# CVEs published 2026-04-29

133 CVEs were published on April 29, 2026: 12 critical, 50 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-7445](https://cve.now/CVE-2026-7445.md): ZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal (CVSS 5.3, ZachHandley ZMCPTools)
- [CVE-2026-7443](https://cve.now/CVE-2026-7443.md): BurtTheCoder mcp-dnstwist MCP index.ts fuzz\_domain os command injection (CVSS 6.9, BurtTheCoder mcp-dnstwist)
- [CVE-2026-7420](https://cve.now/CVE-2026-7420.md): UTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-7419](https://cve.now/CVE-2026-7419.md): UTT HiPER 1250GW formTaskEdit\_ap strcpy buffer overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-7381](https://cve.now/CVE-2026-7381.md): Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting (CVSS 9.1, MIYAGAWA Plack::Middleware::XSendfile)
- [CVE-2026-7418](https://cve.now/CVE-2026-7418.md): UTT HiPER 1250GW NTP strcpy buffer overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-7417](https://cve.now/CVE-2026-7417.md): Algovate xhs-mcp MCP mcp.server.ts xhs\_publish\_content server-side request forgery (CVSS 6.9, Algovate xhs-mcp)
- [CVE-2026-7416](https://cve.now/CVE-2026-7416.md): PolarVista xcode-mcp-server MCP index.ts run\_tests os command injection (CVSS 6.9, PolarVista xcode-mcp-server)
- [CVE-2026-7410](https://cve.now/CVE-2026-7410.md): SourceCodester Pizzafy Ecommerce System ajax.php add\_to\_cart sql injection (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7409](https://cve.now/CVE-2026-7409.md): SourceCodester Pizzafy Ecommerce System ajax.php save\_user sql injection (CVSS 5.1, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7408](https://cve.now/CVE-2026-7408.md): SourceCodester Pizzafy Ecommerce System ajax.php save\_menu sql injection (CVSS 5.1, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7407](https://cve.now/CVE-2026-7407.md): SourceCodester Pizzafy Ecommerce System Setting ajax.php save\_settings sql injection (CVSS 5.1, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-1858](https://cve.now/CVE-2026-1858.md): wget2 Improper Certificate Validation (CVSS 4.8, gnu wget2)
- [CVE-2026-7404](https://cve.now/CVE-2026-7404.md): getsimpletool mcpo-simple-server base\_manager.py delete\_shared\_prompt path traversal (CVSS 6.9, getsimpletool mcpo-simple-server · mcpo-simple-server)
- [CVE-2026-7403](https://cve.now/CVE-2026-7403.md): geldata gel-mcp server.py fetch\_rule path traversal (CVSS 6.9, geldata gel-mcp)
- [CVE-2026-34965](https://cve.now/CVE-2026-34965.md): Cockpit CMS Authenticated Remote Code Execution via Collections (CVSS 8.8, Cockpit CMS)
- [CVE-2018-25311](https://cve.now/CVE-2018-25311.md): VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal (CVSS 7.1, VideoFlow Digital Video Protection)
- [CVE-2018-25310](https://cve.now/CVE-2018-25310.md): VideoFlow Digital Video Protection DVP 2.10 - Authenticated Remote Code Execution (CVSS 5.3, VideoFlow Digital Video Protection)
- [CVE-2018-25318](https://cve.now/CVE-2018-25318.md): Tenda FH303/A300 V5.07.68\_EN Cookie Session Weakness DNS Change (CVSS 9.3, Tenda FH303/A300)
- [CVE-2018-25317](https://cve.now/CVE-2018-25317.md): Tenda W3002R/A302/W309R V5.07.64\_en Cookie Session Weakness DNS Change (CVSS 9.3, Tenda W3002R · Tenda A302 +1)
- [CVE-2018-25316](https://cve.now/CVE-2018-25316.md): Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change (CVSS 9.3, Tenda W308R)
- [CVE-2018-25315](https://cve.now/CVE-2018-25315.md): Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name (CVSS 8.6, Alloksoft Video Joiner)
