# CVEs published 2026-04-28

221 CVEs were published on April 28, 2026: 18 critical, 81 high. Days are UTC.

- [CVE-2026-40560](https://cve.now/CVE-2026-40560.md): Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence (CVSS 7.5, MIYAGAWA Starman)
- [CVE-2026-7355](https://cve.now/CVE-2026-7355.md): Use after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-7340](https://cve.now/CVE-2026-7340.md): Integer overflow in ANGLE in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker to perform an out of bounds memory r (CVSS 4.3, Google Chrome)
- [CVE-2026-7339](https://cve.now/CVE-2026-7339.md): Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-7341](https://cve.now/CVE-2026-7341.md): Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-7342](https://cve.now/CVE-2026-7342.md): Use after free in WebView in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a s (CVSS 8.8, Google Chrome)
- [CVE-2026-7338](https://cve.now/CVE-2026-7338.md): Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heap (CVSS 7.5, Google Chrome)
- [CVE-2026-7345](https://cve.now/CVE-2026-7345.md): Insufficient validation of untrusted input in Feedback in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromise (CVSS 8.3, Google Chrome)
- [CVE-2026-7346](https://cve.now/CVE-2026-7346.md): Inappropriate implementation in Tint in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to perform out of bounds memory acce (CVSS 8.1, Google Chrome)
- [CVE-2026-7347](https://cve.now/CVE-2026-7347.md): Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious netw (CVSS 8.1, Google Chrome)
- [CVE-2026-7337](https://cve.now/CVE-2026-7337.md): Type Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-7336](https://cve.now/CVE-2026-7336.md): Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-7335](https://cve.now/CVE-2026-7335.md): Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-7348](https://cve.now/CVE-2026-7348.md): Use after free in Codecs in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-7349](https://cve.now/CVE-2026-7349.md): Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to execute arbitrary code i (CVSS 7.5, Google Chrome)
- [CVE-2026-7350](https://cve.now/CVE-2026-7350.md): Use after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-7351](https://cve.now/CVE-2026-7351.md): Race in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to install a malicious extension to leak cro (CVSS 3.1, Google Chrome)
- [CVE-2026-7352](https://cve.now/CVE-2026-7352.md): Use after free in Media in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-7353](https://cve.now/CVE-2026-7353.md): Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-7354](https://cve.now/CVE-2026-7354.md): Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox es (CVSS 8.8, Google Chrome)
- [CVE-2026-7356](https://cve.now/CVE-2026-7356.md): Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2026-7357](https://cve.now/CVE-2026-7357.md): Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 7.5, Google Chrome)
- [CVE-2026-7334](https://cve.now/CVE-2026-7334.md): Use after free in Views in Google Chrome on Mac prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-7358](https://cve.now/CVE-2026-7358.md): Use after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-7359](https://cve.now/CVE-2026-7359.md): Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.8, Google Chrome)
- [CVE-2026-7360](https://cve.now/CVE-2026-7360.md): Insufficient validation of untrusted input. (CVSS 3.1, Google Chrome)
- [CVE-2026-7333](https://cve.now/CVE-2026-7333.md): Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a craft (CVSS 9.6, Google Chrome)
- [CVE-2026-7343](https://cve.now/CVE-2026-7343.md): Use after free in Views in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer proce (CVSS 7.5, Google Chrome)
- [CVE-2026-7344](https://cve.now/CVE-2026-7344.md): Use after free in Accessibility in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the render (CVSS 8.8, Google Chrome)
- [CVE-2026-7361](https://cve.now/CVE-2026-7361.md): Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2026-7363](https://cve.now/CVE-2026-7363.md): Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code ins (CVSS 8.8, Google Chrome)
- [CVE-2026-33467](https://cve.now/CVE-2026-33467.md): Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass (CVSS 5.9, Elastic Package Registry · github.com/elastic/package-regis…)
- [CVE-2026-41446](https://cve.now/CVE-2026-41446.md): WattBox 800 & 820 Series \< 2.10.0.0 RCE via Diagnostic Endpoints (CVSS 9.2, Snap One WattBox)
- [CVE-2026-7319](https://cve.now/CVE-2026-7319.md): elinsky execution-system-mcp add\_action Tool server.py \_get\_context\_file\_path path traversal (CVSS 6.9, elinsky execution-system-mcp)
- [CVE-2026-7318](https://cve.now/CVE-2026-7318.md): elie mcp-project research\_server.py search\_papers path traversal (CVSS 5.1, elie mcp-project)
- [CVE-2026-7317](https://cve.now/CVE-2026-7317.md): Grav CMS Cache Value FileCache.php doGet deserialization (CVSS 2.3, Grav CMS · getgrav/grav)
- [CVE-2026-7316](https://cve.now/CVE-2026-7316.md): eiliyaabedini aider-mcp code\_with\_ai aider\_mcp.py command injection (CVSS 6.9, eiliyaabedini aider-mcp)
- [CVE-2026-41649](https://cve.now/CVE-2026-41649.md): Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces (CVSS 7.7, outline)
- [CVE-2026-7315](https://cve.now/CVE-2026-7315.md): eiceblue spire-pdf-mcp-server PDF File server.py get\_pdf\_path path traversal (CVSS 6.9, eiceblue spire-pdf-mcp-server)
- [CVE-2026-7314](https://cve.now/CVE-2026-7314.md): eiceblue spire-doc-mcp-server base.py get\_doc\_path path traversal (CVSS 6.9, eiceblue spire-doc-mcp-server)
- [CVE-2026-7306](https://cve.now/CVE-2026-7306.md): Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key (CVSS 6.3, Xuxueli xxl-job)
- [CVE-2026-7305](https://cve.now/CVE-2026-7305.md): Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery (CVSS 5.3, Xuxueli xxl-job)
- [CVE-2026-7303](https://cve.now/CVE-2026-7303.md): Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection (CVSS 6.3, Xuxueli xxl-job · com.xuxueli:xxl-job-admin)
- [CVE-2026-7297](https://cve.now/CVE-2026-7297.md): SourceCodester Pizzafy Ecommerce System ajax.php save\_user cross site scripting (CVSS 4.8, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7296](https://cve.now/CVE-2026-7296.md): SourceCodester Pizzafy Ecommerce System ajax.php save\_order cross site scripting (CVSS 4.8, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7295](https://cve.now/CVE-2026-7295.md): SourceCodester Pizzafy Ecommerce System ajax.php save\_menu cross site scripting (CVSS 4.8, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-42432](https://cve.now/CVE-2026-42432.md): OpenClaw \< 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass (CVSS 7.3, OpenClaw)
- [CVE-2026-42431](https://cve.now/CVE-2026-42431.md): OpenClaw \< 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass (CVSS 7.6, OpenClaw)
- [CVE-2026-42430](https://cve.now/CVE-2026-42430.md): OpenClaw \< 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling (CVSS 4.8, OpenClaw)
- [CVE-2026-42429](https://cve.now/CVE-2026-42429.md): OpenClaw \< 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication (CVSS 6.0, OpenClaw)
- [CVE-2026-42428](https://cve.now/CVE-2026-42428.md): OpenClaw \< 2026.4.8 - Missing Integrity Verification in Package Downloads (CVSS 7.5, OpenClaw)
- [CVE-2026-42427](https://cve.now/CVE-2026-42427.md): OpenClaw \< 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection (CVSS 5.8, OpenClaw)
- [CVE-2026-42426](https://cve.now/CVE-2026-42426.md): OpenClaw \< 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope (CVSS 8.7, OpenClaw)
- [CVE-2026-42424](https://cve.now/CVE-2026-42424.md): OpenClaw \< 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Paths (CVSS 5.9, OpenClaw)
- [CVE-2026-42423](https://cve.now/CVE-2026-42423.md): OpenClaw \< 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback (CVSS 7.7, OpenClaw)
- [CVE-2026-42422](https://cve.now/CVE-2026-42422.md): OpenClaw \< 2026.4.8 - Role Bypass in device.token.rotate Function (CVSS 7.7, OpenClaw)
- [CVE-2026-42421](https://cve.now/CVE-2026-42421.md): OpenClaw \< 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation (CVSS 2.3, OpenClaw)
- [CVE-2026-42420](https://cve.now/CVE-2026-42420.md): OpenClaw \< 2026.4.8 - Improper Base64 Decoding Size Validation (CVSS 5.3, OpenClaw)
- [CVE-2026-41916](https://cve.now/CVE-2026-41916.md): OpenClaw \< 2026.4.8 - Stale Authentication State via Config Reload (CVSS 2.3, OpenClaw)
- [CVE-2026-41915](https://cve.now/CVE-2026-41915.md): OpenClaw \< 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment (CVSS 5.8, OpenClaw)
- [CVE-2026-41914](https://cve.now/CVE-2026-41914.md): OpenClaw \< 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths (CVSS 5.1, OpenClaw)
- [CVE-2026-41913](https://cve.now/CVE-2026-41913.md): OpenClaw \< 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts (CVSS 6.3, OpenClaw)
- [CVE-2026-41912](https://cve.now/CVE-2026-41912.md): OpenClaw \< 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered Navigation (CVSS 4.8, OpenClaw)
- [CVE-2026-41911](https://cve.now/CVE-2026-41911.md): OpenClaw \< 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload\_file/upload\_image (CVSS 6.0, OpenClaw)
- [CVE-2026-41910](https://cve.now/CVE-2026-41910.md): OpenClaw \< 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes (CVSS 2.3, OpenClaw)
- [CVE-2026-41408](https://cve.now/CVE-2026-41408.md): OpenClaw \< 2026.3.31 - Disk Exhaustion via Media Download Bypass (CVSS 2.3, OpenClaw)
- [CVE-2026-41407](https://cve.now/CVE-2026-41407.md): OpenClaw \< 2026.4.2 - Timing Side Channel in Shared-Secret Comparison (CVSS 6.3, OpenClaw)
- [CVE-2026-41406](https://cve.now/CVE-2026-41406.md): OpenClaw \< 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages (CVSS 2.3, OpenClaw)
- [CVE-2026-41405](https://cve.now/CVE-2026-41405.md): OpenClaw \< 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing (CVSS 8.7, OpenClaw)
- [CVE-2026-41404](https://cve.now/CVE-2026-41404.md): OpenClaw \< 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authentication (CVSS 7.7, OpenClaw)
- [CVE-2026-41403](https://cve.now/CVE-2026-41403.md): OpenClaw \< 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification (CVSS 6.3, OpenClaw)
- [CVE-2026-41402](https://cve.now/CVE-2026-41402.md): OpenClaw \< 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass (CVSS 2.3, OpenClaw)
- [CVE-2026-41400](https://cve.now/CVE-2026-41400.md): OpenClaw \< 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-call (CVSS 6.9, OpenClaw)
- [CVE-2026-41399](https://cve.now/CVE-2026-41399.md): OpenClaw \< 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades (CVSS 8.7, OpenClaw)
- [CVE-2026-41398](https://cve.now/CVE-2026-41398.md): OpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge (CVSS 2.1, OpenClaw)
- [CVE-2026-41397](https://cve.now/CVE-2026-41397.md): OpenClaw \< 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal (CVSS 7.6, OpenClaw)
- [CVE-2026-41396](https://cve.now/CVE-2026-41396.md): OpenClaw \< 2026.3.31 - Environment Variable Override of Plugin Trust Root (CVSS 8.5, OpenClaw)
- [CVE-2026-41395](https://cve.now/CVE-2026-41395.md): OpenClaw \< 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3 (CVSS 8.2, OpenClaw)
- [CVE-2026-41394](https://cve.now/CVE-2026-41394.md): OpenClaw \< 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes (CVSS 8.8, OpenClaw)
- [CVE-2026-41393](https://cve.now/CVE-2026-41393.md): OpenClaw \< 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery (CVSS 5.9, OpenClaw)
- [CVE-2026-41392](https://cve.now/CVE-2026-41392.md): OpenClaw \< 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options (CVSS 5.4, OpenClaw)
- [CVE-2026-41391](https://cve.now/CVE-2026-41391.md): OpenClaw \< 2026.3.31 - Environment Variable Bypass in Package Index URL Handling (CVSS 5.8, OpenClaw)
- [CVE-2026-41390](https://cve.now/CVE-2026-41390.md): OpenClaw \< 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper (CVSS 7.0, OpenClaw)
- [CVE-2026-41388](https://cve.now/CVE-2026-41388.md): OpenClaw \< 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling (CVSS 6.3, OpenClaw)
- [CVE-2026-41387](https://cve.now/CVE-2026-41387.md): OpenClaw \< 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization (CVSS 8.5, OpenClaw)
- [CVE-2026-41386](https://cve.now/CVE-2026-41386.md): OpenClaw \< 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes (CVSS 9.1, OpenClaw)
- [CVE-2026-41385](https://cve.now/CVE-2026-41385.md): OpenClaw \< 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass (CVSS 7.1, OpenClaw)
- [CVE-2026-41384](https://cve.now/CVE-2026-41384.md): OpenClaw \< 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend (CVSS 8.5, OpenClaw)
- [CVE-2026-41383](https://cve.now/CVE-2026-41383.md): OpenClaw \< 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths (CVSS 6.1, OpenClaw)
- [CVE-2026-41382](https://cve.now/CVE-2026-41382.md): OpenClaw \< 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps (CVSS 2.3, OpenClaw)
- [CVE-2026-41381](https://cve.now/CVE-2026-41381.md): OpenClaw \< 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist (CVSS 2.3, OpenClaw)
- [CVE-2026-41380](https://cve.now/CVE-2026-41380.md): OpenClaw \< 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables (CVSS 7.0, OpenClaw)
- [CVE-2026-41379](https://cve.now/CVE-2026-41379.md): OpenClaw \< 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config (CVSS 7.1, OpenClaw)
- [CVE-2026-41378](https://cve.now/CVE-2026-41378.md): OpenClaw \< 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch (CVSS 7.7, OpenClaw)
- [CVE-2026-41377](https://cve.now/CVE-2026-41377.md): OpenClaw \< 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation (CVSS 5.1, OpenClaw)
- [CVE-2026-41376](https://cve.now/CVE-2026-41376.md): OpenClaw \< 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation (CVSS 2.3, OpenClaw)
- [CVE-2026-41375](https://cve.now/CVE-2026-41375.md): OpenClaw \< 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints (CVSS 7.1, OpenClaw)
- [CVE-2026-41374](https://cve.now/CVE-2026-41374.md): OpenClaw \< 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization (CVSS 6.9, OpenClaw)
- [CVE-2026-41373](https://cve.now/CVE-2026-41373.md): OpenClaw \< 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy (CVSS 5.8, OpenClaw)
- [CVE-2026-7294](https://cve.now/CVE-2026-7294.md): SourceCodester Pizzafy Ecommerce System index.php save\_settings cross site scripting (CVSS 4.8, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-24231](https://cve.now/CVE-2026-24231.md): NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side (CVSS 6.3, NVIDIA NemoClaw)
- [CVE-2026-24222](https://cve.now/CVE-2026-24222.md): NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper a (CVSS 8.6, NVIDIA NemoClaw)
- [CVE-2026-24204](https://cve.now/CVE-2026-24204.md): NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. (CVSS 6.5, NVIDIA FLARE SDK)
- [CVE-2026-24186](https://cve.now/CVE-2026-24186.md): NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOB (CVSS 8.8, NVIDIA FLARE SDK)
- [CVE-2026-7293](https://cve.now/CVE-2026-7293.md): SourceCodester Pizzafy Ecommerce System ajax.php delete\_category sql injection (CVSS 5.1, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-24178](https://cve.now/CVE-2026-24178.md): NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cau (CVSS 9.8, NVIDIA FLARE SDK · nvflare)
- [CVE-2026-6807](https://cve.now/CVE-2026-6807.md): NSA GRASSMARLIN Improper Restriction of XML External Entity Reference (CVSS 5.5, NSA GRASSMARLIN)
- [CVE-2026-3893](https://cve.now/CVE-2026-3893.md): Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function (CVSS 9.4, Carlson Software VASCO-B GNSS Receiver)
- [CVE-2026-7292](https://cve.now/CVE-2026-7292.md): o2oa NodeAgent NodeAgent.java syncFile improper authorization (CVSS 6.3, o2oa)
- [CVE-2026-7291](https://cve.now/CVE-2026-7291.md): o2oa URL Fetching FileAction.java FileAction server-side request forgery (CVSS 5.3, o2oa)
- [CVE-2026-5794](https://cve.now/CVE-2026-5794.md): Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout (CVSS 4.9, Ercom Cryptobox)
- [CVE-2026-6238](https://cve.now/CVE-2026-6238.md): Buffer overread in ns\_printrrf with corrupted RDATA field (CVSS 6.5, The GNU C Library glibc)
- [CVE-2026-7290](https://cve.now/CVE-2026-7290.md): JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection (CVSS 5.3, JeecgBoot)
