# CVEs published 2026-04-30

167 CVEs were published on April 30, 2026: 5 critical, 58 high. Days are UTC.

- [CVE-2026-7513](https://cve.now/CVE-2026-7513.md): UTT HiPER 1200GW formRemoteControl strcpy buffer overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-7512](https://cve.now/CVE-2026-7512.md): UTT HiPER 1200GW formUser strcpy buffer overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-22726](https://cve.now/CVE-2026-22726.md): Route Services Firewall Bypass (CVSS 5.0, CloudFoundry Foundation Routing release · CloudFoundry Foun…)
- [CVE-2026-5404](https://cve.now/CVE-2026-5404.md): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark (CVSS 4.7, Wireshark Foundation Wireshark)
- [CVE-2026-5403](https://cve.now/CVE-2026-5403.md): Heap-based Buffer Overflow in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2026-5656](https://cve.now/CVE-2026-5656.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVSS 7.0, Wireshark Foundation Wireshark)
- [CVE-2026-5405](https://cve.now/CVE-2026-5405.md): Heap-based Buffer Overflow in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2026-7510](https://cve.now/CVE-2026-7510.md): OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization (CVSS 5.3, OWAP DefectDojo)
- [CVE-2026-7508](https://cve.now/CVE-2026-7508.md): Bootstrap CMS Page Creation show.blade.php code injection (CVSS 5.3, Bootstrap CMS)
- [CVE-2026-7506](https://cve.now/CVE-2026-7506.md): SourceCodester Hotel Management System check sql injection (CVSS 6.9, SourceCodester Hotel Management System)
- [CVE-2026-7505](https://cve.now/CVE-2026-7505.md): nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization (CVSS 6.9, nextlevelbuilder GoClaw)
- [CVE-2026-28909](https://cve.now/CVE-2026-28909.md): Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaint (CVSS 6.5, Apple macOS)
- [CVE-2026-1577](https://cve.now/CVE-2026-1577.md): IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries (CVSS 6.5, IBM Db2)
- [CVE-2025-36122](https://cve.now/CVE-2025-36122.md): IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic (CVSS 6.5, IBM Db2)
- [CVE-2025-14688](https://cve.now/CVE-2025-14688.md): IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations (CVSS 5.3, IBM Db2)
- [CVE-2026-7503](https://cve.now/CVE-2026-7503.md): code-projects for Plugin cstecgi.cgi setWiFiMultipleConfig buffer overflow (CVSS 8.7, code-projects for Plugin)
- [CVE-2026-2311](https://cve.now/CVE-2026-2311.md): IBM i is affected by a privilege escalation vulnerability in Web Administration GUI \[\] (CVSS 6.4, IBM i)
- [CVE-2026-7551](https://cve.now/CVE-2026-7551.md): HKUDS OpenHarness Remote Command Execution via /bridge Slash Command (CVSS 8.7, HKUDS OpenHarness)
- [CVE-2025-36180](https://cve.now/CVE-2025-36180.md): Inadequate Pod Communication Restrictions, affects watsonx.data (CVSS 5.3, IBM watsonx.data)
- [CVE-2026-6389](https://cve.now/CVE-2026-6389.md): IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability (CVSS 8.8, IBM Turbonomic prometurbo agent)
- [CVE-2026-6542](https://cve.now/CVE-2026-6542.md): Monitor API allows cross-user read of transaction logs and deletion of build data via flow\_id (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-7502](https://cve.now/CVE-2026-7502.md): LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization (CVSS 5.3, LinkStackOrg LinkStack)
- [CVE-2025-36335](https://cve.now/CVE-2025-36335.md): Vulnerabilities found (CVSS 6.2, IBM watsonx.data intelligence)
- [CVE-2026-6543](https://cve.now/CVE-2026-6543.md): Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint (CVSS 8.8, IBM Langflow Desktop)
- [CVE-2026-3345](https://cve.now/CVE-2026-3345.md): Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint (CVSS 6.5, IBM Langflow Desktop)
- [CVE-2026-3346](https://cve.now/CVE-2026-3346.md): Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw (CVSS 6.4, IBM Langflow Desktop)
