CVEs published April 24, 2026
275 CVEs were published on April 24, 2026: 29 critical, 98 high.
- Published
- 275
- Critical
- 29
- High
- 98
- Medium
- 57
- Low
- 8
- Unrated
- 83
- Now in CISA KEV
- 0
- Fix available
- 169
Most affected products
- Linux
- 137
- axios
- 12
- rust-openssl · openssl
- 5
- DeltaWW AS320T
- 4
- getkirby kirby · getkirby/cms
- 4
- roxy-wi
- 4
- SenseLive X3050
- 4
- xibosignage xibo-cms
- 4
- bacnet-stack
- 3
- kyverno · github.com/kyverno/kyverno
- 3
Critical 29
- CVE-2026-41248Official Clerk JavaScript SDKs: Middleware-based route protection bypassclerk astro · clerk nextjs +6
- CVE-2026-41478Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)saltcorn · @saltcorn/server
- CVE-2026-41428Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpointsbudibase · @budibase/backend-core
- CVE-2026-41492Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraphdgraph-io dgraph · github.com/dgraph-io/dgraph +3
- CVE-2026-41327Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Fielddgraph-io dgraph · github.com/dgraph-io/dgraph +3
- CVE-2026-41328Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Fielddgraph-io dgraph · github.com/dgraph-io/dgraph/v25 +3
- CVE-2026-6911Authentication Bypass via Missing JWT Signature Verification in AWS Ops WheelAWS Ops Wheel
- CVE-2026-39920BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCEBridgeHead Software FileStore
- CVE-2026-31669mptcp: fix slab-use-after-free in __inet_lookup_establishedLinux
- CVE-2026-31668seg6: separate dst_cache for input and output paths in seg6 lwtunnelLinux
- CVE-2026-31659batman-adv: reject oversized global TT response buffersLinux
- CVE-2026-31657batman-adv: hold claim backbone gateways by referenceLinux
- CVE-2026-31649net: stmmac: fix integer underflow in chain modeLinux
- CVE-2026-31637rxrpc: reject undecryptable rxkad response ticketsLinux
- CVE-2026-31636rxrpc: fix RESPONSE authenticator parser OOB readLinux
- CVE-2026-31633rxrpc: Fix integer overflow in rxgk_verify_response()Linux
- CVE-2026-31609smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()Linux
- CVE-2026-31608smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()Linux
- CVE-2026-31607usbip: validate number_of_packets in usbip_pack_ret_submit()Linux
- CVE-2026-31589mm: call ->free_folio() directly in folio_unmap_invalidate()Linux
- CVE-2026-31536smb: server: let send_done handle a completion without IB_SEND_SIGNALEDLinux
- CVE-2026-25660Authentication bypass for certain API callsEricsson CodeChecker · codechecker
- CVE-2026-21515Azure IoT Central Elevation of Privilege VulnerabilityMicrosoft Azure IOT Central
- CVE-2026-1951No checking of the length of the buffer with the directory name in AS320TDeltaWW AS320T
- CVE-2026-1952Denial of service via the undocumented subfunction in AS320TDeltaWW AS320T
- CVE-2026-1950No checking of the length of the buffer with the file name in AS320TDeltaWW AS320T
- CVE-2026-1949Incorrect calculation of buffer size on the stack in AS320TDeltaWW AS320T
- CVE-2026-25775SenseLive X3050 Missing authentication for critical functionSenseLive X3050
- CVE-2026-40620SenseLive X3050 Missing authentication for critical functionSenseLive X3050
High 98
- CVE-2026-42171NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing locNullsoft Scriptable Install System
- CVE-2026-41473CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpointsusmannasir cyberpanel
- CVE-2026-41477Deskflow: Local privilege escalation via unauthenticated IPCdeskflow
- CVE-2026-41476Deskflow: clipboard deserialization global-buffer-overflowdeskflow
- CVE-2026-41503BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parserbacnet-stack
- CVE-2026-41502BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoderbacnet-stack
- CVE-2026-41475BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parserbacnet-stack
- CVE-2026-41433OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIRopen-telemetry opentelemetry-ebpf-instrumentation · go.open…
- CVE-2026-41427Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clientsbetter-auth · @better-auth/oauth-provider
- CVE-2026-41429Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruptionespressif arduino-esp32