- [CVE-2026-41873](https://cve.now/CVE-2026-41873.md): Pony Mail: Admin account takeover via request smuggling (CVSS 9.8, Apache Software Foundation Pony Mail)
- [CVE-2026-7289](https://cve.now/CVE-2026-7289.md): D-Link DIR-825M formWanConfigSetup sub\_414BA8 buffer overflow (CVSS 8.7, D-Link DIR-825M)
- [CVE-2026-40969](https://cve.now/CVE-2026-40969.md): Spring gRPC AuthenticationException message reflected to remote client (CVSS 3.7, Spring gRPC · org.springframework.grpc:spring-grpc)
- [CVE-2026-7288](https://cve.now/CVE-2026-7288.md): D-Link DIR-825M formVpnConfigSetup sub\_4151FC buffer overflow (CVSS 8.7, D-Link DIR-825M)
- [CVE-2026-7283](https://cve.now/CVE-2026-7283.md): SourceCodester Pharmacy Sales and Inventory System ajax.php save\_expired sql injection (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-7321](https://cve.now/CVE-2026-7321.md): Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-7324](https://cve.now/CVE-2026-7324.md): Memory safety bugs fixed in Thunderbird 150.0.1 (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-7323](https://cve.now/CVE-2026-7323.md): Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-7322](https://cve.now/CVE-2026-7322.md): Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-7320](https://cve.now/CVE-2026-7320.md): Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-27760](https://cve.now/CVE-2026-27760.md): OpenCATS PHP Code Injection via installer AJAX endpoint (CVSS 9.2, OpenCATS)
- [CVE-2026-40968](https://cve.now/CVE-2026-40968.md): Spring gRPC SecurityContext leaks across requests on authorization failure (CVSS 4.3, Spring gRPC · org.springframework.grpc:spring-grpc)
- [CVE-2026-7282](https://cve.now/CVE-2026-7282.md): SourceCodester Pharmacy Sales and Inventory System ajax.php delete\_expired sql injection (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-7281](https://cve.now/CVE-2026-7281.md): SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting (CVSS 4.8, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-40552](https://cve.now/CVE-2026-40552.md): Remote Code Execution in multiple BinSoft products (CVSS 4.7, BinSoft mpGabinet · BinSoft mpFirma +5)
- [CVE-2026-40551](https://cve.now/CVE-2026-40551.md): Use of Client-Side Authentication in multiple BinSoft products (CVSS 8.4, BinSoft mpGabinet · BinSoft mpFirma +5)
- [CVE-2026-40550](https://cve.now/CVE-2026-40550.md): Privilege Escalation in multiple BinSoft products (CVSS 6.9, BinSoft mpGabinet · BinSoft mpFirma +5)
- [CVE-2026-6706](https://cve.now/CVE-2026-6706.md): Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation co (CVSS 6.5, Devolutions Server)
- [CVE-2026-5944](https://cve.now/CVE-2026-5944.md): Cisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access (CVSS 6.7, Nutanix Cisco Intersight Device Connector for Prism Central)
- [CVE-2026-7272](https://cve.now/CVE-2026-7272.md): WilliamCloudQi matlab-mcp-server MCP index.ts execute\_matlab\_code path traversal (CVSS 6.9, WilliamCloudQi matlab-mcp-server)
- [CVE-2026-7309](https://cve.now/CVE-2026-7309.md): Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection (CVSS 4.3, Red Hat OpenShift Container Platform)
- [CVE-2026-7271](https://cve.now/CVE-2026-7271.md): DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal (CVSS 6.9, DV0x creative-ad-agent)
- [CVE-2026-7269](https://cve.now/CVE-2026-7269.md): SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting (CVSS 4.8, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-5435](https://cve.now/CVE-2026-5435.md): Potential buffer overflow in ns\_sprintrrf TSIG handling path (CVSS 7.3, The GNU C Library glibc)
- [CVE-2026-5781](https://cve.now/CVE-2026-5781.md): Multiple vulnerabilities in MphRx's Minerva (CVSS 8.5, MphRx Minerva)
- [CVE-2026-5780](https://cve.now/CVE-2026-5780.md): Multiple vulnerabilities in MphRx's Minerva (CVSS 8.5, MphRx Minerva)
- [CVE-2026-5779](https://cve.now/CVE-2026-5779.md): Multiple vulnerabilities in MphRx's Minerva (CVSS 9.4, MphRx Minerva)
