CVEs published April 26, 2026
79 CVEs were published on April 26, 2026: 2 critical, 19 high.
- Published
- 79
- Critical
- 2
- High
- 19
- Medium
- 58
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Tenda F456
- 11
- MaxSite CMS
- 6
- 666ghj MiroFish
- 4
- GreenCMS
- 2
- SmythOS sre
- 2
- Tenda FH1202
- 2
- tufantunc ssh-mcp
- 2
- Acutesystems CrossFont
- 1
- Acutesystems TransMac
- 1
- AgentDeskAI browser-tools-mcp
- 1
Critical 2
High 19
- CVE-2026-7068D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflowD-Link DIR-825
- CVE-2026-7057Tenda F456 httpd setcfm buffer overflowTenda F456
- CVE-2026-7056Tenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflowTenda F456
- CVE-2026-7055Tenda F456 httpd VirtualSer fromVirtualSer buffer overflowTenda F456
- CVE-2026-7054Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflowTenda F456
- CVE-2026-7053Tenda F456 httpd L7Prot frmL7ProtForm buffer overflowTenda F456
- CVE-2018-25294CEWE Photoshow 6.3.4 Buffer Overflow Denial of ServiceCewe-Photoworld CEWE Photoshow
- CVE-2018-25283iSmartViewPro 1.5 Buffer Overflow via SavePath ParameterSecurimport iSmartViewPro
- CVE-2018-25263Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEHFaleemi Desktop Software
- CVE-2026-7039tufantunc ssh-mcp index.ts shell.write command injectiontufantunc ssh-mcp
- CVE-2026-7035Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflowTenda FH1202
- CVE-2026-7034Tenda FH1202 httpd WrlExtraSet stack-based overflowTenda FH1202
- CVE-2026-7033Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflowTenda F456
- CVE-2026-7032Tenda F456 SafeEmailFilter buffer overflowTenda F456
- CVE-2026-7031Tenda F456 SafeMacFilter fromSafeMacFilter buffer overflowTenda F456
- CVE-2026-7030Tenda F456 RouteStatic fromRouteStatic buffer overflowTenda F456
- CVE-2026-7029Tenda F456 addressNat fromaddressNat buffer overflowTenda F456
- CVE-2026-7019Tenda F456 P2pListFilter fromP2pListFilter buffer overflowTenda F456
- CVE-2026-42255Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.Technitium DnsServer
Medium, low and unrated 58
- CVE-2026-7067D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injectionD-Link DIR-822
- CVE-2026-7066choieastsea simple-openstack-mcp server.py exec_openstack os command injectionchoieastsea simple-openstack-mcp
- CVE-2026-7065BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgeryBidingCC BuildingAI
- CVE-2026-7064AgentDeskAI browser-tools-mcp browser-connector.ts os command injectionAgentDeskAI browser-tools-mcp
- CVE-2026-7063code-projects Employee Management System Endpoint eprocess.php sql injectioncode-projects Employee Management System
- CVE-2026-7062Intina47 context-sync Git Integration git-integration.ts os command injectionIntina47 context-sync
- CVE-2026-7061Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injectionToowiredd chatgpt-mcp-server
- CVE-2026-7060liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injectionliyupi yu-picture
- CVE-2026-7059666ghj MiroFish Query Parameter simulation.py get_simulation_posts path traversal666ghj MiroFish
- CVE-2026-7058666ghj MiroFish Inter-Process Communication simulation_ipc.py SimulationIPCClient.send_command command injection666ghj MiroFish
- CVE-2026-7045baomidou dynamic-datasource StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injectionbaomidou dynamic-datasource · com.baomidou:dynamic-datasour…
- CVE-2026-7044GreenCMS index.php themeadd unrestricted uploadGreenCMS
- CVE-2018-25297Wansview 1.0.2 Denial of Service via Buffer OverflowWansview
- CVE-2018-25296P10 Central Management Software 1.4.13 Denial of ServiceP10 Central Management Software
- CVE-2018-25295ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP FieldP10 ObserverIP Scan Tool
- CVE-2018-25293Prime95 29.4b7 Denial of Service via Proxy Password FieldMersenne Prime95