- [CVE-2026-3340](https://cve.now/CVE-2026-3340.md): Server-Side Request Forgery (SSRF) in Langflow URL Component (CVSS 6.5, IBM Langflow Desktop)
- [CVE-2026-4502](https://cve.now/CVE-2026-4502.md): Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API (CVSS 6.5, IBM Langflow Desktop)
- [CVE-2026-4503](https://cve.now/CVE-2026-4503.md): Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint (CVSS 7.5, IBM Langflow Desktop)
- [CVE-2026-7501](https://cve.now/CVE-2026-7501.md): LinkStackOrg LinkStack UserController.php editPage cross site scripting (CVSS 5.1, LinkStackOrg LinkStack)
- [CVE-2026-41263](https://cve.now/CVE-2026-41263.md): Traefik: BasicAuth middleware: timing side-channel vulnerability (CVSS 6.3, traefik · github.com/traefik/traefik +2)
- [CVE-2026-40912](https://cve.now/CVE-2026-40912.md): Traefik: StripPrefixRegex auth bypass via Path/RawPath desync (CVSS 7.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-6539](https://cve.now/CVE-2026-6539.md): Notepad++ 8.9.3 Format String Injection via nativeLang.xml (CVSS 4.6, Notepad++)
- [CVE-2026-39858](https://cve.now/CVE-2026-39858.md): Traefik: Forwarded alias spoofing top pre-auth decision bypass (CVSS 7.8, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-35051](https://cve.now/CVE-2026-35051.md): Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth (CVSS 7.8, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-40951](https://cve.now/CVE-2026-40951.md): Memory corruption in Secure Access Windows clients prior to 14.50 (CVSS 6.8, Absolute Software Secure Access)
- [CVE-2026-41174](https://cve.now/CVE-2026-41174.md): Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding (CVSS 4.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-40950](https://cve.now/CVE-2026-40950.md): Buffer overflow in the Secure Access server prior to 14.50 (CVSS 7.1, Absolute Software Secure Access)
- [CVE-2026-28532](https://cve.now/CVE-2026-28532.md): FRRouting \< 10.5.3 Integer Overflow in OSPF TLV Parser Functions (CVSS 6.0, FRRouting frr)
- [CVE-2026-40949](https://cve.now/CVE-2026-40949.md): Buffer overflow in Windows clients prior to 14.50 (CVSS 6.8, Absolute Software Secure Access)
- [CVE-2026-33452](https://cve.now/CVE-2026-33452.md): Buffer overflow in Windows clients prior to 14.50 (CVSS 5.9, Absolute Software Secure Access)
- [CVE-2026-7435](https://cve.now/CVE-2026-7435.md): SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString (CVSS 8.6, siteserver SSCMS)
- [CVE-2026-33451](https://cve.now/CVE-2026-33451.md): Arbitrary read/write vulnerability in Windows clients prior to 14.50 (CVSS 8.5, Absolute Software Secure Access)
- [CVE-2026-33450](https://cve.now/CVE-2026-33450.md): Out of bounds read in Secure Access MacOS clients prior to 14.50 (CVSS 2.3, Absolute Software Secure Access)
- [CVE-2026-33449](https://cve.now/CVE-2026-33449.md): Message handler buffer overflow in clients prior to 14.50 (CVSS 2.3, Absolute Software Secure Access)
- [CVE-2026-33448](https://cve.now/CVE-2026-33448.md): Format string vulnerability in MacOS clients prior to 14.50 (CVSS 4.8, Absolute Software Secure Access)
- [CVE-2026-7429](https://cve.now/CVE-2026-7429.md): SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing (CVSS 2.1, siteserver SSCMS)
- [CVE-2026-33447](https://cve.now/CVE-2026-33447.md): CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. (CVSS 2.3, Absolute Software Secure Access)
- [CVE-2026-33446](https://cve.now/CVE-2026-33446.md): Buffer overflow in client authentication prior to version 14.50 (CVSS 2.3, Absolute Software Secure Access)
- [CVE-2026-7461](https://cve.now/CVE-2026-7461.md): OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials (CVSS 7.2, AWS Amazon ECS Agent · github.com/aws/amazon-ecs-agent)
- [CVE-2026-40603](https://cve.now/CVE-2026-40603.md): Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override (CVSS 6.5, chartbrew)
