April 19, 2026—KB5091157 (OS Build 26100.32698) Out-of-band

None None...

April 19, 2026—KB5091571 (OS Build 25398.2276) Out-of-band

None None...

April 19, 2026—KB5091575 (OS Build 20348.5024) Out-of-band

None None...

April 19, 2026—KB5091573 (OS Build 17763.8647) Out-of-band

None None...

April 19, 2026—KB5091572 (OS Build 14393.9062) Out-of-band

None None...

CVE-2026-6284 Horner Automation Cscape and XL4, XL7 PLC Weak password requirements

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...

USN-8184-1 linux-realtime, linux-realtime-6.8 vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcod...

CVE-2026-3614 AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2026-3614 AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...

Storage Spaces Privilege Escalation

The vulnerability of the driver responsible for providing functionality for Storage Spaces in Windows operating systems involves reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2026-30461: Improper Neutralization of Special Elements used in a Command

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the /controllers/Installer.php and the function addgitsubmodule...

CVE-2026-40038

Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into POST parameters. Attackers can inject scripts through the value, commentbody, articlecontent, description, and message parameters...

CVE-2026-40038 Pachno 1.0.6 Stored Cross-Site Scripting via Multiple Parameters

Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into POST parameters. Attackers can inject scripts through the value, commentbody, articlecontent, description, and message parameters...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: stakater-reloader, actions-runner-controller, github-mcp-server, smarter-device-manager, flux-image-reflector-controller, nova, omnibump, goreleaser, clickhouse-operator, grafana-operator, sftpgo-plugin-eventsearch, fluxcd-kustomize-mutating-webhook, supercronic,...

PT-2026-33564

Summary When kube-router is configured with per-node BGP peer passwords using the kube-router.io/peer.passwords node annotation, and verbose logging is enabled --v=2 or higher, the raw Kubernetes node annotation map is logged verbatim — including the base64-encoded BGP MD5 passwords. Anyone with...

CVE-2026-35164: Unrestricted Upload of File with Dangerous Type

Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload functionality. It is found in app/Http/Controllers/Dashboard/CkEditorController.php within the ckupload method. The method fails to validate uploaded file types and relies...

CVE-2026-5561: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of the file app/Http/Controllers/SettingsController.php of the component Environment Variable Handler. Executing a manipulation can lead to injection. It is...

Improper Following of a Certificate's Chain of Trust

Overview Affected versions of this package are vulnerable to Improper Following of a Certificate's Chain of Trust in the TLS Client/Server authentication for database cluster connections. An attacker can gain unauthorized access to the cluster, read and modify sensitive data, escalate privileges,...

Dell iDRAC9/iDRAC10 Process Management Code Execution

The vulnerability of microprogrammed software in embedded access controllers of Dell’s iDRAC9 and iDRAC10 lies in improper management of processes. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

CVE-2026-33887 Statamic allows unauthorized content access through missing authorization in its revision controllers

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the...