CVEs published April 18, 2026
32 CVEs were published on April 18, 2026: 6 critical, 12 high.
- Published
- 32
- Critical
- 6
- High
- 12
- Medium
- 13
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Apache Software Foundation Apache Airflow · apache-airfl… +1
- 3
- HappySeaFox sail
- 3
- leepeuker movary
- 3
- MinecAnton209 NovumOS
- 2
- ajay Contextual Related Posts
- 1
- Apache Software Foundation Apache Airflow
- 1
- Apache Software Foundation Apache Airflow · apache-airflow-…
- 1
- Apache Software Foundation Apache Airflow Providers Keycloa…
- 1
- AsyncHttpClient async-http-client · org.asynchttpclient:asy…
- 1
- ChurchCRM CRM
- 1
Critical 6
- CVE-2026-41242protobufjs has an arbitrary code execution issueprotobufjs protobuf.js · protobufjs
- CVE-2026-40494SAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds checkHappySeaFox sail
- CVE-2026-40493SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit modeHappySeaFox sail
- CVE-2026-40492SAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swapHappySeaFox sail
- CVE-2026-40572NovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange)MinecAnton209 NovumOS
- CVE-2026-40317NovumOS has Privilege Escalation in the Syscall InterfaceMinecAnton209 NovumOS
High 12
- CVE-2026-30898Apache Airflow: Bad example of BashOperator shell injection via dag_run.confApache Software Foundation Apache Airflow
- CVE-2026-30912Apache Airflow: Exposing stack trace in case of constraint errorApache Software Foundation Apache Airflow · apache-airfl… +1
- CVE-2026-25917Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)Apache Software Foundation Apache Airflow · apache-airfl… +1
- CVE-2026-32228Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access toApache Software Foundation Apache Airflow · apache-airflow-…
- CVE-2026-6518CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code ExecutionCMP – Coming Soon & Maintenance Plugin by NiteoThemes
- CVE-2026-40489editorconfig-core-c has incomplete fix for CVE-2023-0341editorconfig-core-c
- CVE-2026-40487Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSSgitroomhq postiz-app
- CVE-2026-35582Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in ExecutrixNationalSecurityAgency emissary · gov.nsa.emissary:emissary
- CVE-2026-35465SecureDrop Client has path injection in read_gzip_header_filename()freedomofpress securedrop-client
- CVE-2026-40350Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accountsleepeuker movary
- CVE-2026-40349Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=trueleepeuker movary
- CVE-2026-40348Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probingleepeuker movary
Medium, low and unrated 14
- CVE-2026-40948Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth ManagerApache Software Foundation Apache Airflow Providers Keycloa…
- CVE-2026-2986Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'ajay Contextual Related Posts
- CVE-2026-2505Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcodeelzahlan Categories Images
- CVE-2026-0894Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcodevanderwijk Content Blocks
- CVE-2026-41254Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplicalittlecms little cms color engine
- CVE-2026-32690Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1Apache Software Foundation Apache Airflow · apache-airfl… +1
- CVE-2026-41253In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains aiTerm2
- CVE-2026-6048Flipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributesdragwyb Flipbox Addon for Elementor
- CVE-2026-4801Page Builder Gutenberg Blocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Datagodaddy Page Builder Gutenberg Blocks – CoBlocks
- CVE-2026-40491gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractallwkentaro gdown · gdown
- CVE-2026-40490AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirectsAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-1559Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' ParameterYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2026-1838Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameterprasunsen Hostel
- CVE-2026-40593ChurchCRM: Stored XSS in UserEditor.php via Login Name FieldChurchCRM CRM