- [CVE-2018-25314](https://cve.now/CVE-2018-25314.md): Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow (CVSS 8.6, Alloksoft WMV to AVI MPEG DVD WMV Converter)
- [CVE-2018-25313](https://cve.now/CVE-2018-25313.md): SysGauge 4.5.18 Local Denial of Service via Proxy Configuration (CVSS 6.9, SysGauge)
- [CVE-2018-25312](https://cve.now/CVE-2018-25312.md): LifeSize ClearSea 3.1.4 Directory Traversal Remote Code Execution (CVSS 7.1, LifeSize ClearSea)
- [CVE-2018-25309](https://cve.now/CVE-2018-25309.md): MyBB Recent threads 17.0 Persistent Cross-Site Scripting (CVSS 5.1, MyBB Recent threads)
- [CVE-2018-25308](https://cve.now/CVE-2018-25308.md): BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion (CVSS 8.7, donmik Buddypress Xprofile Custom Fields Type)
- [CVE-2018-25307](https://cve.now/CVE-2018-25307.md): SysGauge Pro 4.6.12 Local Buffer Overflow SEH (CVSS 8.6, SysGauge Pro)
- [CVE-2018-25306](https://cve.now/CVE-2018-25306.md): PDFunite 0.41.0 Buffer Overflow via Malformed PDF (CVSS 6.9, poppler-utils PDFunite)
- [CVE-2018-25305](https://cve.now/CVE-2018-25305.md): librsvg2-bin 2.40.13 Buffer Overflow via Malformed SVG (CVSS 6.9, librsvg2-bin)
- [CVE-2018-25304](https://cve.now/CVE-2018-25304.md): Free Download Manager 2.0 Build 417 Local Buffer Overflow SEH (CVSS 8.6, Filehippo Free Download Manager)
- [CVE-2018-25303](https://cve.now/CVE-2018-25303.md): Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH (CVSS 8.6, Alloksoft Allok Video to DVD Burner)
- [CVE-2018-25302](https://cve.now/CVE-2018-25302.md): Allok AVI to DVD SVCD VCD Converter 4.0.1217 Buffer Overflow SEH (CVSS 8.5, Alloksoft Allok AVI to DVD SVCD VCD Converter)
- [CVE-2018-25301](https://cve.now/CVE-2018-25301.md): Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow (CVSS 8.6, Easy MPEG to DVD Burner)
- [CVE-2018-25300](https://cve.now/CVE-2018-25300.md): XATABoost CMS 1.0.0 SQL Injection via news.php (CVSS 8.8, XATABoost CMS)
- [CVE-2018-25299](https://cve.now/CVE-2018-25299.md): Prime95 29.4b8 Local Buffer Overflow via SEH (CVSS 8.6, Mersenne Prime95)
- [CVE-2018-25298](https://cve.now/CVE-2018-25298.md): Merge PACS 7.0 Cross-Site Request Forgery via merge-viewer (CVSS 6.9, Merge PACS)
- [CVE-2026-7401](https://cve.now/CVE-2026-7401.md): SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting (CVSS 5.3, SourceCodester CET Automated Grading System with AI Predict…)
- [CVE-2026-7400](https://cve.now/CVE-2026-7400.md): geekgod382 filesystem-mcp-server read\_file\_tool/write\_file\_tool server.py is\_path\_allowed path traversal (CVSS 6.9, geekgod382 filesystem-mcp-server)
- [CVE-2026-7426](https://cve.now/CVE-2026-7426.md): Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP (CVSS 8.1, AWS FreeRTOS-Plus-TCP)
- [CVE-2026-7425](https://cve.now/CVE-2026-7425.md): Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP (CVSS 6.5, AWS FreeRTOS-Plus-TCP)
- [CVE-2026-7424](https://cve.now/CVE-2026-7424.md): Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP (CVSS 8.1, AWS FreeRTOS-Plus-TCP)
- [CVE-2026-7466](https://cve.now/CVE-2026-7466.md): AgentFlow Arbitrary Python Pipeline Execution via pipeline\_path (CVSS 7.7, berabuddies AgentFlow)
- [CVE-2026-7423](https://cve.now/CVE-2026-7423.md): Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP (CVSS 5.3, AWS FreeRTOS-Plus-TCP)
- [CVE-2026-7422](https://cve.now/CVE-2026-7422.md): MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing (CVSS 6.5, AWS FreeRTOS-Plus-TCP)
