# CVEs published 2026-04-24

275 CVEs were published on April 24, 2026: 29 critical, 98 high. Days are UTC.

- [CVE-2026-42171](https://cve.now/CVE-2026-42171.md): NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing loc (CVSS 7.8, Nullsoft Scriptable Install System)
- [CVE-2026-41248](https://cve.now/CVE-2026-41248.md): Official Clerk JavaScript SDKs: Middleware-based route protection bypass (CVSS 9.1, clerk astro · clerk nextjs +6)
- [CVE-2026-41488](https://cve.now/CVE-2026-41488.md): angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding (CVSS 3.1, langchain-ai langchain-openai · langchain-openai)
- [CVE-2026-41481](https://cve.now/CVE-2026-41481.md): LangChain: HTMLHeaderTextSplitter.split\_text\_from\_url SSRF Redirect Bypass (CVSS 6.5, langchain-ai langchain-text-splitters · langchain-text-spli…)
- [CVE-2026-41478](https://cve.now/CVE-2026-41478.md): Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) (CVSS 10.0, saltcorn · @saltcorn/server)
- [CVE-2026-41473](https://cve.now/CVE-2026-41473.md): CyberPanel \< 2.4.5 Unauthenticated API Access via AI Scanner Endpoints (CVSS 8.8, usmannasir cyberpanel)
- [CVE-2026-41472](https://cve.now/CVE-2026-41472.md): CyberPanel \< 2.4.5 Stored XSS via AI Scanner Dashboard (CVSS 5.3, usmannasir cyberpanel)
- [CVE-2026-41477](https://cve.now/CVE-2026-41477.md): Deskflow: Local privilege escalation via unauthenticated IPC (CVSS 7.8, deskflow)
- [CVE-2026-41476](https://cve.now/CVE-2026-41476.md): Deskflow: clipboard deserialization global-buffer-overflow (CVSS 7.4, deskflow)
- [CVE-2026-6968](https://cve.now/CVE-2026-6968.md): Multiple Path Traversal Variants in awslabs/tough (CVSS 5.9, AWS tough · AWS tuftool)
- [CVE-2026-41503](https://cve.now/CVE-2026-41503.md): BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser (CVSS 8.7, bacnet-stack)
- [CVE-2026-6967](https://cve.now/CVE-2026-6967.md): Missing Delegated Metadata Validation in awslabs/tough (CVSS 5.9, AWS tough · AWS tuftool +2)
- [CVE-2026-41502](https://cve.now/CVE-2026-41502.md): BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder (CVSS 8.7, bacnet-stack)
- [CVE-2026-41475](https://cve.now/CVE-2026-41475.md): BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser (CVSS 8.7, bacnet-stack)
- [CVE-2026-6966](https://cve.now/CVE-2026-6966.md): Signature Threshold Bypass in awslabs/tough Delegated Roles (CVSS 5.3, AWS tough · AWS tuftool +2)
- [CVE-2026-41433](https://cve.now/CVE-2026-41433.md): OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR (CVSS 8.4, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-41427](https://cve.now/CVE-2026-41427.md): Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients (CVSS 7.1, better-auth · @better-auth/oauth-provider)
- [CVE-2026-41429](https://cve.now/CVE-2026-41429.md): Improper validation of NBNS name\_len in arduino-esp32 NetBIOS leads to memory corruption (CVSS 8.8, espressif arduino-esp32)
- [CVE-2026-41428](https://cve.now/CVE-2026-41428.md): Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints (CVSS 9.1, budibase · @budibase/backend-core)
- [CVE-2026-41426](https://cve.now/CVE-2026-41426.md): pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates (CVSS 6.1, pretalx)
- [CVE-2026-41425](https://cve.now/CVE-2026-41425.md): Authlib: Cross-site request forging when using cache (CVSS 5.4, authlib)
- [CVE-2026-41244](https://cve.now/CVE-2026-41244.md): Mojic: Observable Timing Discrepancy in HMAC Verification (CVSS 4.7, notamitgamer mojic · mojic)
- [CVE-2026-41894](https://cve.now/CVE-2026-41894.md): SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in \`/export/\` Endpoint (CVSS 7.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-41421](https://cve.now/CVE-2026-41421.md): SiYuan Desktop Notification XSS Leads to Electron RCE (CVSS 8.8, siyuan-note siyuan)
- [CVE-2026-41419](https://cve.now/CVE-2026-41419.md): 4ga Boards: Import Path Traversal Leads to Arbitrary File Read (CVSS 7.6, RARgames 4gaBoards)
- [CVE-2026-41418](https://cve.now/CVE-2026-41418.md): 4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint (CVSS 5.3, RARgames 4gaBoards)
- [CVE-2026-41326](https://cve.now/CVE-2026-41326.md): Kata Containers: CopyFile Policy Subversion via Symlinks (CVSS 8.2, kata-containers · github.com/kata-containers/kata-containers)
- [CVE-2026-41416](https://cve.now/CVE-2026-41416.md): PJSIP: Asymmetric ptime integer overflow in Media Stream (CVSS 8.1, pjsip pjproject)
- [CVE-2026-41415](https://cve.now/CVE-2026-41415.md): PJSIP: SIP Multipart CID URI Length Underflow (CVSS 6.7, pjsip pjproject)
- [CVE-2026-41414](https://cve.now/CVE-2026-41414.md): Skim: Arbitrary code execution via pull\_request\_target fork checkout in pr.yml (CVSS 7.4, skim-rs skim)
- [CVE-2026-41492](https://cve.now/CVE-2026-41492.md): Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph (CVSS 9.8, dgraph-io dgraph · github.com/dgraph-io/dgraph +3)
