# CVEs published 2026-04-22

337 CVEs were published on April 22, 2026: 18 critical, 92 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-41176](https://cve.now/CVE-2026-41176.md): Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution (CVSS 9.2, rclone · github.com/rclone/rclone)
- [CVE-2026-1726](https://cve.now/CVE-2026-1726.md): Multiple Vulnerabilities in IBM Guardium Key Lifecycle Manager (CVSS 4.8, IBM Guardium Key Lifecycle Manager)
- [CVE-2025-36074](https://cve.now/CVE-2025-36074.md): Security vulnerability has been detected in IBM Security Verify Directory (CVSS 5.5, IBM Security Verify Directory)
- [CVE-2026-5926](https://cve.now/CVE-2026-5926.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 6.5, IBM Verify Identity Access Container · IBM Security Veri… +2)
- [CVE-2026-1352](https://cve.now/CVE-2026-1352.md): IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index (CVSS 6.5, IBM Db2)
- [CVE-2026-1272](https://cve.now/CVE-2026-1272.md): IBM Guardium Data Protection is affected by multiple vulnerabilities (CVSS 2.7, IBM Guardium Data Protection)
- [CVE-2026-1274](https://cve.now/CVE-2026-1274.md): IBM Guardium Data Protection is affected by multiple vulnerabilities (CVSS 4.9, IBM Guardium Data Protection)
- [CVE-2026-29198](https://cve.now/CVE-2026-29198.md): In Rocket.Chat \<8.3.0, \<8.2.1, \<8.1.2, \<8.0.3, \<7.13.5, \<7.12.6, \<7.11.6, and \<7.10.9, a NoSQL injection vulnerability can lead to account t (CVSS 9.8, Rocket.Chat)
- [CVE-2026-6874](https://cve.now/CVE-2026-6874.md): ericc-ch copilot-api Header token dns rebinding (CVSS 5.3, ericc-ch copilot-api · copilot-api)
- [CVE-2026-5935](https://cve.now/CVE-2026-5935.md): TSSC/IMC is vulnerable to OS Command Injection (CVSS 7.3, IBM Total Storage Service Console (TSSC) / TS4500 IMC)
- [CVE-2026-4917](https://cve.now/CVE-2026-4917.md): IBM Guardium Data Protection is affected by multiple vulnerabilities (CVSS 4.9, IBM Guardium Data Protection)
- [CVE-2026-4918](https://cve.now/CVE-2026-4918.md): IBM Guardium Data Protection is affected by multiple vulnerabilities (CVSS 5.5, IBM Guardium Data Protection)
- [CVE-2026-4919](https://cve.now/CVE-2026-4919.md): IBM Guardium Data Protection is affected by multiple vulnerabilities (CVSS 4.8, IBM Guardium Data Protection)
- [CVE-2026-3621](https://cve.now/CVE-2026-3621.md): IBM WebSphere Application Server Liberty is affected by identity spoofing (CVSS 7.5, IBM WebSphere Application Server - Liberty)
- [CVE-2026-40517](https://cve.now/CVE-2026-40517.md): radare2 \< 6.1.4 Command Injection via PDB Parser Symbol Names (CVSS 8.4, radareorg radare2)
- [CVE-2026-41175](https://cve.now/CVE-2026-41175.md): Statamic: Unsafe method invocation via query value resolution allows data destruction (CVSS 8.1, statamic cms · statamic/cms)
- [CVE-2026-41177](https://cve.now/CVE-2026-41177.md): Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction (CVSS 5.5, squidex)
- [CVE-2026-41172](https://cve.now/CVE-2026-41172.md): Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets) (CVSS 7.3, squidex)
- [CVE-2026-41171](https://cve.now/CVE-2026-41171.md): SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient (CVSS 7.3, squidex)
- [CVE-2026-41170](https://cve.now/CVE-2026-41170.md): Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests (CVSS 7.2, squidex)
- [CVE-2026-41455](https://cve.now/CVE-2026-41455.md): WeKan \< 8.35 SSRF via Webhook URL (CVSS 6.3, wekan)
- [CVE-2026-41454](https://cve.now/CVE-2026-41454.md): WeKan \< 8.35 Missing Authorization via Integration REST API (CVSS 8.7, wekan)
- [CVE-2026-41314](https://cve.now/CVE-2026-41314.md): pypdf: Manipulated FlateDecode image dimensions can exhaust RAM (CVSS 4.8, py-pdf pypdf · pypdf)
- [CVE-2026-41313](https://cve.now/CVE-2026-41313.md): pypdf: Possible long runtimes for wrong size values in incremental mode (CVSS 4.8, py-pdf pypdf · pypdf)
- [CVE-2026-41312](https://cve.now/CVE-2026-41312.md): pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM (CVSS 4.8, py-pdf pypdf · pypdf)
- [CVE-2026-41168](https://cve.now/CVE-2026-41168.md): pypdf has possible long runtimes for wrong size values in cross-reference and object streams (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-41167](https://cve.now/CVE-2026-41167.md): Jellystat has SQL Injection that leads to to Remote Code Execution (CVSS 9.1, CyferShepard Jellystat)
- [CVE-2026-40882](https://cve.now/CVE-2026-40882.md): OpenRemote has XXE in Velbus Asset Import (CVSS 7.6, openremote · io.openremote:openremote-manager)
- [CVE-2026-41166](https://cve.now/CVE-2026-41166.md): OpenRemote has Improper Access Control via updateUserRealmRoles function (CVSS 7.0, openremote · io.openremote:openremote-manager)
- [CVE-2026-41134](https://cve.now/CVE-2026-41134.md): Kiota: Code Generation Literal Injection (CVSS 7.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-40937](https://cve.now/CVE-2026-40937.md): RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks (CVSS 8.3, rustfs)
- [CVE-2026-33733](https://cve.now/CVE-2026-33733.md): EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete (CVSS 7.2, espocrm)
- [CVE-2026-33656](https://cve.now/CVE-2026-33656.md): EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment \`sourceId\`, exploitable by admin user (CVSS 9.1, espocrm)
- [CVE-2026-34068](https://cve.now/CVE-2026-34068.md): nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge (CVSS 6.8, nimiq-transaction)
- [CVE-2026-3837](https://cve.now/CVE-2026-3837.md): Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters (CVSS 4.6, Frappe)
- [CVE-2026-34067](https://cve.now/CVE-2026-34067.md): nimiq-transaction vulnerable to panic via \`HistoryTreeProof\` length mismatch (CVSS 3.1, nimiq-transaction)
- [CVE-2026-34066](https://cve.now/CVE-2026-34066.md): nimiq-blockchain: Peer-triggerable panic during history sync (CVSS 5.3, nimiq-blockchain)
- [CVE-2026-34065](https://cve.now/CVE-2026-34065.md): nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals (CVSS 7.5, nimiq-primitives)
- [CVE-2026-34064](https://cve.now/CVE-2026-34064.md): nimiq-account: Vesting insufficient funds error can panic (CVSS 5.3, nimiq-account)
- [CVE-2026-34063](https://cve.now/CVE-2026-34063.md): network-libp2p: Peer can crash the node by opening discovery protocol substream twice (CVSS 7.5, nimiq network-libp2p)
