# CVEs published 2026-04-26

79 CVEs were published on April 26, 2026: 2 critical, 19 high. Days are UTC.

- [CVE-2026-42363](https://cve.now/CVE-2026-42363.md): GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability (CVSS 9.3, GeoVision GV-IP Device Utility)
- [CVE-2026-7068](https://cve.now/CVE-2026-7068.md): D-Link DIR-825 nmbd sserver.c NMBD\_process buffer overflow (CVSS 8.7, D-Link DIR-825)
- [CVE-2026-7067](https://cve.now/CVE-2026-7067.md): D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection (CVSS 6.9, D-Link DIR-822)
- [CVE-2026-7066](https://cve.now/CVE-2026-7066.md): choieastsea simple-openstack-mcp server.py exec\_openstack os command injection (CVSS 6.9, choieastsea simple-openstack-mcp)
- [CVE-2026-7065](https://cve.now/CVE-2026-7065.md): BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery (CVSS 6.9, BidingCC BuildingAI)
- [CVE-2026-7064](https://cve.now/CVE-2026-7064.md): AgentDeskAI browser-tools-mcp browser-connector.ts os command injection (CVSS 6.9, AgentDeskAI browser-tools-mcp)
- [CVE-2026-7063](https://cve.now/CVE-2026-7063.md): code-projects Employee Management System Endpoint eprocess.php sql injection (CVSS 6.9, code-projects Employee Management System)
- [CVE-2026-7062](https://cve.now/CVE-2026-7062.md): Intina47 context-sync Git Integration git-integration.ts os command injection (CVSS 6.9, Intina47 context-sync)
- [CVE-2026-7061](https://cve.now/CVE-2026-7061.md): Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection (CVSS 6.9, Toowiredd chatgpt-mcp-server)
- [CVE-2026-7060](https://cve.now/CVE-2026-7060.md): liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection (CVSS 6.9, liyupi yu-picture)
- [CVE-2026-7059](https://cve.now/CVE-2026-7059.md): 666ghj MiroFish Query Parameter simulation.py get\_simulation\_posts path traversal (CVSS 6.9, 666ghj MiroFish)
- [CVE-2026-7058](https://cve.now/CVE-2026-7058.md): 666ghj MiroFish Inter-Process Communication simulation\_ipc.py SimulationIPCClient.send\_command command injection (CVSS 6.9, 666ghj MiroFish)
- [CVE-2026-7057](https://cve.now/CVE-2026-7057.md): Tenda F456 httpd setcfm buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7056](https://cve.now/CVE-2026-7056.md): Tenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7055](https://cve.now/CVE-2026-7055.md): Tenda F456 httpd VirtualSer fromVirtualSer buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7054](https://cve.now/CVE-2026-7054.md): Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7053](https://cve.now/CVE-2026-7053.md): Tenda F456 httpd L7Prot frmL7ProtForm buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7045](https://cve.now/CVE-2026-7045.md): baomidou dynamic-datasource StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injection (CVSS 5.3, baomidou dynamic-datasource · com.baomidou:dynamic-datasour…)
- [CVE-2026-7044](https://cve.now/CVE-2026-7044.md): GreenCMS index.php themeadd unrestricted upload (CVSS 5.3, GreenCMS)
- [CVE-2018-25297](https://cve.now/CVE-2018-25297.md): Wansview 1.0.2 Denial of Service via Buffer Overflow (CVSS 6.9, Wansview)
- [CVE-2018-25296](https://cve.now/CVE-2018-25296.md): P10 Central Management Software 1.4.13 Denial of Service (CVSS 6.8, P10 Central Management Software)
- [CVE-2018-25295](https://cve.now/CVE-2018-25295.md): ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field (CVSS 6.9, P10 ObserverIP Scan Tool)
- [CVE-2018-25294](https://cve.now/CVE-2018-25294.md): CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service (CVSS 8.7, Cewe-Photoworld CEWE Photoshow)
- [CVE-2018-25293](https://cve.now/CVE-2018-25293.md): Prime95 29.4b7 Denial of Service via Proxy Password Field (CVSS 6.9, Mersenne Prime95)
- [CVE-2018-25292](https://cve.now/CVE-2018-25292.md): Bome Restorator 1793 Denial of Service via Buffer Overflow (CVSS 6.9, Bome Restorator)
