# CVEs published 2026-04-23

183 CVEs were published on April 23, 2026: 42 critical, 55 high. Days are UTC.

- [CVE-2026-40623](https://cve.now/CVE-2026-40623.md): SenseLive X3050 Missing Authorization (CVSS 7.2, SenseLive X3050)
- [CVE-2026-29050](https://cve.now/CVE-2026-29050.md): melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline\[\].uses (CVSS 6.1, chainguard-dev melange · chainguard.dev/melange)
- [CVE-2026-40431](https://cve.now/CVE-2026-40431.md): SenseLive X3050 Cleartext transmission of sensitive information (CVSS 6.9, SenseLive X3050)
- [CVE-2026-27843](https://cve.now/CVE-2026-27843.md): SenseLive X3050 Missing authentication for critical function (CVSS 9.2, SenseLive X3050)
- [CVE-2026-39462](https://cve.now/CVE-2026-39462.md): SenseLive X3050 Insufficiently Protected Credentials (CVSS 9.3, SenseLive X3050)
- [CVE-2026-35503](https://cve.now/CVE-2026-35503.md): SenseLive X3050 Use of Hard-coded Credentials (CVSS 9.3, SenseLive X3050)
- [CVE-2026-25720](https://cve.now/CVE-2026-25720.md): SenseLive X3050 Insufficient session expiration (CVSS 6.9, SenseLive X3050)
- [CVE-2026-40630](https://cve.now/CVE-2026-40630.md): SenseLive X3050 Authentication bypass using an alternate path or channel (CVSS 9.3, SenseLive X3050)
- [CVE-2026-1789](https://cve.now/CVE-2026-1789.md): A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive information on the device vi (CVSS 4.9, Canon imagePRESS Series · Canon imageFORCE Series +13)
- [CVE-2026-29197](https://cve.now/CVE-2026-29197.md): In versions \<8.4.0, \<8.3.2, \<8.2.2, \<8.1.3, \<8.0.4, \<7.13.6, \<7.12.7, \<7.11.7, and \<7.10.10, the endpoints /api/apps/logs and /api/apps/:id/ (CVSS 4.3, Rocket.Chat)
- [CVE-2026-6732](https://cve.now/CVE-2026-6732.md): Libxml2: libxml2: denial of service via crafted xsd-validated document (CVSS 6.5, Red Hat Hardened Images · Red Hat Enterprise Linux +2)
- [CVE-2026-41361](https://cve.now/CVE-2026-41361.md): OpenClaw \< 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use Ranges (CVSS 5.1, OpenClaw)
- [CVE-2026-41360](https://cve.now/CVE-2026-41360.md): OpenClaw \< 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding (CVSS 5.4, OpenClaw)
- [CVE-2026-41359](https://cve.now/CVE-2026-41359.md): OpenClaw \< 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence (CVSS 7.1, OpenClaw)
- [CVE-2026-41358](https://cve.now/CVE-2026-41358.md): OpenClaw \< 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context (CVSS 2.3, OpenClaw)
- [CVE-2026-41357](https://cve.now/CVE-2026-41357.md): OpenClaw \< 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backends (CVSS 2.0, OpenClaw)
- [CVE-2026-41356](https://cve.now/CVE-2026-41356.md): OpenClaw \< 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate (CVSS 2.3, OpenClaw)
- [CVE-2026-41355](https://cve.now/CVE-2026-41355.md): OpenClaw \< 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversion (CVSS 5.4, OpenClaw)
- [CVE-2026-41354](https://cve.now/CVE-2026-41354.md): OpenClaw \< 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys (CVSS 6.3, OpenClaw)
- [CVE-2026-41353](https://cve.now/CVE-2026-41353.md): OpenClaw \< 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection (CVSS 7.6, OpenClaw)
- [CVE-2026-41352](https://cve.now/CVE-2026-41352.md): OpenClaw \< 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass (CVSS 7.7, OpenClaw)
- [CVE-2026-41351](https://cve.now/CVE-2026-41351.md): OpenClaw \< 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encoding (CVSS 6.3, OpenClaw)
- [CVE-2026-41350](https://cve.now/CVE-2026-41350.md): OpenClaw \< 2026.3.31 - Session Visibility Bypass via session\_status in Unsandboxed Invocations (CVSS 5.3, OpenClaw)
- [CVE-2026-41349](https://cve.now/CVE-2026-41349.md): OpenClaw \< 2026.3.28 - Agentic Consent Bypass via config.patch (CVSS 8.7, OpenClaw)
- [CVE-2026-41348](https://cve.now/CVE-2026-41348.md): OpenClaw \< 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands (CVSS 2.3, OpenClaw)
- [CVE-2026-41347](https://cve.now/CVE-2026-41347.md): OpenClaw \< 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints (CVSS 2.3, OpenClaw)
- [CVE-2026-41346](https://cve.now/CVE-2026-41346.md): OpenClaw 2026.2.26 \< 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement (CVSS 6.3, OpenClaw)
- [CVE-2026-41345](https://cve.now/CVE-2026-41345.md): OpenClaw \< 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download (CVSS 6.0, OpenClaw)
- [CVE-2026-41344](https://cve.now/CVE-2026-41344.md): OpenClaw \< 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter (CVSS 5.3, OpenClaw)
- [CVE-2026-41343](https://cve.now/CVE-2026-41343.md): OpenClaw \< 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency (CVSS 6.9, OpenClaw)
- [CVE-2026-41342](https://cve.now/CVE-2026-41342.md): OpenClaw \< 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding (CVSS 7.4, OpenClaw)
- [CVE-2026-41341](https://cve.now/CVE-2026-41341.md): OpenClaw \< 2026.3.31 - Component Interaction Misclassification in Discord Extension (CVSS 2.3, OpenClaw)
- [CVE-2026-41340](https://cve.now/CVE-2026-41340.md): OpenClaw \< 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration (CVSS 6.3, OpenClaw)
- [CVE-2026-41339](https://cve.now/CVE-2026-41339.md): OpenClaw \< 2026.4.2 - Information Disclosure via Gateway Connect Snapshot (CVSS 5.3, OpenClaw)
- [CVE-2026-41338](https://cve.now/CVE-2026-41338.md): OpenClaw \< 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations (CVSS 4.3, OpenClaw)
- [CVE-2026-41337](https://cve.now/CVE-2026-41337.md): OpenClaw \< 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay (CVSS 6.3, OpenClaw)
- [CVE-2026-41336](https://cve.now/CVE-2026-41336.md): OpenClaw \< 2026.3.31 - Arbitrary Hook Code Execution via OPENCLAW\_BUNDLED\_HOOKS\_DIR Environment Variable Override (CVSS 8.5, OpenClaw)
- [CVE-2026-41335](https://cve.now/CVE-2026-41335.md): OpenClaw \< 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON (CVSS 6.9, OpenClaw)
- [CVE-2026-41334](https://cve.now/CVE-2026-41334.md): OpenClaw \< 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass (CVSS 7.1, OpenClaw)
- [CVE-2026-41333](https://cve.now/CVE-2026-41333.md): OpenClaw \< 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken (CVSS 6.3, OpenClaw)
- [CVE-2026-41332](https://cve.now/CVE-2026-41332.md): OpenClaw \< 2026.3.28 - Code Execution via Missing Environment Variable Blocklist (CVSS 5.8, OpenClaw)
- [CVE-2026-2708](https://cve.now/CVE-2026-2708.md): Libsoup: libsoup: http request smuggling via duplicate content-length headers (CVSS 3.7, Red Hat Enterprise Linux)
- [CVE-2026-32172](https://cve.now/CVE-2026-32172.md): Microsoft Power Apps Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Power Apps)
- [CVE-2026-35431](https://cve.now/CVE-2026-35431.md): Microsoft Entra ID Entitlement Management Spoofing Vulnerability (CVSS 10.0, Microsoft Entra)
- [CVE-2026-24303](https://cve.now/CVE-2026-24303.md): Microsoft Partner Center Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Partner Center)