- CVE-2026-41894SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpointsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-41421SiYuan Desktop Notification XSS Leads to Electron RCEsiyuan-note siyuan
- CVE-2026-414194ga Boards: Import Path Traversal Leads to Arbitrary File ReadRARgames 4gaBoards
- CVE-2026-41326Kata Containers: CopyFile Policy Subversion via Symlinkskata-containers · github.com/kata-containers/kata-containers
- CVE-2026-41416PJSIP: Asymmetric ptime integer overflow in Media Streampjsip pjproject
- CVE-2026-41414Skim: Arbitrary code execution via pull_request_target fork checkout in pr.ymlskim-rs skim
- CVE-2026-33666Zserio: Integer Overflow in BitStreamReader on 32-bit platformsndsev zserio
- CVE-2026-33524Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserializationndsev zserio · io.github.ndsev:zserio-runtime
- CVE-2026-33662OP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode()OP-TEE optee_os
- CVE-2026-41907uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provideduuidjs uuid · uuid
- CVE-2026-42043Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0axios
- CVE-2026-42035Axios: Header Injection via Prototype Pollutionaxios
- CVE-2026-42033Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijackingaxios
- CVE-2026-41680Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizermarkedjs marked · marked
- CVE-2026-41898rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peerrust-openssl · openssl
- CVE-2026-41681rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length checkrust-openssl · openssl
- CVE-2026-41678rust-openssl: Incorrect bounds assertion in aes key wraprust-openssl · openssl
- CVE-2026-41676rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1rust-openssl · openssl
- CVE-2026-40897Math.js: Unsafe object property setter in mathjsjosdejong mathjs · mathjs
- CVE-2026-41066lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local fileslxml
- CVE-2026-6912Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops WheelAWS Ops Wheel
- CVE-2026-31667Input: uinput - fix circular locking dependency with ff-coreLinux
- CVE-2026-31666btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()Linux
- CVE-2026-31665netfilter: nft_ct: fix use-after-free in timeout object destroyLinux
- CVE-2026-31663xfrm: hold dev ref until after transport_finish NF_HOOKLinux
- CVE-2026-31662tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSGLinux
- CVE-2026-31656drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeatLinux
- CVE-2026-31648mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()Linux
- CVE-2026-31644net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()Linux
- CVE-2026-31641rxrpc: Fix RxGK token loading to check boundsLinux
- CVE-2026-31640rxrpc: Fix use of wrong skb when comparing queued RESP challenge serialLinux
- CVE-2026-31638rxrpc: Only put the call ref if one was acquiredLinux
- CVE-2026-31635rxrpc: fix oversized RESPONSE authenticator length checkLinux
- CVE-2026-31631rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()Linux
- CVE-2026-31630rxrpc: proc: size address buffers for %pISpc outputLinux
- CVE-2026-31629nfc: llcp: add missing return after LLCP_CLOSED checksLinux · :linux_kernel:
- CVE-2026-31627i2c: s3c24xx: check the size of the SMBUS message before using itLinux
- CVE-2026-31626staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()Linux
- CVE-2026-31622NFC: digital: Bounds check NFC-A cascade depth in SDD response handlerLinux
- CVE-2026-31613smb: client: fix OOB reads parsing symlink error responseLinux
- CVE-2026-31612ksmbd: validate EaNameLength in smb2_get_ea()Linux
- CVE-2026-31611ksmbd: require 3 sub-authorities before reading sub_auth[2]Linux
- CVE-2026-31602ALSA: ctxfi: Limit PTP to a single pageLinux
- CVE-2026-31600arm64: mm: Handle invalid large leaf mappings correctlyLinux
- CVE-2026-31598ocfs2: fix possible deadlock between unlink and dio_end_io_writeLinux
- CVE-2026-31597ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRYLinux
- CVE-2026-31588KVM: x86: Use scratch field in MMIO fragment to hold small write valuesLinux
- CVE-2026-31587ASoC: qcom: q6apm: move component registration to unmanaged versionLinux
- CVE-2026-31586mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()Linux
