# CVEs published 2026-04-18 32 CVEs were published on April 18, 2026: 6 critical, 12 high. Days are UTC. - [CVE-2026-41242](https://cve.now/CVE-2026-41242.md): protobufjs has an arbitrary code execution issue (CVSS 9.4, protobufjs protobuf.js · protobufjs) - [CVE-2026-40948](https://cve.now/CVE-2026-40948.md): Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager (CVSS 5.4, Apache Software Foundation Apache Airflow Providers Keycloa…) - [CVE-2026-2986](https://cve.now/CVE-2026-2986.md): Contextual Related Posts \<= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other\_attributes' (CVSS 6.4, ajay Contextual Related Posts) - [CVE-2026-2505](https://cve.now/CVE-2026-2505.md): Categories Images \<= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z\_taxonomy\_image' Shortcode (CVSS 5.4, elzahlan Categories Images) - [CVE-2026-0894](https://cve.now/CVE-2026-0894.md): Content Blocks (Custom Post Widget) \<= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content\_block Shortcode (CVSS 6.4, vanderwijk Content Blocks) - [CVE-2026-41254](https://cve.now/CVE-2026-41254.md): Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplica (CVSS 4.0, littlecms little cms color engine) - [CVE-2026-32690](https://cve.now/CVE-2026-32690.md): Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max\_depth=1 (CVSS 3.7, Apache Software Foundation Apache Airflow · apache-airfl… +1) - [CVE-2026-30898](https://cve.now/CVE-2026-30898.md): Apache Airflow: Bad example of BashOperator shell injection via dag\_run.conf (CVSS 8.8, Apache Software Foundation Apache Airflow) - [CVE-2026-30912](https://cve.now/CVE-2026-30912.md): Apache Airflow: Exposing stack trace in case of constraint error (CVSS 7.5, Apache Software Foundation Apache Airflow · apache-airfl… +1) - [CVE-2026-25917](https://cve.now/CVE-2026-25917.md): Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) (CVSS 7.2, Apache Software Foundation Apache Airflow · apache-airfl… +1) - [CVE-2026-32228](https://cve.now/CVE-2026-32228.md): Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to (CVSS 7.5, Apache Software Foundation Apache Airflow · apache-airflow-…) - [CVE-2026-41253](https://cve.now/CVE-2026-41253.md): In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a (CVSS 6.9, iTerm2) - [CVE-2026-6048](https://cve.now/CVE-2026-6048.md): Flipbox Addon for Elementor \<= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes (CVSS 6.4, dragwyb Flipbox Addon for Elementor) - [CVE-2026-6518](https://cve.now/CVE-2026-6518.md): CMP – Coming Soon & Maintenance Plugin by NiteoThemes \<= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution (CVSS 8.8, CMP – Coming Soon & Maintenance Plugin by NiteoThemes) - [CVE-2026-4801](https://cve.now/CVE-2026-4801.md): Page Builder Gutenberg Blocks \<= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data (CVSS 6.4, godaddy Page Builder Gutenberg Blocks – CoBlocks) - [CVE-2026-40494](https://cve.now/CVE-2026-40494.md): SAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds check (CVSS 9.8, HappySeaFox sail) - [CVE-2026-40493](https://cve.now/CVE-2026-40493.md): SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode (CVSS 9.8, HappySeaFox sail) - [CVE-2026-40492](https://cve.now/CVE-2026-40492.md): SAIL has heap buffer overflow in XWD decoder — bits\_per\_pixel vs pixmap\_depth type confusion in byte-swap (CVSS 9.8, HappySeaFox sail) - [CVE-2026-40491](https://cve.now/CVE-2026-40491.md): gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall (CVSS 6.5, wkentaro gdown · gdown) - [CVE-2026-40490](https://cve.now/CVE-2026-40490.md): AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects (CVSS 6.8, AsyncHttpClient async-http-client · org.asynchttpclient:asy…) - [CVE-2026-1559](https://cve.now/CVE-2026-1559.md): Youzify \<= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin\_place\_id' Parameter (CVSS 6.4, Youzify – BuddyPress Community, User Profile, Social Networ…) - [CVE-2026-1838](https://cve.now/CVE-2026-1838.md): Hostel \<= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode\_id' Parameter (CVSS 6.1, prasunsen Hostel) - [CVE-2026-40489](https://cve.now/CVE-2026-40489.md): editorconfig-core-c has incomplete fix for CVE-2023-0341 (CVSS 8.6, editorconfig-core-c) - [CVE-2026-40487](https://cve.now/CVE-2026-40487.md): Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS (CVSS 8.9, gitroomhq postiz-app) - [CVE-2026-35582](https://cve.now/CVE-2026-35582.md): Emissary has an OS Command Injection via Unvalidated IN\_FILE\_ENDING / OUT\_FILE\_ENDING in Executrix (CVSS 8.8, NationalSecurityAgency emissary · gov.nsa.emissary:emissary) - [CVE-2026-35465](https://cve.now/CVE-2026-35465.md): SecureDrop Client has path injection in read\_gzip\_header\_filename() (CVSS 7.5, freedomofpress securedrop-client) - [CVE-2026-40572](https://cve.now/CVE-2026-40572.md): NovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange) (CVSS 9.0, MinecAnton209 NovumOS) - [CVE-2026-40317](https://cve.now/CVE-2026-40317.md): NovumOS has Privilege Escalation in the Syscall Interface (CVSS 9.4, MinecAnton209 NovumOS) - [CVE-2026-40350](https://cve.now/CVE-2026-40350.md): Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts (CVSS 8.8, leepeuker movary) - [CVE-2026-40349](https://cve.now/CVE-2026-40349.md): Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true (CVSS 8.8, leepeuker movary) - [CVE-2026-40593](https://cve.now/CVE-2026-40593.md): ChurchCRM: Stored XSS in UserEditor.php via Login Name Field (CVSS 4.8, ChurchCRM CRM) - [CVE-2026-40348](https://cve.now/CVE-2026-40348.md): Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing (CVSS 7.7, leepeuker movary) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2026-04-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.