- CVE-2018-25292Bome Restorator 1793 Denial of Service via Buffer OverflowBome Restorator
- CVE-2018-25291Project64 2.3.2 Denial of Service via Plugin DirectoryPj64-Emu Project64
- CVE-2018-25290Easyboot 6.6.0 Buffer Overflow Denial of ServiceEzbsystems Easyboot
- CVE-2018-25289Softdisk 3.0.3 Buffer Overflow Denial of ServiceEzbsystems Softdisk
- CVE-2018-25288StyleWriter 1.0 Denial of Service via Pattern InputEditorsoftware StyleWriter
- CVE-2018-25287Drive Power Manager 1.10 Denial of Service via Name FieldHdtune Drive Power Manager
- CVE-2018-25286Easy PhotoResQ 1.0 Buffer Overflow Denial of ServiceHdtune Easy PhotoResQ
- CVE-2018-25285Fathom 2.4 Denial of Service via Authorization Code Buffer OverflowFathom
- CVE-2018-25284HD Tune Pro 5.70 Denial of Service via Options DialogHdtune HD Tune Pro
- CVE-2018-25282Nmap 7.70 Denial of Service via XML Entity ExpansionZenMap
- CVE-2018-25281iCash 7.6.5 Denial of Service via Connect to ServerMaxprog iCash
- CVE-2018-25280Infiltrator Network Security Scanner 4.6 Denial of ServiceInfiltration-Systems Infiltrator Network Security Scanner
- CVE-2018-25279jiNa OCR Image to Text 1.0 Denial of Service via PNGConvertimagetotext jiNa OCR Image to Text
- CVE-2018-25278PicaJet FX 2.6.5 Denial of Service via Registration FieldsPicaJet FX
- CVE-2018-25277PixGPS 1.1.8 Buffer Overflow Denial of ServiceBr-Software PixGPS
- CVE-2018-25276RoboImport 1.2.0.72 Denial of Service via Registration FieldsPicajet RoboImport
- CVE-2018-25275Faleemi Plus 1.0.2 Denial of Service via Buffer OverflowFaleemi Plus
- CVE-2018-25274InfraRecorder 0.53 Denial of Service via txt File ImportInfraRecorder
- CVE-2018-25273CrossFont 7.5 Denial of Service via License Key FieldAcutesystems CrossFont
- CVE-2018-25264TransMac 12.2 Denial of Service via License Key FieldAcutesystems TransMac
- CVE-2026-7043GreenCMS index.php pluginAddLocal unrestricted uploadGreenCMS
- CVE-2026-7042666ghj MiroFish REST API Endpoint __init__.py create_app missing authentication666ghj MiroFish
- CVE-2026-7041666ghj MiroFish Werkzeug Debugger PIN console information disclosure666ghj MiroFish
- CVE-2026-7038tufantunc ssh-mcp Command Line index.ts insufficiently protected credentialstufantunc ssh-mcp
- CVE-2026-7036Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversalTenda i9
- CVE-2026-7028CodeAstro Online Job Portal All Jobs delete-jobs.php sql injectionCodeAstro Online Job Portal
- CVE-2026-7027D-Link DSL-2740R Wireless Setup Section cross site scriptingD-Link DSL-2740R
- CVE-2026-7026D-Link DGS-3420 System Information Settings cross site scriptingD-Link DGS-3420
- CVE-2026-7025Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgeryTypecho
- CVE-2026-7024rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversalrawchen sims
- CVE-2026-7023ByteDance coze-studio databaseTool database_impl.go ExecuteSQL sql injectionByteDance coze-studio
- CVE-2026-7022SmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authenticationSmythOS sre
- CVE-2026-7021SmythOS sre Connector Service utils.ts information disclosureSmythOS sre
- CVE-2026-7020Ollama Tensor Model Transfer transfer.go digestToPath path traversalOllama · github.com/ollama/ollama
- CVE-2026-7018Datavane Datavines JWT Token TokenManager.java hard-coded keyDatavane Datavines
- CVE-2026-7016MaxSite CMS ushki Plugin cross site scriptingMaxSite CMS
- CVE-2026-7015MaxSite CMS Guestbook Plugin cross site scriptingMaxSite CMS
- CVE-2026-42254Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query thatHickory Project Hickory DNS · hickory-recursor
- CVE-2026-7014MaxSite CMS down_count Plugin cross site scriptingMaxSite CMS
- CVE-2026-7013MaxSite CMS mail_send Plugin cross site scriptingMaxSite CMS
- CVE-2026-7012MaxSite CMS Redirect Plugin cross site scriptingMaxSite CMS
- CVE-2026-7011MaxSite CMS Antispam Plugin plugin_antispam cross site scriptingMaxSite CMS