# CVEs published 2026-04-20

180 CVEs were published on April 20, 2026: 18 critical, 49 high. Days are UTC.

- [CVE-2026-35570](https://cve.now/CVE-2026-35570.md): OpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal (CVSS 8.4, Gitlawb openclaude · @gitlawb/openclaude)
- [CVE-2026-35588](https://cve.now/CVE-2026-35588.md): Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values (CVSS 6.3, nicolargo glances · glances)
- [CVE-2026-35587](https://cve.now/CVE-2026-35587.md): Glances IP Plugin has SSRF via public\_api that leads to credential leakage (CVSS 7.3, nicolargo glances · glances)
- [CVE-2026-34839](https://cve.now/CVE-2026-34839.md): Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS (CVSS 7.7, nicolargo glances · glances)
- [CVE-2026-41331](https://cve.now/CVE-2026-41331.md): OpenClaw \< 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcription (CVSS 6.9, OpenClaw)
- [CVE-2026-41330](https://cve.now/CVE-2026-41330.md): OpenClaw \< 2026.3.31 - Environment Variable Override via Host Exec Policy (CVSS 2.0, OpenClaw)
- [CVE-2026-41329](https://cve.now/CVE-2026-41329.md): OpenClaw \< 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation (CVSS 9.0, OpenClaw)
- [CVE-2026-41303](https://cve.now/CVE-2026-41303.md): OpenClaw \< 2026.3.28 - Authorization Bypass in Discord Text Approval Commands (CVSS 8.7, OpenClaw)
- [CVE-2026-41302](https://cve.now/CVE-2026-41302.md): OpenClaw \< 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download (CVSS 4.8, OpenClaw)
- [CVE-2026-41301](https://cve.now/CVE-2026-41301.md): OpenClaw 2026.3.22 \< 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass (CVSS 6.9, OpenClaw)
- [CVE-2026-41300](https://cve.now/CVE-2026-41300.md): OpenClaw \< 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding (CVSS 6.9, OpenClaw)
- [CVE-2026-41299](https://cve.now/CVE-2026-41299.md): OpenClaw \< 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard (CVSS 7.1, OpenClaw)
- [CVE-2026-41298](https://cve.now/CVE-2026-41298.md): OpenClaw \< 2026.4.2 - Authorization Bypass in Session Termination Endpoint (CVSS 5.3, OpenClaw)
- [CVE-2026-41297](https://cve.now/CVE-2026-41297.md): OpenClaw \< 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect (CVSS 4.8, OpenClaw)
- [CVE-2026-41296](https://cve.now/CVE-2026-41296.md): OpenClaw \< 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFile (CVSS 8.8, OpenClaw)
- [CVE-2026-41295](https://cve.now/CVE-2026-41295.md): OpenClaw \< 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel Setup (CVSS 8.5, OpenClaw)
- [CVE-2026-41294](https://cve.now/CVE-2026-41294.md): OpenClaw \< 2026.3.28 - Environment Variable Injection via CWD .env File (CVSS 8.5, OpenClaw)
- [CVE-2026-40045](https://cve.now/CVE-2026-40045.md): OpenClaw \< 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints (CVSS 5.9, OpenClaw)
- [CVE-2026-34082](https://cve.now/CVE-2026-34082.md): Dify has IDOR in deleting someone else's chat conversation (CVSS 5.3, langgenius dify)
- [CVE-2026-5721](https://cve.now/CVE-2026-5721.md): wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin \<= 6.5.0.4 - Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data Import (CVSS 4.7, wpDataTables – WordPress Data Table, Dynamic Tables & Table…)
- [CVE-2026-6729](https://cve.now/CVE-2026-6729.md): HKUDS OpenHarness Session Key Collision Privilege Escalation (CVSS 5.3, HKUDS OpenHarness)
- [CVE-2026-0930](https://cve.now/CVE-2026-0930.md): Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize (CVSS 2.3, wolfSSL wolfSSH)
- [CVE-2026-22051](https://cve.now/CVE-2026-22051.md): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerabili (CVSS 2.3, NETAPP StorageGRID)
- [CVE-2026-5450](https://cve.now/CVE-2026-5450.md): scanf %mc off-by-one heap buffer overflow (CVSS 9.8, The GNU C Library glibc)
- [CVE-2026-5928](https://cve.now/CVE-2026-5928.md): Potential buffer under-read in ungetwc (CVSS 7.5, The GNU C Library glibc)
