Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,382 results · page 10 of 28
Apr 21, 2026A vulnerability was determined in Bagisto up to 2.3.15.CVE-2026-6745 · Other software · reported by VulDBLow 2
A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Apr 20, 2026A vulnerability was determined in Qibo CMS 1.0.CVE-2026-6649 · Other software · Qibo · reported by VulDBLow 2.1
A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/image/headers. Executing a manipulation of the argument starts can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtcn60zf28jhk.feishu.cnvuldb.com
Apr 20, 2026A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7958.CVE-2026-6631 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7958. Impacted is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- F451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026A vulnerability was determined in 1024bit extend-deep up to 0.1.6.CVE-2026-6621 · Other software · 1024bit · reported by VulDBMedium 5.5
A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument __proto__ causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.
- Product
- extend-deep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6612 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file superagi/controllers/agent_execution.py of the component Agent Execution Endpoint. Executing a manipulation of the argument agent_execution_id can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 20, 2026A vulnerability was determined in modelscope agentscope up to 1.0.18.CVE-2026-6603 · Other software · modelscope · reported by VulDBMedium 5.5
A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function execute_python_code/execute_shell_command of the file src/AgentScope/tool/_coding/_python.py. This manipulation causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- agentscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 19, 2026A vulnerability was determined in brikcss merge up to 1.3.0.CVE-2026-6594 · Other software · brikcss · reported by VulDBMedium 6.9
A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2026A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6585 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organisation of the file superagi/controllers/organisation.py of the component Organisation Update Endpoint. This manipulation of the argument organisation_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 19, 2026A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0.CVE-2026-6576 · Other software · liangliangyy · reported by VulDBLow 2.1
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/commonapi.py of the component WeChat Bot Interface. Executing a manipulation of the argument Source can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DjangoBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2026A vulnerability was determined in kodcloud KodExplorer up to 4.52.CVE-2026-6568 · Other software · kodcloud · reported by VulDBMedium 5.5
A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026A vulnerability was determined in prasathmani TinyFileManager up to 2.6.CVE-2026-6497 · Other software · prasathmani · reported by VulDBLow 2.1
A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the file /filemanager.php?p= ajax=true&type=upload of the component File Upload Handler. This manipulation of the argument uploadurl causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TinyFileManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Apr 13, 2026A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2.CVE-2026-6219 · Other software · aandrew-me · reported by VulDBLow 1.9
A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of the file src/compressor.js of the component Compressor Feature. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
- Product
- ytDownloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 13, 2026A vulnerability was determined in Tenda F456 1.0.0.5.CVE-2026-6200 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F456 1.0.0.5. The affected element is the function formwebtypelibrary of the file /goform/webtypelibrary. This manipulation of the argument menufacturer/Go causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- F456
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026A vulnerability was determined in danielmiessler Personal_AI_Infrastructure up to 2.3.0.CVE-2026-6141 · Other software · danielmiessler · reported by VulDBLow 2.1
A vulnerability was determined in danielmiessler Personal_AI_Infrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parse_url.ts. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 14322e87e58bf585cf3c7b9295578a6eb7dc4945. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- Personal_AI_Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024.CVE-2026-6132 · Other software · Totolink · reported by VulDBHigh 8.9
A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- A7100RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026A vulnerability was determined in Tenda F451 1.0.0.7.CVE-2026-6124 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- F451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026A vulnerability was determined in AstrBotDevs AstrBot up to 4.22.1.CVE-2026-6118 · Other software · AstrBotDevs · reported by VulDBLow 2.1
A vulnerability was determined in AstrBotDevs AstrBot up to 4.22.1. Impacted is the function add_mcp_server of the file astrbot/dashboard/routes/tools.py of the component MCP Endpoint. This manipulation of the argument command causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- AstrBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2026A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1.CVE-2026-6109 · Other software · FoundationAgents · reported by VulDBLow 2.1
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MetaGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026A vulnerability was determined in CodeAstro Online Classroom 1.0.CVE-2026-6033 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /updatedetailsfromstudent.php?eno=146891650. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- Online Classroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Apr 10, 2026A vulnerability was determined in Tenda i6 1.0.0.7(2204).CVE-2026-6024 · Network & remote access · Tenda · reported by VulDBMedium 5.5
A vulnerability was determined in Tenda i6 1.0.0.7(2204). Affected by this issue is the function R7WebsSecurityHandlerfunction of the component HTTP Handler. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A vulnerability was determined in Tenda F451 1.0.0.7.CVE-2026-5992 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F451 1.0.0.7. This affects the function fromP2pListFilter of the file /goform/P2pListFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- F451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A vulnerability was determined in D-Link DIR-605L 2.13B01.CVE-2026-5983 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DIR-605L 2.13B01. This issue affects the function formSetDDNS of the file /goform/formSetDDNS of the component POST Request Handler. Executing a manipulation of the argument curTime can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Apr 9, 2026A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1.CVE-2026-5974 · Other software · FoundationAgents · reported by VulDBMedium 6.9
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.
- Product
- MetaGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A vulnerability was determined in Tenda i12 1.0.0.11(3862).CVE-2026-5849 · Network & remote access · Tenda · reported by VulDBMedium 5.5
A vulnerability was determined in Tenda i12 1.0.0.11(3862). The impacted element is an unknown function of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A vulnerability was determined in Tenda CX12L 16.03.53.12.CVE-2026-5684 · Network & remote access · Tenda · reported by VulDBHigh 7.3
A vulnerability was determined in Tenda CX12L 16.03.53.12. Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack requires access to the local network. The exploit has been publicly disclosed and may be utilized.
