-2026-5502.md): Tutor LMS \<= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor\_update\_course\_content\_order (CVSS 5.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-5427](https://cve.now/CVE-2026-5427.md): Kubio AI Page Builder \<= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes (CVSS 5.3, extendthemes Kubio AI Page Builder)
- [CVE-2026-5234](https://cve.now/CVE-2026-5234.md): LatePoint \<= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID (CVSS 5.3, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-6080](https://cve.now/CVE-2026-6080.md): Tutor LMS \<= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-3330](https://cve.now/CVE-2026-3330.md): Form Maker by 10Web \<= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip\_search' Parameter (CVSS 4.9, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-4853](https://cve.now/CVE-2026-4853.md): JetBackup \<= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter (CVSS 4.9, backupguard JetBackup – Backup, Restore & Migrate)
- [CVE-2026-5807](https://cve.now/CVE-2026-5807.md): Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations (CVSS 7.5, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2026-4525](https://cve.now/CVE-2026-4525.md): Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header (CVSS 7.5, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2026-5052](https://cve.now/CVE-2026-5052.md): Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS (CVSS 5.3, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2026-3605](https://cve.now/CVE-2026-3605.md): Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service (CVSS 8.1, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2026-4666](https://cve.now/CVE-2026-4666.md): wpForo Forum \<= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter (CVSS 6.5, tomdever wpForo Forum)
- [CVE-2026-3488](https://cve.now/CVE-2026-3488.md): WP Statistics \<= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation (CVSS 6.5, veronalabs WP Statistics – Simple, privacy-friendly Google…)
- [CVE-2026-5231](https://cve.now/CVE-2026-5231.md): WP Statistics \<= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm\_source' Parameter (CVSS 7.2, veronalabs WP Statistics – Simple, privacy-friendly Google…)
- [CVE-2026-4817](https://cve.now/CVE-2026-4817.md): MasterStudy LMS \<= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters (CVSS 6.5, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2026-5162](https://cve.now/CVE-2026-5162.md): Royal Addons for Elementor \<= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-70795](https://cve.now/CVE-2025-70795.md): STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to termin (CVSS 5.5)
- [CVE-2026-31317](https://cve.now/CVE-2026-31317.md): Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the ven (CVSS 7.5, markhuot/craftql)
- [CVE-2026-37749](https://cve.now/CVE-2026-37749.md): A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authen (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.