- [CVE-2018-25291](https://cve.now/CVE-2018-25291.md): Project64 2.3.2 Denial of Service via Plugin Directory (CVSS 6.9, Pj64-Emu Project64)
- [CVE-2018-25290](https://cve.now/CVE-2018-25290.md): Easyboot 6.6.0 Buffer Overflow Denial of Service (CVSS 6.9, Ezbsystems Easyboot)
- [CVE-2018-25289](https://cve.now/CVE-2018-25289.md): Softdisk 3.0.3 Buffer Overflow Denial of Service (CVSS 6.9, Ezbsystems Softdisk)
- [CVE-2018-25288](https://cve.now/CVE-2018-25288.md): StyleWriter 1.0 Denial of Service via Pattern Input (CVSS 6.9, Editorsoftware StyleWriter)
- [CVE-2018-25287](https://cve.now/CVE-2018-25287.md): Drive Power Manager 1.10 Denial of Service via Name Field (CVSS 6.8, Hdtune Drive Power Manager)
- [CVE-2018-25286](https://cve.now/CVE-2018-25286.md): Easy PhotoResQ 1.0 Buffer Overflow Denial of Service (CVSS 6.9, Hdtune Easy PhotoResQ)
- [CVE-2018-25285](https://cve.now/CVE-2018-25285.md): Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow (CVSS 6.8, Fathom)
- [CVE-2018-25284](https://cve.now/CVE-2018-25284.md): HD Tune Pro 5.70 Denial of Service via Options Dialog (CVSS 6.9, Hdtune HD Tune Pro)
- [CVE-2018-25283](https://cve.now/CVE-2018-25283.md): iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter (CVSS 8.6, Securimport iSmartViewPro)
- [CVE-2018-25282](https://cve.now/CVE-2018-25282.md): Nmap 7.70 Denial of Service via XML Entity Expansion (CVSS 6.9, ZenMap)
- [CVE-2018-25281](https://cve.now/CVE-2018-25281.md): iCash 7.6.5 Denial of Service via Connect to Server (CVSS 6.8, Maxprog iCash)
- [CVE-2018-25280](https://cve.now/CVE-2018-25280.md): Infiltrator Network Security Scanner 4.6 Denial of Service (CVSS 6.8, Infiltration-Systems Infiltrator Network Security Scanner)
- [CVE-2018-25279](https://cve.now/CVE-2018-25279.md): jiNa OCR Image to Text 1.0 Denial of Service via PNG (CVSS 6.9, Convertimagetotext jiNa OCR Image to Text)
- [CVE-2018-25278](https://cve.now/CVE-2018-25278.md): PicaJet FX 2.6.5 Denial of Service via Registration Fields (CVSS 6.9, PicaJet FX)
- [CVE-2018-25277](https://cve.now/CVE-2018-25277.md): PixGPS 1.1.8 Buffer Overflow Denial of Service (CVSS 6.9, Br-Software PixGPS)
- [CVE-2018-25276](https://cve.now/CVE-2018-25276.md): RoboImport 1.2.0.72 Denial of Service via Registration Fields (CVSS 6.8, Picajet RoboImport)
- [CVE-2018-25275](https://cve.now/CVE-2018-25275.md): Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow (CVSS 6.9, Faleemi Plus)
- [CVE-2018-25274](https://cve.now/CVE-2018-25274.md): InfraRecorder 0.53 Denial of Service via txt File Import (CVSS 6.9, InfraRecorder)
- [CVE-2018-25273](https://cve.now/CVE-2018-25273.md): CrossFont 7.5 Denial of Service via License Key Field (CVSS 6.9, Acutesystems CrossFont)
- [CVE-2018-25264](https://cve.now/CVE-2018-25264.md): TransMac 12.2 Denial of Service via License Key Field (CVSS 6.9, Acutesystems TransMac)
- [CVE-2018-25263](https://cve.now/CVE-2018-25263.md): Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH (CVSS 8.6, Faleemi Desktop Software)
- [CVE-2026-7043](https://cve.now/CVE-2026-7043.md): GreenCMS index.php pluginAddLocal unrestricted upload (CVSS 5.3, GreenCMS)
- [CVE-2026-7042](https://cve.now/CVE-2026-7042.md): 666ghj MiroFish REST API Endpoint \_\_init\_\_.py create\_app missing authentication (CVSS 6.9, 666ghj MiroFish)
- [CVE-2026-7041](https://cve.now/CVE-2026-7041.md): 666ghj MiroFish Werkzeug Debugger PIN console information disclosure (CVSS 6.3, 666ghj MiroFish)
- [CVE-2026-7039](https://cve.now/CVE-2026-7039.md): tufantunc ssh-mcp index.ts shell.write command injection (CVSS 8.5, tufantunc ssh-mcp)
- [CVE-2026-7038](https://cve.now/CVE-2026-7038.md): tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials (CVSS 4.8, tufantunc ssh-mcp)
