Explore CVE records

CritPublished 20 Apr 2026, 14:36 WIB

CVE-2026-5964

Digiwin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:38 WIB

Official record

CritPublished 20 Apr 2026, 14:32 WIB

CVE-2026-5963

Digiwin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

CVSS

MedPublished 20 Apr 2026, 14:30 WIB

CVE-2026-6617

langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery

A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the function get_api_tool_provider_remote_schema of the file api/services/tools/api_tools_manage_service.py of the component ApiToolManageService. Performing a manipulation of the argument url results in server-side request forgery.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 18:12 WIB

Official record

MedPublished 20 Apr 2026, 14:15 WIB

CVE-2026-6616

TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract_with_bs4/extract_with_3k/extract_with_lxml of the file superagi/helper/webpage_extractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. It is possible to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:54 WIB

Official record

MedPublished 20 Apr 2026, 14:10 WIB

CVE-2026-41282

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).

Excerpt language: en.

CVSS4v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 07:59 WIB

Official record

MedPublished 20 Apr 2026, 14:00 WIB

CVE-2026-6615

TransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal

A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initiate the attack remotely.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:56 WIB

Official record

CritPublished 20 Apr 2026, 13:54 WIB

CVE-2026-6644

A command injection vulnerability was found in the PPTP VPN Clients on the ADM

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is pas…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 19:48 WIB

Official record

MedPublished 20 Apr 2026, 13:45 WIB

CVE-2026-6614

TransformerOptimus SuperAGI project.py get_projects_organisation authorization

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_projects_organisation of the file superagi/controllers/project.py. The manipulation results in authorization bypass. The attack may be performed from remote. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:51 WIB

Official record

HighPublished 20 Apr 2026, 13:34 WIB

CVE-2026-6643

A stack-based buffer overflow vulnerability in the VPN Clients on the ADM

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:46 WIB

Official record

MedPublished 20 Apr 2026, 13:30 WIB

CVE-2026-6613

TransformerOptimus SuperAGI agent.py get_schedule_data authorization

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file superagi/controllers/agent.py. The manipulation of the argument agent_id leads to authorization bypass. The attack is possible to be carried out remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:57 WIB

Official record

MedPublished 20 Apr 2026, 13:15 WIB

CVE-2026-6612

TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization

A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file superagi/controllers/agent_execution.py of the component Agent Execution Endpoint. Executing a manipulation of the argument agent_execution_id can lead to authoriz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 18:24 WIB

Official record

LowPublished 20 Apr 2026, 13:00 WIB

CVE-2026-6611

liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key

A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File Upload Endpoint. Performing a manipulation of the argument SECRET_KEY results in use of hard-coded cryptographic key . Remote exploitation of the attack is possi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:00 WIB

Official record

UnscoredPublished 20 Apr 2026, 13:00 WIB

CVE-2024-7083

Email Encoder < 2.3.4 - Admin+ Stored XSS

The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:16 WIB

Official record

MedPublished 20 Apr 2026, 12:45 WIB

CVE-2026-6610

liangliangyy DjangoBlog Setting settings.py hard-coded credentials

A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the component Setting Handler. Such manipulation of the argument USER/PASSWORD leads to hard-coded credentials. The attack may be launched remotely. The attack requi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:03 WIB

Official record

MedPublished 20 Apr 2026, 12:30 WIB

CVE-2026-6609

liangliangyy DjangoBlog views.py form_valid improper authorization

A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation of the argument oauthid causes improper authorization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:51 WIB

Official record

MedPublished 20 Apr 2026, 12:15 WIB

CVE-2026-6608

lm-sys fastchat Arena Side-by-Side View add_text control flow

A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:57 WIB

Official record

MedPublished 20 Apr 2026, 12:00 WIB

CVE-2026-6607

lm-sys fastchat Worker API Endpoint api_generate resource consumption

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 18:37 WIB

Official record

MedPublished 20 Apr 2026, 11:45 WIB

CVE-2026-6606

modelscope agentscope _agent_base.py _process_audio_block server-side request forgery

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:07 WIB

Official record

MedPublished 20 Apr 2026, 11:30 WIB

CVE-2026-6605

modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery

A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/_common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:58 WIB

Official record

MedPublished 20 Apr 2026, 11:15 WIB

CVE-2026-6604

modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:53 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage