CVEs published April 27, 2026
197 CVEs were published on April 27, 2026: 30 critical, 56 high.
- Published
- 197
- Critical
- 30
- High
- 56
- Medium
- 103
- Low
- 3
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 53
Most affected products
- Totolink A8000RU
- 16
- OpenClaw
- 11
- Tenda F456
- 11
- SourceCodester Pharmacy Sales and Inventory System
- 10
- code-projects Invoice System in Laravel
- 7
- Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- 7
- code-projects Employee Management System
- 6
- ProjeQtor
- 6
- Linux
- 5
- Milesight MS-Cxx63-PD · Milesight MS-Cxx64-xPD +80
- 5
Critical 30
- CVE-2026-7202Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injectionTotolink A8000RU
- CVE-2026-32644Milesight Cameras Use of Hard-coded Cryptographic KeyMilesight MS-Cxx63-PD · Milesight MS-Cxx64-xPD +80
- CVE-2026-40976In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Spring Boot · org.springframework.boot:spring-boot
- CVE-2026-7156Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injectionTotolink A8000RU
- CVE-2026-7155Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injectionTotolink A8000RU
- CVE-2026-7154Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injectionTotolink A8000RU
- CVE-2026-7153Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injectionTotolink A8000RU
- CVE-2026-7152Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injectionTotolink A8000RU
- CVE-2026-7140Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injectionTotolink A8000RU
- CVE-2026-7139Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injectionTotolink A8000RU
- CVE-2026-7138Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injectionTotolink A8000RU
- CVE-2026-7137Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injectionTotolink A8000RU
- CVE-2026-7136Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injectionTotolink A8000RU
- CVE-2026-41462ProjeQtor < 12.4.4 Unauthenticated SQL Injection via LoginProjeQtor
- CVE-2026-7125Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injectionTotolink A8000RU
- CVE-2026-7124Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injectionTotolink A8000RU
- CVE-2026-7123Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injectionTotolink A8000RU
- CVE-2026-7122Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injectionTotolink A8000RU
- CVE-2026-7121Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injectionTotolink A8000RU
- CVE-2026-22337WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerabilityDirectorist Social Login
- CVE-2026-22336WordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerabilityDirectorist Booking
- CVE-2026-33453Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-33454Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)Apache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-41409Apache MINA: CWE-502 Deserialization of Untrusted DataApache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2026-41635Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCEApache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2026-40453Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injectionApache Software Foundation Apache Camel JMS · Apache Sof… +5
- CVE-2026-40860Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpApache Software Foundation Apache Camel · org.apache.cam… +5
- CVE-2024-46636NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the
- CVE-2026-30352A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execu
- CVE-2026-35903MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service.
High 56
- CVE-2026-20766Milesight Cameras Heap-based Buffer OverflowMilesight MS-Cxx63-PD · Milesight MS-Cxx64-xPD +80
- CVE-2026-32649Milesight Cameras OS Command InjectionMilesight MS-Cxx63-PD · Milesight MS-Cxx64-xPD +80
- CVE-2026-27785Milesight Cameras Use of Hard-coded CredentialsMilesight MS-Cxx63-PD · Milesight MS-Cxx64-xPD +80
- CVE-2026-40973A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`.Spring Boot · org.springframework.boot:spring-boot
- CVE-2026-41371OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset CommandOpenClaw
- CVE-2026-41370OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP DispatchOpenClaw
- CVE-2026-41369OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host ExecutionOpenClaw
- CVE-2026-41368OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter BypassOpenClaw
- CVE-2026-41364OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar UploadOpenClaw