- [CVE-2026-3673](https://cve.now/CVE-2026-3673.md): Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer (CVSS 4.6, Frappe)
- [CVE-2026-6019](https://cve.now/CVE-2026-6019.md): BaseCookie.js\_output() does not neutralize embedded characters (CVSS 2.1, Python Software Foundation CPython)
- [CVE-2026-34062](https://cve.now/CVE-2026-34062.md): Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response (CVSS 5.3, nimiq network-libp2p)
- [CVE-2026-33471](https://cve.now/CVE-2026-33471.md): nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation (CVSS 9.6, nimiq-block)
- [CVE-2026-34413](https://cve.now/CVE-2026-34413.md): Xerte Online Toolkits Missing Authentication via connector.php (CVSS 8.8, thexerteproject xerteonlinetoolkits)
- [CVE-2026-34415](https://cve.now/CVE-2026-34415.md): Xerte Online Toolkits File Upload RCE via elfinder Connector (CVSS 9.3, thexerteproject xerteonlinetoolkits)
- [CVE-2026-34414](https://cve.now/CVE-2026-34414.md): Xerte Online Toolkits Path Traversal via connector.php (CVSS 7.1, thexerteproject xerteonlinetoolkits)
- [CVE-2026-41459](https://cve.now/CVE-2026-41459.md): Xerte Online Toolkits Path Disclosure via /setup (CVSS 6.9, thexerteproject xerteonlinetoolkits)
- [CVE-2026-28950](https://cve.now/CVE-2026-28950.md): A logging issue was addressed with improved data redaction. (CVSS 6.2, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2026-26354](https://cve.now/CVE-2026-26354.md): Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version (CVSS 8.1, Dell PowerProtect Data Domain)
- [CVE-2026-41468](https://cve.now/CVE-2026-41468.md): Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection (CVSS 9.3, Beghelli SicuroWeb)
- [CVE-2026-41469](https://cve.now/CVE-2026-41469.md): Beghelli Sicuro24 SicuroWeb Missing Content Security Policy (CVSS 5.1, Beghelli SicuroWeb)
- [CVE-2026-32885](https://cve.now/CVE-2026-32885.md): DDEV has ZipSlip path traversal in tar and zip archive extraction (CVSS 6.5, ddev · github.com/ddev/ddev)
- [CVE-2026-3254](https://cve.now/CVE-2026-3254.md): Improper Restriction of Rendered UI Layers or Frames in GitLab (CVSS 3.5, GitLab)
- [CVE-2026-4922](https://cve.now/CVE-2026-4922.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 8.1, GitLab)
- [CVE-2026-35381](https://cve.now/CVE-2026-35381.md): uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering (CVSS 3.3, Uutils coreutils · uu\_cut)
- [CVE-2026-35380](https://cve.now/CVE-2026-35380.md): uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing (CVSS 5.5, Uutils coreutils · coreutils)
- [CVE-2026-35379](https://cve.now/CVE-2026-35379.md): uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling (CVSS 3.3, Uutils coreutils · coreutils)
- [CVE-2026-35378](https://cve.now/CVE-2026-35378.md): uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions (CVSS 3.3, Uutils coreutils · coreutils)
- [CVE-2026-35377](https://cve.now/CVE-2026-35377.md): uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode (CVSS 3.3, Uutils coreutils · coreutils)
- [CVE-2026-35376](https://cve.now/CVE-2026-35376.md): uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition (CVSS 4.5, Uutils coreutils · coreutils)
- [CVE-2026-35375](https://cve.now/CVE-2026-35375.md): uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding (CVSS 3.3, Uutils coreutils · coreutils)
- [CVE-2026-35374](https://cve.now/CVE-2026-35374.md): uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition (CVSS 6.3, Uutils coreutils · coreutils)
- [CVE-2026-35373](https://cve.now/CVE-2026-35373.md): uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames (CVSS 3.3, Uutils coreutils · uu\_ln)
- [CVE-2026-35372](https://cve.now/CVE-2026-35372.md): uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag (CVSS 5.0, Uutils coreutils · coreutils)
- [CVE-2026-35371](https://cve.now/CVE-2026-35371.md): uutils coreutils id Misleading Identity Reporting in Pretty Print Mode (CVSS 3.3, Uutils coreutils · uu\_id)
- [CVE-2026-35370](https://cve.now/CVE-2026-35370.md): uutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membership (CVSS 4.4, Uutils coreutils · uu\_id)
- [CVE-2026-35369](https://cve.now/CVE-2026-35369.md): uutils coreutils kill System-wide Process Termination and Denial of Service via Argument Misinterpretation (CVSS 5.5, Uutils coreutils · uu\_kill)
- [CVE-2026-35368](https://cve.now/CVE-2026-35368.md): uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection (CVSS 7.2, Uutils coreutils · coreutils)
- [CVE-2026-35367](https://cve.now/CVE-2026-35367.md): uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions (CVSS 3.3, Uutils coreutils · coreutils)
- [CVE-2026-35366](https://cve.now/CVE-2026-35366.md): uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement (CVSS 4.4, Uutils coreutils · uu\_printenv)
- [CVE-2026-35365](https://cve.now/CVE-2026-35365.md): uutils coreutils mv Denial of Service and Data Duplication via Improper Symlink Expansion (CVSS 6.6, Uutils coreutils · uu\_mv)
- [CVE-2026-35364](https://cve.now/CVE-2026-35364.md): uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition (CVSS 6.3, Uutils coreutils · coreutils)
- [CVE-2026-35363](https://cve.now/CVE-2026-35363.md): uutils coreutils rm Safeguard Bypass via Improper Path Normalization (CVSS 5.6, Uutils coreutils · uu\_rm)
- [CVE-2026-35362](https://cve.now/CVE-2026-35362.md): uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module (CVSS 3.6, Uutils coreutils · uucore)
- [CVE-2026-35361](https://cve.now/CVE-2026-35361.md): uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems (CVSS 3.4, Uutils coreutils · uu\_mknod)
- [CVE-2026-35360](https://cve.now/CVE-2026-35360.md): uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition (CVSS 6.3, Uutils coreutils · coreutils)
- [CVE-2026-35359](https://cve.now/CVE-2026-35359.md): uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swap (CVSS 4.7, Uutils coreutils · coreutils)
- [CVE-2026-35358](https://cve.now/CVE-2026-35358.md): uutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream Reading (CVSS 4.4, Uutils coreutils · uu\_cp)
- [CVE-2026-35357](https://cve.now/CVE-2026-35357.md): uutils coreutils cp Information Disclosure via Permission Handling Race (CVSS 4.7, Uutils coreutils · coreutils)