- [CVE-2026-33626](https://cve.now/CVE-2026-33626.md): LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading (CVSS 7.5, InternLM lmdeploy · lmdeploy)
- [CVE-2026-4852](https://cve.now/CVE-2026-4852.md): Image Source Control Lite – Show Image Credits and Captions \<= 3.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'Image Source' Field (CVSS 6.4, webzunft Image Source Control Lite – Show Image Credits and…)
- [CVE-2026-33432](https://cve.now/CVE-2026-33432.md): Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass (CVSS 7.7, roxy-wi)
- [CVE-2026-33431](https://cve.now/CVE-2026-33431.md): Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer (CVSS 5.7, roxy-wi)
- [CVE-2026-34403](https://cve.now/CVE-2026-34403.md): Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints (CVSS 5.5, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-33031](https://cve.now/CVE-2026-33031.md): Nginx-UI: Disabled users retain full API access through previously issued bearer tokens (CVSS 8.6, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-32613](https://cve.now/CVE-2026-32613.md): Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling (CVSS 10.0, spinnaker · io.spinnaker.echo:echo-pipelinetriggers)
- [CVE-2026-32604](https://cve.now/CVE-2026-32604.md): Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths (CVSS 10.0, spinnaker · io.spinnaker.clouddriver:clouddriver-artifacts-…)
- [CVE-2026-6249](https://cve.now/CVE-2026-6249.md): Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload (CVSS 8.7, Vvveb CMS)
- [CVE-2026-32311](https://cve.now/CVE-2026-32311.md): Command Injection and Docker container escape allows root on host machine (CVSS 9.3, reconurge flowsint)
- [CVE-2026-5478](https://cve.now/CVE-2026-5478.md): Everest Forms \<= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old\_files' Parameter (CVSS 8.1, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2026-32135](https://cve.now/CVE-2026-32135.md): NanoMQ has Heap Buffer Overflow in URI Parameter Parsing (CVSS 7.7, nanomq)
- [CVE-2026-6550](https://cve.now/CVE-2026-6550.md): Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python (CVSS 4.7, AWS Encryption SDK for Python · aws-encryption-sdk)
- [CVE-2026-6257](https://cve.now/CVE-2026-6257.md): Vvveb CMS \< v1.0.8.2 Remote Code Execution via Media Management (CVSS 9.2, Vvveb CMS)
- [CVE-2026-6248](https://cve.now/CVE-2026-6248.md): wpForo Forum \<= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path (CVSS 8.1, tomdever wpForo Forum)
- [CVE-2026-6060](https://cve.now/CVE-2026-6060.md): Possible DoS via SQL Box (CVSS 4.5, OTRS AG OTRS)
- [CVE-2026-41389](https://cve.now/CVE-2026-41389.md): OpenClaw 2026.4.7 \< 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths (CVSS 6.3, OpenClaw)
- [CVE-2026-23753](https://cve.now/CVE-2026-23753.md): GFI HelpDesk \< 4.99.9 Stored XSS via charset Parameter (CVSS 4.8, GFI Software HelpDesk)
- [CVE-2026-23752](https://cve.now/CVE-2026-23752.md): GFI HelpDesk \< 4.99.9 Stored XSS via companyname Parameter (CVSS 4.8, GFI Software HelpDesk)
- [CVE-2026-23756](https://cve.now/CVE-2026-23756.md): GFI HelpDesk \< 4.99.9 Stored XSS via Troubleshooter Step Subject (CVSS 5.1, GFI Software HelpDesk)
- [CVE-2026-23758](https://cve.now/CVE-2026-23758.md): GFI HelpDesk \< 4.99.9 Stored XSS via editsubject Parameter (CVSS 5.1, GFI Software HelpDesk)
- [CVE-2026-23757](https://cve.now/CVE-2026-23757.md): GFI HelpDesk \< 4.99.10 Stored XSS via Reports Module (CVSS 5.1, GFI Software HelpDesk)
- [CVE-2026-6662](https://cve.now/CVE-2026-6662.md): ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy (CVSS 6.9, ericc-ch copilot-api)
- [CVE-2026-35154](https://cve.now/CVE-2026-35154.md): Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3 (CVSS 6.3, Dell PowerProtect Data Domain appliances)