- CVE-2026-40972An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seSpring Boot · org.springframework.boot:spring-boot-devtools
- CVE-2026-28747Milesight Cameras Authorization Bypass Through User-Controlled KeyMilesight MS-Cxx63-PD · Milesight MS-Cxx64-xPD +80
- CVE-2026-7160Tenda HG3 formTracert command injectionTenda HG3
- CVE-2026-7191Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWSQnABot on AWS
- CVE-2026-6741LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' AbilityLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-7151Tenda HG3 formIPv6Routing formUploadConfig stack-based overflowTenda HG3
- CVE-2026-5394Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handlingpimcore · pimcore/pimcore
- CVE-2026-6970authd Denial of Service and Local Privilege EscalationCanonical authd · github.com/canonical/authd
- CVE-2026-41465ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.phpProjeQtor
- CVE-2026-41464ProjeQtor < 12.4.4 Missing Authorization via objectDetail.phpProjeQtor
- CVE-2026-41463ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.phpProjeQtor
- CVE-2026-40514SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNGSmarterTools SmarterMail
- CVE-2026-32688Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboyelixir-plug plug_cowboy
- CVE-2026-6265Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2Cerberus FTP Server
- CVE-2026-7040Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 charactersRRWO Text::Minify::XS
- CVE-2026-7119Tenda HG3 formCountrystr os command injectionTenda HG3
- CVE-2026-5940Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-5943Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-5941Foxit PDF Editor/Reader AcroForm Signature Remote Code Execution VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-27172Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV storeApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-40022Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtimeApache Software Foundation Apache Camel Platform HTTP Main…
- CVE-2026-40858Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation RepositoryApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-42379WordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerabilityWPDeveloper Templately
- CVE-2026-7101Tenda F456 httpd WrlclientSet fromWrlclientSet buffer overflowTenda F456
- CVE-2026-40048Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManagerApache Software Foundation Apache Camel PQC · org.apache.ca…
- CVE-2026-40473Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDPApache Software Foundation Apache Camel Mina · org.apache.c…
- CVE-2026-7100Tenda F456 httpd Natlimit fromNatlimitof buffer overflowTenda F456
- CVE-2026-7099Tenda F456 httpd QuickIndex formQuickIndex buffer overflowTenda F456
- CVE-2026-7098Tenda F456 httpd DhcpListClient fromDhcpListClient buffer overflowTenda F456
- CVE-2026-7097Tenda F456 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflowTenda F456
- CVE-2026-7096Tenda HG3 formgponConf os command injectionTenda HG3
- CVE-2026-7082Tenda F456 httpd WrlExtraSet formWrlExtraSet buffer overflowTenda F456
- CVE-2026-7081Tenda F456 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflowTenda F456
- CVE-2026-3868An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.Moxa EDR-8010 Series · Moxa EDR-G9010 Series
- CVE-2026-7080Tenda F456 httpd PPTPUserSetting fromPPTPUserSetting buffer overflowTenda F456
- CVE-2026-3006Race Condition VulnerabilityWinFSP
- CVE-2026-7079Tenda F456 httpd AdvSetWan fromAdvSetWan buffer overflowTenda F456
- CVE-2026-7106Highland Software Custom Role Manager <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalationjgrodgers Highland Software Custom Role Manager
- CVE-2026-7078Tenda F456 httpd SetIpBind fromSetIpBind buffer overflowTenda F456
- CVE-2026-33277An OS command Injection issue exists in LogonTracer prior to v2.0.0.Japan Computer Emergency Response Team Coordination Center…
- CVE-2026-7069D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflowD-Link DIR-825
- CVE-2025-69428An issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories.
- CVE-2025-69689The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog.
- CVE-2026-30350An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via
- CVE-2026-30351A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via
- CVE-2026-31256A null pointer dereference vulnerability exists in the RTSP service of the MERCURY MIPC252W 1.0.5 Build 230306 Rel.79931n.
- CVE-2026-38934Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5.