- [CVE-2026-41327](https://cve.now/CVE-2026-41327.md): Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field (CVSS 9.1, dgraph-io dgraph · github.com/dgraph-io/dgraph +3)
- [CVE-2026-41328](https://cve.now/CVE-2026-41328.md): Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field (CVSS 9.1, dgraph-io dgraph · github.com/dgraph-io/dgraph/v25 +3)
- [CVE-2026-33666](https://cve.now/CVE-2026-33666.md): Zserio: Integer Overflow in BitStreamReader on 32-bit platforms (CVSS 7.5, ndsev zserio)
- [CVE-2026-33524](https://cve.now/CVE-2026-33524.md): Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization (CVSS 7.5, ndsev zserio · io.github.ndsev:zserio-runtime)
- [CVE-2026-33662](https://cve.now/CVE-2026-33662.md): OP-TEE: RSASSA EMSA- PKCS1-v1\_5 underflow in emsa\_pkcs1\_v1\_5\_encode() (CVSS 7.5, OP-TEE optee\_os)
- [CVE-2026-41907](https://cve.now/CVE-2026-41907.md): uuid: Missing buffer bounds check in \`v3\`/\`v5\`/\`v6\` when \`buf\` is provided (CVSS 8.1, uuidjs uuid · uuid)
- [CVE-2026-42042](https://cve.now/CVE-2026-42042.md): Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in \`withXSRFToken\` Boolean Coercion (CVSS 5.4, axios)
- [CVE-2026-42039](https://cve.now/CVE-2026-42039.md): Axios: unbounded recursion in toFormData causes DoS via deeply nested request data (CVSS 6.9, axios)
- [CVE-2026-42036](https://cve.now/CVE-2026-42036.md): Axios: HTTP adapter streamed responses bypass maxContentLength (CVSS 5.3, axios)
- [CVE-2026-42034](https://cve.now/CVE-2026-42034.md): Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 (CVSS 5.3, axios)
- [CVE-2026-42037](https://cve.now/CVE-2026-42037.md): Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream (CVSS 5.3, axios)
- [CVE-2026-42038](https://cve.now/CVE-2026-42038.md): Axios: no\_proxy bypass via IP alias allows SSRF (CVSS 6.8, axios)
- [CVE-2026-42041](https://cve.now/CVE-2026-42041.md): Axios: Authentication Bypass via Prototype Pollution Gadget in \`validateStatus\` Merge Strategy (CVSS 4.8, axios)
- [CVE-2026-42043](https://cve.now/CVE-2026-42043.md): Axios: Incomplete Fix for CVE-2025-62718 — NO\_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 (CVSS 7.2, axios)
- [CVE-2026-42044](https://cve.now/CVE-2026-42044.md): Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in \`parseReviver\` (CVSS 6.5, axios)
- [CVE-2026-42040](https://cve.now/CVE-2026-42040.md): Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams (CVSS 3.7, axios)
- [CVE-2026-42035](https://cve.now/CVE-2026-42035.md): Axios: Header Injection via Prototype Pollution (CVSS 7.4, axios)
- [CVE-2026-42033](https://cve.now/CVE-2026-42033.md): Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking (CVSS 7.4, axios)
- [CVE-2026-41680](https://cve.now/CVE-2026-41680.md): Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer (CVSS 8.7, markedjs marked · marked)
- [CVE-2026-41898](https://cve.now/CVE-2026-41898.md): rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peer (CVSS 8.3, rust-openssl · openssl)
- [CVE-2026-41681](https://cve.now/CVE-2026-41681.md): rust-openssl: MdCtxRef::digest\_final() writes past caller buffer with no length check (CVSS 8.1, rust-openssl · openssl)
- [CVE-2026-41678](https://cve.now/CVE-2026-41678.md): rust-openssl: Incorrect bounds assertion in aes key wrap (CVSS 7.2, rust-openssl · openssl)
- [CVE-2026-41677](https://cve.now/CVE-2026-41677.md): rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length (CVSS 1.7, rust-openssl · openssl)
- [CVE-2026-41676](https://cve.now/CVE-2026-41676.md): rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 (CVSS 7.2, rust-openssl · openssl)
- [CVE-2026-41140](https://cve.now/CVE-2026-41140.md): Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4 (CVSS 0.6, python-poetry poetry · poetry)
- [CVE-2026-41322](https://cve.now/CVE-2026-41322.md): @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed (CVSS 5.3, withastro astro · @astrojs/node)
- [CVE-2026-41321](https://cve.now/CVE-2026-41321.md): @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint (CVSS 2.2, withastro @astrojs/cloudflare · @astrojs/cloudflare)
- [CVE-2026-41067](https://cve.now/CVE-2026-41067.md): Astro: XSS via incomplete \`\</script\>\` sanitization in \`define:vars\` allows case-insensitive and whitespace-based bypass (CVSS 6.1, withastro astro · astro)
- [CVE-2026-41079](https://cve.now/CVE-2026-41079.md): OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users (CVSS 4.3, OpenPrinting cups)
- [CVE-2026-41411](https://cve.now/CVE-2026-41411.md): Vim: Command injection via backtick expansion in tag filenames (CVSS 6.6, vim)
- [CVE-2026-40897](https://cve.now/CVE-2026-40897.md): Math.js: Unsafe object property setter in mathjs (CVSS 8.8, josdejong mathjs · mathjs)
- [CVE-2026-41066](https://cve.now/CVE-2026-41066.md): lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files (CVSS 7.5, lxml)
- [CVE-2026-6912](https://cve.now/CVE-2026-6912.md): Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel (CVSS 8.8, AWS Ops Wheel)
- [CVE-2026-6911](https://cve.now/CVE-2026-6911.md): Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel (CVSS 9.8, AWS Ops Wheel)
- [CVE-2026-39920](https://cve.now/CVE-2026-39920.md): BridgeHead FileStore \< 24A Apache Axis2 Default Credentials RCE (CVSS 9.3, BridgeHead Software FileStore)
- [CVE-2026-31672](https://cve.now/CVE-2026-31672.md): wifi: rt2x00usb: fix devres lifetime (no CVSS, Linux)
- [CVE-2026-31671](https://cve.now/CVE-2026-31671.md): xfrm\_user: fix info leak in build\_report() (no CVSS, Linux)
- [CVE-2026-31670](https://cve.now/CVE-2026-31670.md): net: rfkill: prevent unlimited numbers of rfkill events from being created (no CVSS, Linux)
- [CVE-2026-31669](https://cve.now/CVE-2026-31669.md): mptcp: fix slab-use-after-free in \_\_inet\_lookup\_established (CVSS 9.8, Linux)
- [CVE-2026-31668](https://cve.now/CVE-2026-31668.md): seg6: separate dst\_cache for input and output paths in seg6 lwtunnel (CVSS 9.8, Linux)
- [CVE-2026-31667](https://cve.now/CVE-2026-31667.md): Input: uinput - fix circular locking dependency with ff-core (CVSS 7.8, Linux)
- [CVE-2026-31666](https://cve.now/CVE-2026-31666.md): btrfs: fix incorrect return value after changing leaf in lookup\_extent\_data\_ref() (CVSS 7.8, Linux)
- [CVE-2026-31665](https://cve.now/CVE-2026-31665.md): netfilter: nft\_ct: fix use-after-free in timeout object destroy (CVSS 7.8, Linux)
- [CVE-2026-31664](https://cve.now/CVE-2026-31664.md): xfrm: clear trailing padding in build\_polexpire() (no CVSS, Linux)
- [CVE-2026-31663](https://cve.now/CVE-2026-31663.md): xfrm: hold dev ref until after transport\_finish NF\_HOOK (CVSS 7.8, Linux)
- [CVE-2026-31662](https://cve.now/CVE-2026-31662.md): tipc: fix bc\_ackers underflow on duplicate GRP\_ACK\_MSG (CVSS 7.5, Linux)
- [CVE-2026-31661](https://cve.now/CVE-2026-31661.md): wifi: brcmsmac: Fix dma\_free\_coherent() size (no CVSS, Linux)
- [CVE-2026-31660](https://cve.now/CVE-2026-31660.md): nfc: pn533: allocate rx skb before consuming bytes (no CVSS, Linux)
- [CVE-2026-31659](https://cve.now/CVE-2026-31659.md): batman-adv: reject oversized global TT response buffers (CVSS 9.8, Linux)
- [CVE-2026-31658](https://cve.now/CVE-2026-31658.md): net: altera-tse: fix skb leak on DMA mapping error in tse\_start\_xmit() (no CVSS, Linux)
- [CVE-2026-31657](https://cve.now/CVE-2026-31657.md): batman-adv: hold claim backbone gateways by reference (CVSS 9.8, Linux)
- [CVE-2026-31656](https://cve.now/CVE-2026-31656.md): drm/i915/gt: fix refcount underflow in intel\_engine\_park\_heartbeat (CVSS 7.8, Linux)
- [CVE-2026-31655](https://cve.now/CVE-2026-31655.md): pmdomain: imx8mp-blk-ctrl: Keep the NOC\_HDCP clock enabled (no CVSS, Linux)
- [CVE-2026-31654](https://cve.now/CVE-2026-31654.md): mm/vma: fix memory leak in \_\_mmap\_region() (no CVSS, Linux)
- [CVE-2026-31653](https://cve.now/CVE-2026-31653.md): mm/damon/sysfs: dealloc repeat\_call\_control if damon\_call() fails (no CVSS, Linux)
- [CVE-2026-31652](https://cve.now/CVE-2026-31652.md): mm/damon/stat: deallocate damon\_call() failure leaking damon\_ctx (no CVSS, Linux)
- [CVE-2026-31651](https://cve.now/CVE-2026-31651.md): mmc: vub300: fix NULL-deref on disconnect (no CVSS, Linux)
- [CVE-2026-31650](https://cve.now/CVE-2026-31650.md): mmc: vub300: fix use-after-free on disconnect (no CVSS, Linux)
- [CVE-2026-31649](https://cve.now/CVE-2026-31649.md): net: stmmac: fix integer underflow in chain mode (CVSS 9.8, Linux)
- [CVE-2026-31648](https://cve.now/CVE-2026-31648.md): mm: filemap: fix nr\_pages calculation overflow in filemap\_map\_pages() (CVSS 7.8, Linux)
- [CVE-2026-31647](https://cve.now/CVE-2026-31647.md): idpf: fix PREEMPT\_RT raw/bh spinlock nesting for async VC handling (no CVSS, Linux)
- [CVE-2026-31646](https://cve.now/CVE-2026-31646.md): net: lan966x: fix page\_pool error handling in lan966x\_fdma\_rx\_alloc\_page\_pool() (no CVSS, Linux)
- [CVE-2026-31645](https://cve.now/CVE-2026-31645.md): net: lan966x: fix page pool leak in error paths (no CVSS, Linux)
- [CVE-2026-31644](https://cve.now/CVE-2026-31644.md): net: lan966x: fix use-after-free and leak in lan966x\_fdma\_reload() (CVSS 7.8, Linux)
- [CVE-2026-31643](https://cve.now/CVE-2026-31643.md): rxrpc: Fix key parsing memleak (no CVSS, Linux)
- [CVE-2026-31642](https://cve.now/CVE-2026-31642.md): rxrpc: Fix call removal to use RCU safe deletion (no CVSS, Linux)
- [CVE-2026-31641](https://cve.now/CVE-2026-31641.md): rxrpc: Fix RxGK token loading to check bounds (CVSS 7.8, Linux)
- [CVE-2026-31640](https://cve.now/CVE-2026-31640.md): rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial (CVSS 7.5, Linux)
- [CVE-2026-31639](https://cve.now/CVE-2026-31639.md): rxrpc: Fix key reference count leak from call-\>key (no CVSS, Linux)
- [CVE-2026-31638](https://cve.now/CVE-2026-31638.md): rxrpc: Only put the call ref if one was acquired (CVSS 7.5, Linux)
- [CVE-2026-31637](https://cve.now/CVE-2026-31637.md): rxrpc: reject undecryptable rxkad response tickets (CVSS 9.8, Linux)