- [CVE-2026-7398](https://cve.now/CVE-2026-7398.md): florensiawidjaja BioinfoMCP Upload Endpoint app.py upload path traversal (CVSS 6.9, florensiawidjaja BioinfoMCP)
- [CVE-2026-27105](https://cve.now/CVE-2026-27105.md): Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnera (CVSS 6.3, Dell/Alienware Purchased Apps)
- [CVE-2026-7439](https://cve.now/CVE-2026-7439.md): AgentFlow Local Web API Content-Type Validation Bypass (CVSS 4.8, berabuddies AgentFlow)
- [CVE-2026-41499](https://cve.now/CVE-2026-41499.md): Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse\_uname\_string() (CVSS 6.5, wazuh)
- [CVE-2026-7397](https://cve.now/CVE-2026-7397.md): NousResearch hermes-agent file\_tools.py \_check\_sensitive\_path symlink (CVSS 4.8, NousResearch hermes-agent)
- [CVE-2026-30893](https://cve.now/CVE-2026-30893.md): Wazuh cluster sync path traversal in decompress\_files() enables arbitrary file write and code execution from authenticated cluster peer (CVSS 9.0, wazuh)
- [CVE-2026-28221](https://cve.now/CVE-2026-28221.md): Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print\_hex\_string() due to signed char promotion on x86\_64 (CVSS 6.5, wazuh)
- [CVE-2026-26206](https://cve.now/CVE-2026-26206.md): Wazuh: API brute-force protection bypass via race condition in login attempt tracking (CVSS 6.5, wazuh)
- [CVE-2026-26204](https://cve.now/CVE-2026-26204.md): Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData (CVSS 4.4, wazuh)
- [CVE-2026-26015](https://cve.now/CVE-2026-26015.md): Unauthenticated RCE in DocsGPT MCP STDIO Configuration (CVSS 10.0, arc53 DocsGPT)
- [CVE-2026-7396](https://cve.now/CVE-2026-7396.md): NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-5712](https://cve.now/CVE-2026-5712.md): IdentityIQ Role Editor Incorrect Authorization Vulnerability (CVSS 8.0, SailPoint Technologies IdentityIQ)
- [CVE-2026-7394](https://cve.now/CVE-2026-7394.md): SourceCodester Pizzafy Ecommerce System GET Parameter view\_order.php sql injection (CVSS 5.1, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-7393](https://cve.now/CVE-2026-7393.md): SourceCodester Pizzafy Ecommerce System File Extension admin\_class\_novo.php save\_menu unrestricted upload (CVSS 5.1, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-6915](https://cve.now/CVE-2026-6915.md): Flaw in the updateUser Command May Allow Unauthorized Configuration Change (CVSS 5.3, MongoDB Server)
- [CVE-2026-6914](https://cve.now/CVE-2026-6914.md): MD5 checksum creation may cause availability loss (CVSS 7.1, MongoDB Server)
- [CVE-2026-7392](https://cve.now/CVE-2026-7392.md): SourceCodester Pharmacy Sales and Inventory System ajax.php delete\_supplier sql injection (CVSS 5.3, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-0206](https://cve.now/CVE-2026-0206.md): A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall. (CVSS 4.9, SonicWall SonicOS)
- [CVE-2026-0205](https://cve.now/CVE-2026-0205.md): A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. (CVSS 6.8, SonicWall SonicOS)
- [CVE-2026-0204](https://cve.now/CVE-2026-0204.md): A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific (CVSS 8.0, SonicWall SonicOS)
- [CVE-2026-7391](https://cve.now/CVE-2026-7391.md): SourceCodester Pharmacy Sales and Inventory System ajax.php save\_supplier sql injection (CVSS 5.3, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-42198](https://cve.now/CVE-2026-42198.md): pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS (CVSS 7.5, pgjdbc · org.postgresql:postgresql)
- [CVE-2026-7390](https://cve.now/CVE-2026-7390.md): SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-40230](https://cve.now/CVE-2026-40230.md): Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering (CVSS 4.8, helpyio helpy)