- Product
- CX12L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f.CVE-2026-5671 · Other software · Cyber-III · reported by VulDBLow 2.1
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Impacted is an unknown function of the file /admin/class%20schedule/delete_batch.php of the component Class Schedule Deletion Endpoint. Executing a manipulation of the argument batch can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Student-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f.CVE-2026-5642 · Other software · Cyber-III · reported by VulDBMedium 5.5
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the file /viva/update.php of the component HTTP POST Request Handler. This manipulation of the argument Name causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Student-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3.CVE-2026-5633 · Other software · assafelovic · reported by VulDBMedium 5.5
A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument source_urls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- gpt-researcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A vulnerability was determined in hcengineering Huly Platform 0.7.382.CVE-2026-5622 · Other software · hcengineering · reported by VulDBLow 2.9
A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packages/token/src/token.ts of the component JWT Token Handler. This manipulation of the argument SERVER_SECRET with the input secret causes use of hard-coded cryptographic key . The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Huly Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A vulnerability was determined in Belkin F9K1015 1.00.10.CVE-2026-5612 · Other software · Belkin · reported by VulDBHigh 7.4
A vulnerability was determined in Belkin F9K1015 1.00.10. This vulnerability affects the function formWlEncrypt of the file /goform/formWlEncrypt. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1015
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A vulnerability was determined in Nor2-io heim-mcp up to 0.1.3.CVE-2026-5602 · Other software · Nor2-io · reported by VulDBLow 1.9
A vulnerability was determined in Nor2-io heim-mcp up to 0.1.3. Impacted is the function registerTools of the file src/tools.ts of the component new_heim_application/deploy_heim_application/deploy_heim_application_to_cloud. This manipulation causes os command injection. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Patch name: c321d8af25f77668781e6ccb43a1336f9185df37. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- heim-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1.CVE-2026-5586 · Other software · zhongyu09 · reported by VulDBLow 2.1
A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1. The impacted element is an unknown function of the component Multi-stage Text2SQL Workflow. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- openchatbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A vulnerability was determined in CodeAstro Online Classroom 1.0.CVE-2026-5579 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was determined in CodeAstro Online Classroom 1.0. This issue affects some unknown processing of the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 of the component Parameter Handler. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- Online Classroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Apr 5, 2026A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30.CVE-2026-5570 · Other software · Technostrobe · reported by VulDBMedium 5.5
A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function index_config of the file /LoginCB. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HI-LED-WR120-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01.CVE-2026-5549 · Network & remote access · Tenda · reported by VulDBMedium 5.5
A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this issue is some unknown functionality of the file /webroot_ro/pem/privkeySrv.pem of the component RSA 2048-bit Private Key Handler. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- AC10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2026A vulnerability was determined in badlogic pi-mono 0.58.4.CVE-2026-5533 · Other software · badlogic · reported by VulDBLow 2.1
A vulnerability was determined in badlogic pi-mono 0.58.4. The impacted element is an unknown function of the file packages/web-ui/src/tools/artifacts/SvgArtifact.ts of the component SVG Artifact Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- pi-mono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026A vulnerability was determined in NASA cFS up to 7.0.0.CVE-2026-5475 · Other software · NASA · reported by VulDBMedium 5.1
A vulnerability was determined in NASA cFS up to 7.0.0. This impacts the function CFE_SB_TransmitMsg of the file cfe_sb_priv.c of the component CCSDS Header Size Handler. Executing a manipulation can lead to memory corruption. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- cFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026A vulnerability was determined in Dialogue App up to 4.3.2 on Android.CVE-2026-5455 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the component ca.diagram.dialogue. Executing a manipulation of the argument SEGMENT_WRITE_KEY can lead to use of hard-coded cryptographic key . The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026A vulnerability was determined in Dataease SQLbot up to 1.6.0.CVE-2026-5417 · Other software · Dataease · reported by VulDBLow 2
A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of the component Elasticsearch Handler. This manipulation of the argument address causes server-side request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.0 is capable of addressing this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure.
- Product
- SQLbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026A vulnerability was determined in huimeicloud hm_editor up to 2.2.3.CVE-2026-5346 · Other software · huimeicloud · reported by VulDBMedium 5.5
A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- hm_editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026A vulnerability was determined in OpenCart 4.1.0.3.CVE-2026-5331 · Other software · reported by VulDBLow 2
A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Apr 2, 2026A vulnerability was determined in Cesanta Mongoose up to 7.20.CVE-2026-5246 · Other software · Cesanta · reported by VulDBLow 2.9
A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026A vulnerability was determined in Nothings stb up to 1.26.CVE-2026-5315 · Other software · Nothings · reported by VulDBLow 2.1
A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- stb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 1, 2026A vulnerability was determined in AutohomeCorp frostmourne up to 1.0.CVE-2026-5259 · Other software · AutohomeCorp · reported by VulDBLow 2.1
A vulnerability was determined in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.java of the component Alarm Preview. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- frostmourne
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfx4tqqfvdw4.feishu.cnvuldb.com
Mar 31, 2026A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641.CVE-2026-5235 · Other software · Axiomatic · reported by VulDBLow 1.9
A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-CVE-2026-5213 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_adduser_to_session of the file /cgi-bin/account_mgr.cgi. This manipulation of the argument read_list causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DNS-120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2026-5204 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A vulnerability was determined in TRENDnet TEW-713RE up to 1.02.CVE-2026-5183 · Other software · TRENDnet · reported by VulDBLow 2.1
A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub_421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TEW-713RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2026-5156 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This impacts the function formQuickIndex of the file /goform/QuickIndex of the component Parameter Handler. This manipulation of the argument mit_linktype causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2026A vulnerability was determined in mxml up to 4.0.4.CVE-2026-5037 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.