- [CVE-2026-40601](https://cve.now/CVE-2026-40601.md): Chartbrew: Missing Authorization in /api/chart/:chart\_id/query via team-level refresh toggle (CVSS 7.5, chartbrew)
- [CVE-2026-40600](https://cve.now/CVE-2026-40600.md): Chartbrew: Incorrect Access Control in project share policy routes via unbound policy\_id (CVSS 8.1, chartbrew)
- [CVE-2026-40595](https://cve.now/CVE-2026-40595.md): Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks (CVSS 7.5, chartbrew)
- [CVE-2026-35514](https://cve.now/CVE-2026-35514.md): Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew (CVSS 6.5, chartbrew)
- [CVE-2026-40904](https://cve.now/CVE-2026-40904.md): Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks (CVSS 8.1, chartbrew)
- [CVE-2026-32148](https://cve.now/CVE-2026-32148.md): Lockfile checksums not verified in Hex allows dependency integrity bypass (CVSS 8.9, hexpm hex)
- [CVE-2026-33845](https://cve.now/CVE-2026-33845.md): Gnutls: gnutls: denial of service via dtls zero-length fragment (CVSS 7.5, gnutls · Red Hat Enterprise Linux +7)
- [CVE-2026-3832](https://cve.now/CVE-2026-3832.md): Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response (CVSS 3.7, gnutls · Red Hat Enterprise Linux +5)
- [CVE-2026-3833](https://cve.now/CVE-2026-3833.md): Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison (CVSS 6.5, gnutls · Red Hat Enterprise Linux +6)
- [CVE-2025-51846](https://cve.now/CVE-2025-51846.md): CryptPad unbounded WebSocket frame flood (CVSS 7.5, CryptPad)
- [CVE-2022-50992](https://cve.now/CVE-2022-50992.md): Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet (CVSS 8.7, Weaver Network Co. E-cology)
- [CVE-2022-50993](https://cve.now/CVE-2022-50993.md): Weaver E-office \< 10.0\_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet (CVSS 9.3, Weaver Network Co. E-office)
- [CVE-2025-71284](https://cve.now/CVE-2025-71284.md): Synway SMG Gateway Management Software OS Command Injection via radius\_address (CVSS 9.3, Synway Information Engineering Co. Synway SMG Gateway Manag…)
- [CVE-2025-14543](https://cve.now/CVE-2025-14543.md): Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking. (CVSS 8.8, RTI Connext Professional)
- [CVE-2026-5174](https://cve.now/CVE-2026-5174.md): Improper Access Control Vulnerability in Progress MOVEit Automation (CVSS 7.7, Progress Software MOVEit Automation)
- [CVE-2026-4670](https://cve.now/CVE-2026-4670.md): Improper Authentication vulnerability in Progress MOVEit Automation (CVSS 9.8, Progress Software MOVEit Automation)
- [CVE-2026-7500](https://cve.now/CVE-2026-7500.md): Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled (CVSS 5.4, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-2892](https://cve.now/CVE-2026-2892.md): Otter Blocks \<= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie (CVSS 7.5, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2026-7163](https://cve.now/CVE-2026-7163.md): Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure (CVSS 6.1, assisted-service · Red Hat multicluster engine for Kubernet…)
- [CVE-2026-7246](https://cve.now/CVE-2026-7246.md): \[DISPUTED\] Pallets Click contains a command injection via Unsanitized Filename "click.edit()" (CVSS 7.2, Pallets Click Click)
- [CVE-2026-7402](https://cve.now/CVE-2026-7402.md): Improper Rate Limiting in MeWare Software's PDKS (CVSS 8.1, MeWare Software Development PDKS)
- [CVE-2025-14576](https://cve.now/CVE-2025-14576.md): Possible QML code injection in VectorImage component (CVSS 7.4, Qt)
- [CVE-2026-7399](https://cve.now/CVE-2026-7399.md): IDOR in MeWare Software's PDKS (CVSS 8.1, MeWare Software Development PDKS)
- [CVE-2026-7382](https://cve.now/CVE-2026-7382.md): Information Disclosure in MeWare Software's PDKS (CVSS 6.5, MeWare Software Development PDKS)
