CVEs published April 11, 2026

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability.

aws-mcp-server Command Injection Remote Code Execution Vulnerability.

Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability.

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php).

The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3.

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in…

Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution Vulnerability.

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.

NoMachine External Control of File Path Local Privilege Escalation Vulnerability.

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability.

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability.

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability.

Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download.

ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability.

ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability.

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability.

OpenClaw Canvas Authentication Bypass Vulnerability.

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7.

KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2.

The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2.

NoMachine External Control of File Path Arbitrary File Deletion Vulnerability.

The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1.

OpenClaw Canvas Path Traversal Information Disclosure Vulnerability.

Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.

The GreenShift - Animation and Page Builder Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 12.8.9 This is due to insufficient input sanitization…

The BlockArt Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clientId' block attribute in all versions up to, and including, 2.2.15.

The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output…

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7.

OpenClaw Client PKCE Verifier Information Disclosure Vulnerability.

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and…

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7.

A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1.

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.