- [CVE-2026-26951](https://cve.now/CVE-2026-26951.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13 (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-22761](https://cve.now/CVE-2026-22761.md): Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-26942](https://cve.now/CVE-2026-26942.md): Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-26943](https://cve.now/CVE-2026-26943.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13 (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-28684](https://cve.now/CVE-2026-28684.md): python-dotenv: Symlink following in set\_key allows arbitrary file overwrite via cross-device rename fallback (CVSS 6.6, theskumar python-dotenv · python-dotenv)
- [CVE-2026-40488](https://cve.now/CVE-2026-40488.md): OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution (CVSS 8.7, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2026-24506](https://cve.now/CVE-2026-24506.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13 (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-40098](https://cve.now/CVE-2026-40098.md): OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant (CVSS 5.3, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2026-41445](https://cve.now/CVE-2026-41445.md): KissFFT Integer Overflow Heap Buffer Overflow via kiss\_fftndr\_alloc() (CVSS 8.7, mborgerding kissfft)
- [CVE-2026-24505](https://cve.now/CVE-2026-24505.md): Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-25525](https://cve.now/CVE-2026-25525.md): OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module (CVSS 4.9, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2026-25524](https://cve.now/CVE-2026-25524.md): OpenMage LTS's Phar Deserialization leads to Remote Code Execution (CVSS 8.1, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2026-24504](https://cve.now/CVE-2026-24504.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13 (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-25883](https://cve.now/CVE-2026-25883.md): Vexa Webhook Feature has a SSRF Vulnerability (CVSS 5.8, Vexa-ai vexa)
- [CVE-2026-25058](https://cve.now/CVE-2026-25058.md): Vexa's unauthenticated internal transcript endpoint exposed by default (CVSS 7.5, Vexa-ai vexa)
- [CVE-2026-23774](https://cve.now/CVE-2026-23774.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-26944](https://cve.now/CVE-2026-26944.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13 (CVSS 8.8, Dell PowerProtect Data Domain)
- [CVE-2026-24468](https://cve.now/CVE-2026-24468.md): OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API (CVSS 5.3, OpenAEV-Platform openaev)
- [CVE-2026-24467](https://cve.now/CVE-2026-24467.md): OpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise (CVSS 9.1, OpenAEV-Platform openaev)
- [CVE-2026-6066](https://cve.now/CVE-2026-6066.md): Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center (CVSS 7.1, ConnectWise Automate)
- [CVE-2026-41245](https://cve.now/CVE-2026-41245.md): Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix (CVSS 5.9, junrar · com.github.junrar:junrar)
- [CVE-2026-40896](https://cve.now/CVE-2026-40896.md): OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup (CVSS 6.5, opf openproject)
- [CVE-2026-6652](https://cve.now/CVE-2026-6652.md): Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection (CVSS 5.1, Pagekit CMS)
- [CVE-2026-3219](https://cve.now/CVE-2026-3219.md): pip doesn't reject concatenated ZIP and tar archives (CVSS 4.6, Python Packaging Authority pip · pip)
- [CVE-2026-39918](https://cve.now/CVE-2026-39918.md): Vvveb \< 1.0.8.1 Code Injection via Installation Endpoint (CVSS 9.2, givanz Vvveb)
- [CVE-2026-6651](https://cve.now/CVE-2026-6651.md): erponline.xyz ERP Online Inventory Edit Item cross site scripting (CVSS 4.8, erponline.xyz ERP Online)
- [CVE-2026-6650](https://cve.now/CVE-2026-6650.md): Z-BlogPHP ZBA File app\_upload.php UnPack unrestricted upload (CVSS 5.1, Z-BlogPHP)
- [CVE-2026-34428](https://cve.now/CVE-2026-34428.md): Vvveb \< 1.0.8.1 SSRF via oEmbedProxy (CVSS 8.3, givanz Vvveb)
- [CVE-2026-34427](https://cve.now/CVE-2026-34427.md): Vvveb \< 1.0.8.1 Privilege Escalation via admin/user/save (CVSS 8.7, givanz Vvveb)