- [CVE-2026-31636](https://cve.now/CVE-2026-31636.md): rxrpc: fix RESPONSE authenticator parser OOB read (CVSS 9.1, Linux)
- [CVE-2026-31635](https://cve.now/CVE-2026-31635.md): rxrpc: fix oversized RESPONSE authenticator length check (CVSS 7.5, Linux)
- [CVE-2026-31634](https://cve.now/CVE-2026-31634.md): rxrpc: fix reference count leak in rxrpc\_server\_keyring() (no CVSS, Linux)
- [CVE-2026-31633](https://cve.now/CVE-2026-31633.md): rxrpc: Fix integer overflow in rxgk\_verify\_response() (CVSS 9.8, Linux)
- [CVE-2026-31632](https://cve.now/CVE-2026-31632.md): rxrpc: Fix leak of rxgk context in rxgk\_verify\_response() (no CVSS, Linux)
- [CVE-2026-31631](https://cve.now/CVE-2026-31631.md): rxrpc: Fix buffer overread in rxgk\_do\_verify\_authenticator() (CVSS 8.2, Linux)
- [CVE-2026-31630](https://cve.now/CVE-2026-31630.md): rxrpc: proc: size address buffers for %pISpc output (CVSS 7.8, Linux)
- [CVE-2026-31629](https://cve.now/CVE-2026-31629.md): nfc: llcp: add missing return after LLCP\_CLOSED checks (CVSS 8.8, Linux · :linux\_kernel:)
- [CVE-2026-31628](https://cve.now/CVE-2026-31628.md): x86/CPU: Fix FPDSS on Zen1 (no CVSS, Linux)
- [CVE-2026-31627](https://cve.now/CVE-2026-31627.md): i2c: s3c24xx: check the size of the SMBUS message before using it (CVSS 7.8, Linux)
- [CVE-2026-31626](https://cve.now/CVE-2026-31626.md): staging: rtl8723bs: initialize le\_tmp64 in rtw\_BIP\_verify() (CVSS 7.1, Linux)
- [CVE-2026-31625](https://cve.now/CVE-2026-31625.md): HID: alps: fix NULL pointer dereference in alps\_raw\_event() (no CVSS, Linux)
- [CVE-2026-31624](https://cve.now/CVE-2026-31624.md): HID: core: clamp report\_size in s32ton() to avoid undefined shift (no CVSS, Linux)
- [CVE-2026-31623](https://cve.now/CVE-2026-31623.md): net: usb: cdc-phonet: fix skb frags\[\] overflow in rx\_complete() (no CVSS, Linux)
- [CVE-2026-31622](https://cve.now/CVE-2026-31622.md): NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (CVSS 8.8, Linux)
- [CVE-2026-31621](https://cve.now/CVE-2026-31621.md): bnge: return after auxiliary\_device\_uninit() in error path (no CVSS, Linux)
- [CVE-2026-31620](https://cve.now/CVE-2026-31620.md): ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 (no CVSS, Linux)
- [CVE-2026-31619](https://cve.now/CVE-2026-31619.md): ALSA: fireworks: bound device-supplied status before string array lookup (no CVSS, Linux)
- [CVE-2026-31618](https://cve.now/CVE-2026-31618.md): fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT\_VSCREENINFO (no CVSS, Linux)
- [CVE-2026-31617](https://cve.now/CVE-2026-31617.md): usb: gadget: f\_ncm: validate minimum block\_len in ncm\_unwrap\_ntb() (CVSS 5.5, Linux)
- [CVE-2026-31616](https://cve.now/CVE-2026-31616.md): usb: gadget: f\_phonet: fix skb frags\[\] overflow in pn\_rx\_complete() (no CVSS, Linux)
- [CVE-2026-31615](https://cve.now/CVE-2026-31615.md): usb: gadget: renesas\_usb3: validate endpoint index in standard request handlers (no CVSS, Linux)
- [CVE-2026-31614](https://cve.now/CVE-2026-31614.md): smb: client: fix off-by-8 bounds check in check\_wsl\_eas() (no CVSS, Linux)
- [CVE-2026-31613](https://cve.now/CVE-2026-31613.md): smb: client: fix OOB reads parsing symlink error response (CVSS 8.1, Linux)
- [CVE-2026-31612](https://cve.now/CVE-2026-31612.md): ksmbd: validate EaNameLength in smb2\_get\_ea() (CVSS 7.5, Linux)
- [CVE-2026-31611](https://cve.now/CVE-2026-31611.md): ksmbd: require 3 sub-authorities before reading sub\_auth\[2\] (CVSS 8.6, Linux)
- [CVE-2026-31610](https://cve.now/CVE-2026-31610.md): ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc (no CVSS, Linux)
- [CVE-2026-31609](https://cve.now/CVE-2026-31609.md): smb: client: avoid double-free in smbd\_free\_send\_io() after smbd\_send\_batch\_flush() (CVSS 9.8, Linux)
- [CVE-2026-31608](https://cve.now/CVE-2026-31608.md): smb: server: avoid double-free in smb\_direct\_free\_sendmsg after smb\_direct\_flush\_send\_list() (CVSS 9.8, Linux)
- [CVE-2026-31607](https://cve.now/CVE-2026-31607.md): usbip: validate number\_of\_packets in usbip\_pack\_ret\_submit() (CVSS 9.8, Linux)
- [CVE-2026-31606](https://cve.now/CVE-2026-31606.md): usb: gadget: f\_hid: don't call cdev\_init while cdev in use (no CVSS, Linux)
- [CVE-2026-31605](https://cve.now/CVE-2026-31605.md): fbdev: udlfb: avoid divide-by-zero on FBIOPUT\_VSCREENINFO (no CVSS, Linux)
- [CVE-2026-31604](https://cve.now/CVE-2026-31604.md): wifi: rtw88: fix device leak on probe failure (no CVSS, Linux)
- [CVE-2026-31603](https://cve.now/CVE-2026-31603.md): staging: sm750fb: fix division by zero in ps\_to\_hz() (no CVSS, Linux)
- [CVE-2026-31602](https://cve.now/CVE-2026-31602.md): ALSA: ctxfi: Limit PTP to a single page (CVSS 7.8, Linux)
- [CVE-2026-31601](https://cve.now/CVE-2026-31601.md): vfio/xe: Reorganize the init to decouple migration from reset (no CVSS, Linux)
- [CVE-2026-31600](https://cve.now/CVE-2026-31600.md): arm64: mm: Handle invalid large leaf mappings correctly (CVSS 7.5, Linux)