- CVE-2026-31584media: mediatek: vcodec: fix use-after-free in encoder release pathLinux
- CVE-2026-31570can: gw: fix OOB heap access in cgw_csum_crc8_rel()Linux
- CVE-2026-31569LoongArch: KVM: Handle the case that EIOINTC's coremap is emptyLinux
- CVE-2026-31566drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ibLinux
- CVE-2026-31563net: macb: Use dev_consume_skb_any() to free TX SKBsLinux
- CVE-2026-31558LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robustLinux
- CVE-2026-31557nvmet: move async event work off nvmet-wqLinux
- CVE-2026-31554futex: Require sys_futex_requeue() to have identical flagsLinux
- CVE-2026-31553KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()Linux
- CVE-2026-31552wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroomLinux
- CVE-2026-31548wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_downLinux
- CVE-2026-31539smb: smbdirect: introduce smbdirect_socket.recv_io.credits.availableLinux
- CVE-2026-31538smb: server: make use of smbdirect_socket.recv_io.credits.availableLinux
- CVE-2026-5367Ovn: ovn: information disclosure via crafted dhcpv6 packetsFast Datapath for Red Hat Enterprise Linux · Red Hat Fas… +1
- CVE-2026-6043Insecure Default Configuration in P4 ServerPerforce Helix Core Server
- CVE-2026-23902Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.Apache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2026-41044Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by JolokiaApache Software Foundation Apache ActiveMQ · org.apache.… +2
- CVE-2026-40466Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URIApache Software Foundation Apache ActiveMQ Broker · Apac… +4
- CVE-2026-6272A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStreamEclipse Foundation Eclipse KUKSA - Databroker
- CVE-2026-21728Tempo query limit results in unbounded memory allocationGrafana Tempo · Grafana Enterprise Traces +1
- CVE-2026-5364Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypassaddonsorg Drag and Drop File Upload for Contact Form
- CVE-2026-6947D-Link｜DWM-222W USB Wi-Fi Adapter - Brute-Force Protection BypassD-Link DWM-222W
- CVE-2026-41324basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()patrickjuchli basic-ftp · basic-ftp
- CVE-2026-41485Kyverno Controller Denial of Service via forEach Mutation Panickyverno · github.com/kyverno/kyverno
- CVE-2026-41323Kyverno: ServiceAccount token leaked to external servers via apiCall service URLkyverno · github.com/kyverno/kyverno
- CVE-2026-41068Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)kyverno · github.com/kyverno/kyverno
- CVE-2026-41316ERB has an @_init deserialization guard bypass via def_module / def_method / def_classruby erb · erb
- CVE-2026-41309Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processingopensource-socialnetwork
- CVE-2026-33317OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosureOP-TEE optee_os
- CVE-2026-33318Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Serversactualbudget actual · @actual-app/sync-server
- CVE-2026-33208Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpointroxy-wi
- CVE-2026-33078Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameterroxy-wi
- CVE-2026-33077Roxy-WI has an arbitrary file read vulnerabilityroxy-wi
- CVE-2026-33076Roxy-WI vulnerable to path traversal and arbitrary file writingroxy-wi
- CVE-2026-41325Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injectiongetkirby kirby · getkirby/cms
- CVE-2026-34587Kirby has Server-Side Template Injection (SSTI) via double template resolution in option renderinggetkirby kirby · getkirby/cms
- CVE-2026-31952Xibo CMS API has SQL Injection via DataSet Filter Parameterxibosignage xibo-cms
- CVE-2026-35064SenseLive X3050 Missing authentication for critical functionSenseLive X3050
- CVE-2026-27841SenseLive X3050 Cross-Site request forgerySenseLive X3050
Medium, low and unrated 148
- CVE-2026-41488angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebindinglangchain-ai langchain-openai · langchain-openai
- CVE-2026-41481LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypasslangchain-ai langchain-text-splitters · langchain-text-spli…