- [CVE-2026-34429](https://cve.now/CVE-2026-34429.md): Vvveb \< 1.0.8.1 Stored XSS via Media Upload and Rename (CVSS 5.1, givanz Vvveb)
- [CVE-2026-5760](https://cve.now/CVE-2026-5760.md): CVE-2026-5760 (CVSS 9.8, SGLang)
- [CVE-2026-6369](https://cve.now/CVE-2026-6369.md): Exposed Session Token in canonical-livepatch client snap (CVSS 5.7, canonical-livepatch)
- [CVE-2026-4048](https://cve.now/CVE-2026-4048.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4, Progress Software LoadMaster · Progress Software ECS Con… +2)
- [CVE-2026-3519](https://cve.now/CVE-2026-3519.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4, Progress Software LoadMaster · Progress Software ECS Con… +2)
- [CVE-2026-6649](https://cve.now/CVE-2026-6649.md): Qibo CMS headers server-side request forgery (CVSS 5.3, Qibo CMS)
- [CVE-2026-3518](https://cve.now/CVE-2026-3518.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4, Progress Software LoadMaster · Progress Software ECS Con… +2)
- [CVE-2026-33557](https://cve.now/CVE-2026-33557.md): Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication (CVSS 9.1, Apache Software Foundation Apache Kafka · org.apache.kafka:…)
- [CVE-2025-66335](https://cve.now/CVE-2025-66335.md): Apache Doris MCP Server: MCP SQL inject (CVSS 5.3, Apache Software Foundation Apache Doris MCP Server · doris-…)
- [CVE-2026-3517](https://cve.now/CVE-2026-3517.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4, Progress Software LoadMaster · Progress Software ECS Con… +2)
- [CVE-2026-33558](https://cve.now/CVE-2026-33558.md): Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output (CVSS 5.3, Apache Software Foundation Apache Kafka · org.apache.kafka:…)
- [CVE-2026-6648](https://cve.now/CVE-2026-6648.md): Qibo CMS Internal Message cross site scripting (CVSS 5.1, Qibo CMS)
- [CVE-2026-6636](https://cve.now/CVE-2026-6636.md): p2r3 convert API buildCache.js Bun.serve path traversal (CVSS 5.3, p2r3 convert)
- [CVE-2026-5958](https://cve.now/CVE-2026-5958.md): Race Condition in GNU Sed (CVSS 2.1, GNU Sed)
- [CVE-2026-6635](https://cve.now/CVE-2026-6635.md): rowboatlabs rowboat tools\_webhook app.py tool\_call improper authentication (CVSS 6.9, rowboatlabs rowboat)
- [CVE-2026-6634](https://cve.now/CVE-2026-6634.md): usememos UpdateInstanceSetting App.tsx memos\_access\_token improper authorization (CVSS 5.3, usememos memos · github.com/usememos/memos)
- [CVE-2026-6633](https://cve.now/CVE-2026-6633.md): Yifang CMS Extended Management L\_rbac\_admin.php store cross site scripting (CVSS 5.1, Yifang CMS)
- [CVE-2026-6632](https://cve.now/CVE-2026-6632.md): Tenda F451 httpd SafeClientFilter fromSafeClientFilter buffer overflow (CVSS 8.7, Tenda F451)
- [CVE-2026-6631](https://cve.now/CVE-2026-6631.md): Tenda F451 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow (CVSS 8.7, Tenda F451)
- [CVE-2026-6630](https://cve.now/CVE-2026-6630.md): Tenda F451 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow (CVSS 8.7, Tenda F451)
- [CVE-2026-6629](https://cve.now/CVE-2026-6629.md): Metasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injection (CVSS 6.9, Metasoft 美特软件 MetaCRM)
- [CVE-2026-6654](https://cve.now/CVE-2026-6654.md): Use-After-Free and Double-Free in IntoIter::drop when element drop panics (CVSS 5.1, Mozilla thin-vec · thin-vec)
- [CVE-2026-6628](https://cve.now/CVE-2026-6628.md): phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection (CVSS 5.3, phili67 Ecclesia CRM)
- [CVE-2026-6626](https://cve.now/CVE-2026-6626.md): Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection (CVSS 5.3, Cockpit-HQ Cockpit · cockpit-hq/cockpit)
- [CVE-2026-31430](https://cve.now/CVE-2026-31430.md): X.509: Fix out-of-bounds access when parsing extensions (no CVSS, Linux)
- [CVE-2026-31429](https://cve.now/CVE-2026-31429.md): net: skb: fix cross-cache free of KFENCE-allocated skb head (no CVSS, Linux)
- [CVE-2026-6625](https://cve.now/CVE-2026-6625.md): moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery (CVSS 6.9, moxi624 Mogu Blog)