- [CVE-2024-13971](https://cve.now/CVE-2024-13971.md): Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster\_pro (CVSS 7.7, Lobster\_pro)
- [CVE-2026-5080](https://cve.now/CVE-2026-5080.md): Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely (CVSS 5.9, BIGPRESH Dancer::Session::Abstract)
- [CVE-2026-31693](https://cve.now/CVE-2026-31693.md): cifs: some missing initializations on replay (CVSS 7.8, Linux)
- [CVE-2026-1493](https://cve.now/CVE-2026-1493.md): Cross-Site Scripting in LEX Baza Dokumentów (CVSS 4.6, Wolters Kluwer Polska LEX Baza Dokumentów)
- [CVE-2026-41882](https://cve.now/CVE-2026-41882.md): In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible vi (CVSS 7.4, JetBrains IntelliJ IDEA)
- [CVE-2026-31692](https://cve.now/CVE-2026-31692.md): rtnetlink: add missing netlink\_ns\_capable() check for peer netns (no CVSS, Linux)
- [CVE-2026-31787](https://cve.now/CVE-2026-31787.md): xen/privcmd: fix double free via VMA splitting (no CVSS, Linux)
- [CVE-2026-31786](https://cve.now/CVE-2026-31786.md): Buffer overflow in drivers/xen/sys-hypervisor.c (CVSS 7.8, Linux)
- [CVE-2026-6498](https://cve.now/CVE-2026-6498.md): Five Star Restaurant Reservations \<= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment\_id' Parameter (CVSS 5.3, rustaurius Five Star Restaurant Reservations – WordPress Bo…)
- [CVE-2026-41016](https://cve.now/CVE-2026-41016.md): Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider (CVSS 5.9, Apache Software Foundation Apache Airflow Providers SMTP ·…)
- [CVE-2026-42800](https://cve.now/CVE-2026-42800.md): Deference after null check in ims\_client sip (CVSS 7.4, ASR Lapwing\_Linux)
- [CVE-2026-42799](https://cve.now/CVE-2026-42799.md): Out-of-bounds read in ulp (CVSS 7.4, ASR Kestrel)
- [CVE-2026-22070](https://cve.now/CVE-2026-22070.md): ColorOS Assistant Path Traversal Vulnerability (CVSS 7.1, OPPO ColorOS Assistant)
- [CVE-2026-35547](https://cve.now/CVE-2026-35547.md): Heap overflow in libnv (CVSS 8.1, FreeBSD)
- [CVE-2026-39457](https://cve.now/CVE-2026-39457.md): Stack overflow via select() file descriptor set overflow (CVSS 7.8, FreeBSD)
- [CVE-2026-42512](https://cve.now/CVE-2026-42512.md): Remotely triggerable out-of-bounds heap write in dhclient (CVSS 8.1, FreeBSD)
- [CVE-2026-7164](https://cve.now/CVE-2026-7164.md): pf can overflow the stack parsing crafted SCTP packets (CVSS 7.5, FreeBSD)
- [CVE-2024-39847](https://cve.now/CVE-2024-39847.md): Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP (CVSS 8.7, 4D Server)
- [CVE-2026-7270](https://cve.now/CVE-2026-7270.md): Local privilege escalation via execve() (CVSS 7.8, FreeBSD)
- [CVE-2026-42511](https://cve.now/CVE-2026-42511.md): Remote code execution via malicious DHCP options (CVSS 8.1, FreeBSD)
- [CVE-2026-42798](https://cve.now/CVE-2026-42798.md): Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c. (CVSS 4.0, littlecms little cms color engine)
- [CVE-2026-41226](https://cve.now/CVE-2026-41226.md): Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. (CVSS 4.7, Ricoh Company Multiple laser printers and MFPs which implem…)
- [CVE-2026-5409](https://cve.now/CVE-2026-5409.md): Uncontrolled Recursion in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5408](https://cve.now/CVE-2026-5408.md): Uncontrolled Recursion in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5406](https://cve.now/CVE-2026-5406.md): Uncontrolled Recursion in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5407](https://cve.now/CVE-2026-5407.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5299](https://cve.now/CVE-2026-5299.md): Uncontrolled Recursion in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5402](https://cve.now/CVE-2026-5402.md): Heap-based Buffer Overflow in Wireshark (CVSS 8.8, Wireshark Foundation Wireshark)