- [CVE-2026-40229](https://cve.now/CVE-2026-40229.md): Helpy 2.8.0 - Stored XSS in post author display via PostsHelper (CVSS 5.1, helpyio helpy)
- [CVE-2026-7389](https://cve.now/CVE-2026-7389.md): EyouCMS common.php GetSortData sql injection (CVSS 6.9, EyouCMS)
- [CVE-2026-2810](https://cve.now/CVE-2026-2810.md): Endpoint DLP Driver Out-of-Bounds Read (CVSS 6.8, Netskope Client)
- [CVE-2026-7388](https://cve.now/CVE-2026-7388.md): EyouCMS Template File FilemanagerLogic.php editFile code injection (CVSS 5.1, EyouCMS)
- [CVE-2026-41940](https://cve.now/CVE-2026-41940.md): WebPros cPanel and WHM Authentication Bypass via Login Flow (CVSS 9.3, KEV, WebPros cPanel · WebPros WP Squared +1)
- [CVE-2026-7386](https://cve.now/CVE-2026-7386.md): fatbobman mail-mcp-bridge mail\_mcp\_server.py path traversal (CVSS 6.9, fatbobman mail-mcp-bridge)
- [CVE-2026-6849](https://cve.now/CVE-2026-6849.md): OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer (CVSS 8.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-5166](https://cve.now/CVE-2026-5166.md): Path Traversal in TUBITAK BILGEM's Pardus Software Center (CVSS 9.6, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-7384](https://cve.now/CVE-2026-7384.md): ezequiroga mcp-bases research\_server.py search\_papers path traversal (CVSS 6.9, ezequiroga mcp-bases)
- [CVE-2026-5161](https://cve.now/CVE-2026-5161.md): Improper Authentication in TUBITAK BILGEM's Pardus About (CVSS 8.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-7111](https://cve.now/CVE-2026-7111.md): Text::CSV\_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption (CVSS 8.4, HMBRAND Text::CSV\_XS)
- [CVE-2026-5141](https://cve.now/CVE-2026-5141.md): Improper Access Control in TUBITAK BILGEM's Pardus Software Center (CVSS 8.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-41220](https://cve.now/CVE-2026-41220.md): Local privilege escalation due to improper input validation. (CVSS 7.8, Acronis DeviceLock DLP · Acronis Cyber Protect Cloud Agent)
- [CVE-2026-41952](https://cve.now/CVE-2026-41952.md): Local privilege escalation due to improper input validation. (CVSS 7.8, Acronis DeviceLock DLP · Acronis Cyber Protect Cloud Agent)
- [CVE-2026-25852](https://cve.now/CVE-2026-25852.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis DeviceLock DLP)
- [CVE-2026-42525](https://cve.now/CVE-2026-42525.md): Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowi (CVSS 4.3, Jenkins Project Jenkins Microsoft Entra ID (previously Azur…)
- [CVE-2026-42524](https://cve.now/CVE-2026-42524.md): Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site (CVSS 8.0, Jenkins Project Jenkins HTML Publisher Plugin · org.jenkins…)
- [CVE-2026-42523](https://cve.now/CVE-2026-42523.md): Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the featu (CVSS 9.0, Jenkins Project Jenkins GitHub Plugin · com.coravy.hudson.p…)
- [CVE-2026-42522](https://cve.now/CVE-2026-42522.md): A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea\_d580c1a\_b\_a\_ and earlier allows attackers with Overall/Read perm (CVSS 4.3, Jenkins Project Jenkins GitHub Branch Source Plugin · org.j…)
- [CVE-2026-42521](https://cve.now/CVE-2026-42521.md): Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specifi (CVSS 6.5, Jenkins Project Jenkins Matrix Authorization Strategy Plugi…)