- [CVE-2026-26150](https://cve.now/CVE-2026-26150.md): Microsoft Purview eDiscovery Elevation of Privilege Vulnerability (CVSS 8.6, Microsoft Purview eDiscovery)
- [CVE-2026-33819](https://cve.now/CVE-2026-33819.md): Microsoft Bing Remote Code Execution Vulnerability (CVSS 10.0, Microsoft Bing)
- [CVE-2026-33102](https://cve.now/CVE-2026-33102.md): Microsoft 365 Copilot Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft 365 Copilot)
- [CVE-2026-32210](https://cve.now/CVE-2026-32210.md): Microsoft Dynamics 365 (online) Spoofing Vulnerability (CVSS 9.3, Microsoft Dynamics)
- [CVE-2026-26210](https://cve.now/CVE-2026-26210.md): KTransformers Unsafe Deserialization RCE via balance\_serve (CVSS 9.3, kvcache-ai ktransformers)
- [CVE-2026-41274](https://cve.now/CVE-2026-41274.md): Flowise: Cypher Injection in GraphCypherQAChain (CVSS 9.3, FlowiseAI Flowise · FlowiseAI flowise-components +2)
- [CVE-2026-28525](https://cve.now/CVE-2026-28525.md): SWUpdate Integer Underflow in Multipart Upload Parser (CVSS 8.2, sbabic swupdate)
- [CVE-2026-6942](https://cve.now/CVE-2026-6942.md): radare2-mcp \<=1.6.0 OS Command Injection via Shell Metacharacter Bypass (CVSS 9.3, radareorg radare2-mcp)
- [CVE-2026-6941](https://cve.now/CVE-2026-6941.md): radare2 \< 6.1.4 Project Notes Path Traversal via Symlink (CVSS 6.9, radareorg radare2)
- [CVE-2026-6940](https://cve.now/CVE-2026-6940.md): radare2 \< 6.1.4 Project Deletion Path Traversal Directory Deletion (CVSS 6.9, radareorg radare2)
- [CVE-2026-6376](https://cve.now/CVE-2026-6376.md): Missing authentication for critical function in SpiceJet Online Booking System (CVSS 8.7, SpiceJet Online Booking System)
- [CVE-2026-6375](https://cve.now/CVE-2026-6375.md): Authorization bypass through User-Controlled key in SpiceJet Online Booking System (CVSS 8.7, SpiceJet Online Booking System)
- [CVE-2026-41264](https://cve.now/CVE-2026-41264.md): Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability (CVSS 9.2, FlowiseAI Flowise · flowise +1)
- [CVE-2026-41265](https://cve.now/CVE-2026-41265.md): Flowise: Airtable\_Agent Code Injection Remote Code Execution Vulnerability (CVSS 9.2, FlowiseAI Flowise · flowise +1)
- [CVE-2026-41279](https://cve.now/CVE-2026-41279.md): Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials (CVSS 8.2, FlowiseAI Flowise · flowise)
- [CVE-2026-41278](https://cve.now/CVE-2026-41278.md): Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs (CVSS 8.7, FlowiseAI Flowise · flowise)
- [CVE-2026-41276](https://cve.now/CVE-2026-41276.md): Flowise: AccountService resetPassword Authentication Bypass Vulnerability (CVSS 7.7, FlowiseAI Flowise · flowise)
- [CVE-2026-41277](https://cve.now/CVE-2026-41277.md): Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) (CVSS 7.6, FlowiseAI Flowise · flowise)
- [CVE-2026-25874](https://cve.now/CVE-2026-25874.md): LeRobot Unsafe Deserialization Remote Code Execution via gRPC (CVSS 9.3, Hugging Face LeRobot)
- [CVE-2026-41275](https://cve.now/CVE-2026-41275.md): Flowise: Password Reset Link Sent Over Unsecured HTTP (CVSS 7.5, FlowiseAI Flowise · flowise)
- [CVE-2026-41273](https://cve.now/CVE-2026-41273.md): Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow (CVSS 7.7, FlowiseAI Flowise · flowise)
- [CVE-2026-41271](https://cve.now/CVE-2026-41271.md): Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains (CVSS 7.1, FlowiseAI Flowise · FlowiseAI flowise-components +2)
- [CVE-2026-41272](https://cve.now/CVE-2026-41272.md): Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) (CVSS 7.1, FlowiseAI Flowise · FlowiseAI flowise-components +2)