- CVE-2026-41472CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboardusmannasir cyberpanel
- CVE-2026-6968Multiple Path Traversal Variants in awslabs/toughAWS tough · AWS tuftool
- CVE-2026-6967Missing Delegated Metadata Validation in awslabs/toughAWS tough · AWS tuftool +2
- CVE-2026-6966Signature Threshold Bypass in awslabs/tough Delegated RolesAWS tough · AWS tuftool +2
- CVE-2026-41426pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templatespretalx
- CVE-2026-41425Authlib: Cross-site request forging when using cacheauthlib
- CVE-2026-41244Mojic: Observable Timing Discrepancy in HMAC Verificationnotamitgamer mojic · mojic
- CVE-2026-414184ga Boards: User Enumeration via Timing Side-Channel in Authentication EndpointRARgames 4gaBoards
- CVE-2026-41415PJSIP: SIP Multipart CID URI Length Underflowpjsip pjproject
- CVE-2026-42042Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercionaxios
- CVE-2026-42039Axios: unbounded recursion in toFormData causes DoS via deeply nested request dataaxios
- CVE-2026-42036Axios: HTTP adapter streamed responses bypass maxContentLengthaxios
- CVE-2026-42034Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0axios
- CVE-2026-42037Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamaxios
- CVE-2026-42038Axios: no_proxy bypass via IP alias allows SSRFaxios
- CVE-2026-42041Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategyaxios
- CVE-2026-42044Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`axios
- CVE-2026-42040Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsaxios
- CVE-2026-41677rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized lengthrust-openssl · openssl
- CVE-2026-41140Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4python-poetry poetry · poetry
- CVE-2026-41322@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformedwithastro astro · @astrojs/node
- CVE-2026-41321@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpointwithastro @astrojs/cloudflare · @astrojs/cloudflare
- CVE-2026-41067Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypasswithastro astro · astro
- CVE-2026-41079OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated usersOpenPrinting cups
- CVE-2026-41411Vim: Command injection via backtick expansion in tag filenamesvim
- CVE-2026-31672wifi: rt2x00usb: fix devres lifetimeLinux
- CVE-2026-31671xfrm_user: fix info leak in build_report()Linux
- CVE-2026-31670net: rfkill: prevent unlimited numbers of rfkill events from being createdLinux
- CVE-2026-31664xfrm: clear trailing padding in build_polexpire()Linux
- CVE-2026-31661wifi: brcmsmac: Fix dma_free_coherent() sizeLinux
- CVE-2026-31660nfc: pn533: allocate rx skb before consuming bytesLinux
- CVE-2026-31658net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()Linux
- CVE-2026-31655pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabledLinux
- CVE-2026-31654mm/vma: fix memory leak in __mmap_region()Linux
- CVE-2026-31653mm/damon/sysfs: dealloc repeat_call_control if damon_call() failsLinux
- CVE-2026-31652mm/damon/stat: deallocate damon_call() failure leaking damon_ctxLinux
- CVE-2026-31651mmc: vub300: fix NULL-deref on disconnectLinux
- CVE-2026-31650mmc: vub300: fix use-after-free on disconnectLinux
- CVE-2026-31647idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handlingLinux
- CVE-2026-31646net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()Linux
- CVE-2026-31645net: lan966x: fix page pool leak in error pathsLinux
- CVE-2026-31643rxrpc: Fix key parsing memleakLinux
- CVE-2026-31642rxrpc: Fix call removal to use RCU safe deletionLinux
- CVE-2026-31639rxrpc: Fix key reference count leak from call->keyLinux
- CVE-2026-31634rxrpc: fix reference count leak in rxrpc_server_keyring()Linux
- CVE-2026-31632rxrpc: Fix leak of rxgk context in rxgk_verify_response()Linux
- CVE-2026-31628x86/CPU: Fix FPDSS on Zen1Linux
- CVE-2026-31625HID: alps: fix NULL pointer dereference in alps_raw_event()Linux
- CVE-2026-31624HID: core: clamp report_size in s32ton() to avoid undefined shiftLinux
- CVE-2026-31623net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()Linux
- CVE-2026-31621bnge: return after auxiliary_device_uninit() in error pathLinux
- CVE-2026-31620ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0Linux