- [CVE-2026-31599](https://cve.now/CVE-2026-31599.md): media: vidtv: fix NULL pointer dereference in vidtv\_channel\_pmt\_match\_sections (no CVSS, Linux)
- [CVE-2026-31598](https://cve.now/CVE-2026-31598.md): ocfs2: fix possible deadlock between unlink and dio\_end\_io\_write (CVSS 7.5, Linux)
- [CVE-2026-31597](https://cve.now/CVE-2026-31597.md): ocfs2: fix use-after-free in ocfs2\_fault() when VM\_FAULT\_RETRY (CVSS 7.8, Linux)
- [CVE-2026-31596](https://cve.now/CVE-2026-31596.md): ocfs2: handle invalid dinode in ocfs2\_group\_extend (no CVSS, Linux)
- [CVE-2026-31595](https://cve.now/CVE-2026-31595.md): PCI: endpoint: pci-epf-vntb: Stop cmd\_handler work in epf\_ntb\_epc\_cleanup (no CVSS, Linux)
- [CVE-2026-31594](https://cve.now/CVE-2026-31594.md): PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown (no CVSS, Linux)
- [CVE-2026-31593](https://cve.now/CVE-2026-31593.md): KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (no CVSS, Linux)
- [CVE-2026-31592](https://cve.now/CVE-2026-31592.md): KVM: SEV: Protect all of sev\_mem\_enc\_register\_region() with kvm-\>lock (no CVSS, Linux)
- [CVE-2026-31591](https://cve.now/CVE-2026-31591.md): KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (no CVSS, Linux)
- [CVE-2026-31590](https://cve.now/CVE-2026-31590.md): KVM: SEV: Drop WARN on large size for KVM\_MEMORY\_ENCRYPT\_REG\_REGION (no CVSS, Linux)
- [CVE-2026-31589](https://cve.now/CVE-2026-31589.md): mm: call -\>free\_folio() directly in folio\_unmap\_invalidate() (CVSS 9.8, Linux)
- [CVE-2026-31588](https://cve.now/CVE-2026-31588.md): KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVSS 8.8, Linux)
- [CVE-2026-31587](https://cve.now/CVE-2026-31587.md): ASoC: qcom: q6apm: move component registration to unmanaged version (CVSS 7.8, Linux)
- [CVE-2026-31586](https://cve.now/CVE-2026-31586.md): mm: blk-cgroup: fix use-after-free in cgwb\_release\_workfn() (CVSS 7.8, Linux)
- [CVE-2026-31585](https://cve.now/CVE-2026-31585.md): media: vidtv: fix nfeeds state corruption on start\_streaming failure (no CVSS, Linux)
- [CVE-2026-31584](https://cve.now/CVE-2026-31584.md): media: mediatek: vcodec: fix use-after-free in encoder release path (CVSS 7.8, Linux)
- [CVE-2026-31583](https://cve.now/CVE-2026-31583.md): media: em28xx: fix use-after-free in em28xx\_v4l2\_open() (no CVSS, Linux)
- [CVE-2026-31582](https://cve.now/CVE-2026-31582.md): hwmon: (powerz) Fix use-after-free on USB disconnect (no CVSS, Linux)
- [CVE-2026-31581](https://cve.now/CVE-2026-31581.md): ALSA: 6fire: fix use-after-free on disconnect (no CVSS, Linux)
- [CVE-2026-31580](https://cve.now/CVE-2026-31580.md): bcache: fix cached\_dev.sb\_bio use-after-free and crash (no CVSS, Linux)
- [CVE-2026-31579](https://cve.now/CVE-2026-31579.md): wireguard: device: use exit\_rtnl callback instead of manual rtnl\_lock in pre\_exit (no CVSS, Linux)
- [CVE-2026-31578](https://cve.now/CVE-2026-31578.md): media: as102: fix to not free memory after the device is registered in as102\_usb\_probe() (no CVSS, Linux)
- [CVE-2026-31577](https://cve.now/CVE-2026-31577.md): nilfs2: fix NULL i\_assoc\_inode dereference in nilfs\_mdt\_save\_to\_shadow\_map (no CVSS, Linux)
- [CVE-2026-31576](https://cve.now/CVE-2026-31576.md): media: hackrf: fix to not free memory after the device is registered in hackrf\_probe() (no CVSS, Linux)
- [CVE-2026-31575](https://cve.now/CVE-2026-31575.md): mm/userfaultfd: fix hugetlb fault mutex hash calculation (no CVSS, Linux)
- [CVE-2026-31574](https://cve.now/CVE-2026-31574.md): clockevents: Add missing resets of the next\_event\_forced flag (no CVSS, Linux)
- [CVE-2026-31573](https://cve.now/CVE-2026-31573.md): media: verisilicon: Fix kernel panic due to \_\_initconst misuse (no CVSS, Linux)
- [CVE-2026-31572](https://cve.now/CVE-2026-31572.md): i2c: designware: amdisp: Fix resume-probe race condition issue (no CVSS, Linux)
- [CVE-2026-31571](https://cve.now/CVE-2026-31571.md): drm/i915: Unlink NV12 planes earlier (no CVSS, Linux)
- [CVE-2026-31570](https://cve.now/CVE-2026-31570.md): can: gw: fix OOB heap access in cgw\_csum\_crc8\_rel() (CVSS 8.8, Linux)
- [CVE-2026-31569](https://cve.now/CVE-2026-31569.md): LoongArch: KVM: Handle the case that EIOINTC's coremap is empty (CVSS 7.3, Linux)
- [CVE-2026-31568](https://cve.now/CVE-2026-31568.md): s390/mm: Add missing secure storage access fixups for donated memory (no CVSS, Linux)
- [CVE-2026-31567](https://cve.now/CVE-2026-31567.md): PM: sleep: Drop spurious WARN\_ON() from pm\_restore\_gfp\_mask() (no CVSS, Linux)
- [CVE-2026-31566](https://cve.now/CVE-2026-31566.md): drm/amdgpu: Fix fence put before wait in amdgpu\_amdkfd\_submit\_ib (CVSS 7.8, Linux)
- [CVE-2026-31565](https://cve.now/CVE-2026-31565.md): RDMA/irdma: Fix deadlock during netdev reset with active connections (no CVSS, Linux)
- [CVE-2026-31564](https://cve.now/CVE-2026-31564.md): LoongArch: KVM: Fix base address calculation in kvm\_eiointc\_regs\_access() (no CVSS, Linux)
- [CVE-2026-31563](https://cve.now/CVE-2026-31563.md): net: macb: Use dev\_consume\_skb\_any() to free TX SKBs (CVSS 7.5, Linux)