- [CVE-2026-41270](https://cve.now/CVE-2026-41270.md): Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox (CVSS 7.1, FlowiseAI Flowise · FlowiseAI flowise-components +2)
- [CVE-2026-41269](https://cve.now/CVE-2026-41269.md): Flowise: File Upload Validation Bypass in createAttachment (CVSS 7.1, FlowiseAI Flowise · flowise)
- [CVE-2026-41268](https://cve.now/CVE-2026-41268.md): Flowise: Flowise Parameter Override Bypass Remote Command Execution (CVSS 7.7, FlowiseAI Flowise · flowise +1)
- [CVE-2026-41267](https://cve.now/CVE-2026-41267.md): Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association (CVSS 8.1, FlowiseAI Flowise · flowise)
- [CVE-2026-41266](https://cve.now/CVE-2026-41266.md): Flowise: Sensitive Data Leak in public-chatbotConfig (CVSS 7.7, FlowiseAI Flowise · flowise)
- [CVE-2026-41137](https://cve.now/CVE-2026-41137.md): Flowise: Code Injection in CSVAgent leads to Authenticated RCE (CVSS 9.4, FlowiseAI Flowise · FlowiseAI flowise-components +2)
- [CVE-2026-41138](https://cve.now/CVE-2026-41138.md): Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. (CVSS 8.3, FlowiseAI Flowise · flowise +1)
- [CVE-2026-41259](https://cve.now/CVE-2026-41259.md): Mastodon: Insufficient verification of email addresses (CVSS 8.2, mastodon)
- [CVE-2026-41205](https://cve.now/CVE-2026-41205.md): Mako: Path traversal via double-slash URI prefix in TemplateLookup (CVSS 7.7, sqlalchemy mako · mako)
- [CVE-2026-41247](https://cve.now/CVE-2026-41247.md): elFinder: Command injection in resize background color parameter when using ImageMagick CLI (CVSS 8.9, Studio-42 elFinder · studio-42/elfinder)
- [CVE-2026-41246](https://cve.now/CVE-2026-41246.md): Contour: Lua code injection via Cookie Path Rewrite Policy (CVSS 8.1, projectcontour contour · github.com/projectcontour/contour)
- [CVE-2026-41213](https://cve.now/CVE-2026-41213.md): @node-oauth/oauth2-server: PKCE code\_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes (CVSS 5.9, node-oauth2-server · @node-oauth/oauth2-server)
- [CVE-2026-41241](https://cve.now/CVE-2026-41241.md): pretalx: Stored cross-site scripting in organiser search typeahead (CVSS 8.7, pretalx)
- [CVE-2026-41173](https://cve.now/CVE-2026-41173.md): Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS (CVSS 5.9, open-telemetry opentelemetry-dotnet-contrib · OpenTeleme… +1)
- [CVE-2026-6074](https://cve.now/CVE-2026-6074.md): Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW) (CVSS 9.3, Intrado 911 Emergency Gateway)
- [CVE-2026-40886](https://cve.now/CVE-2026-40886.md): Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller (CVSS 7.7, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-33694](https://cve.now/CVE-2026-33694.md): Junction File Manipulation (CVSS 7.4, Tenable Nessus, Tenable Nessus Agent)
- [CVE-2026-41078](https://cve.now/CVE-2026-41078.md): OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path (CVSS 5.9, open-telemetry opentelemetry-dotnet · open-telemetry Ope… +1)
- [CVE-2026-40894](https://cve.now/CVE-2026-40894.md): OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers (CVSS 5.3, open-telemetry opentelemetry-dotnet · open-telemetry Ope… +3)
- [CVE-2026-40891](https://cve.now/CVE-2026-40891.md): OpenTelemetry dotnet: Unbounded \`grpc-status-details-bin\` parsing in OTLP/gRPC retry handling (CVSS 5.3, open-telemetry opentelemetry-dotnet · open-telemetry Ope… +1)
- [CVE-2026-41909](https://cve.now/CVE-2026-41909.md): OpenClaw \< 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions (CVSS 5.3, OpenClaw)
- [CVE-2026-41908](https://cve.now/CVE-2026-41908.md): OpenClaw \< 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route (CVSS 2.3, OpenClaw)
- [CVE-2026-40182](https://cve.now/CVE-2026-40182.md): OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies (CVSS 5.3, open-telemetry opentelemetry-dotnet · OpenTelemetry.Exporte…)
- [CVE-2026-6921](https://cve.now/CVE-2026-6921.md): Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 8.3, Google Chrome)
- [CVE-2026-6920](https://cve.now/CVE-2026-6920.md): Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer pro (CVSS 9.6, Google Chrome)
- [CVE-2026-6919](https://cve.now/CVE-2026-6919.md): Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to po (CVSS 9.6, Google Chrome)
- [CVE-2026-5039](https://cve.now/CVE-2026-5039.md): Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N (CVSS 6.1, TP-Link Systems TL-WL841N)
- [CVE-2026-31533](https://cve.now/CVE-2026-31533.md): net/tls: fix use-after-free in -EBUSY error path of tls\_do\_encryption (CVSS 9.8, Linux)
- [CVE-2026-40472](https://cve.now/CVE-2026-40472.md): Hackage package metadata stored XSS vulnerability (CVSS 9.9, hackage-server)
- [CVE-2026-40471](https://cve.now/CVE-2026-40471.md): Hackage CSRF vulnerability (CVSS 9.6, hackage-server)
- [CVE-2026-41240](https://cve.now/CVE-2026-41240.md): DOMPurify: FORBID\_TAGS bypassed by function-based ADD\_TAGS predicate (asymmetry with FORBID\_ATTR fix) (CVSS 6.0, cure53 DOMPurify · dompurify)
- [CVE-2026-34003](https://cve.now/CVE-2026-34003.md): Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-34001](https://cve.now/CVE-2026-34001.md): Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-33999](https://cve.now/CVE-2026-33999.md): Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-40470](https://cve.now/CVE-2026-40470.md): Hackage package and doc upload stored XSS vulnerability (CVSS 9.9, hackage-server)
- [CVE-2026-41239](https://cve.now/CVE-2026-41239.md): DOMPurify has a SAFE\_FOR\_TEMPLATES bypass in RETURN\_DOM mode (CVSS 6.8, cure53 DOMPurify · dompurify)
- [CVE-2026-23751](https://cve.now/CVE-2026-23751.md): Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting (CVSS 9.3, Tungsten Automation Tungsten Capture)
- [CVE-2026-41238](https://cve.now/CVE-2026-41238.md): DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM\_ELEMENT\_HANDLING Fallback (CVSS 6.9, cure53 DOMPurify · dompurify)
- [CVE-2025-62373](https://cve.now/CVE-2025-62373.md): Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer (CVSS 9.8, pipecat-ai pipecat · pipecat-ai)
- [CVE-2026-35225](https://cve.now/CVE-2026-35225.md): Improper timeout handling in CODESYS EtherNetIP (CVSS 8.7, CODESYS EtherNetIP)
- [CVE-2026-41461](https://cve.now/CVE-2026-41461.md): SocialEngine \<= 7.8.0 Blind SSRF via /core/link/preview (CVSS 6.3, SocialEngine)
- [CVE-2026-41460](https://cve.now/CVE-2026-41460.md): SocialEngine \<= 7.8.0 SQL Injection via activity/index/get-memberall (CVSS 9.3, SocialEngine)
- [CVE-2025-66286](https://cve.now/CVE-2025-66286.md): Webkitgtk: authorization bypass through webpage::send-request signal handler (CVSS 4.7, Red Hat Enterprise Linux)
- [CVE-2025-13763](https://cve.now/CVE-2025-13763.md): Libopensc: opensc: multiple uses of uninitialized variable (CVSS 5.7, OpenSC · Red Hat Enterprise Linux)
- [CVE-2026-39440](https://cve.now/CVE-2026-39440.md): WordPress FunnelFormsPro plugin \<= 3.8.1 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, FunnelFormsPro)
