cisa.gov | Bulletins
Follow
Vulnerability Summary for the Week of April 13, 2026
This document details several high-severity vulnerabilities across various software and systems. Grafana Pyroscope exposes a secret key if accessed directly, exploitable when using Tencent COS. Multiple SQL injection vulnerabilities exist in a Grocery Store Management System and a School Management System. WordPress themes, specifically WebStack and Career Section, allow arbitrary file uploads and deletions, respectively. Cisco ISE software has multiple vulnerabilities allowing remote code execution with varying levels of access. Cisco Webex Meetings is vulnerable to impersonation through improper certificate validation in SSO integration. Ubiquiti UniFi Play products are affected by path traversal, command injection, and improper access control. A remote, low-privileged attacker can exploit functions in Festo MSE6 products. Nozomi Networks Guardian has access control and XSS vulnerabilities in threat intelligence and assets/nodes. Finally, the Livemesh Addons for Elementor plugin and Cloud Foundry UUA are also vulnerable to local file inclusion and SAML 2.0 bypass, respectively.