- CVE-2026-31619ALSA: fireworks: bound device-supplied status before string array lookupLinux
- CVE-2026-31618fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFOLinux
- CVE-2026-31617usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()Linux
- CVE-2026-31616usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()Linux
- CVE-2026-31615usb: gadget: renesas_usb3: validate endpoint index in standard request handlersLinux
- CVE-2026-31614smb: client: fix off-by-8 bounds check in check_wsl_eas()Linux
- CVE-2026-31610ksmbd: fix mechToken leak when SPNEGO decode fails after token allocLinux
- CVE-2026-31606usb: gadget: f_hid: don't call cdev_init while cdev in useLinux
- CVE-2026-31605fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFOLinux
- CVE-2026-31604wifi: rtw88: fix device leak on probe failureLinux
- CVE-2026-31603staging: sm750fb: fix division by zero in ps_to_hz()Linux
- CVE-2026-31601vfio/xe: Reorganize the init to decouple migration from resetLinux
- CVE-2026-31599media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sectionsLinux
- CVE-2026-31596ocfs2: handle invalid dinode in ocfs2_group_extendLinux
- CVE-2026-31595PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanupLinux
- CVE-2026-31594PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardownLinux
- CVE-2026-31593KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPULinux
- CVE-2026-31592KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lockLinux
- CVE-2026-31591KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finishLinux
- CVE-2026-31590KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGIONLinux
- CVE-2026-31585media: vidtv: fix nfeeds state corruption on start_streaming failureLinux
- CVE-2026-31583media: em28xx: fix use-after-free in em28xx_v4l2_open()Linux
- CVE-2026-31582hwmon: (powerz) Fix use-after-free on USB disconnectLinux
- CVE-2026-31581ALSA: 6fire: fix use-after-free on disconnectLinux
- CVE-2026-31580bcache: fix cached_dev.sb_bio use-after-free and crashLinux
- CVE-2026-31579wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exitLinux
- CVE-2026-31578media: as102: fix to not free memory after the device is registered in as102_usb_probe()Linux
- CVE-2026-31577nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_mapLinux
- CVE-2026-31576media: hackrf: fix to not free memory after the device is registered in hackrf_probe()Linux
- CVE-2026-31575mm/userfaultfd: fix hugetlb fault mutex hash calculationLinux
- CVE-2026-31574clockevents: Add missing resets of the next_event_forced flagLinux
- CVE-2026-31573media: verisilicon: Fix kernel panic due to __initconst misuseLinux
- CVE-2026-31572i2c: designware: amdisp: Fix resume-probe race condition issueLinux
- CVE-2026-31571drm/i915: Unlink NV12 planes earlierLinux
- CVE-2026-31568s390/mm: Add missing secure storage access fixups for donated memoryLinux
- CVE-2026-31567PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()Linux
- CVE-2026-31565RDMA/irdma: Fix deadlock during netdev reset with active connectionsLinux
- CVE-2026-31564LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()Linux
- CVE-2026-31562drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_registerLinux
- CVE-2026-31561x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits maskLinux
- CVE-2026-31560spi: spi-dw-dma: fix print error log when wait finish transactionLinux
- CVE-2026-31559LoongArch: Fix missing NULL checks for kstrdup()Linux
- CVE-2026-31556xfs: scrub: unlock dquot before early return in quota scrubLinux
- CVE-2026-31555futex: Clear stale exiting pointer in futex_lock_pi() retry pathLinux
- CVE-2026-31551wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.Linux
- CVE-2026-31550pmdomain: bcm: bcm2835-power: Increase ASB control timeoutLinux
- CVE-2026-31549i2c: cp2615: fix serial string NULL-deref at probeLinux
- CVE-2026-31547drm/xe: Fix missing runtime PM reference in ccs_mode_storeLinux
- CVE-2026-31546net: bonding: fix NULL deref in bond_debug_rlb_hash_showLinux
- CVE-2026-31545NFC: nxp-nci: allow GPIOs to sleepLinux
- CVE-2026-31544firmware: arm_scmi: Fix NULL dereference on notify error pathLinux
- CVE-2026-31543crash_dump: don't log dm-crypt key bytes in read_key_from_user_keyingLinux
