2026 CVEs (page 327)
Page 327 of 462 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39111 | High | 7.5 | 2026-04-20 | SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password pag… |
CVE-2026-39110 | High | 8.2 | 2026-04-20 | SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of the forgot password… |
CVE-2026-39109 | Critical | 9.4 | 2026-04-20 | SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (… |
CVE-2026-26399 | Medium | 5.3 | 2026-04-20 | A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structur… |
CVE-2026-23758 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject m… |
CVE-2026-23757 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Re… |
CVE-2026-23756 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized… |
CVE-2026-23753 | Medium | 4.8 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is pa… |
CVE-2026-23752 | Medium | 4.8 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authentica… |
CVE-2026-6662 | High | 7.3 | 2026-04-20 | A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src/server.ts of the component Token Endpo… |
CVE-2026-41445 | High | 8.8 | 2026-04-20 | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calcula… |
CVE-2026-40488 | High | 8.8 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-40098 | Medium | 5.4 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-35154 | Medium | 6.3 | 2026-04-20 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2… |
CVE-2026-30269 | Critical | 9.9 | 2026-04-20 | Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platfor… |
CVE-2026-30266 | High | 7.8 | 2026-04-20 | Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file |
CVE-2026-28684 | Medium | 6.6 | 2026-04-20 | python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python… |
CVE-2026-26951 | Medium | 6.7 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-26943 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-26942 | Medium | 6.7 | 2026-04-20 | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS command injection… |
CVE-2026-25525 | Medium | 4.9 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-25524 | High | 8.1 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-24506 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-24505 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privileged attacker with remote access could… |
CVE-2026-24504 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-22761 | Medium | 6.7 | 2026-04-20 | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A high privileged attacker with remote access could potentia… |
CVE-2026-6652 | Medium | 4.7 | 2026-04-20 | A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the comp… |
CVE-2026-6651 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page… |
CVE-2026-6650 | Medium | 4.7 | 2026-04-20 | A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/AppCentre/app_upload.php of the component… |
CVE-2026-6066 | High | 7.1 | 2026-04-20 | ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client… |
CVE-2026-41245 | Medium | 5.9 | 2026-04-20 | Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFolderExtractor` allows an attacker to writ… |
CVE-2026-40896 | Medium | 6.5 | 2026-04-20 | OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject a… |
CVE-2026-3219 | | 2026-04-20 | pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in conf… | |
CVE-2026-39918 | Critical | 9.8 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env… |
CVE-2026-34429 | Medium | 5.4 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute… |
CVE-2026-34428 | High | 7.7 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is pa… |
CVE-2026-34427 | High | 8.8 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileg… |
CVE-2026-26944 | High | 8.8 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-25883 | Medium | 5.8 | 2026-04-20 | Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated… |
CVE-2026-25058 | High | 7.5 | 2026-04-20 | Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service expo… |
CVE-2026-24468 | Medium | 5.3 | 2026-04-20 | OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11… |
CVE-2026-24467 | Critical | 9.0 | 2026-04-20 | OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.0… |
CVE-2026-23774 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug… |
CVE-2026-6649 | Medium | 6.3 | 2026-04-20 | A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/image/headers. Executing a manipulation… |
CVE-2026-6369 | Medium | 5.5 | 2026-04-20 | An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive… |
CVE-2026-5760 | Critical | 9.8 | 2026-04-20 | SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the… |
CVE-2026-4048 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbi… |
CVE-2026-3519 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions… |
CVE-2026-3518 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arb… |
CVE-2026-3517 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions… |
CVE-2026-33558 | Medium | 5.3 | 2026-04-20 | Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in t… |
CVE-2026-33557 | Critical | 9.1 | 2026-04-20 | A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.a… |
CVE-2026-6648 | Low | 3.5 | 2026-04-20 | A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component Internal Message Module. Performing a ma… |
CVE-2026-6636 | Medium | 4.3 | 2026-04-20 | A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file buildCache.js of th… |
CVE-2026-6635 | High | 7.3 | 2026-04-20 | A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook… |
CVE-2026-6634 | Medium | 6.3 | 2026-04-20 | A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInst… |
CVE-2026-6633 | Low | 3.5 | 2026-04-20 | A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admi… |
CVE-2026-5958 | | 2026-04-20 | When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations o… | |
CVE-2026-6654 | Medium | 5.1 | 2026-04-20 | Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting… |
CVE-2026-6632 | High | 8.8 | 2026-04-20 | A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. The affected element is the function fromSafeClientFilter of the file /goform/SafeClientFilter… |
CVE-2026-6631 | High | 8.8 | 2026-04-20 | A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7958. Impacted is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of… |
CVE-2026-6630 | High | 8.8 | 2026-04-20 | A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the componen… |
CVE-2026-6629 | High | 7.3 | 2026-04-20 | A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.0. This vulnerability affects the function Statement.executeUpdate of the file sql.jsp of the… |
CVE-2026-6628 | Medium | 6.3 | 2026-04-20 | A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. This affects the function ValidateInput of the file /v2/query/view/ of the component Query Viewer Co… |
CVE-2026-6626 | Medium | 6.3 | 2026-04-20 | A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate… |
CVE-2026-6625 | High | 7.3 | 2026-04-20 | A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the function LocalFileServiceImpl.uploadPicture… |
CVE-2026-6624 | Low | 2.4 | 2026-04-20 | A weakness has been identified in BichitroGan ISP Billing Software 2025.3.20. Affected is an unknown function of the file /?\_route=pool/add of the component P… |
CVE-2026-6623 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20. This impacts an unknown function of the file /?_route=settings/users-view/ o… |
CVE-2026-6622 | Low | 2.4 | 2026-04-20 | A vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20. This affects an unknown function of the file /?\_route=customers/edit/ of the com… |
CVE-2026-31430 | High | 7.1 | 2026-04-20 | In the Linux kernel, the following vulnerability has been resolved: X.509: Fix out-of-bounds access when parsing extensions Leo reports an out-of-bounds acce… |
CVE-2026-31429 | Medium | 5.5 | 2026-04-20 | In the Linux kernel, the following vulnerability has been resolved: net: skb: fix cross-cache free of KFENCE-allocated skb head SKB_SMALL_HEAD_CACHE_SIZE is… |
CVE-2026-6621 | High | 7.3 | 2026-04-20 | A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the a… |
CVE-2026-6620 | Medium | 6.3 | 2026-04-20 | A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the function Upload of the file FileTool.java of the component Fil… |
CVE-2026-6619 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-… |
CVE-2026-6618 | Medium | 6.3 | 2026-04-20 | A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils… |
CVE-2026-5967 | High | 8.8 | 2026-04-20 | ThreatSonar Anti-Ransomware developed by TeamT5 has an Privilege Escalation vulnerability. Authenticated remote attackers with shell access can inject OS comma… |
CVE-2026-39454 | High | 7.8 | 2026-04-20 | SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-admini… |
CVE-2026-6617 | Medium | 6.3 | 2026-04-20 | A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the function get_api_tool_provider_remote_schema of the file api/servic… |
CVE-2026-6616 | Medium | 6.3 | 2026-04-20 | A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract_with_bs4/extract_with_3k/extract_with… |
CVE-2026-6615 | High | 7.3 | 2026-04-20 | A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/reso… |
CVE-2026-5966 | High | 8.1 | 2026-04-20 | ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authenticated remote attackers with web access can exploit Path T… |
CVE-2026-5964 | Critical | 9.8 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modif… |
CVE-2026-5963 | Critical | 9.8 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modif… |
CVE-2026-41282 | Medium | 4.0 | 2026-04-20 | ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not t… |
CVE-2026-6644 | Critical | 9.1 | 2026-04-20 | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted… |
CVE-2026-6643 | Critical | 9.9 | 2026-04-20 | A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-contro… |
CVE-2026-6614 | Medium | 6.3 | 2026-04-20 | A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_… |
CVE-2026-6613 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file s… |
CVE-2026-6612 | Medium | 6.3 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file su… |
CVE-2026-6611 | Low | 3.1 | 2026-04-20 | A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File U… |
CVE-2026-6610 | Low | 3.7 | 2026-04-20 | A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the… |
CVE-2026-6609 | Medium | 6.3 | 2026-04-20 | A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation o… |
CVE-2026-6608 | Medium | 5.3 | 2026-04-20 | A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulat… |
CVE-2026-6607 | Medium | 5.3 | 2026-04-20 | A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint… |
CVE-2026-6606 | High | 7.3 | 2026-04-20 | A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/a… |
CVE-2026-6605 | High | 7.3 | 2026-04-20 | A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/… |
CVE-2026-6604 | High | 7.3 | 2026-04-20 | A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of t… |
CVE-2026-6603 | High | 7.3 | 2026-04-20 | A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function execute_python_code/execute_shell_command… |
CVE-2026-6602 | High | 7.3 | 2026-04-20 | A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /bac… |
CVE-2026-6601 | Medium | 4.3 | 2026-04-20 | A vulnerability has been found in Lagom WHMCS Template up to 2.4.2. This impacts an unknown function of the component Datatables. The manipulation leads to res… |