- [CVE-2026-6624](https://cve.now/CVE-2026-6624.md): BichitroGan ISP Billing Software Pool List add cross site scripting (CVSS 4.8, BichitroGan ISP Billing Software)
- [CVE-2026-6623](https://cve.now/CVE-2026-6623.md): BichitroGan ISP Billing Software Profile users-view cross site scripting (CVSS 4.8, BichitroGan ISP Billing Software)
- [CVE-2025-13480](https://cve.now/CVE-2025-13480.md): Incorrect authorization in Fudo Enterprise (CVSS 5.1, Fudo Security Fudo Enterprise)
- [CVE-2026-6622](https://cve.now/CVE-2026-6622.md): BichitroGan ISP Billing Software Customer edit cross site scripting (CVSS 4.8, BichitroGan ISP Billing Software)
- [CVE-2026-6621](https://cve.now/CVE-2026-6621.md): 1024bit extend-deep index.js prototype pollution (CVSS 6.9, 1024bit extend-deep)
- [CVE-2026-6620](https://cve.now/CVE-2026-6620.md): SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal (CVSS 5.3, SonicCloudOrg sonic-server)
- [CVE-2026-39454](https://cve.now/CVE-2026-39454.md): SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. (CVSS 7.8, Sky Co. SKYSEA Client View · Sky Co. SKYMEC IT Manager)
- [CVE-2026-6619](https://cve.now/CVE-2026-6619.md): langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting (CVSS 5.1, langgenius dify)
- [CVE-2026-6618](https://cve.now/CVE-2026-6618.md): langgenius dify ApiBasedToolSchemaParser parser.py parse\_openai\_plugin\_json\_to\_tool\_bundle server-side request forgery (CVSS 5.3, langgenius dify)
- [CVE-2026-5967](https://cve.now/CVE-2026-5967.md): TeamT5｜ThreatSonar Anti-Ransomware - Privilege Escalation (CVSS 8.7, TeamT5 ThreatSonar Anti-Ransomware)
- [CVE-2026-5966](https://cve.now/CVE-2026-5966.md): TeamT5｜ThreatSonar Anti-Ransomware - Arbitrary File Deletion (CVSS 7.2, TeamT5 ThreatSonar Anti-Ransomware)
- [CVE-2026-5964](https://cve.now/CVE-2026-5964.md): Digiwin｜EasyFlow .NET - SQL Injection (CVSS 9.3, Digiwin EasyFlow .NET)
- [CVE-2026-5963](https://cve.now/CVE-2026-5963.md): Digiwin｜EasyFlow .NET - SQL Injection (CVSS 9.3, Digiwin EasyFlow .NET)
- [CVE-2026-6617](https://cve.now/CVE-2026-6617.md): langgenius dify ApiToolManageService api\_tools\_manage\_service.py get\_api\_tool\_provider\_remote\_schema server-side request forgery (CVSS 5.3, langgenius dify)
- [CVE-2026-6616](https://cve.now/CVE-2026-6616.md): TransformerOptimus SuperAGI WebScraperTool webpage\_extractor.py extract\_with\_lxml server-side request forgery (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-41282](https://cve.now/CVE-2026-41282.md): ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. (CVSS 4.0, ProjectDiscovery Nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-6615](https://cve.now/CVE-2026-6615.md): TransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal (CVSS 6.9, TransformerOptimus SuperAGI)
- [CVE-2026-6644](https://cve.now/CVE-2026-6644.md): A command injection vulnerability was found in the PPTP VPN Clients on the ADM (CVSS 9.4, ASUSTOR ADM)
- [CVE-2026-6614](https://cve.now/CVE-2026-6614.md): TransformerOptimus SuperAGI project.py get\_projects\_organisation authorization (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-6643](https://cve.now/CVE-2026-6643.md): A stack-based buffer overflow vulnerability in the VPN Clients on the ADM (CVSS 8.6, ASUSTOR ADM)
- [CVE-2026-6613](https://cve.now/CVE-2026-6613.md): TransformerOptimus SuperAGI agent.py get\_schedule\_data authorization (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-6612](https://cve.now/CVE-2026-6612.md): TransformerOptimus SuperAGI Agent Execution Endpoint agent\_execution.py update\_agent\_execution authorization (CVSS 5.3, TransformerOptimus SuperAGI)
- [CVE-2026-6611](https://cve.now/CVE-2026-6611.md): liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key (CVSS 2.3, liangliangyy DjangoBlog)
- [CVE-2024-7083](https://cve.now/CVE-2024-7083.md): Email Encoder \< 2.3.4 - Admin+ Stored XSS (CVSS 3.5, Email Encoder)