- [CVE-2026-31562](https://cve.now/CVE-2026-31562.md): drm/mediatek: dsi: Store driver data before invoking mipi\_dsi\_host\_register (no CVSS, Linux)
- [CVE-2026-31561](https://cve.now/CVE-2026-31561.md): x86/cpu: Remove X86\_CR4\_FRED from the CR4 pinned bits mask (no CVSS, Linux)
- [CVE-2026-31560](https://cve.now/CVE-2026-31560.md): spi: spi-dw-dma: fix print error log when wait finish transaction (no CVSS, Linux)
- [CVE-2026-31559](https://cve.now/CVE-2026-31559.md): LoongArch: Fix missing NULL checks for kstrdup() (no CVSS, Linux)
- [CVE-2026-31558](https://cve.now/CVE-2026-31558.md): LoongArch: KVM: Make kvm\_get\_vcpu\_by\_cpuid() more robust (CVSS 8.8, Linux)
- [CVE-2026-31557](https://cve.now/CVE-2026-31557.md): nvmet: move async event work off nvmet-wq (CVSS 7.5, Linux)
- [CVE-2026-31556](https://cve.now/CVE-2026-31556.md): xfs: scrub: unlock dquot before early return in quota scrub (no CVSS, Linux)
- [CVE-2026-31555](https://cve.now/CVE-2026-31555.md): futex: Clear stale exiting pointer in futex\_lock\_pi() retry path (no CVSS, Linux)
- [CVE-2026-31554](https://cve.now/CVE-2026-31554.md): futex: Require sys\_futex\_requeue() to have identical flags (CVSS 7.8, Linux)
- [CVE-2026-31553](https://cve.now/CVE-2026-31553.md): KVM: arm64: Fix the descriptor address in \_\_kvm\_at\_swap\_desc() (CVSS 8.8, Linux)
- [CVE-2026-31552](https://cve.now/CVE-2026-31552.md): wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (CVSS 7.5, Linux)
- [CVE-2026-31551](https://cve.now/CVE-2026-31551.md): wifi: mac80211: Fix static\_branch\_dec() underflow for aql\_disable. (no CVSS, Linux)
- [CVE-2026-31550](https://cve.now/CVE-2026-31550.md): pmdomain: bcm: bcm2835-power: Increase ASB control timeout (no CVSS, Linux)
- [CVE-2026-31549](https://cve.now/CVE-2026-31549.md): i2c: cp2615: fix serial string NULL-deref at probe (no CVSS, Linux)
- [CVE-2026-31548](https://cve.now/CVE-2026-31548.md): wifi: cfg80211: cancel pmsr\_free\_wk in cfg80211\_pmsr\_wdev\_down (CVSS 7.8, Linux)
- [CVE-2026-31547](https://cve.now/CVE-2026-31547.md): drm/xe: Fix missing runtime PM reference in ccs\_mode\_store (no CVSS, Linux)
- [CVE-2026-31546](https://cve.now/CVE-2026-31546.md): net: bonding: fix NULL deref in bond\_debug\_rlb\_hash\_show (no CVSS, Linux)
- [CVE-2026-31545](https://cve.now/CVE-2026-31545.md): NFC: nxp-nci: allow GPIOs to sleep (no CVSS, Linux)
- [CVE-2026-31544](https://cve.now/CVE-2026-31544.md): firmware: arm\_scmi: Fix NULL dereference on notify error path (no CVSS, Linux)
- [CVE-2026-31543](https://cve.now/CVE-2026-31543.md): crash\_dump: don't log dm-crypt key bytes in read\_key\_from\_user\_keying (no CVSS, Linux)
- [CVE-2026-31542](https://cve.now/CVE-2026-31542.md): x86/platform/uv: Handle deconfigured sockets (no CVSS, Linux)
- [CVE-2026-31541](https://cve.now/CVE-2026-31541.md): tracing: Fix trace\_marker copy link list updates (no CVSS, Linux)
- [CVE-2026-31540](https://cve.now/CVE-2026-31540.md): drm/i915/gt: Check set\_default\_submission() before deferencing (no CVSS, Linux)
- [CVE-2026-31539](https://cve.now/CVE-2026-31539.md): smb: smbdirect: introduce smbdirect\_socket.recv\_io.credits.available (CVSS 7.5, Linux)
- [CVE-2026-31538](https://cve.now/CVE-2026-31538.md): smb: server: make use of smbdirect\_socket.recv\_io.credits.available (CVSS 7.5, Linux)
- [CVE-2026-31537](https://cve.now/CVE-2026-31537.md): smb: server: make use of smbdirect\_socket.send\_io.bcredits (no CVSS, Linux)
- [CVE-2026-31536](https://cve.now/CVE-2026-31536.md): smb: server: let send\_done handle a completion without IB\_SEND\_SIGNALED (CVSS 9.8, Linux)
- [CVE-2026-31535](https://cve.now/CVE-2026-31535.md): smb: client: make use of smbdirect\_socket.recv\_io.credits.available (no CVSS, Linux)
- [CVE-2026-25660](https://cve.now/CVE-2026-25660.md): Authentication bypass for certain API calls (CVSS 9.3, Ericsson CodeChecker · codechecker)
- [CVE-2026-21515](https://cve.now/CVE-2026-21515.md): Azure IoT Central Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure IOT Central)
- [CVE-2026-38743](https://cve.now/CVE-2026-38743.md): Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-40690](https://cve.now/CVE-2026-40690.md): Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-5265](https://cve.now/CVE-2026-5265.md): Ovn: ovn: heap over-read in icmp error response generation (CVSS 6.5, Fast Datapath for Red Hat Enterprise Linux · Red Hat Fast D…)
- [CVE-2026-5367](https://cve.now/CVE-2026-5367.md): Ovn: ovn: information disclosure via crafted dhcpv6 packets (CVSS 8.6, Fast Datapath for Red Hat Enterprise Linux · Red Hat Fas… +1)
- [CVE-2026-4313](https://cve.now/CVE-2026-4313.md): Stored XSS in AdaptiveGRC (CVSS 2.4, C&F AdaptiveGRC)
- [CVE-2026-6043](https://cve.now/CVE-2026-6043.md): Insecure Default Configuration in P4 Server (CVSS 8.8, Perforce Helix Core Server)