- [CVE-2026-7268](https://cve.now/CVE-2026-7268.md): SourceCodester Pizzafy Ecommerce System ajax.php save\_category sql injection (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7267](https://cve.now/CVE-2026-7267.md): SourceCodester Pizzafy Ecommerce System view\_prod.php sql injection (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7266](https://cve.now/CVE-2026-7266.md): SourceCodester Pizzafy Ecommerce System ajax.php save\_order sql injection (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7265](https://cve.now/CVE-2026-7265.md): SourceCodester Pizzafy Ecommerce System index.php category sql injection (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-3323](https://cve.now/CVE-2026-3323.md): VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices (CVSS 7.5, VEGA Grieshaber VEGAPULS 6X Two-wire PROFINET, Modbus TCP,…)
- [CVE-2026-7280](https://cve.now/CVE-2026-7280.md): eMPIA Technology｜AVACAST - Unquoted Service Path (CVSS 8.4, eMPIA Technology AVACAST)
- [CVE-2026-7279](https://cve.now/CVE-2026-7279.md): eMPIA Technology｜AVACAST - DLL Hijacking (CVSS 8.5, eMPIA Technology AVACAST)
- [CVE-2026-7264](https://cve.now/CVE-2026-7264.md): SourceCodester Pizzafy Ecommerce System ajax.php get\_cart\_items sql injection (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-41636](https://cve.now/CVE-2026-41636.md): Apache Thrift: Node.js skip() recursion (CVSS 8.7, Apache Software Foundation Apache Thrift · thrift)
- [CVE-2026-41607](https://cve.now/CVE-2026-41607.md): Apache Thrift: C++ JSON OOB read (CVSS 6.5, Apache Software Foundation Apache Thrift)
- [CVE-2026-41606](https://cve.now/CVE-2026-41606.md): Apache Thrift: c\_glib dispatch stack overflow (CVSS 5.3, Apache Software Foundation Apache Thrift)
- [CVE-2026-41605](https://cve.now/CVE-2026-41605.md): Apache Thrift: Swift Compact Protocol integer overflow (CVSS 7.3, Apache Software Foundation Apache Thrift)
- [CVE-2026-41604](https://cve.now/CVE-2026-41604.md): Apache Thrift: Swift Range crash in skip() (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-41602](https://cve.now/CVE-2026-41602.md): Apache Thrift: Go TFramedTransport uint32 overflow (CVSS 7.5, Apache Software Foundation Apache Thrift · github.com/apach…)
- [CVE-2025-48431](https://cve.now/CVE-2025-48431.md): Apache Thrift: Specially crafted input can crash a c\_glib Thrift server with invalid pointer error. (CVSS 7.5, Apache Software Foundation Apache Thrift)
- [CVE-2026-7248](https://cve.now/CVE-2026-7248.md): D-Link DI-8100 CGI Endpoint tgfile.htm tgfile\_htm buffer overflow (CVSS 9.3, D-Link DI-8100)
- [CVE-2026-7247](https://cve.now/CVE-2026-7247.md): D-Link DI-8100 File Extension file\_exten.asp file\_exten\_asp buffer overflow (CVSS 8.6, D-Link DI-8100)
- [CVE-2026-7244](https://cve.now/CVE-2026-7244.md): Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-7243](https://cve.now/CVE-2026-7243.md): Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2025-10539](https://cve.now/CVE-2025-10539.md): Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App (CVSS 4.8, DeskTime Time Tracking App)
- [CVE-2026-7242](https://cve.now/CVE-2026-7242.md): Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-40980](https://cve.now/CVE-2026-40980.md): In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by \`ForkPDFLay (CVSS 6.5, Spring AI · org.springframework.ai:spring-ai-pdf-document-r…)
- [CVE-2026-40979](https://cve.now/CVE-2026-40979.md): In Spring AI, having access to a shared environment can expose the ONNX model used by the application. (CVSS 6.1, Spring AI · org.springframework.ai:spring-ai-transformers)
- [CVE-2026-7241](https://cve.now/CVE-2026-7241.md): Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-40978](https://cve.now/CVE-2026-40978.md): SQL injection vulnerability in Spring AI's \`CosmosDBVectorStore\` allows attackers to execute arbitrary SQL queries via crafted document IDs. (CVSS 8.8, Spring AI · org.springframework.ai:spring-ai-azure-cosmos-d…)
- [CVE-2026-7240](https://cve.now/CVE-2026-7240.md): Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2024-54013](https://cve.now/CVE-2024-54013.md): Authentication Bypass (CVSS 8.7, Hanwha Vision QND-8080R)
- [CVE-2024-54012](https://cve.now/CVE-2024-54012.md): Command Injection (CVSS 8.5, Hanwha Vision QND-8080R)