- CVE-2026-31542x86/platform/uv: Handle deconfigured socketsLinux
- CVE-2026-31541tracing: Fix trace_marker copy link list updatesLinux
- CVE-2026-31540drm/i915/gt: Check set_default_submission() before deferencingLinux
- CVE-2026-31537smb: server: make use of smbdirect_socket.send_io.bcreditsLinux
- CVE-2026-31535smb: client: make use of smbdirect_socket.recv_io.credits.availableLinux
- CVE-2026-38743Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entitiesApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-40690Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized usersApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-5265Ovn: ovn: heap over-read in icmp error response generationFast Datapath for Red Hat Enterprise Linux · Red Hat Fast D…
- CVE-2026-4313Stored XSS in AdaptiveGRCC&F AdaptiveGRC
- CVE-2025-62233Apache DolphinScheduler: Deserialization of untrusted data in RPCApache Software Foundation Apache DolphinScheduler · org… +1
- CVE-2026-41043Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queuesApache Software Foundation Apache ActiveMQ · org.apache.… +2
- CVE-2026-3569Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API EndpointLiaison Site Prober
- CVE-2026-4078ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesITERAS
- CVE-2026-3565Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX ActionTaqnix
- CVE-2025-11762HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosurehubspotdev HubSpot All-In-One Marketing – Forms, Popups, Li…
- CVE-2026-5428Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Fieldwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-6810Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeovercodepeople Booking Calendar Contact Form
- CVE-2026-5347WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parametermhmrajib WP Books Gallery – Build Stunning Book Showcases &…
- CVE-2026-2028Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameterckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns…
- CVE-2026-5488ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'smub ExactMetrics – Google Analytics Dashboard for WordPress
- CVE-2026-6393BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usagewpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…
- CVE-2026-41319MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgradejstedfast MailKit · MailKit
- CVE-2026-41318AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable componentMintplex-Labs anything-llm
- CVE-2026-41430Press vulnerable to reflected XSS on login redirectionfrappe press
- CVE-2026-41317Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generationfrappe press
- CVE-2026-41305PostCSS has XSS via Unescaped </style> in its CSS Stringify Outputpostcss
- CVE-2026-40254FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..FreeRDP
- CVE-2026-32952go-ntlmssp NTLM challenges can panic on malformed payloadsAzure go-ntlmssp · github.com/Azure/go-ntlmssp
- CVE-2026-40099Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parametergetkirby kirby · getkirby/cms
- CVE-2026-32870Kirby has XML injection in its XML creator toolkitgetkirby kirby · getkirby/cms
- CVE-2026-31956Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorizationxibosignage xibo-cms
- CVE-2026-31955Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionalityxibosignage xibo-cms
- CVE-2026-31953Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Loginxibosignage xibo-cms
- CVE-2026-29051melange has Path Traversal via .PKGINFO in --persist-lint-resultschainguard-dev melange · chainguard.dev/melange
- CVE-2025-59308In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site
- CVE-2025-61872Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string.
- CVE-2025-67259A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthor
- CVE-2026-30368A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by Lightspeed Classroom
- CVE-2026-31050Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code
- CVE-2026-31051An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component
- CVE-2026-31052An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow
- CVE-2026-42095bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.KDE Arianna