Medium, low and unrated 111
- CVE-2026-40977When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corruSpring Boot · org.springframework.boot:spring-boot-cassandra
- CVE-2026-40975Values produced by ${random.value} are not suitable for use as secrets.Spring Boot · org.springframework.boot:spring-boot-cassandra
- CVE-2026-40974Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.Spring Boot · org.springframework.boot:spring-boot-cassandra
- CVE-2026-7200SourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-41372OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP DiscoveryOpenClaw
- CVE-2026-41367OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component InteractionsOpenClaw
- CVE-2026-41366OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-WhitelistingOpenClaw
- CVE-2026-41365OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread HistoryOpenClaw
- CVE-2026-41363OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image ParameterOpenClaw
- CVE-2026-41362OpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared AuthenticationOpenClaw
- CVE-2026-7199SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7196CodeAstro Online Classroom guestdetails sql injectionCodeAstro Online Classroom
- CVE-2026-40971When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to thSpring Boot · org.springframework.boot:spring-boot-rabbitmq
- CVE-2026-7194SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7183aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exceptionaligungr UERANSIM
- CVE-2026-7179OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversalOSPG binwalk
- CVE-2026-7178ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgeryChatGPTNextWeb NextChat
- CVE-2026-7177ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgeryChatGPTNextWeb NextChat
- CVE-2026-7159douinc mkdocs-mcp-plugin server.py list_documents path traversaldouinc mkdocs-mcp-plugin · mkdocs-mcp-plugin
- CVE-2026-7158dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgerydmitryglhf mcp-url-downloader · mcp-url-downloader
- CVE-2026-3087shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPsPython Software Foundation CPython
- CVE-2026-7157disler aider-mcp-server aider_ai_code server.py command injectiondisler aider-mcp-server
- CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingpimcore · pimcore/pimcore
- CVE-2026-40970When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting Spring Boot · org.springframework.boot:spring-boot-elastics…
- CVE-2026-7150dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgerydh1011 auto-favicon · auto-favicon
- CVE-2026-7149dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversaldexhunter kaggle-mcp · kaggle-mcp
- CVE-2026-7148CodeAstro Online Classroom addnewfaculty sql injectionCodeAstro Online Classroom
- CVE-2026-7147JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgeryJoeCastrom mcp-chat-studio
- CVE-2026-32655Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least Privilege Violation vulnerability.Dell Alienware Command Center
- CVE-2026-25908Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCCDell Alienware Command Center
- CVE-2026-7146AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgeryAlejandroArciniegas mcp-data-vis
- CVE-2026-7145mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorizationmettle sendportal
- CVE-2026-31691igb: remove napi_synchronize() in igb_down()Linux
- CVE-2026-31690firmware: thead: Fix buffer overflow and use standard endian macrosLinux
- CVE-2026-31689EDAC/mc: Fix error path ordering in edac_mc_alloc()Linux
- CVE-2026-31687gpio: omap: do not register driver in probe()Linux
- CVE-2026-31686mm/kasan: fix double free for kasan pXdsLinux
- CVE-2026-71441000 Projects Portfolio Management System MCA update_passwd_process.php authorization1000 Projects Portfolio Management System MCA
- CVE-2026-71431000 Projects Portfolio Management System MCA block_status.php sql injection1000 Projects Portfolio Management System MCA
- CVE-2026-7142Wooey API Endpoint scripts.py add_or_update_script improper authorizationWooey
- CVE-2026-7141vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resourcevLLM
- CVE-2025-54505A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor uAMD EPYC™ 7001 Series Processors · AMD EPYC™ Embedded 3000…
- CVE-2026-7135GPAC MP4Box box_code_base.c elng_box_read out-of-boundsGPAC
- CVE-2026-41467ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()ProjeQtor
- CVE-2026-41466ProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText()ProjeQtor
- CVE-2026-7134code-projects Online Lot Reservation System edithousepic.php unrestricted uploadcode-projects Online Lot Reservation System
- CVE-2026-7133code-projects Online Lot Reservation System activity.php unrestricted uploadcode-projects Online Lot Reservation System
- CVE-2026-7132code-projects Online Lot Reservation System download.php readfile path traversalcode-projects Online Lot Reservation System
- CVE-2026-6357pip self-update functionality can import newly installed modules after wheel installationPip maintainers pip · pip
- CVE-2026-7131code-projects Online Lot Reservation System loginuser.php sql injectioncode-projects Online Lot Reservation System
- CVE-2026-7130SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7129SourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7128SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7127SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-40557Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connectionsApache Software Foundation Apache Storm Prometheus Reporter…
- CVE-2026-41081Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failureApache Software Foundation Apache Storm Client · org.apache…