- [CVE-2026-35356](https://cve.now/CVE-2026-35356.md): uutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Race (CVSS 6.3, Uutils coreutils · uu\_install)
- [CVE-2026-35355](https://cve.now/CVE-2026-35355.md): uutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Race (CVSS 6.3, Uutils coreutils · uu\_install)
- [CVE-2026-35354](https://cve.now/CVE-2026-35354.md): uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device (CVSS 4.7, Uutils coreutils · coreutils)
- [CVE-2026-35353](https://cve.now/CVE-2026-35353.md): uutils coreutils mkdir Permission Exposure Race Condition with -m (CVSS 3.3, Uutils coreutils · uu\_mkdir)
- [CVE-2026-35352](https://cve.now/CVE-2026-35352.md): uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition (CVSS 7.0, Uutils coreutils · coreutils)
- [CVE-2026-35351](https://cve.now/CVE-2026-35351.md): uutils coreutils mv Silent Ownership Loss in Cross-Device Operations (CVSS 4.2, Uutils coreutils · coreutils)
- [CVE-2026-35350](https://cve.now/CVE-2026-35350.md): uutils coreutils cp Unexpected Privileged Executable Creation with -p (CVSS 6.6, Uutils coreutils · coreutils)
- [CVE-2026-35349](https://cve.now/CVE-2026-35349.md): uutils coreutils Path-Based Safety Bypass with --preserve-root (CVSS 6.7, Uutils coreutils · uu\_rm)
- [CVE-2026-35348](https://cve.now/CVE-2026-35348.md): uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing (CVSS 5.5, Uutils coreutils · coreutils)
- [CVE-2026-35347](https://cve.now/CVE-2026-35347.md): uutils coreutils comm Silent Data Loss or Denial of Service via Improper Input Validation (CVSS 4.4, Uutils coreutils · uu\_comm)
- [CVE-2026-35346](https://cve.now/CVE-2026-35346.md): uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization (CVSS 3.3, Uutils coreutils · uu\_comm)
- [CVE-2026-35345](https://cve.now/CVE-2026-35345.md): uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race (CVSS 5.3, Uutils coreutils · coreutils)
- [CVE-2026-35344](https://cve.now/CVE-2026-35344.md): uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression (CVSS 3.3, Uutils coreutils · coreutils)
- [CVE-2026-35343](https://cve.now/CVE-2026-35343.md): uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters (CVSS 3.3, Uutils coreutils · uu\_cut)
- [CVE-2026-35342](https://cve.now/CVE-2026-35342.md): uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIR (CVSS 3.3, Uutils coreutils · uu\_mktemp)
- [CVE-2026-35341](https://cve.now/CVE-2026-35341.md): uutils coreutils mkfifo Unauthorized Permission Change on Existing Files (CVSS 7.1, Uutils coreutils · uu\_mkfifo)
- [CVE-2026-35340](https://cve.now/CVE-2026-35340.md): uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode (CVSS 5.5, Uutils coreutils)
- [CVE-2026-35339](https://cve.now/CVE-2026-35339.md): uutils coreutils chmod False Success Exit Code in Recursive Mode (CVSS 5.5, Uutils coreutils · uu\_chmod)
- [CVE-2026-35338](https://cve.now/CVE-2026-35338.md): uutils coreutils chmod Path Traversal Bypass of --preserve-root (CVSS 7.3, Uutils coreutils · uu\_chmod)
- [CVE-2025-0186](https://cve.now/CVE-2025-0186.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-3922](https://cve.now/CVE-2025-3922.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-6016](https://cve.now/CVE-2025-6016.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-9957](https://cve.now/CVE-2025-9957.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab)
- [CVE-2026-1660](https://cve.now/CVE-2026-1660.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-5262](https://cve.now/CVE-2026-5262.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab)
- [CVE-2026-5377](https://cve.now/CVE-2026-5377.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-5816](https://cve.now/CVE-2026-5816.md): Improper Resolution of Path Equivalence in GitLab (CVSS 8.0, GitLab)
- [CVE-2026-6515](https://cve.now/CVE-2026-6515.md): Insufficient Session Expiration in GitLab (CVSS 5.4, GitLab)
- [CVE-2025-58922](https://cve.now/CVE-2025-58922.md): WordPress Avada theme \< 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThemeFusion Avada)
- [CVE-2024-58344](https://cve.now/CVE-2024-58344.md): Carbon Forum 5.9.0 Persistent XSS via Forum Name Field (CVSS 5.1, 94Cb Carbon Forum)
- [CVE-2018-25272](https://cve.now/CVE-2018-25272.md): ELBA5 5.8.0 Remote Code Execution via Database Access (CVSS 9.3, ELBA5)
- [CVE-2018-25271](https://cve.now/CVE-2018-25271.md): Textpad 8.1.2 Denial of Service via Run Command (CVSS 6.9, Textpad)
- [CVE-2018-25270](https://cve.now/CVE-2018-25270.md): ThinkPHP 5.0.23 Remote Code Execution via invokefunction (CVSS 9.3, ThinkPHP)
- [CVE-2018-25269](https://cve.now/CVE-2018-25269.md): ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection (CVSS 5.1, ICEWARP Client)
- [CVE-2018-25268](https://cve.now/CVE-2018-25268.md): LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field (CVSS 8.6, Lizardsystems LanSpy)
- [CVE-2018-25267](https://cve.now/CVE-2018-25267.md): UltraISO 9.7.1.3519 Buffer Overflow via Output FileName (CVSS 6.9, UltraISO)
- [CVE-2018-25266](https://cve.now/CVE-2018-25266.md): Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow (CVSS 6.9, Angryip Angry IP Scanner)
- [CVE-2018-25265](https://cve.now/CVE-2018-25265.md): LanSpy 2.0.1.159 Local Buffer Overflow (CVSS 8.6, Lizardsystems LanSpy)
- [CVE-2018-25262](https://cve.now/CVE-2018-25262.md): Angry IP Scanner for Linux 3.5.3 Denial of Service (CVSS 6.9, Angryip Angry IP Scanner for Linux)
- [CVE-2018-25261](https://cve.now/CVE-2018-25261.md): Iperius Backup 5.8.1 Local Buffer Overflow SEH (CVSS 8.6, Iperiusbackup Iperius Backup)
- [CVE-2018-25260](https://cve.now/CVE-2018-25260.md): MAGIX Music Editor 3.1 Buffer Overflow via SEH (CVSS 8.6, MAGIX Music Editor)
- [CVE-2018-25259](https://cve.now/CVE-2018-25259.md): Terminal Services Manager 3.1 Buffer Overflow SEH (CVSS 8.6, Lizardsystems Terminal Services Manager)
- [CVE-2026-33611](https://cve.now/CVE-2026-33611.md): Insufficient validation of HTTPS and SVCB records (CVSS 6.5, PowerDNS Authoritative)
- [CVE-2026-33610](https://cve.now/CVE-2026-33610.md): Possible file descriptor exhaustion in forward-dnsupdate (CVSS 5.9, PowerDNS Authoritative)
- [CVE-2026-33609](https://cve.now/CVE-2026-33609.md): LDAP DN injection (CVSS 5.3, PowerDNS Authoritative)
- [CVE-2026-33608](https://cve.now/CVE-2026-33608.md): Incomplete domain name sanitization during (CVSS 7.4, PowerDNS Authoritative)
- [CVE-2026-31530](https://cve.now/CVE-2026-31530.md): cxl/port: Fix use after free of parent\_port in cxl\_detach\_ep() (no CVSS, Linux)
- [CVE-2026-31529](https://cve.now/CVE-2026-31529.md): cxl/region: Fix leakage in \_\_construct\_region() (no CVSS, Linux)
- [CVE-2026-31528](https://cve.now/CVE-2026-31528.md): perf: Make sure to use pmu\_ctx-\>pmu for groups (CVSS 7.8, Linux)
- [CVE-2026-31527](https://cve.now/CVE-2026-31527.md): driver core: platform: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-31526](https://cve.now/CVE-2026-31526.md): bpf: Fix exception exit lock checking for subprogs (no CVSS, Linux)
- [CVE-2026-31525](https://cve.now/CVE-2026-31525.md): bpf: Fix undefined behavior in interpreter sdiv/smod for INT\_MIN (CVSS 7.8, Linux)
- [CVE-2026-31524](https://cve.now/CVE-2026-31524.md): HID: asus: avoid memory leak in asus\_report\_fixup() (no CVSS, Linux)
- [CVE-2026-31523](https://cve.now/CVE-2026-31523.md): nvme-pci: ensure we're polling a polled queue (no CVSS, Linux)
- [CVE-2026-31522](https://cve.now/CVE-2026-31522.md): HID: magicmouse: avoid memory leak in magicmouse\_report\_fixup() (no CVSS, Linux)
- [CVE-2026-31521](https://cve.now/CVE-2026-31521.md): module: Fix kernel panic when a symbol st\_shndx is out of bounds (no CVSS, Linux)
- [CVE-2026-31520](https://cve.now/CVE-2026-31520.md): HID: apple: avoid memory leak in apple\_report\_fixup() (no CVSS, Linux)
- [CVE-2026-31519](https://cve.now/CVE-2026-31519.md): btrfs: set BTRFS\_ROOT\_ORPHAN\_CLEANUP during subvol create (no CVSS, Linux)
- [CVE-2026-31518](https://cve.now/CVE-2026-31518.md): esp: fix skb leak with espintcp and async crypto (no CVSS, Linux)
- [CVE-2026-31517](https://cve.now/CVE-2026-31517.md): xfrm: iptfs: fix skb\_put() panic on non-linear skb during reassembly (no CVSS, Linux)
- [CVE-2026-31516](https://cve.now/CVE-2026-31516.md): xfrm: prevent policy\_hthresh.work from racing with netns teardown (CVSS 7.8, Linux)
- [CVE-2026-31515](https://cve.now/CVE-2026-31515.md): af\_key: validate families in pfkey\_send\_migrate() (no CVSS, Linux)
- [CVE-2026-31514](https://cve.now/CVE-2026-31514.md): erofs: set fileio bio failed in short read case (no CVSS, Linux)
- [CVE-2026-31513](https://cve.now/CVE-2026-31513.md): Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap\_ecred\_conn\_req (CVSS 8.1, Linux)
- [CVE-2026-31512](https://cve.now/CVE-2026-31512.md): Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap\_ecred\_data\_rcv() (no CVSS, Linux)
- [CVE-2026-31511](https://cve.now/CVE-2026-31511.md): Bluetooth: MGMT: Fix dangling pointer on mgmt\_add\_adv\_patterns\_monitor\_complete (CVSS 7.8, Linux)
- [CVE-2026-31510](https://cve.now/CVE-2026-31510.md): Bluetooth: L2CAP: Fix null-ptr-deref on l2cap\_sock\_ready\_cb (no CVSS, Linux)
- [CVE-2026-31509](https://cve.now/CVE-2026-31509.md): nfc: nci: fix circular locking dependency in nci\_close\_device (no CVSS, Linux)
- [CVE-2026-31508](https://cve.now/CVE-2026-31508.md): net: openvswitch: Avoid releasing netdev before teardown completes (CVSS 7.8, Linux)
- [CVE-2026-31507](https://cve.now/CVE-2026-31507.md): net/smc: fix double-free of smc\_spd\_priv when tee() duplicates splice pipe buffer (CVSS 7.8, Linux)
- [CVE-2026-31506](https://cve.now/CVE-2026-31506.md): net: bcmasp: fix double free of WoL irq (no CVSS, Linux)
- [CVE-2026-31505](https://cve.now/CVE-2026-31505.md): iavf: fix out-of-bounds writes in iavf\_get\_ethtool\_stats() (CVSS 7.8, Linux)
- [CVE-2026-31504](https://cve.now/CVE-2026-31504.md): net: fix fanout UAF in packet\_release() via NETDEV\_UP race (CVSS 7.8, Linux)
- [CVE-2026-31503](https://cve.now/CVE-2026-31503.md): udp: Fix wildcard bind conflict check when using hash2 (no CVSS, Linux)
- [CVE-2026-31502](https://cve.now/CVE-2026-31502.md): team: fix header\_ops type confusion with non-Ethernet ports (CVSS 7.8, Linux)
- [CVE-2026-31501](https://cve.now/CVE-2026-31501.md): net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path (CVSS 9.8, Linux)
- [CVE-2026-31500](https://cve.now/CVE-2026-31500.md): Bluetooth: btintel: serialize btintel\_hw\_error() with hci\_req\_sync\_lock (no CVSS, Linux)
- [CVE-2026-31499](https://cve.now/CVE-2026-31499.md): Bluetooth: L2CAP: Fix deadlock in l2cap\_conn\_del() (no CVSS, Linux)
- [CVE-2026-31498](https://cve.now/CVE-2026-31498.md): Bluetooth: L2CAP: Fix ERTM re-init and zero pdu\_len infinite loop (no CVSS, Linux)
- [CVE-2026-31497](https://cve.now/CVE-2026-31497.md): Bluetooth: btusb: clamp SCO altsetting table indices (no CVSS, Linux)
- [CVE-2026-31496](https://cve.now/CVE-2026-31496.md): netfilter: nf\_conntrack\_expect: skip expectations in other netns via proc (no CVSS, Linux)
- [CVE-2026-31495](https://cve.now/CVE-2026-31495.md): netfilter: ctnetlink: use netlink policy range checks (no CVSS, Linux)
- [CVE-2026-31494](https://cve.now/CVE-2026-31494.md): net: macb: use the current queue number for stats (CVSS 7.8, Linux)
- [CVE-2026-31493](https://cve.now/CVE-2026-31493.md): RDMA/efa: Fix use of completion ctx after free (no CVSS, Linux)
- [CVE-2026-31492](https://cve.now/CVE-2026-31492.md): RDMA/irdma: Initialize free\_qp completion before using it (no CVSS, Linux)
- [CVE-2026-31491](https://cve.now/CVE-2026-31491.md): RDMA/irdma: Harden depth calculation functions (no CVSS, Linux)
- [CVE-2026-31490](https://cve.now/CVE-2026-31490.md): drm/xe/pf: Fix use-after-free in migration restore (CVSS 7.8, Linux)
- [CVE-2026-31489](https://cve.now/CVE-2026-31489.md): spi: meson-spicc: Fix double-put in remove path (no CVSS, Linux)
- [CVE-2026-31488](https://cve.now/CVE-2026-31488.md): drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVSS 7.8, Linux)
- [CVE-2026-31487](https://cve.now/CVE-2026-31487.md): spi: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-31486](https://cve.now/CVE-2026-31486.md): hwmon: (pmbus/core) Protect regulator operations with mutex (CVSS 7.1, Linux)
- [CVE-2026-31485](https://cve.now/CVE-2026-31485.md): spi: spi-fsl-lpspi: fix teardown order issue (UAF) (no CVSS, Linux)
- [CVE-2026-31484](https://cve.now/CVE-2026-31484.md): io\_uring/fdinfo: fix OOB read in SQE\_MIXED wrap check (CVSS 7.1, Linux)
- [CVE-2026-31483](https://cve.now/CVE-2026-31483.md): s390/syscalls: Add spectre boundary for syscall dispatch table (no CVSS, Linux)
- [CVE-2026-31482](https://cve.now/CVE-2026-31482.md): s390/entry: Scrub r12 register on kernel entry (no CVSS, Linux)
- [CVE-2026-31481](https://cve.now/CVE-2026-31481.md): tracing: Drain deferred trigger frees if kthread creation fails (no CVSS, Linux)
- [CVE-2026-31480](https://cve.now/CVE-2026-31480.md): tracing: Fix potential deadlock in cpu hotplug with osnoise (no CVSS, Linux)
- [CVE-2026-31479](https://cve.now/CVE-2026-31479.md): drm/xe: always keep track of remap prev/next (CVSS 7.8, Linux)
- [CVE-2026-31478](https://cve.now/CVE-2026-31478.md): ksmbd: replace hardcoded hdr2\_len with offsetof() in smb2\_calc\_max\_out\_buf\_len() (CVSS 9.8, Linux)
- [CVE-2026-31477](https://cve.now/CVE-2026-31477.md): ksmbd: fix memory leaks and NULL deref in smb2\_lock() (CVSS 7.5, Linux)
- [CVE-2026-31476](https://cve.now/CVE-2026-31476.md): ksmbd: do not expire session on binding failure (CVSS 8.2, Linux)
- [CVE-2026-31475](https://cve.now/CVE-2026-31475.md): ASoC: sma1307: fix double free of devm\_kzalloc() memory (CVSS 7.8, Linux)
- [CVE-2026-31474](https://cve.now/CVE-2026-31474.md): can: isotp: fix tx.buf use-after-free in isotp\_sendmsg() (CVSS 7.8, Linux)
- [CVE-2026-31473](https://cve.now/CVE-2026-31473.md): media: mc, v4l2: serialize REINIT and REQBUFS with req\_queue\_mutex (CVSS 7.8, Linux)
- [CVE-2026-31472](https://cve.now/CVE-2026-31472.md): xfrm: iptfs: validate inner IPv4 header length in IPTFS payload (no CVSS, Linux)
- [CVE-2026-31471](https://cve.now/CVE-2026-31471.md): xfrm: iptfs: only publish mode\_data after clone setup (CVSS 7.8, Linux)
- [CVE-2026-31470](https://cve.now/CVE-2026-31470.md): virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (CVSS 7.1, Linux)
- [CVE-2026-31469](https://cve.now/CVE-2026-31469.md): virtio\_net: Fix UAF on dst\_ops when IFF\_XMIT\_DST\_RELEASE is cleared and napi\_tx is false (CVSS 7.8, Linux)
- [CVE-2026-31468](https://cve.now/CVE-2026-31468.md): vfio/pci: Fix double free in dma-buf feature (CVSS 7.8, Linux)
- [CVE-2026-31467](https://cve.now/CVE-2026-31467.md): erofs: add GFP\_NOIO in the bio completion if needed (CVSS 7.5, Linux)
- [CVE-2026-31466](https://cve.now/CVE-2026-31466.md): mm/huge\_memory: fix folio isn't locked in softleaf\_to\_folio() (no CVSS, Linux)
- [CVE-2026-31465](https://cve.now/CVE-2026-31465.md): writeback: don't block sync for filesystems with no data integrity guarantees (no CVSS, Linux)
- [CVE-2026-31464](https://cve.now/CVE-2026-31464.md): scsi: ibmvfc: Fix OOB access in ibmvfc\_discover\_targets\_done() (CVSS 8.1, Linux)
- [CVE-2026-31463](https://cve.now/CVE-2026-31463.md): iomap: fix invalid folio access when i\_blkbits differs from I/O granularity (CVSS 9.8, Linux)
- [CVE-2026-31462](https://cve.now/CVE-2026-31462.md): drm/amdgpu: prevent immediate PASID reuse case (no CVSS, Linux)
- [CVE-2026-31461](https://cve.now/CVE-2026-31461.md): drm/amd/display: Fix drm\_edid leak in amdgpu\_dm (no CVSS, Linux)
- [CVE-2026-31460](https://cve.now/CVE-2026-31460.md): drm/amd/display: check if ext\_caps is valid in BL setup (no CVSS, Linux)
- [CVE-2026-31459](https://cve.now/CVE-2026-31459.md): mm/damon/sysfs: fix param\_ctx leak on damon\_sysfs\_new\_test\_ctx() failure (no CVSS, Linux)
- [CVE-2026-31458](https://cve.now/CVE-2026-31458.md): mm/damon/sysfs: check contexts-\>nr before accessing contexts\_arr\[0\] (no CVSS, Linux)
- [CVE-2026-31457](https://cve.now/CVE-2026-31457.md): mm/damon/sysfs: check contexts-\>nr in repeat\_call\_fn (no CVSS, Linux)
- [CVE-2026-31456](https://cve.now/CVE-2026-31456.md): mm/pagewalk: fix race between concurrent split and refault (no CVSS, Linux)
- [CVE-2026-31455](https://cve.now/CVE-2026-31455.md): xfs: stop reclaim before pushing AIL during unmount (no CVSS, Linux)
- [CVE-2026-31454](https://cve.now/CVE-2026-31454.md): xfs: save ailp before dropping the AIL lock in push callbacks (CVSS 7.8, Linux)
- [CVE-2026-31453](https://cve.now/CVE-2026-31453.md): xfs: avoid dereferencing log items after push callbacks (CVSS 7.8, Linux)
- [CVE-2026-31452](https://cve.now/CVE-2026-31452.md): ext4: convert inline data to extents when truncate exceeds inline size (no CVSS, Linux)
- [CVE-2026-31451](https://cve.now/CVE-2026-31451.md): ext4: replace BUG\_ON with proper error handling in ext4\_read\_inline\_folio (no CVSS, Linux)
- [CVE-2026-31450](https://cve.now/CVE-2026-31450.md): ext4: publish jinode after initialization (CVSS 8.8, Linux)
- [CVE-2026-31449](https://cve.now/CVE-2026-31449.md): ext4: validate p\_idx bounds in ext4\_ext\_correct\_indexes (CVSS 7.8, Linux)
- [CVE-2026-31448](https://cve.now/CVE-2026-31448.md): ext4: avoid infinite loops caused by residual data (CVSS 9.4, Linux)
- [CVE-2026-31447](https://cve.now/CVE-2026-31447.md): ext4: reject mount if bigalloc with s\_first\_data\_block != 0 (CVSS 7.8, Linux)
- [CVE-2026-31446](https://cve.now/CVE-2026-31446.md): ext4: fix use-after-free in update\_super\_work when racing with umount (CVSS 7.8, Linux)
- [CVE-2026-31445](https://cve.now/CVE-2026-31445.md): mm/damon/core: avoid use of half-online-committed context (no CVSS, Linux)
- [CVE-2026-31444](https://cve.now/CVE-2026-31444.md): ksmbd: fix use-after-free and NULL deref in smb\_grant\_oplock() (CVSS 9.8, Linux)
- [CVE-2026-31443](https://cve.now/CVE-2026-31443.md): dmaengine: idxd: Fix crash when the event log is disabled (no CVSS, Linux)
- [CVE-2026-31442](https://cve.now/CVE-2026-31442.md): dmaengine: idxd: Fix possible invalid memory access after FLR (CVSS 7.8, Linux)
- [CVE-2026-31441](https://cve.now/CVE-2026-31441.md): dmaengine: idxd: Fix memory leak when a wq is reset (no CVSS, Linux)
- [CVE-2026-31440](https://cve.now/CVE-2026-31440.md): dmaengine: idxd: Fix leaking event log memory (no CVSS, Linux)
- [CVE-2026-31439](https://cve.now/CVE-2026-31439.md): dmaengine: xilinx: xdma: Fix regmap init error handling (no CVSS, Linux)
- [CVE-2026-31438](https://cve.now/CVE-2026-31438.md): netfs: Fix kernel BUG in netfs\_limit\_iter() for ITER\_KVEC iterators (no CVSS, Linux)
- [CVE-2026-31437](https://cve.now/CVE-2026-31437.md): netfs: Fix NULL pointer dereference in netfs\_unbuffered\_write() on retry (no CVSS, Linux)
- [CVE-2026-31436](https://cve.now/CVE-2026-31436.md): dmaengine: idxd: fix possible wrong descriptor completion in llist\_abort\_desc() (CVSS 9.8, Linux)
- [CVE-2026-31435](https://cve.now/CVE-2026-31435.md): netfs: Fix read abandonment during retry (CVSS 8.8, Linux)
- [CVE-2026-31434](https://cve.now/CVE-2026-31434.md): btrfs: fix leak of kobject name for sub-group space\_info (no CVSS, Linux)
- [CVE-2026-33593](https://cve.now/CVE-2026-33593.md): Denial of service via crafted DNSCrypt query (CVSS 7.5, PowerDNS DNSdist)
- [CVE-2026-33594](https://cve.now/CVE-2026-33594.md): Outgoing DoH excessive memory allocation (CVSS 5.3, PowerDNS DNSdist)
- [CVE-2026-33595](https://cve.now/CVE-2026-33595.md): DoQ/DoH3 excessive memory allocation (CVSS 5.3, PowerDNS DNSdist)
- [CVE-2026-33597](https://cve.now/CVE-2026-33597.md): PRSD detection denial of service (CVSS 3.7, PowerDNS DNSdist)
- [CVE-2026-33596](https://cve.now/CVE-2026-33596.md): TCP backend stream ID overflow (CVSS 3.1, PowerDNS DNSdist)
- [CVE-2026-33598](https://cve.now/CVE-2026-33598.md): Out-of-bounds read in cache inspection via Lua (CVSS 4.8, PowerDNS DNSdist)
- [CVE-2026-33599](https://cve.now/CVE-2026-33599.md): Out-of-bounds read in service discovery (CVSS 3.1, PowerDNS DNSdist)
- [CVE-2026-6862](https://cve.now/CVE-2026-6862.md): Efivar: efivar: denial of service due to stack overflow in device path node parsing (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-33602](https://cve.now/CVE-2026-33602.md): Off-by-one access when processing crafted UDP responses (CVSS 6.5, PowerDNS DNSdist)
- [CVE-2026-33254](https://cve.now/CVE-2026-33254.md): Resource exhaustion via DoQ/DoH3 connections (CVSS 5.3, PowerDNS DNSdist)
- [CVE-2026-6861](https://cve.now/CVE-2026-6861.md): Emacs: emacs: memory corruption vulnerability when processing svg css (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-5750](https://cve.now/CVE-2026-5750.md): Insecure direct object reference (IDOR) vulnerability in Fullstep (CVSS 7.6, Fullstep)
- [CVE-2026-5749](https://cve.now/CVE-2026-5749.md): Inadequate access control vulnerability in Fullstep (CVSS 8.7, Fullstep)
- [CVE-2026-6356](https://cve.now/CVE-2026-6356.md): CVE-2026-6356 (CVSS 9.6, Augmentt)
- [CVE-2026-6355](https://cve.now/CVE-2026-6355.md): CVE-2026-6355 (CVSS 6.5, Augmentt)
- [CVE-2026-41651](https://cve.now/CVE-2026-41651.md): PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root (CVSS 8.8, PackageKit)
- [CVE-2026-6859](https://cve.now/CVE-2026-6859.md): Instructlab: instructlab: arbitrary code execution due to hardcoded \`trust\_remote\_code=true\` (CVSS 8.8, Red Hat Enterprise Linux AI (RHEL AI) · instructlab)
- [CVE-2026-0539](https://cve.now/CVE-2026-0539.md): Local Privilege Escalation in pcvisit service client (CVSS 8.5, pcvisit Remote Host Modul)
- [CVE-2026-6857](https://cve.now/CVE-2026-6857.md): Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization (CVSS 7.5, camel-infinispan · Red Hat build of Apache Camel 4.18.1… +5)
- [CVE-2026-6855](https://cve.now/CVE-2026-6855.md): Instructlab: instructlab: path traversal allows arbitrary directory creation and file write (CVSS 7.1, Red Hat Enterprise Linux AI (RHEL AI) · instructlab)
- [CVE-2026-33262](https://cve.now/CVE-2026-33262.md): Insufficient validation of cookie reply (CVSS 5.9, PowerDNS Recursor)
- [CVE-2026-33261](https://cve.now/CVE-2026-33261.md): Null pointer accces in aggressive NSEC(3) cache (CVSS 5.9, PowerDNS Recursor)
- [CVE-2026-33260](https://cve.now/CVE-2026-33260.md): Insufficient input validation of internal webserver (CVSS 5.3, PowerDNS Authoritative · PowerDNS DNSdist +1)
- [CVE-2026-33259](https://cve.now/CVE-2026-33259.md): Concurrent modification of RPZ data can lead to denial of servce (CVSS 5.0, PowerDNS Recursor)
- [CVE-2026-33258](https://cve.now/CVE-2026-33258.md): Crafted zones can cause increased resource usage (CVSS 5.3, PowerDNS Recursor)
- [CVE-2026-33257](https://cve.now/CVE-2026-33257.md): Insufficient input validation of internal webserver (CVSS 5.3, PowerDNS Authoritative · PowerDNS DNSdist +1)
- [CVE-2026-33256](https://cve.now/CVE-2026-33256.md): Unbounded memory allocation by internal web server (CVSS 5.3, PowerDNS Recursor)
- [CVE-2026-33601](https://cve.now/CVE-2026-33601.md): Insufficient validation of zonemd record (CVSS 4.4, PowerDNS Recursor)
- [CVE-2026-33600](https://cve.now/CVE-2026-33600.md): Null pointer dereference in RPZ transfer (CVSS 4.4, PowerDNS Recursor)
- [CVE-2026-1913](https://cve.now/CVE-2026-1913.md): Gallagher Website Design \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute (CVSS 6.4, gallagherwebsitedesign Gallagher Website Design)
- [CVE-2026-1395](https://cve.now/CVE-2026-1395.md): Gutentools \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes (CVSS 6.4, Gutentools)
- [CVE-2026-1930](https://cve.now/CVE-2026-1930.md): Emailchef \<= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion (CVSS 4.3, hanicker Emailchef)
- [CVE-2026-6848](https://cve.now/CVE-2026-6848.md): Quay: red hat quay: authentication bypass allows privileged actions without valid credentials (CVSS 5.4, Red Hat Quay)
- [CVE-2026-6846](https://cve.now/CVE-2026-6846.md): Binutils: binutils: arbitrary code execution via malformed xcoff object file processing (CVSS 7.8, binutils · Red Hat Hardened Images +2)
- [CVE-2026-6844](https://cve.now/CVE-2026-6844.md): Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-6843](https://cve.now/CVE-2026-6843.md): Nano: nano: format string vulnerability leads to denial of service (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-31433](https://cve.now/CVE-2026-31433.md): ksmbd: fix potencial OOB in get\_file\_all\_info() for compound requests (CVSS 8.8, Linux)
- [CVE-2026-31432](https://cve.now/CVE-2026-31432.md): ksmbd: fix OOB write in QUERY\_INFO for compound requests (CVSS 8.8, Linux)
- [CVE-2026-31431](https://cve.now/CVE-2026-31431.md): crypto: algif\_aead - Revert to operating out-of-place (CVSS 7.8, KEV, Linux)
- [CVE-2026-6845](https://cve.now/CVE-2026-6845.md): Binutils: binutils: denial of service via crafted elf file (CVSS 5.0, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-4353](https://cve.now/CVE-2026-4353.md): CI HUB Connector \<= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, cihubconnector CI HUB Connector)
- [CVE-2026-4138](https://cve.now/CVE-2026-4138.md): DX Unanswered Comments \<= 1.7 - Cross-Site Request Forgery via Settings Update (CVSS 4.3, nofearinc DX Unanswered Comments)
- [CVE-2026-6294](https://cve.now/CVE-2026-6294.md): Google PageRank Display \<= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page (CVSS 4.3, byybora Google PageRank Display)
- [CVE-2026-6236](https://cve.now/CVE-2026-6236.md): Posts map \<= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (CVSS 6.4, lucdecri Posts map)
- [CVE-2026-4117](https://cve.now/CVE-2026-4117.md): CalJ \<= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action (CVSS 5.3, CalJ Shabbat Times)
- [CVE-2026-4119](https://cve.now/CVE-2026-4119.md): Create DB Tables \<= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php (CVSS 9.1, jppreus Create DB Tables)
- [CVE-2026-4132](https://cve.now/CVE-2026-4132.md): HTTP Headers \<= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh\_htpasswd\_path' and 'hh\_www\_authenticate\_user' Parameters (CVSS 7.2, zinoui HTTP Headers)
- [CVE-2026-2719](https://cve.now/CVE-2026-2719.md): Private WP suite \<= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting (CVSS 4.4, fpoller Private WP suite)
- [CVE-2026-4121](https://cve.now/CVE-2026-4121.md): Kcaptcha \<= 1.0.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, ksolves Kcaptcha)
- [CVE-2026-5748](https://cve.now/CVE-2026-5748.md): Text Snippets \<= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute (CVSS 6.4, snedled Text Snippets)
- [CVE-2026-4074](https://cve.now/CVE-2026-4074.md): Quran Live Multilanguage \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, karim42 Quran Live Multilanguage)
- [CVE-2026-4085](https://cve.now/CVE-2026-4085.md): Easy Social Photos Gallery \<= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper\_class' Shortcode Attribute (CVSS 6.4, maltathemes Easy Social Photos Gallery – MIF)
- [CVE-2026-6246](https://cve.now/CVE-2026-6246.md): Simple Random Posts Shortcode \<= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container\_right\_width' Shortcode Attribute (CVSS 6.4, mkerstner Simple Random Posts Shortcode)
- [CVE-2026-4142](https://cve.now/CVE-2026-4142.md): Sentence To SEO (keywords, description and tags) \<= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' Field (CVSS 4.4, eazyserver Sentence To SEO)
- [CVE-2026-6235](https://cve.now/CVE-2026-6235.md): Sendmachine for WordPress \<= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage\_admin\_requests (CVSS 9.8, Sendmachine for WordPress)
- [CVE-2026-4090](https://cve.now/CVE-2026-4090.md): Inquiry cart \<= 3.4.2 - Cross-Site Request Forgery via Settings Form (CVSS 6.1, ravster Inquiry cart)
- [CVE-2026-2717](https://cve.now/CVE-2026-2717.md): HTTP Headers \<= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values (CVSS 5.5, zinoui HTTP Headers)
- [CVE-2026-4118](https://cve.now/CVE-2026-4118.md): Call To Action Plugin \<= 3.1.3 - Cross-Site Request Forgery via Settings Update (CVSS 4.3, tmarek Call To Action Plugin)
- [CVE-2026-4139](https://cve.now/CVE-2026-4139.md): mCatFilter \<= 0.5.2 - Cross-Site Request Forgery via compute\_post() Function (CVSS 4.3, chsxf mCatFilter)
- [CVE-2026-4125](https://cve.now/CVE-2026-4125.md): WPMK Block \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, wpmkorg WPMK Block)
- [CVE-2026-4128](https://cve.now/CVE-2026-4128.md): TP Restore Categories And Taxonomies \<= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt\_delete\_term' AJAX Action (CVSS 4.3, tplugins TP Restore Categories And Taxonomies)
- [CVE-2026-5767](https://cve.now/CVE-2026-5767.md): SlideShowPro SC \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute (CVSS 6.4, luetkemj SlideShowPro SC)
- [CVE-2026-4089](https://cve.now/CVE-2026-4089.md): Twittee Text Tweet \<= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, johnnie2u Twittee Text Tweet)
- [CVE-2026-3362](https://cve.now/CVE-2026-3362.md): Short Comment Filter \<= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting (CVSS 4.4, itsananderson Short Comment Filter)
- [CVE-2026-6396](https://cve.now/CVE-2026-6396.md): Fast & Fancy Filter – 3F \<= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff\_save\_settins AJAX Action (CVSS 4.3, webarea Fast & Fancy Filter –)
- [CVE-2026-4280](https://cve.now/CVE-2026-4280.md): Breaking News WP \<= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read (CVSS 6.5, doctorwp Breaking News WP)
- [CVE-2026-4140](https://cve.now/CVE-2026-4140.md): Ni WooCommerce Order Export \<= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni\_order\_export\_action AJAX Action (CVSS 4.3, anzia Ni WooCommerce Order Export)
- [CVE-2026-4133](https://cve.now/CVE-2026-4133.md): TextP2P Texting Widget \<= 1.7 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, TextP2P Texting Widget)
- [CVE-2026-4076](https://cve.now/CVE-2026-4076.md): Slider Bootstrap Carousel \<= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, felipermendes Slider Bootstrap Carousel)
- [CVE-2026-4126](https://cve.now/CVE-2026-4126.md): Table Manager \<= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute (CVSS 4.3, primisdigital Table Manager)
- [CVE-2026-2714](https://cve.now/CVE-2026-2714.md): Institute Management \<= 5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Enquiry Form Title' Setting (CVSS 4.4, weblizar Institute Management – Learning Management System)
- [CVE-2026-4088](https://cve.now/CVE-2026-4088.md): Switch CTA Box \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpshouter Switch CTA Box)
- [CVE-2026-1845](https://cve.now/CVE-2026-1845.md): Real Estate Pro \<= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings (CVSS 5.5, bhubbard Real Estate Pro)
- [CVE-2026-6041](https://cve.now/CVE-2026-6041.md): Buzz Comments \<= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting (CVSS 4.4, mixer2 Buzz Comments)
