CVEs published April 25, 2026
77,396 CVEs in 2026
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that…
The following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it…
The following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are…
A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon.
The following vulnerability has been resolved: batman-adv: avoid OGM aggregation when skb tailroom is insufficient When OGM aggregation state is toggled at runtime, an existing forwarded packet may have…
The following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file RCU read-side lock…
The following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device.
The following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), the packet corruption logic uses…
The following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a reference to the socket, but not to u->path.
The following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING.
A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1.
A vulnerability was detected in PicoClaw up to 0.2.4.
A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd.
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2.
A vulnerability was identified in Linksys MR9600 2.0.6.206937.
The following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions.
The following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS. rt_mt6() expects addrnr to stay…
A weakness has been identified in Envoy up to 1.33.0.
A vulnerability was determined in colinhacks Zod up to 4.3.6.
A vulnerability has been found in Tenda F453 up to 1.0.0.3.
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0.
A vulnerability was found in IhateCreatingUserNames2 AiraHub2 up to 3e4b77fd7d48ed811ffe5b8d222068c17c76495e.
A flaw has been found in devlikeapro WAHA up to 2026.3.4.
The following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN…
The following vulnerability has been resolved: netfilter: xt_multiport: validate range encoding in checkentry ports_match_v1() treats any non-zero pflags entry as the start of a port range and…
The following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive buffer budget Make af_alg_get_rsgl() limit each RX scatterlist extraction to the remaining receive buffer…
A security flaw has been discovered in go-kratos kratos up to 2.9.2.
A weakness has been identified in Cesanta Mongoose up to 7.20.
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1.
A vulnerability was identified in pagekit up to 1.0.18.
A vulnerability was detected in JiZhiCMS up to 2.5.6.
A security vulnerability has been detected in Cesanta Mongoose up to 7.20.
A vulnerability was found in projeto-siga siga 11.0.3.18.
A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709.
A vulnerability has been found in Datacom DM4100 1.3.6.1.4.1.3709.
A flaw has been found in BIVOCOM TR321 21.1.1.50.
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345.
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345.
A weakness has been identified in BDCOM P3310D 0.4.2 10.1.0F Build 86345.
A security flaw has been discovered in BDCOM P3310D 0.4.2 10.1.0F Build 86345.