CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-04-18 (5)

2026-04-18 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-04-18

5 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-40317 — 9.3 — NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (JumpToUser) accepts an arbitrary entry point address from user-space registers without validation, allow…
  • CVE-2026-33516 — 9.1 — xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining bu…
  • CVE-2026-40324 — 9.1 — Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's recursive descent parser Utf8GraphQLParser has no recursion depth limit. A crafted GraphQL docume…
  • CVE-2026-40572 — 9.0 — NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their add…
  • CVE-2026-40487 — 9.0 — Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.