- [CVE-2026-42520](https://cve.now/CVE-2026-42520.md): Jenkins Credentials Binding Plugin 719.v80e905ef14eb\_ and earlier does not sanitize file names for file and zip file credentials, allowing a (CVSS 7.5, Jenkins Project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2026-42519](https://cve.now/CVE-2026-42519.md): A missing permission check in Jenkins Script Security Plugin 1399.ve6a\_66547f6e1 and earlier allows attackers with Overall/Read permission t (CVSS 4.3, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-5140](https://cve.now/CVE-2026-5140.md): Authorization Bypass in TUBITAK BILGEM's Pardus Update (CVSS 8.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-42249](https://cve.now/CVE-2026-42249.md): Remote Code Execution in Ollama via Update Mechanism (CVSS 7.7, Ollama)
- [CVE-2026-42248](https://cve.now/CVE-2026-42248.md): Missing Signature Verification for Updates in Ollama (CVSS 7.7, Ollama)
- [CVE-2026-22745](https://cve.now/CVE-2026-22745.md): CVE-2026-22745 : Denial of service in static resource handling on Windows platforms (CVSS 5.3, VMware Spring Framework · org.springframework:spring-web… +1)
- [CVE-2026-22741](https://cve.now/CVE-2026-22741.md): Static resource cache poisoning in Spring MVC and WebFlux (CVSS 3.1, VMware Spring Framework · org.springframework:spring-web… +1)
- [CVE-2026-2902](https://cve.now/CVE-2026-2902.md): WP Meteor Website Speed Optimization Addon \<= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment (CVSS 6.1, aguidrevitch WP Meteor Website Speed Optimization Addon)
- [CVE-2026-22740](https://cve.now/CVE-2026-22740.md): Spring Framework DoS with Multipart Temp Files in WebFlux (CVSS 6.5, VMware Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-42641](https://cve.now/CVE-2026-42641.md): WordPress Share This Image plugin \<= 2.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, ILLID Share This Image)
- [CVE-2026-42645](https://cve.now/CVE-2026-42645.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2026-42648](https://cve.now/CVE-2026-42648.md): WordPress Spectra plugin \<= 2.19.22 - Broken Access Control vulnerability (CVSS 4.3, Brainstorm Force Spectra)
- [CVE-2026-42642](https://cve.now/CVE-2026-42642.md): WordPress GiveWP plugin \<= 4.14.5 - Broken Access Control vulnerability (CVSS 5.3, StellarWP GiveWP)
- [CVE-2026-42646](https://cve.now/CVE-2026-42646.md): WordPress TaxoPress plugin \<= 3.44.0 - SQL Injection vulnerability (CVSS 7.6, Steve Burge TaxoPress)
- [CVE-2026-42643](https://cve.now/CVE-2026-42643.md): WordPress Image Widget plugin \<= 4.4.11 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, StellarWP Image Widget)
- [CVE-2026-42644](https://cve.now/CVE-2026-42644.md): WordPress BetterDocs plugin \<= 4.3.10 - Sensitive Data Exposure vulnerability (CVSS 5.3, WPDeveloper BetterDocs)
- [CVE-2026-42652](https://cve.now/CVE-2026-42652.md): WordPress User Registration plugin \<= 5.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpeverest User Registration)
- [CVE-2026-42518](https://cve.now/CVE-2026-42518.md): Information Disclosure Vulnerability in e-Sushrut HMIS (CVSS 8.7, CDAC-Noida e-Sushrut, Hospital Management Information System)
- [CVE-2026-3325](https://cve.now/CVE-2026-3325.md): SQL injection in MegaCMS by CRM Sistemas de Fidelización (CVSS 10.0, CRM Sistemas de Fidelización MegaCMS)
- [CVE-2026-42517](https://cve.now/CVE-2026-42517.md): Cryptographic Failure Vulnerability in e-Sushrut HMIS (CVSS 7.1, CDAC-Noida e-Sushrut, Hospital Management Information System)
- [CVE-2026-4019](https://cve.now/CVE-2026-4019.md): Complianz – GDPR/CCPA Cookie Consent \<= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint (CVSS 5.3, Complianz – GDPR/CCPA Cookie Consent)