- [CVE-2026-7238](https://cve.now/CVE-2026-7238.md): code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload (CVSS 5.1, code-projects Online Music Site)
- [CVE-2024-54011](https://cve.now/CVE-2024-54011.md): Missing Error/Exception Handling (CVSS 5.3, Hanwha Vision QND-8080R)
- [CVE-2026-4805](https://cve.now/CVE-2026-4805.md): Woostify \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block (CVSS 6.4, duongancol Woostify)
- [CVE-2026-4911](https://cve.now/CVE-2026-4911.md): Booking Package \<= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter (CVSS 5.3, masaakitanaka Booking Package)
- [CVE-2026-7237](https://cve.now/CVE-2026-7237.md): AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal (CVSS 6.9, AgiFlow scaffold-mcp)
- [CVE-2026-40966](https://cve.now/CVE-2026-40966.md): VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration (CVSS 5.9, VMware Spring AI · org.springframework.ai:spring-ai-advisor…)
- [CVE-2026-7235](https://cve.now/CVE-2026-7235.md): ErlichLiu claude-agent-sdk-master route.ts path traversal (CVSS 6.9, ErlichLiu claude-agent-sdk-master)
- [CVE-2026-7234](https://cve.now/CVE-2026-7234.md): BrowserOperator browser-operator-core server.js startsWith path traversal (CVSS 6.9, BrowserOperator browser-operator-core)
- [CVE-2026-40967](https://cve.now/CVE-2026-40967.md): In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector stor (CVSS 8.6, Spring AI · org.springframework.ai:spring-ai-vector-store)
- [CVE-2026-7233](https://cve.now/CVE-2026-7233.md): Artifex MuPDF CFF Index subset-cff.c fz\_subset\_cff\_for\_gids out-of-bounds (CVSS 4.8, Artifex MuPDF)
- [CVE-2026-5306](https://cve.now/CVE-2026-5306.md): Check & Log Email \< 2.0.13 - Unauthenticated Stored XSS (CVSS 5.4, Check & Log Email)
- [CVE-2026-7230](https://cve.now/CVE-2026-7230.md): SourceCodester Safety Anger Pad cross site scripting (CVSS 5.3, SourceCodester Safety Anger Pad)
- [CVE-2026-7229](https://cve.now/CVE-2026-7229.md): code-projects Coaching Management System POST reply.php sql injection (CVSS 5.3, code-projects Coaching Management System)
- [CVE-2026-7228](https://cve.now/CVE-2026-7228.md): SourceCodester Pizzafy Ecommerce System ajax.php get\_cart\_count sql injection (CVSS 6.9, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7227](https://cve.now/CVE-2026-7227.md): SourceCodester Pizzafy Ecommerce System ajax.php login sql injection (CVSS 6.9, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-42510](https://cve.now/CVE-2026-42510.md): OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface. (CVSS 6.6, OpenStack Ironic · ironic)
- [CVE-2026-7226](https://cve.now/CVE-2026-7226.md): SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection (CVSS 6.9, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7225](https://cve.now/CVE-2026-7225.md): SourceCodester Pizzafy Ecommerce System ajax.php delete\_menu sql injection (CVSS 6.9, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-6725](https://cve.now/CVE-2026-6725.md): WPC Smart Messages for WooCommerce \<= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute (CVSS 6.4, wpclever WPC Smart Messages for WooCommerce)
- [CVE-2026-6809](https://cve.now/CVE-2026-6809.md): Social Post Embed \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed (CVSS 6.4, dartiss Social Post Embed)
- [CVE-2026-6551](https://cve.now/CVE-2026-6551.md): Timeline Blocks for Gutenberg \<= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute (CVSS 6.4, techeshta Timeline Blocks for Gutenberg)
- [CVE-2026-7224](https://cve.now/CVE-2026-7224.md): SourceCodester Pizzafy Ecommerce System ajax.php delete\_cart sql injection (CVSS 6.9, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7223](https://cve.now/CVE-2026-7223.md): BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery (CVSS 6.9, BigSweetPotatoStudio HyperChat · @dadigua/hyperchat)
- [CVE-2026-7222](https://cve.now/CVE-2026-7222.md): code-projects Coaching Management System Complaint Form complaint.php cross site scripting (CVSS 5.1, code-projects Coaching Management System)
- [CVE-2026-7221](https://cve.now/CVE-2026-7221.md): TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery (CVSS 6.9, TencentCloudBase CloudBase-MCP)