- [CVE-2026-5401](https://cve.now/CVE-2026-5401.md): Uncontrolled Recursion in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5654](https://cve.now/CVE-2026-5654.md): Stack-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5655](https://cve.now/CVE-2026-5655.md): Use After Free in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5657](https://cve.now/CVE-2026-5657.md): Double Free in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-5653](https://cve.now/CVE-2026-5653.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6538](https://cve.now/CVE-2026-6538.md): Stack-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6537](https://cve.now/CVE-2026-6537.md): Stack-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6536](https://cve.now/CVE-2026-6536.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6535](https://cve.now/CVE-2026-6535.md): Improperly Controlled Sequential Memory Allocation in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6534](https://cve.now/CVE-2026-6534.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6533](https://cve.now/CVE-2026-6533.md): Improperly Controlled Sequential Memory Allocation in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6532](https://cve.now/CVE-2026-6532.md): Buffer Over-read in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6531](https://cve.now/CVE-2026-6531.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6530](https://cve.now/CVE-2026-6530.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6529](https://cve.now/CVE-2026-6529.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6528](https://cve.now/CVE-2026-6528.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6527](https://cve.now/CVE-2026-6527.md): Uncontrolled Recursion in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6526](https://cve.now/CVE-2026-6526.md): NULL Pointer Dereference in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6524](https://cve.now/CVE-2026-6524.md): Access of Uninitialized Pointer in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6523](https://cve.now/CVE-2026-6523.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6521](https://cve.now/CVE-2026-6521.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6520](https://cve.now/CVE-2026-6520.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6519](https://cve.now/CVE-2026-6519.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6522](https://cve.now/CVE-2026-6522.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6870](https://cve.now/CVE-2026-6870.md): Access of Uninitialized Pointer in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6869](https://cve.now/CVE-2026-6869.md): Improperly Controlled Sequential Memory Allocation in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6867](https://cve.now/CVE-2026-6867.md): Improperly Controlled Sequential Memory Allocation in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6868](https://cve.now/CVE-2026-6868.md): Stack-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-7378](https://cve.now/CVE-2026-7378.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-7379](https://cve.now/CVE-2026-7379.md): Missing Release of Memory after Effective Lifetime in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-7375](https://cve.now/CVE-2026-7375.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-7376](https://cve.now/CVE-2026-7376.md): NULL Pointer Dereference in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2025-13030](https://cve.now/CVE-2025-13030.md): All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. (CVSS 5.1, django-mdeditor)
- [CVE-2026-7470](https://cve.now/CVE-2026-7470.md): Tenda 4G300 SafeMacFilter sub\_427C3C stack-based overflow (CVSS 8.7, Tenda 4G300)
- [CVE-2026-7469](https://cve.now/CVE-2026-7469.md): Tenda 4G300 DelFil sub\_425A28 command injection (CVSS 5.3, Tenda 4G300)
- [CVE-2026-7468](https://cve.now/CVE-2026-7468.md): 1024-lab smart-admin Demo Site index.html access control (CVSS 6.9, 1024-lab smart-admin)
- [CVE-2026-7447](https://cve.now/CVE-2026-7447.md): SourceCodester Pet Grooming Management Software update\_customer.php sql injection (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2026-7446](https://cve.now/CVE-2026-7446.md): VetCoders mcp-server-semgrep MCP index.ts create\_rule os command injection (CVSS 6.9, VetCoders mcp-server-semgrep · mcp-server-semgrep)
- [CVE-2025-46115](https://cve.now/CVE-2025-46115.md): An issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted PDU Session Modification Request (CVSS 7.5)
- [CVE-2025-56568](https://cve.now/CVE-2025-56568.md): Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Ope (CVSS 7.5)
- [CVE-2026-36340](https://cve.now/CVE-2026-36340.md): An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function (CVSS 8.1, krayin/laravel-crm)
- [CVE-2026-36756](https://cve.now/CVE-2026-36756.md): A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan int (CVSS 5.4)
- [CVE-2026-36757](https://cve.now/CVE-2026-36757.md): A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to sca (CVSS 4.3)
- [CVE-2026-36758](https://cve.now/CVE-2026-36758.md): A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan inte (CVSS 4.3)
- [CVE-2026-36759](https://cve.now/CVE-2026-36759.md): A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan (CVSS 6.5)
- [CVE-2026-36760](https://cve.now/CVE-2026-36760.md): An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissi (CVSS 9.6)
- [CVE-2026-36761](https://cve.now/CVE-2026-36761.md): A stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite v5.15.1 allows attackers to execute arbitrar (CVSS 6.1)
- [CVE-2026-36762](https://cve.now/CVE-2026-36762.md): An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload per (CVSS 8.8)
- [CVE-2026-36763](https://cve.now/CVE-2026-36763.md): A stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to ex (CVSS 6.1)
- [CVE-2026-36764](https://cve.now/CVE-2026-36764.md): A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers (CVSS 5.0)
- [CVE-2026-36765](https://cve.now/CVE-2026-36765.md): An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to exec (CVSS 8.8)
- [CVE-2026-36766](https://cve.now/CVE-2026-36766.md): Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attack (CVSS 5.4, com.shopizer:shopizer)
- [CVE-2026-36767](https://cve.now/CVE-2026-36767.md): A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeabl (CVSS 10.0, com.shopizer:shopizer)
- [CVE-2026-36956](https://cve.now/CVE-2026-36956.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. (CVSS 8.8)
- [CVE-2026-36957](https://cve.now/CVE-2026-36957.md): Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler. (CVSS 7.5)
- [CVE-2026-36958](https://cve.now/CVE-2026-36958.md): A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. (CVSS 7.5)
- [CVE-2026-36959](https://cve.now/CVE-2026-36959.md): U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. (CVSS 7.5)
- [CVE-2026-36960](https://cve.now/CVE-2026-36960.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. (CVSS 8.8)
- [CVE-2026-38939](https://cve.now/CVE-2026-38939.md): Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitiv (CVSS 6.1)
- [CVE-2026-38940](https://cve.now/CVE-2026-38940.md): Cross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail\_produ (CVSS 6.1)
- [CVE-2026-40684](https://cve.now/CVE-2026-40684.md): In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is pres (CVSS 5.9, Exim)
- [CVE-2026-40685](https://cve.now/CVE-2026-40685.md): In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in (CVSS 6.5, Exim)
- [CVE-2026-40686](https://cve.now/CVE-2026-40686.md): In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malfo (CVSS 3.7, Exim)
- [CVE-2026-40687](https://cve.now/CVE-2026-40687.md): In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that (CVSS 4.8, Exim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.