- [CVE-2026-42516](https://cve.now/CVE-2026-42516.md): Broken Access Control Vulnerability in e-Sushrut HMIS (CVSS 7.1, CDAC-Noida e-Sushrut, Hospital Management Information System)
- [CVE-2026-42515](https://cve.now/CVE-2026-42515.md): Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS (CVSS 7.1, CDAC-Noida e-Sushrut, Hospital Management Information System)
- [CVE-2026-42514](https://cve.now/CVE-2026-42514.md): Sensitive Data Exposure Vulnerability in e-Sushrut HMIS (CVSS 8.8, CDAC-Noida e-Sushrut, Hospital Management Information System)
- [CVE-2026-42513](https://cve.now/CVE-2026-42513.md): Authentication Bypass Vulnerability in e-Sushrut HMIS (CVSS 8.8, CDAC-Noida e-Sushrut, Hospital Management Information System)
- [CVE-2025-10503](https://cve.now/CVE-2025-10503.md): Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server (CVSS 6.1, WSO2 Identity Server)
- [CVE-2026-42412](https://cve.now/CVE-2026-42412.md): WordPress WP User Frontend plugin \<= 4.3.1 - Broken Access Control vulnerability (CVSS 6.5, weDevs WP User Frontend)
- [CVE-2026-42377](https://cve.now/CVE-2026-42377.md): WordPress SureForms Pro plugin \<= 2.8.0 - Broken Access Control vulnerability (CVSS 7.3, Brainstorm Force SureForms Pro)
- [CVE-2026-21023](https://cve.now/CVE-2026-21023.md): Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-35155](https://cve.now/CVE-2026-35155.md): Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. (CVSS 7.1, Dell iDRAC10)
- [CVE-2026-23773](https://cve.now/CVE-2026-23773.md): Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. (CVSS 4.3, Dell Disk Library for mainframe DLm8700 · Dell Disk Library…)
- [CVE-2026-42615](https://cve.now/CVE-2026-42615.md): GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show\_Base64\_offsets('%3Cscript substring. (CVSS 7.2, GCHQ CyberChef · cyberchef)
- [CVE-2025-50328](https://cve.now/CVE-2025-50328.md): A vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protect (CVSS 7.3)
- [CVE-2025-56534](https://cve.now/CVE-2025-56534.md): A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary (CVSS 6.1)
- [CVE-2025-56535](https://cve.now/CVE-2025-56535.md): A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a (CVSS 6.1)
- [CVE-2025-56536](https://cve.now/CVE-2025-56536.md): A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via inje (CVSS 6.1)
- [CVE-2025-56537](https://cve.now/CVE-2025-56537.md): A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scrip (CVSS 6.1)
- [CVE-2026-30769](https://cve.now/CVE-2026-30769.md): An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via s (CVSS 7.8)
- [CVE-2026-36837](https://cve.now/CVE-2026-36837.md): TOTOLINK A3002RU V3 \<= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formM (CVSS 7.5)
- [CVE-2026-36841](https://cve.now/CVE-2026-36841.md): TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice (CVSS 9.8)
- [CVE-2026-37555](https://cve.now/CVE-2026-37555.md): An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. (CVSS 7.5)
- [CVE-2026-38991](https://cve.now/CVE-2026-38991.md): Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component \_isFileTypeAllowed function where a specially craft (CVSS 8.8, cockpit-hq/cockpit)
- [CVE-2026-38992](https://cve.now/CVE-2026-38992.md): Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. (CVSS 9.8, cockpit-hq/cockpit)
- [CVE-2026-38993](https://cve.now/CVE-2026-38993.md): Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. (CVSS 6.5, cockpit-hq/cockpit)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.