- [CVE-2026-23902](https://cve.now/CVE-2026-23902.md): Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. (CVSS 8.1, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2025-62233](https://cve.now/CVE-2025-62233.md): Apache DolphinScheduler: Deserialization of untrusted data in RPC (CVSS 6.3, Apache Software Foundation Apache DolphinScheduler · org… +1)
- [CVE-2026-41044](https://cve.now/CVE-2026-41044.md): Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia (CVSS 8.8, Apache Software Foundation Apache ActiveMQ · org.apache.… +2)
- [CVE-2026-41043](https://cve.now/CVE-2026-41043.md): Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues (CVSS 6.5, Apache Software Foundation Apache ActiveMQ · org.apache.… +2)
- [CVE-2026-40466](https://cve.now/CVE-2026-40466.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI (CVSS 8.8, Apache Software Foundation Apache ActiveMQ Broker · Apac… +4)
- [CVE-2026-6272](https://cve.now/CVE-2026-6272.md): A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream (CVSS 8.5, Eclipse Foundation Eclipse KUKSA - Databroker)
- [CVE-2026-21728](https://cve.now/CVE-2026-21728.md): Tempo query limit results in unbounded memory allocation (CVSS 7.5, Grafana Tempo · Grafana Enterprise Traces +1)
- [CVE-2026-3569](https://cve.now/CVE-2026-3569.md): Liaison Site Prober \<= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint (CVSS 5.3, Liaison Site Prober)
- [CVE-2026-4078](https://cve.now/CVE-2026-4078.md): ITERAS \<= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ITERAS)
- [CVE-2026-3565](https://cve.now/CVE-2026-3565.md): Taqnix \<= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix\_delete\_my\_account' AJAX Action (CVSS 4.3, Taqnix)
- [CVE-2025-11762](https://cve.now/CVE-2025-11762.md): HubSpot All-In-One Marketing - Forms, Popups, Live Chat \<= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure (CVSS 4.3, hubspotdev HubSpot All-In-One Marketing – Forms, Popups, Li…)
- [CVE-2026-1951](https://cve.now/CVE-2026-1951.md): No checking of the length of the buffer with the directory name in AS320T (CVSS 9.8, DeltaWW AS320T)
- [CVE-2026-1952](https://cve.now/CVE-2026-1952.md): Denial of service via the undocumented subfunction in AS320T (CVSS 9.8, DeltaWW AS320T)
- [CVE-2026-1950](https://cve.now/CVE-2026-1950.md): No checking of the length of the buffer with the file name in AS320T (CVSS 9.8, DeltaWW AS320T)
- [CVE-2026-1949](https://cve.now/CVE-2026-1949.md): Incorrect calculation of buffer size on the stack in AS320T (CVSS 9.8, DeltaWW AS320T)
- [CVE-2026-5428](https://cve.now/CVE-2026-5428.md): Royal Addons for Elementor \<= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-6810](https://cve.now/CVE-2026-6810.md): Booking Calendar Contact Form \<= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover (CVSS 5.3, codepeople Booking Calendar Contact Form)
- [CVE-2026-5347](https://cve.now/CVE-2026-5347.md): WP Books Gallery \<= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink\_structure' Parameter (CVSS 5.3, mhmrajib WP Books Gallery – Build Stunning Book Showcases &…)
- [CVE-2026-5364](https://cve.now/CVE-2026-5364.md): Drag and Drop File Upload for Contact Form 7 \<= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize\_file\_name Bypass (CVSS 8.1, addonsorg Drag and Drop File Upload for Contact Form)
- [CVE-2026-6947](https://cve.now/CVE-2026-6947.md): D-Link｜DWM-222W USB Wi-Fi Adapter - Brute-Force Protection Bypass (CVSS 8.7, D-Link DWM-222W)
- [CVE-2026-41324](https://cve.now/CVE-2026-41324.md): basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() (CVSS 7.5, patrickjuchli basic-ftp · basic-ftp)
- [CVE-2026-41485](https://cve.now/CVE-2026-41485.md): Kyverno Controller Denial of Service via forEach Mutation Panic (CVSS 7.7, kyverno · github.com/kyverno/kyverno)
- [CVE-2026-2028](https://cve.now/CVE-2026-2028.md): Maxi Blocks \<= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old\_media\_src' Parameter (CVSS 5.3, ckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns…)
- [CVE-2026-5488](https://cve.now/CVE-2026-5488.md): ExactMetrics \<= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics\_ads\_get\_token' (CVSS 5.3, smub ExactMetrics – Google Analytics Dashboard for WordPress)
- [CVE-2026-6393](https://cve.now/CVE-2026-6393.md): BetterDocs \<= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage (CVSS 4.3, wpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…)
- [CVE-2026-41323](https://cve.now/CVE-2026-41323.md): Kyverno: ServiceAccount token leaked to external servers via apiCall service URL (CVSS 8.1, kyverno · github.com/kyverno/kyverno)
- [CVE-2026-41068](https://cve.now/CVE-2026-41068.md): Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) (CVSS 7.7, kyverno · github.com/kyverno/kyverno)
- [CVE-2026-41319](https://cve.now/CVE-2026-41319.md): MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade (CVSS 6.5, jstedfast MailKit · MailKit)
- [CVE-2026-41318](https://cve.now/CVE-2026-41318.md): AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component (CVSS 5.4, Mintplex-Labs anything-llm)