- [CVE-2026-6610](https://cve.now/CVE-2026-6610.md): liangliangyy DjangoBlog Setting settings.py hard-coded credentials (CVSS 6.3, liangliangyy DjangoBlog)
- [CVE-2026-6609](https://cve.now/CVE-2026-6609.md): liangliangyy DjangoBlog views.py form\_valid improper authorization (CVSS 5.3, liangliangyy DjangoBlog)
- [CVE-2026-6608](https://cve.now/CVE-2026-6608.md): lm-sys fastchat Arena Side-by-Side View add\_text control flow (CVSS 6.9, lm-sys fastchat · fschat)
- [CVE-2026-6607](https://cve.now/CVE-2026-6607.md): lm-sys fastchat Worker API Endpoint api\_generate resource consumption (CVSS 6.9, lm-sys fastchat · fschat)
- [CVE-2026-6606](https://cve.now/CVE-2026-6606.md): modelscope agentscope \_agent\_base.py \_process\_audio\_block server-side request forgery (CVSS 6.9, modelscope agentscope · agentscope)
- [CVE-2026-6605](https://cve.now/CVE-2026-6605.md): modelscope agentscope Internal Service \_common.py \_get\_bytes\_from\_web\_url server-side request forgery (CVSS 6.9, modelscope agentscope · agentscope)
- [CVE-2026-6604](https://cve.now/CVE-2026-6604.md): modelscope agentscope Cloud Metadata Endpoint \_openai\_tools.py openai\_audio\_to\_text server-side request forgery (CVSS 6.9, modelscope agentscope · agentscope)
- [CVE-2026-6603](https://cve.now/CVE-2026-6603.md): modelscope agentscope \_python.py execute\_shell\_command code injection (CVSS 6.9, modelscope agentscope · agentscope)
- [CVE-2026-6602](https://cve.now/CVE-2026-6602.md): rickxy Hospital Management System his\_admin\_account.php unrestricted upload (CVSS 6.9, rickxy Hospital Management System)
- [CVE-2026-6601](https://cve.now/CVE-2026-6601.md): Lagom WHMCS Template Datatables resource consumption (CVSS 5.3, Lagom WHMCS Template)
- [CVE-2026-32956](https://cve.now/CVE-2026-32956.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 9.8, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32955](https://cve.now/CVE-2026-32955.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 8.8, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32957](https://cve.now/CVE-2026-32957.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 5.3, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32958](https://cve.now/CVE-2026-32958.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 6.5, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32959](https://cve.now/CVE-2026-32959.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 5.9, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32960](https://cve.now/CVE-2026-32960.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 6.5, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32961](https://cve.now/CVE-2026-32961.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 5.3, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32962](https://cve.now/CVE-2026-32962.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 5.3, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32963](https://cve.now/CVE-2026-32963.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 6.1, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32964](https://cve.now/CVE-2026-32964.md): SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 6.5, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-32965](https://cve.now/CVE-2026-32965.md): Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. (CVSS 7.5, silex technology SD-330AC · silex technology AMC Manager)
- [CVE-2026-6600](https://cve.now/CVE-2026-6600.md): langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting (CVSS 5.1, langflow-ai langflow)
- [CVE-2026-6599](https://cve.now/CVE-2026-6599.md): langflow-ai langflow Model Context Protocol Configuration API mcp\_projects.py install\_mcp\_config injection (CVSS 5.3, langflow-ai langflow · langflow)
- [CVE-2026-6598](https://cve.now/CVE-2026-6598.md): langflow-ai langflow Project Creation Endpoint projects.py encrypt\_auth\_settings cleartext storage in file (CVSS 5.3, langflow-ai langflow · langflow)