- [CVE-2026-31532](https://cve.now/CVE-2026-31532.md): can: raw: fix ro-\>uniq use-after-free in raw\_rcv() (CVSS 7.8, Linux)
- [CVE-2026-31531](https://cve.now/CVE-2026-31531.md): ipv4: nexthop: allocate skb dynamically in rtm\_get\_nexthop() (no CVSS, Linux)
- [CVE-2025-62110](https://cve.now/CVE-2025-62110.md): WordPress Rescue Shortcodes plugin \<= 3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rescue Themes Rescue Shortcodes)
- [CVE-2025-62104](https://cve.now/CVE-2025-62104.md): WordPress ACF Galerie 4 plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 4.3, Navneil Naicker ACF Galerie)
- [CVE-2026-28040](https://cve.now/CVE-2026-28040.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Magepeople Taxi Booking Manager for WooCommerce)
- [CVE-2026-6903](https://cve.now/CVE-2026-6903.md): Path Traversal Vulnerability in LabOne User Interface (CVSS 7.5, Zurich Instruments LabOne)
- [CVE-2026-6887](https://cve.now/CVE-2026-6887.md): BorG Technology Corporation｜Borg SPM 2007 - SQL Injection (CVSS 9.3, BorG Technology Borg SPM)
- [CVE-2026-6886](https://cve.now/CVE-2026-6886.md): BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass (CVSS 9.3, BorG Technology Borg SPM)
- [CVE-2026-6885](https://cve.now/CVE-2026-6885.md): BorG Technology Corporation｜Borg SPM 2007 - Arbitrary File Upload (CVSS 9.3, BorG Technology Borg SPM)
- [CVE-2026-3960](https://cve.now/CVE-2026-3960.md): Remote Code Execution in h2oai/h2o-3 (CVSS 5.9, h2oai/h2o-3 · h2o +1)
- [CVE-2026-3259](https://cve.now/CVE-2026-3259.md): Sensitive Data Disclosure in BigQuery via Materialized View Error Messages (CVSS 7.1, Google Cloud BigQuery)
- [CVE-2026-5464](https://cve.now/CVE-2026-5464.md): ExactMetrics \<= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics\_connect\_process (CVSS 7.2, smub ExactMetrics – Google Analytics Dashboard for WordPress)
- [CVE-2026-41564](https://cve.now/CVE-2026-41564.md): CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking (CVSS 7.5, MIK CryptX)
- [CVE-2026-41040](https://cve.now/CVE-2026-41040.md): GROWI provided by GROWI, Inc. (CVSS 7.5, GROWI)
- [CVE-2025-10549](https://cve.now/CVE-2025-10549.md): DLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation (CVSS 5.1, EfficientLab Controlio)
- [CVE-2026-34488](https://cve.now/CVE-2026-34488.md): IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. (CVSS 7.3, i-PRO Co. IP Setting Software)
- [CVE-2026-4512](https://cve.now/CVE-2026-4512.md): WP reCaptcha by WebDesignBy \< 2.0 – Admin+ Stored XSS (CVSS 3.5, reCaptcha by WebDesignBy)
- [CVE-2026-4106](https://cve.now/CVE-2026-4106.md): HT Mega \< 3.0.7 – Unauthenticated PII Disclosure (CVSS 5.3, HT Mega Addons for Elementor)
- [CVE-2026-41990](https://cve.now/CVE-2026-41990.md): Libgcrypt before 1.12.2 mishandles Dilithium signing. (CVSS 4.0, gnupg Libgcrypt)
- [CVE-2026-41989](https://cve.now/CVE-2026-41989.md): Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry\_pk\_decrypt. (CVSS 6.7, gnupg Libgcrypt)
- [CVE-2026-40529](https://cve.now/CVE-2026-40529.md): CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. (CVSS 4.7, KANATA Limited CMS ALAYA)
- [CVE-2026-41988](https://cve.now/CVE-2026-41988.md): uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. (CVSS 3.2, uuidjs uuid · uuid)
- [CVE-2026-41233](https://cve.now/CVE-2026-41233.md): Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() (CVSS 5.4, froxlor · froxlor/froxlor)
- [CVE-2026-41232](https://cve.now/CVE-2026-41232.md): Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing (CVSS 5.0, froxlor · froxlor/froxlor)