- [CVE-2026-41430](https://cve.now/CVE-2026-41430.md): Press vulnerable to reflected XSS on login redirection (CVSS 1.3, frappe press)
- [CVE-2026-41317](https://cve.now/CVE-2026-41317.md): Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation (CVSS 6.6, frappe press)
- [CVE-2026-41316](https://cve.now/CVE-2026-41316.md): ERB has an @\_init deserialization guard bypass via def\_module / def\_method / def\_class (CVSS 8.1, ruby erb · erb)
- [CVE-2026-41309](https://cve.now/CVE-2026-41309.md): Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing (CVSS 8.2, opensource-socialnetwork)
- [CVE-2026-41305](https://cve.now/CVE-2026-41305.md): PostCSS has XSS via Unescaped \</style\> in its CSS Stringify Output (CVSS 6.1, postcss)
- [CVE-2026-40254](https://cve.now/CVE-2026-40254.md): FreeRDP: contains\_dotdot() off-by-one allows drive channel path traversal via terminal .. (CVSS 4.2, FreeRDP)
- [CVE-2026-33317](https://cve.now/CVE-2026-33317.md): OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure (CVSS 8.7, OP-TEE optee\_os)
- [CVE-2026-33318](https://cve.now/CVE-2026-33318.md): Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers (CVSS 8.8, actualbudget actual · @actual-app/sync-server)
- [CVE-2026-33208](https://cve.now/CVE-2026-33208.md): Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint (CVSS 7.4, roxy-wi)
- [CVE-2026-33078](https://cve.now/CVE-2026-33078.md): Roxy-WI has SQL Injection in haproxy\_section\_save Endpoint via Unsanitized server\_ip Parameter (CVSS 8.9, roxy-wi)
- [CVE-2026-33077](https://cve.now/CVE-2026-33077.md): Roxy-WI has an arbitrary file read vulnerability (CVSS 7.7, roxy-wi)
- [CVE-2026-33076](https://cve.now/CVE-2026-33076.md): Roxy-WI vulnerable to path traversal and arbitrary file writing (CVSS 8.9, roxy-wi)
- [CVE-2026-32952](https://cve.now/CVE-2026-32952.md): go-ntlmssp NTLM challenges can panic on malformed payloads (CVSS 5.3, Azure go-ntlmssp · github.com/Azure/go-ntlmssp)
- [CVE-2026-41325](https://cve.now/CVE-2026-41325.md): Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection (CVSS 7.1, getkirby kirby · getkirby/cms)
- [CVE-2026-40099](https://cve.now/CVE-2026-40099.md): Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter (CVSS 5.3, getkirby kirby · getkirby/cms)
- [CVE-2026-34587](https://cve.now/CVE-2026-34587.md): Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering (CVSS 7.6, getkirby kirby · getkirby/cms)
- [CVE-2026-32870](https://cve.now/CVE-2026-32870.md): Kirby has XML injection in its XML creator toolkit (CVSS 6.9, getkirby kirby · getkirby/cms)
- [CVE-2026-31956](https://cve.now/CVE-2026-31956.md): Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization (CVSS 4.3, xibosignage xibo-cms)
- [CVE-2026-31955](https://cve.now/CVE-2026-31955.md): Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality (CVSS 4.9, xibosignage xibo-cms)
- [CVE-2026-31953](https://cve.now/CVE-2026-31953.md): Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login (CVSS 6.4, xibosignage xibo-cms)
- [CVE-2026-25775](https://cve.now/CVE-2026-25775.md): SenseLive X3050 Missing authentication for critical function (CVSS 9.3, SenseLive X3050)
- [CVE-2026-31952](https://cve.now/CVE-2026-31952.md): Xibo CMS API has SQL Injection via DataSet Filter Parameter (CVSS 7.6, xibosignage xibo-cms)
- [CVE-2026-35064](https://cve.now/CVE-2026-35064.md): SenseLive X3050 Missing authentication for critical function (CVSS 8.7, SenseLive X3050)
- [CVE-2026-40620](https://cve.now/CVE-2026-40620.md): SenseLive X3050 Missing authentication for critical function (CVSS 9.3, SenseLive X3050)
- [CVE-2026-27841](https://cve.now/CVE-2026-27841.md): SenseLive X3050 Cross-Site request forgery (CVSS 8.4, SenseLive X3050)
- [CVE-2026-29051](https://cve.now/CVE-2026-29051.md): melange has Path Traversal via .PKGINFO in --persist-lint-results (CVSS 4.4, chainguard-dev melange · chainguard.dev/melange)
- [CVE-2025-59308](https://cve.now/CVE-2025-59308.md): In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site (CVSS 4.7)
- [CVE-2025-61872](https://cve.now/CVE-2025-61872.md): Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. (CVSS 6.1)
- [CVE-2025-67259](https://cve.now/CVE-2025-67259.md): A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthor (CVSS 6.5)
- [CVE-2026-30368](https://cve.now/CVE-2026-30368.md): A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by (CVSS 5.4, Lightspeed Classroom)
- [CVE-2026-31050](https://cve.now/CVE-2026-31050.md): Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code (CVSS 4.9)
- [CVE-2026-31051](https://cve.now/CVE-2026-31051.md): An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component (CVSS 3.8)
- [CVE-2026-31052](https://cve.now/CVE-2026-31052.md): An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow (CVSS 5.3)
- [CVE-2026-42095](https://cve.now/CVE-2026-42095.md): bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL. (CVSS 4.0, KDE Arianna)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.