- [CVE-2026-6597](https://cve.now/CVE-2026-6597.md): langflow-ai langflow Flow Using API core.py has\_api\_terms credentials storage (CVSS 5.1, langflow-ai langflow · langflow)
- [CVE-2026-6596](https://cve.now/CVE-2026-6596.md): langflow-ai langflow API Endpoint endpoints.py create\_upload\_file unrestricted upload (CVSS 6.9, langflow-ai langflow · langflow-base)
- [CVE-2026-6595](https://cve.now/CVE-2026-6595.md): ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection (CVSS 6.9, ProjectsAndPrograms School Management System)
- [CVE-2026-6594](https://cve.now/CVE-2026-6594.md): brikcss merge prototype pollution (CVSS 6.9, brikcss merge · @brikcss/merge)
- [CVE-2026-6593](https://cve.now/CVE-2026-6593.md): ComfyUI View Endpoint server.py cross site scripting (CVSS 5.1, ComfyUI)
- [CVE-2026-6592](https://cve.now/CVE-2026-6592.md): ComfyUI userdata Endpoint user\_manager.py getuserdata cross site scripting (CVSS 5.1, ComfyUI)
- [CVE-2026-6591](https://cve.now/CVE-2026-6591.md): ComfyUI LoadImage Node folder\_paths.py folder\_paths.get\_annotated\_filepath path traversal (CVSS 5.3, ComfyUI)
- [CVE-2026-6590](https://cve.now/CVE-2026-6590.md): ComfyUI Model Preview Endpoint model\_manager.py get\_model\_preview path traversal (CVSS 5.3, ComfyUI)
- [CVE-2026-6589](https://cve.now/CVE-2026-6589.md): ComfyUI server.py create\_origin\_only\_middleware cross-site request forgery (CVSS 5.3, ComfyUI)
- [CVE-2026-6588](https://cve.now/CVE-2026-6588.md): serge-chat serge Model API Endpoint model.py delete\_model missing authentication (CVSS 6.9, serge-chat serge)
- [CVE-2026-6587](https://cve.now/CVE-2026-6587.md): vibrantlabsai RAGAS Collections util.py \_try\_process\_url server-side request forgery (CVSS 5.3, vibrantlabsai RAGAS · ragas)
- [CVE-2025-66954](https://cve.now/CVE-2025-66954.md): A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid use (CVSS 6.5)
- [CVE-2026-26399](https://cve.now/CVE-2026-26399.md): A stack-use-after-return issue exists in the Arduino\_Core\_STM32 library prior to version 1.7.0. (CVSS 5.3)
- [CVE-2026-29642](https://cve.now/CVE-2026-29642.md): A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menv (CVSS 7.8)
- [CVE-2026-29643](https://cve.now/CVE-2026-29643.md): XiangShan (Open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) contains an improper (CVSS 7.1)
- [CVE-2026-29645](https://cve.now/CVE-2026-29645.md): NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. (CVSS 7.5)
- [CVE-2026-29646](https://cve.now/CVE-2026-29646.md): In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interr (CVSS 9.8)
- [CVE-2026-29647](https://cve.now/CVE-2026-29647.md): In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei C (CVSS 6.5)
- [CVE-2026-29648](https://cve.now/CVE-2026-29648.md): In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. (CVSS 8.8)
- [CVE-2026-29649](https://cve.now/CVE-2026-29649.md): NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg\[7:4\] (CBIE/CBCFE/CBZE-related fields) is incorrectl (CVSS 9.8)
- [CVE-2026-30266](https://cve.now/CVE-2026-30266.md): Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a craf (CVSS 7.8)
- [CVE-2026-30269](https://cve.now/CVE-2026-30269.md): Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privilege (CVSS 9.9)
- [CVE-2026-39109](https://cve.now/CVE-2026-39109.md): SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter (CVSS 9.4)
- [CVE-2026-39110](https://cve.now/CVE-2026-39110.md): SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of (CVSS 8.2)
- [CVE-2026-39111](https://cve.now/CVE-2026-39111.md): SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the (CVSS 7.5)
- [CVE-2026-39112](https://cve.now/CVE-2026-39112.md): Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname paramete (CVSS 5.4)
- [CVE-2026-41285](https://cve.now/CVE-2026-41285.md): In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option ( (CVSS 4.3, OpenBSD)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.