Archive
April 2026
Vulnerabilities first published in this month (UTC), newest first.
98 results · Clear filters · Feed
-
Medium 5.3CVE-2026-26399 Public exploit
A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() functio…
-
Medium 5.4CVE-2026-35603 Public exploit
Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows
Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because …
-
Medium 5.5CVE-2025-70795 Public exploit
STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOC…
-
Medium 5.4CVE-2026-1880 Public exploit
An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows priv…
-
Medium 5.3CVE-2026-40179 Public exploit
Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values a…
-
Medium 5.4CVE-2026-34213 Public exploit
Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same wo…
-
Medium 5.4CVE-2026-34212 Public exploit
Docmost page content has stored XSS via unsanitized attachment URLs
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment nod…
-
Medium 4.3CVE-2026-33146 Public exploit
Docmost's Public Share Search Exposes Metadata of Restricted Children
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-se…
-
Medium 4.3CVE-2026-33829 Public exploit
Windows Snipping Tool Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 14, 2026 -
Medium 6.8CVE-2026-32223 Public exploit
Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 4.3
Windows Shell Spoofing Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 28, 2026 -
Medium 4.9CVE-2026-22692 Public exploit
October CMS: Twig Sandbox Bypass via Collection Methods
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper wer…
-
Medium 6.1CVE-2025-69993 Public exploit
Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. Thi…
-
Medium 6.5CVE-2026-30480 Public exploit
A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows…
-
Medium 4.6CVE-2026-33657 Public exploit
EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-g…
-
Medium 4.3
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 represen…
-
Medium 5.4CVE-2026-6201 Public exploit
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls…
-
Medium 6.6CVE-2026-21010 Public exploit
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged f…
-
Medium 5.1CVE-2026-21008 Public exploit
Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensiti…
-
Medium 5.1CVE-2026-21014 Public exploit
Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. Us…
-
Medium 6.9CVE-2026-21013 Public exploit
Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive i…
-
Medium 6.8CVE-2026-21012 Public exploit
External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create …
-
Medium 5.4CVE-2026-21011 Public exploit
Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attacke…
-
Medium 4.1CVE-2026-21009 Public exploit
Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass…
-
Medium 4.4CVE-2026-21007 Public exploit
Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to b…
-
Medium 4.7CVE-2026-21006 Public exploit
Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden no…
-
Medium 5.2CVE-2026-21003 Public exploit
Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attac…
-
Medium 4.0CVE-2026-33555 Public exploit
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches…
-
Medium 6.2CVE-2026-29628 Public exploit
A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to caus…
-
Medium 6.5CVE-2026-31280 Public exploit
An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to caus…
-
Medium 6.3CVE-2026-6111 Public exploit
FoundationAgents MetaGPT common.py decode_image server-side request forgery
A security flaw has been discovered in FoundationAgents MetaGPT up to 0.8.1. This impacts the function decode_image of the file metagpt/utils/common.py. The manipulation of the argument img_url_or_b64 results in server-side request forgery. It is possible to …
-
Medium 6.3CVE-2026-5724 Public exploit
Missing Authentication on Streaming gRPC Replication Endpoint
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicati…
-
Medium 4.8CVE-2026-40175 Public exploit
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header …
-
Medium 6.1CVE-2026-25854 Public exploit
Apache Tomcat: Occasionally open redirect
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, …
-
Medium 5.3CVE-2026-39676 Public exploit
WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.
-
Medium 6.5CVE-2026-39636 Public exploit
WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through <= 9.0.
-
Medium 4.7CVE-2026-4406 Public exploit
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputtin…
-
Medium 5.4CVE-2025-14857 Public exploit
Semtech LR11xx Memory Write Access Control Bypass
An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An at…
-
Medium 6.9CVE-2026-35584 Public exploit
FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the g…