- [CVE-2026-7037](https://cve.now/CVE-2026-7037.md): Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-7036](https://cve.now/CVE-2026-7036.md): Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal (CVSS 6.9, Tenda i9)
- [CVE-2026-7035](https://cve.now/CVE-2026-7035.md): Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2026-7034](https://cve.now/CVE-2026-7034.md): Tenda FH1202 httpd WrlExtraSet stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2026-7033](https://cve.now/CVE-2026-7033.md): Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7032](https://cve.now/CVE-2026-7032.md): Tenda F456 SafeEmailFilter buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7031](https://cve.now/CVE-2026-7031.md): Tenda F456 SafeMacFilter fromSafeMacFilter buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7030](https://cve.now/CVE-2026-7030.md): Tenda F456 RouteStatic fromRouteStatic buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7029](https://cve.now/CVE-2026-7029.md): Tenda F456 addressNat fromaddressNat buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7028](https://cve.now/CVE-2026-7028.md): CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection (CVSS 5.1, CodeAstro Online Job Portal)
- [CVE-2026-7027](https://cve.now/CVE-2026-7027.md): D-Link DSL-2740R Wireless Setup Section cross site scripting (CVSS 4.8, D-Link DSL-2740R)
- [CVE-2026-7026](https://cve.now/CVE-2026-7026.md): D-Link DGS-3420 System Information Settings cross site scripting (CVSS 6.8, D-Link DGS-3420)
- [CVE-2026-7025](https://cve.now/CVE-2026-7025.md): Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery (CVSS 6.9, Typecho)
- [CVE-2026-7024](https://cve.now/CVE-2026-7024.md): rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal (CVSS 5.3, rawchen sims)
- [CVE-2026-7023](https://cve.now/CVE-2026-7023.md): ByteDance coze-studio databaseTool database\_impl.go ExecuteSQL sql injection (CVSS 5.3, ByteDance coze-studio)
- [CVE-2026-7022](https://cve.now/CVE-2026-7022.md): SmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authentication (CVSS 6.9, SmythOS sre)
- [CVE-2026-7021](https://cve.now/CVE-2026-7021.md): SmythOS sre Connector Service utils.ts information disclosure (CVSS 5.1, SmythOS sre)
- [CVE-2026-7020](https://cve.now/CVE-2026-7020.md): Ollama Tensor Model Transfer transfer.go digestToPath path traversal (CVSS 6.3, Ollama · github.com/ollama/ollama)
- [CVE-2026-7019](https://cve.now/CVE-2026-7019.md): Tenda F456 P2pListFilter fromP2pListFilter buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-7018](https://cve.now/CVE-2026-7018.md): Datavane Datavines JWT Token TokenManager.java hard-coded key (CVSS 6.3, Datavane Datavines)
- [CVE-2026-7016](https://cve.now/CVE-2026-7016.md): MaxSite CMS ushki Plugin cross site scripting (CVSS 4.8, MaxSite CMS)
- [CVE-2026-42255](https://cve.now/CVE-2026-42255.md): Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation. (CVSS 7.2, Technitium DnsServer)
- [CVE-2026-7015](https://cve.now/CVE-2026-7015.md): MaxSite CMS Guestbook Plugin cross site scripting (CVSS 4.8, MaxSite CMS)
- [CVE-2026-42254](https://cve.now/CVE-2026-42254.md): Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that (CVSS 4.0, Hickory Project Hickory DNS · hickory-recursor)
- [CVE-2026-7014](https://cve.now/CVE-2026-7014.md): MaxSite CMS down\_count Plugin cross site scripting (CVSS 4.8, MaxSite CMS)
- [CVE-2026-7013](https://cve.now/CVE-2026-7013.md): MaxSite CMS mail\_send Plugin cross site scripting (CVSS 4.8, MaxSite CMS)
- [CVE-2026-7012](https://cve.now/CVE-2026-7012.md): MaxSite CMS Redirect Plugin cross site scripting (CVSS 4.8, MaxSite CMS)
- [CVE-2026-7011](https://cve.now/CVE-2026-7011.md): MaxSite CMS Antispam Plugin plugin\_antispam cross site scripting (CVSS 4.8, MaxSite CMS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.