Critical vulnerability intelligence.

Critical· 9.1<1% likelyfix available

1640

CVE-2026-34758

Hackerbay Oneuptime

OneUptime, an open‑source monitoring platform, had a critical flaw that let anyone send SMS, calls, emails, or WhatsApp messages and even buy phone numbers without logging in. The issue was fixed in version 10.0.42.

Critical· 9.1<1% likelyfix available

1641

CVE-2026-34745

Shaneisrael Fireshare

Fireshare, a self‑hosted media sharing tool, had a flaw that let anyone upload files to any location on the server. The bug existed in the public upload endpoint before version 1.5.3. The vendor has released a patch that fixes the issue.

Critical· 9.9<1% likelyfix available

1642

CVE-2026-34717

Openproject Openproject

OpenProject, a web‑based project management tool, had a flaw that let attackers inject SQL commands. The bug was fixed in version 17.2.3. Users should update to avoid the risk.

1643

CVE-2026-34877

Arm Mbed Tls +1 more

A critical flaw in the Mbed TLS library allows attackers to modify serialized SSL context or session data, causing memory corruption and arbitrary code execution. The vulnerability exists in versions 2.19.0 through 3.6.5 and 4.0.0. It can be exploited remotely without authentication or user interaction.

published Apr 2, 2026deletes in 34d

1644

CVE-2026-33950

Signalk Signal K Server +3 more

Signal K Server had a critical privilege escalation flaw that let anyone hit /enableSecurity and become an administrator. The bug was fixed in version 2.24.0‑beta.4. Users should update to that or newer version.

Critical· 9.4<1% likelyfix available

Percona Monitoring And Management

1645

CVE-2026-25212

Percona Monitoring and Management (PMM) versions before 3.7 allow an attacker with pmm-admin rights to run arbitrary shell commands on the host by abusing the "Add data source" feature. The flaw exists because an internal database user retains superuser privileges. This can lead to full system compromise.

Critical· 9.9<1% likely

published Apr 2, 2026deletes in 34d

1646

CVE-2026-33746

Convoypanel Convoy

Convoy, a KVM server management panel, had a critical flaw where JWT tokens were not properly verified, allowing attackers to forge tokens and impersonate users. The issue existed in versions 3.9.0-beta through 4.5.0 and was fixed in 4.5.1.

Critical· 9.8<1% likelyfix available

Critical· 9.3<1% likelyfix available

1647

CVE-2026-35002

Agno Agno

Agno software versions before 2.3.24 allow attackers to run arbitrary Python code by manipulating the field_type parameter in a FunctionCall. This flaw lets a remote attacker execute any code on the affected system without needing to log in or interact with the user.

Critical· 9.6<1% likelyfix available

1648

CVE-2026-34449

B3log Siyuan

SiYuan, a personal knowledge‑management app, had a critical flaw that let attackers run arbitrary code on a user’s computer by visiting a malicious website while SiYuan was open. The flaw was fixed in version 3.6.2.

Critical· 9<1% likelyfix available

1649

CVE-2026-34448

B3log Siyuan

SiYuan, a personal knowledge management system, has a critical vulnerability that lets attackers inject malicious JavaScript via a crafted URL. The flaw is triggered when a user opens certain views, and in the Electron desktop client it can lead to arbitrary OS command execution. The issue is fixed in version 3.6.2.

Critical· 9.4<1% likelyfix available

1650

CVE-2026-34406

Aptrs Aptrs

APTRS, a Python/Django reporting tool, had a flaw that let any user reach the edit_user endpoint and set the "is_superuser" flag to true. This gave the attacker full administrative control over the application. The issue was fixed in version 2.0.1.

Critical· 9.3<1% likelyfix available

1651

CVE-2026-1579

Px4 Autopilot

The MAVLink protocol used by PX4 autopilot does not enforce cryptographic authentication unless message signing is enabled. If signing is disabled, anyone with access to the MAVLink interface can send any message, including those that grant shell access. Enabling MAVLink 2.0 message signing blocks unsigned messages at the protocol level.

1652

CVE-2026-30285

Zora Zora

An arbitrary file overwrite vulnerability in Zora: Post, Trade, Earn Crypto v2.60.0 allows attackers to overwrite critical internal files via the file import process, potentially leading to arbitrary code execution or data exposure.

1653

CVE-2026-3356

The MS27102A Remote Spectrum Monitor has a design flaw that lets anyone access its management interface without authentication. Because the device never offers a way to enable login, attackers can read or change settings freely. This flaw is critical because it gives full control over the device.

Critical· 9.3<1% likely

1654

CVE-2026-30286

Funambol Zefiro

Funambol Zefiro Cloud version 32.0.2026011614 has a flaw that lets attackers overwrite important files by using the file import feature. This can allow attackers to run code or expose sensitive data. The vulnerability is critical.

Peaksel Animal Sounds And Ringtones

1655

CVE-2026-30283

An arbitrary file overwrite flaw in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3.0 lets attackers replace critical internal files during the import process. This can lead to arbitrary code execution or leaking sensitive information. The vulnerability is publicly known and rated critical.

1656

CVE-2026-30282

Uxgroupllc Cast To Tv

UXGROUP LLC Cast to TV Screen Mirroring version 2.2.77 contains a critical flaw that lets attackers overwrite internal files via the file import feature. This can enable arbitrary code execution or the exposure of sensitive data. The vulnerability is rated CVSS 9.0.

Critical· 9<1% likely