# CVEs published 2026-04-19

25 CVEs were published on April 19, 2026: 0 critical, 3 high. Days are UTC.

- [CVE-2026-6586](https://cve.now/CVE-2026-6586.md): TransformerOptimus SuperAGI Budget Endpoint budget.py update\_budget authorization (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-6585](https://cve.now/CVE-2026-6585.md): TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update\_organisation authorization (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-6584](https://cve.now/CVE-2026-6584.md): TransformerOptimus SuperAGI User Update Endpoint user.py update\_user authorization (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-6583](https://cve.now/CVE-2026-6583.md): TransformerOptimus SuperAGI API Key Management Endpoint api\_key.py edit\_api\_key authorization (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-6582](https://cve.now/CVE-2026-6582.md): TransformerOptimus SuperAGI Vector Database Management Endpoint vector\_dbs.py get\_vector\_db\_details missing authentication (CVSS 6.9, TransformerOptimus SuperAGI)
- [CVE-2026-6581](https://cve.now/CVE-2026-6581.md): H3C Magic B1 aspForm SetMobileAPInfoById buffer overflow (CVSS 8.7, H3C Magic B1)
- [CVE-2026-6580](https://cve.now/CVE-2026-6580.md): liangliangyy DjangoBlog Amap API Call views.py hard-coded key (CVSS 6.9, liangliangyy DjangoBlog)
- [CVE-2026-6579](https://cve.now/CVE-2026-6579.md): liangliangyy DjangoBlog Clean Endpoint views.py missing authentication (CVSS 6.9, liangliangyy DjangoBlog)
- [CVE-2026-6578](https://cve.now/CVE-2026-6578.md): liangliangyy DjangoBlog Setting settings.py hard-coded credentials (CVSS 6.3, liangliangyy DjangoBlog)
- [CVE-2026-6577](https://cve.now/CVE-2026-6577.md): liangliangyy DjangoBlog logtracks Endpoint views.py missing authentication (CVSS 6.9, liangliangyy DjangoBlog)
- [CVE-2026-6576](https://cve.now/CVE-2026-6576.md): liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection (CVSS 5.3, liangliangyy DjangoBlog)
- [CVE-2026-6574](https://cve.now/CVE-2026-6574.md): osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials (CVSS 6.9, osuuu LightPicture)
- [CVE-2026-6573](https://cve.now/CVE-2026-6573.md): PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery (CVSS 5.3, PHPEMS)
- [CVE-2026-6572](https://cve.now/CVE-2026-6572.md): Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization (CVSS 6.3, Collabora KodExplorer)
- [CVE-2026-6571](https://cve.now/CVE-2026-6571.md): kodcloud KodExplorer systemRole.class.php roleGroupAction authorization (CVSS 5.3, kodcloud KodExplorer)
- [CVE-2026-6570](https://cve.now/CVE-2026-6570.md): kodcloud KodExplorer systemMember.class.php initInstall authorization (CVSS 5.1, kodcloud KodExplorer)
- [CVE-2026-6569](https://cve.now/CVE-2026-6569.md): kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication (CVSS 6.9, kodcloud KodExplorer)
- [CVE-2026-6568](https://cve.now/CVE-2026-6568.md): kodcloud KodExplorer Public Share share.class.php initShareOld path traversal (CVSS 6.9, kodcloud KodExplorer)
- [CVE-2026-6564](https://cve.now/CVE-2026-6564.md): EMQ EMQX Enterprise Session Handling improper authorization (CVSS 5.3, EMQX Enterprise)
- [CVE-2026-6563](https://cve.now/CVE-2026-6563.md): H3C Magic B1 aspForm SetAPWifiorLedInfoById buffer overflow (CVSS 8.7, H3C Magic B1)
- [CVE-2026-6562](https://cve.now/CVE-2026-6562.md): dameng100 muucmf index.html getListByPage sql injection (CVSS 6.9, dameng100 muucmf)
- [CVE-2026-6561](https://cve.now/CVE-2026-6561.md): EyouCMS Index.php edit\_adminlogo unrestricted upload (CVSS 5.1, EyouCMS)
- [CVE-2026-6560](https://cve.now/CVE-2026-6560.md): H3C Magic B0 aspForm Edit\_BasicSSID buffer overflow (CVSS 8.7, H3C Magic B0)
- [CVE-2026-6559](https://cve.now/CVE-2026-6559.md): Wavlink WL-WN579A3 login.cgi sub\_401F80 cross site scripting (CVSS 5.3, Wavlink WL-WN579A3)
- [CVE-2026-0868](https://cve.now/CVE-2026-0868.md): EMC Scheduling Manager \<= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode (CVSS 6.4, turn2honey EMC – Easily Embed Calendly Scheduling)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.