- [CVE-2026-7220](https://cve.now/CVE-2026-7220.md): jackwrichards FastlyMCP fastly\_cli Tool fastly-mcp.mjs os command injection (CVSS 6.9, jackwrichards FastlyMCP)
- [CVE-2026-7219](https://cve.now/CVE-2026-7219.md): Totolink N300RT formIpQoS buffer overflow (CVSS 8.6, Totolink N300RT)
- [CVE-2026-7218](https://cve.now/CVE-2026-7218.md): Totolink N300RT libapmib.so formWsc is\_cmd\_string\_valid buffer overflow (CVSS 8.6, Totolink N300RT)
- [CVE-2026-7217](https://cve.now/CVE-2026-7217.md): Deepractice PromptX Document File index.ts read\_pdf absolute path traversal (CVSS 6.9, Deepractice PromptX)
- [CVE-2026-7216](https://cve.now/CVE-2026-7216.md): donchelo processing-claude-mcp-bridge create\_sketch Tool processing\_server.py path traversal (CVSS 6.9, donchelo processing-claude-mcp-bridge)
- [CVE-2026-1460](https://cve.now/CVE-2026-1460.md): A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX (CVSS 7.2, Zyxel DX3301-T0 firmware · Zyxel EX3301-T0 firmware)
- [CVE-2026-7215](https://cve.now/CVE-2026-7215.md): egtai gmx-vmd-mcp VMD Launch mcp\_server.py launch\_vmd\_gui\_tool command injection (CVSS 6.9, egtai gmx-vmd-mcp)
- [CVE-2026-0711](https://cve.now/CVE-2026-0711.md): A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7. (CVSS 6.8, Zyxel DX3300-T0 firmware)
- [CVE-2026-7214](https://cve.now/CVE-2026-7214.md): eghuzefa engineer-your-data server.py file\_inf path traversal (CVSS 6.9, eghuzefa engineer-your-data)
- [CVE-2026-7213](https://cve.now/CVE-2026-7213.md): ef10007 MLOps\_MCP save\_file Tool fastmcp\_server.py path traversal (CVSS 6.9, ef10007 MLOps\_MCP)
- [CVE-2026-7212](https://cve.now/CVE-2026-7212.md): edvardlindelof notes-mcp notes\_mcp.py path traversal (CVSS 6.9, edvardlindelof notes-mcp · notes-mcp)
- [CVE-2026-7211](https://cve.now/CVE-2026-7211.md): dvladimirov MCP Git Search API mcp\_server.py GitSearchRequest command injection (CVSS 6.9, dvladimirov MCP)
- [CVE-2026-7206](https://cve.now/CVE-2026-7206.md): dubydu sqlite-mcp entry.py extract\_to\_json sql injection (CVSS 6.9, dubydu sqlite-mcp · sqlite-mcp)
- [CVE-2026-7205](https://cve.now/CVE-2026-7205.md): duartium papers-mcp-server main.py search\_papers path traversal (CVSS 6.9, duartium papers-mcp-server)
- [CVE-2026-7204](https://cve.now/CVE-2026-7204.md): Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-7203](https://cve.now/CVE-2026-7203.md): Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2025-60887](https://cve.now/CVE-2025-60887.md): An issue was discovered in Cista v0.15 and below. (CVSS 5.3)
- [CVE-2025-60889](https://cve.now/CVE-2025-60889.md): Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary cod (CVSS 9.8)
- [CVE-2025-67223](https://cve.now/CVE-2025-67223.md): The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable name (CVSS 7.5)
- [CVE-2026-37750](https://cve.now/CVE-2026-37750.md): A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to ex (CVSS 6.1)
- [CVE-2026-38651](https://cve.now/CVE-2026-38651.md): Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. (CVSS 8.2, github.com/gravitl/netmaker)
- [CVE-2026-38948](https://cve.now/CVE-2026-38948.md): Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. (CVSS 5.4)
- [CVE-2026-38949](https://cve.now/CVE-2026-38949.md): Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image (CVSS 8.9)
- [CVE-2026-40355](https://cve.now/CVE-2026-40355.md): In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss\_accept\_sec\_context() on a system (CVSS 5.9, MIT Kerberos)
- [CVE-2026-40356](https://cve.now/CVE-2026-40356.md): In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss\_accep (CVSS 5.9, MIT Kerberos)
- [CVE-2026-41525](https://cve.now/CVE-2026-41525.md): KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbo (CVSS 6.5, KDE Dolphin)
- [CVE-2026-41526](https://cve.now/CVE-2026-41526.md): In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. (CVSS 6.5, KDE KCoreAddons)
- [CVE-2026-42167](https://cve.now/CVE-2026-42167.md): mod\_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of US (CVSS 8.1, ProFTPD)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.