- [CVE-2026-4131](https://cve.now/CVE-2026-4131.md): WP Responsive Popup + Optin \<= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo\_image\_url' Parameter (CVSS 6.1, sphex1987 WP Responsive Popup + Optin)
- [CVE-2026-4082](https://cve.now/CVE-2026-4082.md): ER Swiffy Insert \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, erithq ER Swiffy Insert)
- [CVE-2026-4279](https://cve.now/CVE-2026-4279.md): Bread & Butter: Content Gating for Verified Leads \<= 8.2.0.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, breadbutter Bread & Butter: AI-Powered Lead Intelligence)
- [CVE-2026-1379](https://cve.now/CVE-2026-1379.md): HTTP Headers \<= 1.19.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting (CVSS 4.4, zinoui HTTP Headers)
- [CVE-2026-5820](https://cve.now/CVE-2026-5820.md): Zypento Blocks \<= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block (CVSS 6.4, sproutient Zypento Blocks)
- [CVE-2026-6842](https://cve.now/CVE-2026-6842.md): Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions (CVSS 2.5, nano · Red Hat Enterprise Linux +1)
- [CVE-2026-6023](https://cve.now/CVE-2026-6023.md): Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1, Progress Software Telerik UI for ASP.NET AJAX)
- [CVE-2026-6022](https://cve.now/CVE-2026-6022.md): Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5, Progress Software Telerik UI for ASP.NET AJAX)
- [CVE-2026-40542](https://cve.now/CVE-2026-40542.md): Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification (CVSS 7.3, Apache Software Foundation Apache HttpClient · org.apache.h…)
- [CVE-2026-6840](https://cve.now/CVE-2026-6840.md): Missing bounds validation for operator could allow out of range operator-code lookup during model loading Affected version is prior to comm (CVSS 5.5, Samsung Open Source ONE)
- [CVE-2026-6839](https://cve.now/CVE-2026-6839.md): Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor i (CVSS 6.6, Samsung Open Source ONE)
- [CVE-2026-41667](https://cve.now/CVE-2026-41667.md): Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant (CVSS 6.6, Samsung Open Source ONE)
- [CVE-2026-41666](https://cve.now/CVE-2026-41666.md): Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagation (CVSS 6.6, Samsung Open Source ONE)
- [CVE-2026-41665](https://cve.now/CVE-2026-41665.md): Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for larg (CVSS 6.1, Samsung Open Source ONE)
- [CVE-2026-41664](https://cve.now/CVE-2026-41664.md): Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes (CVSS 6.6, Samsung Open Source ONE)
- [CVE-2026-40450](https://cve.now/CVE-2026-40450.md): Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption f (CVSS 6.6, Samsung Open Source ONE)
- [CVE-2026-40449](https://cve.now/CVE-2026-40449.md): Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source O (CVSS 6.6, Samsung Open Source ONE)
- [CVE-2026-40448](https://cve.now/CVE-2026-40448.md): Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung O (CVSS 5.3, Samsung Open Source ONE)
- [CVE-2026-22754](https://cve.now/CVE-2026-22754.md): ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules (CVSS 7.5, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22753](https://cve.now/CVE-2026-22753.md): Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers (CVSS 7.5, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22748](https://cve.now/CVE-2026-22748.md): Potential Security Misconfiguration when Using withIssuerLocation (CVSS 5.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22747](https://cve.now/CVE-2026-22747.md): Unauthorized User Impersonation when Using X.509 Client Certificates (CVSS 6.8, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22746](https://cve.now/CVE-2026-22746.md): User Attribute Enumeration when Using DaoAuthenticationProvider (CVSS 3.7, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-40451](https://cve.now/CVE-2026-40451.md): DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to e (CVSS 6.1, DeepL Chrome browser extension)
- [CVE-2026-6835](https://cve.now/CVE-2026-6835.md): aEnrich｜a+HCM - Arbitrary File Upload (CVSS 5.1, aEnrich a+HCM)
- [CVE-2026-6834](https://cve.now/CVE-2026-6834.md): aEnrich｜a+HRD - Missing Authorization (CVSS 7.1, aEnrich a+HRD)
- [CVE-2026-6833](https://cve.now/CVE-2026-6833.md): aEnrich｜a+HRD - SQL Injection (CVSS 7.1, aEnrich a+HRD)
- [CVE-2026-6386](https://cve.now/CVE-2026-6386.md): Missing large page handling in pmap\_pkru\_update\_range() (CVSS 6.2, FreeBSD)
- [CVE-2026-5398](https://cve.now/CVE-2026-5398.md): Kernel use-after-free bug in the TIOCNOTTY handler (CVSS 8.4, FreeBSD)
- [CVE-2026-6408](https://cve.now/CVE-2026-6408.md): Tanium addressed an information disclosure vulnerability in Tanium Server. (CVSS 2.7, Tanium Server)
- [CVE-2026-6392](https://cve.now/CVE-2026-6392.md): Tanium addressed an information disclosure vulnerability in Threat Response. (CVSS 2.7, Tanium Threat Response)
- [CVE-2026-41458](https://cve.now/CVE-2026-41458.md): OwnTone Server \< 29.1 Race Condition DoS via DAAP Login (CVSS 8.2, owntone-server)
- [CVE-2026-6416](https://cve.now/CVE-2026-6416.md): Tanium addressed an uncontrolled resource consumption vulnerability in Interact. (CVSS 2.7, Tanium Interact)
- [CVE-2026-41457](https://cve.now/CVE-2026-41457.md): OwnTone Server \< 29.1 SQL Injection via query and filter Parameters (CVSS 6.9, owntone-server)
- [CVE-2026-41146](https://cve.now/CVE-2026-41146.md): facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition (CVSS 8.7, boazsegev facil.io · boazsegev iodine +1)
- [CVE-2026-41145](https://cve.now/CVE-2026-41145.md): MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads (CVSS 8.8, minio · github.com/minio/minio)
- [CVE-2026-40344](https://cve.now/CVE-2026-40344.md): MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads (CVSS 8.8, minio · github.com/minio/minio)
- [CVE-2026-30139](https://cve.now/CVE-2026-30139.md): A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows atta (CVSS 6.1, org.silverpeas.core:silverpeas-core-war · org.silverpeas.co…)
- [CVE-2026-31192](https://cve.now/CVE-2026-31192.md): Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitiv (CVSS 6.5)
- [CVE-2026-35548](https://cve.now/CVE-2026-35548.md): An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). (CVSS 8.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.