- [CVE-2026-41231](https://cve.now/CVE-2026-41231.md): Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron (CVSS 7.5, froxlor · froxlor/froxlor)
- [CVE-2026-41230](https://cve.now/CVE-2026-41230.md): Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() (CVSS 8.5, froxlor · froxlor/froxlor)
- [CVE-2026-41229](https://cve.now/CVE-2026-41229.md): Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) (CVSS 9.1, froxlor · froxlor/froxlor)
- [CVE-2026-41228](https://cve.now/CVE-2026-41228.md): Froxlor has Local File Inclusion via path traversal in API \`def\_language\` parameter that leads to Remote Code Execution (CVSS 10.0, froxlor · froxlor/froxlor)
- [CVE-2026-3361](https://cve.now/CVE-2026-3361.md): WP Store Locator \<= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl\_address' Post Meta (CVSS 6.4, tijmensmit WP Store Locator)
- [CVE-2026-3007](https://cve.now/CVE-2026-3007.md): Stored Cross-Site Scripting (XSS) Vulnerability (CVSS 5.4, Three Learning Koollab Learning Management System)
- [CVE-2026-3844](https://cve.now/CVE-2026-3844.md): Breeze Cache \<= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch\_gravatar\_from\_remote (CVSS 9.8, cloudways Breeze Cache)
- [CVE-2026-2951](https://cve.now/CVE-2026-2951.md): Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor \<= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML (CVSS 5.4, Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Ed…)
- [CVE-2026-1923](https://cve.now/CVE-2026-1923.md): Social Rocket – Social Sharing Plugin \<= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id (CVSS 6.4, socialrocket Social Rocket – Social Sharing Plugin)
- [CVE-2026-41211](https://cve.now/CVE-2026-41211.md): \`vite-plus/binding\` has path traversal \`downloadPackageManager()\` that leads to writes outside of \`VP\_HOME\` (CVSS 8.4, voidzero-dev vite-plus · vite-plus)
- [CVE-2026-41679](https://cve.now/CVE-2026-41679.md): Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass (CVSS 10.0, paperclipai paperclip · @paperclipai/server +1)
- [CVE-2026-41208](https://cve.now/CVE-2026-41208.md): Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution (CVSS 8.8, @paperclipai/server)
- [CVE-2026-41206](https://cve.now/CVE-2026-41206.md): PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate\_plugin\_code (CVSS 6.9, ParzivalHack PySpector · pyspector)
- [CVE-2026-41200](https://cve.now/CVE-2026-41200.md): STIG Manager has reflected XSS vulnerability in the Web App (CVSS 8.5, NUWCDIVNPT stig-manager)
- [CVE-2026-41197](https://cve.now/CVE-2026-41197.md): Brillig: Heap corruption in foreign call results with nested tuple arrays (CVSS 9.3, noir-lang noir · brillig)
- [CVE-2026-41196](https://cve.now/CVE-2026-41196.md): Luanti has a mod security sandbox escape (CVSS 9.0, luanti-org luanti)
- [CVE-2026-41182](https://cve.now/CVE-2026-41182.md): LangSmith SDK: Streaming token events bypass output redaction (CVSS 5.3, langchain-ai langsmith-sdk · langsmith)
- [CVE-2026-41180](https://cve.now/CVE-2026-41180.md): PsiTransfer: Upload PATCH path traversal can create \`config.\<NODE\_ENV\>.js\` and lead to code execution on restart (CVSS 7.5, psi-4ward psitransfer · psitransfer)
- [CVE-2026-41243](https://cve.now/CVE-2026-41243.md): OpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled (CVSS 6.9, siemvk OpenLearn)
- [CVE-2026-41179](https://cve.now/CVE-2026-41179.md): RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution (CVSS 9.2, rclone · github.com/rclone/rclone +1)
