CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-04-15 (10)

2026-04-15 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-04-15

10 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-39906 — 10.0 — Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Win…
  • CVE-2026-39808 — 9.8 — A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <ins… [KEV]
  • CVE-2026-39813 — 9.8 — A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.
  • CVE-2026-33824 — 9.8 — Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. [KEV]
  • CVE-2026-1555 — 9.8 — The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauth…
  • CVE-2026-3461 — 9.8 — The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.1.0. This is due to the express_pay_product_page_pay_for_order() function logging users …
  • CVE-2026-39399 — 9.6 — NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file…
  • CVE-2026-34457 — 9.1 — OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth…
  • CVE-2025-61624 — 6.5 — An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all ver… [KEV]
  • CVE-2026-32202 — 4.3 — Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. [KEV]

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.