# CVEs published 2026-04-25

40 CVEs were published on April 25, 2026: 3 critical, 10 high. Days are UTC.

- [CVE-2026-7002](https://cve.now/CVE-2026-7002.md): KLiK SocialMediaWebsite Private Message get\_message\_ajax.php sql injection (CVSS 6.9, KLiK SocialMediaWebsite)
- [CVE-2026-7001](https://cve.now/CVE-2026-7001.md): Datacom DM4100 Ethernet Configuration cross site scripting (CVSS 4.8, Datacom DM4100)
- [CVE-2026-7000](https://cve.now/CVE-2026-7000.md): Datacom DM4100 VLAN Page cross site scripting (CVSS 4.8, Datacom DM4100)
- [CVE-2026-6999](https://cve.now/CVE-2026-6999.md): BIVOCOM TR321 Wireless Setting cross site scripting (CVSS 4.8, BIVOCOM TR321)
- [CVE-2026-6998](https://cve.now/CVE-2026-6998.md): BDCOM P3310D New RMON Statistics cross site scripting (CVSS 4.8, BDCOM P3310D)
- [CVE-2026-6997](https://cve.now/CVE-2026-6997.md): BDCOM P3310D New RMON History cross site scripting (CVSS 4.8, BDCOM P3310D)
- [CVE-2026-6996](https://cve.now/CVE-2026-6996.md): BDCOM P3310D rmon event Tab cross site scripting (CVSS 4.8, BDCOM P3310D)
- [CVE-2026-6995](https://cve.now/CVE-2026-6995.md): BDCOM P3310D New User index.asp cross site scripting (CVSS 4.8, BDCOM P3310D)
- [CVE-2026-6994](https://cve.now/CVE-2026-6994.md): Envoy Query Parameter header\_mutation.cc params.add injection (CVSS 5.3, Envoy)
- [CVE-2026-6993](https://cve.now/CVE-2026-6993.md): go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy (CVSS 6.9, go-kratos kratos · github.com/go-kratos/kratos/v2)
- [CVE-2026-6992](https://cve.now/CVE-2026-6992.md): Linksys MR9600 JNAP Action run\_central2.sh BTRequestGetSmartConnectStatus os command injection (CVSS 8.6, Linksys MR9600)
- [CVE-2026-6991](https://cve.now/CVE-2026-6991.md): colinhacks Zod CUID Data Type regexes.ts sql injection (CVSS 5.3, colinhacks Zod)
- [CVE-2026-6990](https://cve.now/CVE-2026-6990.md): projeto-siga novo cross site scripting (CVSS 5.1, projeto-siga siga)
- [CVE-2026-6989](https://cve.now/CVE-2026-6989.md): Tenda F453 Telnet Service telnet TendaTelnet command injection (CVSS 5.3, Tenda F453)
- [CVE-2026-6988](https://cve.now/CVE-2026-6988.md): Tenda HG10 Boa Service formRouting formRoute buffer overflow (CVSS 8.7, Tenda HG10)
- [CVE-2026-6987](https://cve.now/CVE-2026-6987.md): PicoClaw Web Launcher Management Plane restart command injection (CVSS 6.9, PicoClaw · github.com/sipeed/picoclaw)
- [CVE-2026-6986](https://cve.now/CVE-2026-6986.md): Cesanta Mongoose GCM Authentication Tag tls\_aes128.c mg\_aes\_gcm\_decrypt signature verification (CVSS 6.3, Cesanta Mongoose)
- [CVE-2026-6985](https://cve.now/CVE-2026-6985.md): Cesanta Mongoose TCP Option net\_builtin.c handle\_opt infinite loop (CVSS 6.9, Cesanta Mongoose)
- [CVE-2026-6984](https://cve.now/CVE-2026-6984.md): AstrBotDevs AstrBot Dashboard API t2i.py create\_template special elements used in a template engine (CVSS 5.1, AstrBotDevs AstrBot · astrbot)
- [CVE-2026-6983](https://cve.now/CVE-2026-6983.md): pagekit download server-side request forgery (CVSS 5.1, pagekit)
- [CVE-2026-6982](https://cve.now/CVE-2026-6982.md): star7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injection (CVSS 5.3, star7th ShowDoc · showdoc/showdoc)
- [CVE-2026-6981](https://cve.now/CVE-2026-6981.md): IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync\_agents server-side request forgery (CVSS 5.3, IhateCreatingUserNames2 AiraHub2)
- [CVE-2026-6980](https://cve.now/CVE-2026-6980.md): Divyanshu-hash GitPilot-MCP main.py repo\_path command injection (CVSS 6.9, Divyanshu-hash GitPilot-MCP)
- [CVE-2026-6979](https://cve.now/CVE-2026-6979.md): devlikeapro WAHA API Request media.controller.ts server-side request forgery (CVSS 5.3, devlikeapro WAHA)
- [CVE-2026-6978](https://cve.now/CVE-2026-6978.md): JiZhiCMS addcache.html htmlspecialchars\_decode sql injection (CVSS 5.1, JiZhiCMS)
- [CVE-2026-6977](https://cve.now/CVE-2026-6977.md): vanna-ai vanna Legacy Flask API improper authorization (CVSS 6.9, vanna-ai vanna)
- [CVE-2026-31685](https://cve.now/CVE-2026-31685.md): netfilter: ip6t\_eui64: reject invalid MAC header for all packets (CVSS 9.4, Linux)
- [CVE-2026-31684](https://cve.now/CVE-2026-31684.md): net: sched: act\_csum: validate nested VLAN headers (no CVSS, Linux)
- [CVE-2026-31683](https://cve.now/CVE-2026-31683.md): batman-adv: avoid OGM aggregation when skb tailroom is insufficient (CVSS 7.8, Linux)
- [CVE-2026-31682](https://cve.now/CVE-2026-31682.md): bridge: br\_nd\_send: linearize skb before parsing ND options (CVSS 9.1, Linux)
- [CVE-2026-31681](https://cve.now/CVE-2026-31681.md): netfilter: xt\_multiport: validate range encoding in checkentry (no CVSS, Linux)
- [CVE-2026-31680](https://cve.now/CVE-2026-31680.md): net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVSS 7.8, Linux)
- [CVE-2026-31679](https://cve.now/CVE-2026-31679.md): openvswitch: validate MPLS set/set\_masked payload length (CVSS 7.1, Linux)
- [CVE-2026-31678](https://cve.now/CVE-2026-31678.md): openvswitch: defer tunnel netdev\_put to RCU release (CVSS 7.8, Linux)
- [CVE-2026-31677](https://cve.now/CVE-2026-31677.md): crypto: af\_alg - limit RX SG extraction by receive buffer budget (no CVSS, Linux)
- [CVE-2026-31676](https://cve.now/CVE-2026-31676.md): rxrpc: only handle RESPONSE during service challenge (CVSS 7.5, Linux)
- [CVE-2026-31675](https://cve.now/CVE-2026-31675.md): net/sched: sch\_netem: fix out-of-bounds access in packet corruption (CVSS 7.8, Linux)
- [CVE-2026-31674](https://cve.now/CVE-2026-31674.md): netfilter: ip6t\_rt: reject oversized addrnr in rt\_mt6\_check() (CVSS 7.1, Linux)
- [CVE-2026-31673](https://cve.now/CVE-2026-31673.md): af\_unix: read UNIX\_DIAG\_VFS data under unix\_state\_lock (CVSS 7.8, Linux)
- [CVE-2026-6951](https://cve.now/CVE-2026-6951.md): Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for \[CVE-2022-25912\] (CVSS 9.2, simple-git · org.webjars.npm:simple-git)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.