- CVE-2026-7126SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2025-15626Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS applicationRibblr Crotchet and Knitting
- CVE-2026-7118code-projects Employee Management System cancel.php sql injectioncode-projects Employee Management System
- CVE-2026-5937Foxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-5938Foxit PDF Editor/Reader Infinite Loop Denial-of-Service VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-5942Foxit PDF Editor/Reader AcroForm Signature Use-After-Free VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-5939UAF in Foxit PDF Editor/Reader via XFA calculate eventFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-7117code-projects Employee Management System approve.php sql injectioncode-projects Employee Management System
- CVE-2026-7116code-projects Employee Management System mark.php cross site scriptingcode-projects Employee Management System
- CVE-2026-42410WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2026-7115code-projects Employee Management System delete.php sql injectioncode-projects Employee Management System
- CVE-2026-7114code-projects Employee Management System edit.php sql injectioncode-projects Employee Management System
- CVE-2026-7113NousResearch hermes-agent Webhooks Endpoint webhook.py missing authenticationNousResearch hermes-agent
- CVE-2026-7112NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authenticationNousResearch hermes-agent
- CVE-2026-7110code-projects Invoice System in Laravel item cross site scriptingcode-projects Invoice System in Laravel
- CVE-2026-7109code-projects Invoice System in Laravel API Endpoint item improper authorizationcode-projects Invoice System in Laravel
- CVE-2026-7108code-projects Invoice System in Laravel cross-site request forgerycode-projects Invoice System in Laravel
- CVE-2026-7107code-projects Invoice System in Laravel company unrestricted uploadcode-projects Invoice System in Laravel
- CVE-2026-7103code-projects Chat System MD5 Hash update_user.php weak hashcode-projects Chat System
- CVE-2026-7102Tenda F456 httpd WriteFacMac FromWriteFacMac command injectionTenda F456
- CVE-2026-22077Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO WalletOPPO Wallet APP
- CVE-2026-7095code-projects Employee Management System edit.php cross site scriptingcode-projects Employee Management System
- CVE-2026-7094ShadowCloneLabs GlutamateMCPServers puppeteer_navigate index.ts server-side request forgeryShadowCloneLabs GlutamateMCPServers
- CVE-2026-3008Vulnerability in Notepad++Notepad++
- CVE-2026-7093code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorizationcode-projects Invoice System in Laravel
- CVE-2026-42371uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.uriparser
- CVE-2026-7092code-projects Invoice System in Laravel Profile profile improper authorizationcode-projects Invoice System in Laravel
- CVE-2026-7091code-projects Invoice System in Laravel User Management user improper authorizationcode-projects Invoice System in Laravel
- CVE-2026-7090code-projects Chat System send_message.php cross site scriptingcode-projects Chat System
- CVE-2026-7089code-projects Home Service System Appointment Booking booking.php cross site scriptingcode-projects Home Service System
- CVE-2026-7088SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7087SourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7086HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversalHBAI-Ltd Toonflow-app
- CVE-2026-7085HBAI-Ltd Toonflow-app downloadApp Endpoint downloadApp.ts z.url path traversalHBAI-Ltd Toonflow-app
- CVE-2026-7084HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgeryHBAI-Ltd Toonflow-app
- CVE-2026-7083likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injectionlikeadmin-likeshop likeadmin_php
- CVE-2026-3867An improper ownership management vulnerability has been identified in Moxa’s Secure Router.Moxa EDR-8010 Series · Moxa EDR-G9010 Series
- CVE-2026-7077itsourcecode Courier Management System edit_parcel.php sql injectionitsourcecode Courier Management System
- CVE-2026-7076itsourcecode Courier Management System edit_branch.php sql injectionitsourcecode Courier Management System
- CVE-2026-7075itsourcecode Construction Management System locations.php sql injectionitsourcecode Construction Management System
- CVE-2026-7074itsourcecode Construction Management System execute1.php sql injectionitsourcecode Construction Management System
- CVE-2026-7073itsourcecode Construction Management System execute.php sql injectionitsourcecode Construction Management System
- CVE-2026-7072CodePanda Source canteen_management_system login.php sql injectionCodePanda Source canteen_management_system
- CVE-2026-7071CodeAstro Online Job Portal user-cvs file information disclosureCodeAstro Online Job Portal
- CVE-2026-7070code-projects Inventory Management System Login sql injectioncode-projects Inventory Management System
- CVE-2026-33566There is a cypher injection issue in LogonTracer prior to v2.0.0.Japan Computer Emergency Response Team Coordination Center…
- CVE-2021-36438SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php.
- CVE-2026-29971A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0.
- CVE-2026-30346An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via
- CVE-2026-30462A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.
- CVE-2026-31255A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi.
- CVE-2026-35901A handling issue in the RTSP service of the Mercury MIPC252W 1.0.5 Build 230306 Rel.79931n allows an authenticated attacker to trigger sessi
- CVE-2026-35902The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts.
- CVE-2026-38935A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameter
- CVE-2026-38936A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains