CVEs published April 20, 2026

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM.

Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts.

2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods.

Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/{username}.

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an…

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could…

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or…

SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs.

Flowsint allows a user to create investigations, which are used to manage sketches and analyses.

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to…

When running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can influence machine-level interrupt enable state (mie).

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php).

A command injection vulnerability was found in the PPTP VPN Clients on the ADM.

Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename…

A possible security vulnerability has been identified in Apache Kafka.

When LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters.

OpenAEV's password reset implementation contains multiple security weaknesses that together allow reliable account takeover.

A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958.

A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7958.

A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958.

Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell…

ThreatSonar Anti-Ransomware developed by TeamT5 has an Privilege Escalation vulnerability.

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation…

The product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads.

Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile.

SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow vulnerability in processing the redirect URLs.

When Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg.

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a missing authentication for…

SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings.

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by…

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster…

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by…

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the…

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of the forgot password page (forgot-password.php).

The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5.

ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability.

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4.

All WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH).

A user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime.

PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths.

Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file

A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode).

Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without…

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43…

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password page (forgot-password.php).

Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module.

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc.

Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API.

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder.

The Vexa transcription-collector service exposes an internal endpoint `GET /internal/transcripts/{meeting_id}` that returns transcript data for any meeting without any authentication or authorization checks.

A vulnerability was found in ericc-ch copilot-api up to 0.7.0.

A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67.

A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.0.

A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2.

A vulnerability was determined in 1024bit extend-deep up to 0.1.6.

A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14.

A weakness has been identified in modelscope agentscope up to 1.0.18.

A security flaw has been discovered in modelscope agentscope up to 1.0.18.

A vulnerability was identified in modelscope agentscope up to 1.0.18.

A vulnerability was determined in modelscope agentscope up to 1.0.18.

A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4.

A security flaw has been discovered in langflow-ai langflow up to 1.1.0.

A vulnerability was identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59.

A vulnerability was determined in brikcss merge up to 1.3.0.

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability.

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability.

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability.

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper input validation…

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0…

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without…

The following vulnerability has been resolved: X.509: Fix out-of-bounds access when parsing extensions Leo reports an out-of-bounds access when parsing a certificate with empty Basic Constraints or Key…

XiangShan (Open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) contains an improper exceptional-condition handling flaw in its CSR subsystem (NewCSR).

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a stack-based buffer overflow…

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS command injection vulnerability.

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability.

python-dotenv reads key-value pairs from a .env file and can set them as environment variables.

A weakness has been identified in serge-chat serge up to 1.4TB.

OpenProject is open-source, web-based project management software.

The POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents…

SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability.

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse.

SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key.

Insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information…

The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image Source' attachment field in all versions up to, and…

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting…

A vulnerability was determined in Qibo CMS 1.0.

A weakness has been identified in usememos memos up to 0.22.1.

A flaw has been found in phili67 Ecclesia CRM up to 8.0.0.

A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5.

A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0.

A flaw has been found in langgenius dify up to 1.13.3.

A vulnerability was detected in langgenius dify up to 0.6.9.

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14.

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14.

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14.

A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14.

A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0.

A vulnerability was detected in langflow-ai langflow up to 1.8.3.

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3.

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14.

Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain…

A path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted.

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm.

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access.

The Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete.

An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an…

The following vulnerability has been resolved: net: skb: fix cross-cache free of KFENCE-allocated skb head SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2 value (e.g. 704 on x86_64) to…

A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14.

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14.

The shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs…

Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname parameter of visitors-form.php.

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type…

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the…

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization.

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and…

A vulnerability was detected in lm-sys fastchat up to 0.2.36.

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36.

Information exposure vulnerability has been identified in Apache Kafka.

SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue.

SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of sx_smpd.

SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue on firmware maintenance.

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0.

The /api/reset endpoint behaves differently depending on whether the supplied username exists in the system.

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate.

SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability.

The Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks.

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create()…

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary…

A weakness has been identified in Pagekit CMS up to 1.0.18.

A vulnerability was identified in Z-BlogPHP 1.7.5.

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key…

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.5.0.4.

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file.

A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS:  *…

A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b.

A vulnerability has been found in Lagom WHMCS Template up to 2.4.2.

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3.

A flaw has been found in ComfyUI up to 0.13.0.

A vulnerability was detected in ComfyUI up to 0.13.0.

A security vulnerability has been detected in ComfyUI up to 0.13.0.

The method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history.

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability.

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request.

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection.

A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0.

A vulnerability was found in Qibo CMS 1.0.

A security flaw has been discovered in Yifang CMS up to 2.0.5.

A vulnerability has been found in langgenius dify up to 1.13.3.

A flaw has been found in langflow-ai langflow up to 1.8.3.

A vulnerability was found in ComfyUI up to 0.13.0.

A vulnerability has been found in ComfyUI up to 0.13.0.

A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0.

A weakness has been identified in langflow-ai langflow up to 1.8.3.

A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0.

A weakness has been identified in BichitroGan ISP Billing Software 2025.3.20.

A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20.

A vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20.

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its…