- [CVE-2026-32679](https://cve.now/CVE-2026-32679.md): The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon (CVSS 7.8, Japan Media Systems Downloader5Installer.exe · Japan Med… +2)
- [CVE-2026-40062](https://cve.now/CVE-2026-40062.md): A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. (CVSS 7.5, Ziosoft Ziostation2)
- [CVE-2026-6878](https://cve.now/CVE-2026-6878.md): ByteDance verl grader.py math\_equal sandbox (CVSS 6.3, ByteDance verl · verl)
- [CVE-2025-50229](https://cve.now/CVE-2025-50229.md): Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. (CVSS 9.8)
- [CVE-2025-70994](https://cve.now/CVE-2025-70994.md): Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. (CVSS 7.3)
- [CVE-2026-31159](https://cve.now/CVE-2026-31159.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the passwor (CVSS 6.5)
- [CVE-2026-31160](https://cve.now/CVE-2026-31160.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the provide (CVSS 6.5)
- [CVE-2026-31162](https://cve.now/CVE-2026-31162.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the ttlWay (CVSS 6.5)
- [CVE-2026-31163](https://cve.now/CVE-2026-31163.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu (CVSS 6.5)
- [CVE-2026-31164](https://cve.now/CVE-2026-31164.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the pppoeMt (CVSS 6.5)
- [CVE-2026-31165](https://cve.now/CVE-2026-31165.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the pppoeSe (CVSS 6.5)
- [CVE-2026-31166](https://cve.now/CVE-2026-31166.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the hour pa (CVSS 6.5)
- [CVE-2026-31167](https://cve.now/CVE-2026-31167.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the mode pa (CVSS 6.5)
- [CVE-2026-31168](https://cve.now/CVE-2026-31168.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the recHour (CVSS 6.5)
- [CVE-2026-31169](https://cve.now/CVE-2026-31169.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the week pa (CVSS 6.5)
- [CVE-2026-31171](https://cve.now/CVE-2026-31171.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the url par (CVSS 6.5)
- [CVE-2026-31172](https://cve.now/CVE-2026-31172.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the user pa (CVSS 6.5)
- [CVE-2026-31173](https://cve.now/CVE-2026-31173.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the interva (CVSS 6.5)
- [CVE-2026-31174](https://cve.now/CVE-2026-31174.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the informE (CVSS 6.5)
- [CVE-2026-31175](https://cve.now/CVE-2026-31175.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the stunEna (CVSS 9.8)
- [CVE-2026-31176](https://cve.now/CVE-2026-31176.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the stun\_us (CVSS 6.5)
- [CVE-2026-31177](https://cve.now/CVE-2026-31177.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the stunMin (CVSS 9.8)
- [CVE-2026-31178](https://cve.now/CVE-2026-31178.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the stunMax (CVSS 9.8)
- [CVE-2026-31179](https://cve.now/CVE-2026-31179.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the stunPor (CVSS 6.5)
- [CVE-2026-31181](https://cve.now/CVE-2026-31181.md): An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557\_B20221024 allowing attackers to execute arbitrary commands via the stunSer (CVSS 9.8)
- [CVE-2026-39087](https://cve.now/CVE-2026-39087.md): ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs. (CVSS 6.4, ntfy · heckel.io/ntfy/v2 +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.