Application Security Detections Published in April 2026
In March, Qualys Web Application Scanning released QIDs targeting vulnerabilities in several widely used software products and frameworks, including:
OpenSSL, Apache Traffic Server, Liferay, WordPress, Apache Airflow, NetScaler, F5, Apache Camel, vLLM, MLflow, DNN, Qwik, Fortinet, Grafana, GitLab, Zabbix, Apache ActiveMQ, Apache Tomcat, Microsoft SharePoint, Adobe, Nginx, Oracle, Apache APISIX, JetBrains, Joomla
Details about the following QIDs can be found in our knowledge base. Please review the reports for the scanned applications for these detections and, if any are identified, follow the steps in the knowledge base to ensure the applications are protected against the reported vulnerabilities. Immediate resolution of these vulnerabilities upon detection should be a priority for all organizations. If left unaddressed, these vulnerabilities can pose security risks, including breaches, unauthorized access, and various malicious activities.
The following table lists the QIDs released in April 2026.
| QID | Title |
| 520129 | OpenSSL TLS Key Exchange Negotiation Failure (CVE-2026-2673) |
| 520130 | OpenSSL Uninitialized Memory Leak via Cryptographic Key Encapsulation (CVE-2026-31790) |
| 520131 | Apache Traffic Server Request Smuggling Vulnerability (CVE-2025-65114) |
| 520132 | Liferay Portal Improper Access Control Vulnerability (CVE-2025-62276) |
| 520133 | Liferay Portal Multiple Cross-Site Scripting Vulnerabilities (CVE-2025-62267) |
| 520134 | Liferay Portal Cross-Site Scripting Vulnerability (CVE-2025-62264) |
| 520135 | Liferay Portal Improper Access Control Vulnerability (CVE-2025-62259) |
| 520136 | Liferay Portal Cross-Site Request Forgery Vulnerability (CVE-2025-62258) |
| 520137 | Liferay Portal Cleartext Storage of Sensitive Information Vulnerability (CVE-2025-62261) |
| 520138 | Liferay Portal Denial of Service Vulnerability (CVE-2025-62260) |
| 520139 | Liferay Portal Information Exposure Vulnerability (CVE-2025-62262) |
| 520140 | Liferay Portal Multiple Cross-Site Scripting Vulnerabilities (CVE-2025-62263) |
| 520141 | Liferay Portal Open Redirect Vulnerability (CVE-2025-62253) |
| 520142 | Liferay Portal Denial of Service Vulnerability (CVE-2025-62254) |
| 531065 | WordPress Handyman Theme: PHP Object Injection Vulnerability (CVE-2026-22451) |
| 531066 | WordPress Kali Forms Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-3584) |
| 531067 | WordPress Equestrian Centre Theme: PHP Object Injection Vulnerability (CVE-2026-22474) |
| 531068 | WordPress Estate Theme: PHP Object Injection Vulnerability (CVE-2026-22475) |
| 531072 | Apache Airflow Session Hijacking Vulnerability (CVE-2026-28779) |
| 531073 | Apache Airflow Missing Authorization Vulnerability (CVE-2026-26929) |
| 531074 | Apache Airflow Authorization Bypass Vulnerability (CVE-2026-28563) |
| 531075 | WordPress Mounthood Theme: PHP Object Injection Vulnerability (CVE-2026-22501) |
| 531076 | WordPress Contact Form Entries Plugin: PHP Object Injection Vulnerability (CVE-2026-2599) |
| 531077 | WordPress Tutor LMS Pro Plugin: Authentication Bypass Vulnerability (CVE-2026-0953) |
| 531078 | WordPress WowOptin Plugin: Missing Authorization Vulnerability (CVE-2026-1720) |
| 531079 | NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Memory Overread Vulnerability (CVE-2026-3055) |
| 531080 | F5 BIG-IP APM Remote Code Execution (RCE) Vulnerability (CVE-2025-53521) |
| 531081 | NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Race Condition Vulnerability (CVE-2026-4368) |
| 531082 | WordPress ExactMetrics Plugin: Improper Privilege Management Vulnerability (CVE-2026-1993) |
| 531083 | WordPress ExactMetrics Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-1992) |
| 531084 | WordPress Royal Elementor Addons Plugin: Arbitrary File Upload Vulnerability (CVE-2025-13067) |
| 531085 | WordPress Dental Clinic Theme: PHP Object Injection Vulnerability (CVE-2026-22473) |
| 531086 | Apache Camel Improper JWT Issuer Validation Vulnerability (CVE-2026-23552) |
| 531087 | vLLM Remote Code Execution (RCE) Vulnerability (CVE-2026-27893) |
| 531088 | MLflow Path Traversal Vulnerability (CVE-2025-15036) |
| 531089 | WordPress Secudeal Payments for Ecommerce Plugin: PHP Object Injection Vulnerability (CVE-2026-22471) |
| 531090 | WordPress Prowess Theme: Local File Inclusion Vulnerability (CVE-2026-22446) |
| 531091 | WordPress Grand Wedding Theme: PHP Object Injection Vulnerability (CVE-2026-22417) |
| 531092 | WordPress Askka Theme: Local File Inclusion Vulnerability (CVE-2026-22456) |
| 531093 | WordPress FormGent Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-22460) |
| 531094 | DNN Cross-Site Scripting Vulnerabilities (CVE-2025-48378, CVE-2025-48377) |
| 531095 | DNN Denial of Service Vulnerability (CVE-2025-32374) |
| 531096 | DNN Improper Access Control Vulnerability (CVE-2025-32373) |
| 531097 | WordPress Don Peppe Theme: Local File Inclusion Vulnerability (CVE-2026-22449) |
| 531098 | WordPress ProfilePress Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-3453) |
| 531099 | WordPress Drag and Drop Plugin: Arbitrary File Upload Vulnerability (CVE-2026-3459) |
| 531100 | WordPress Membership Plugin: Privilege Escalation Vulnerability (CVE-2026-1321) |
| 531101 | DNN Server-Side Request Forgery Vulnerability (CVE-2025-32372) |
| 531102 | DNN Improper Input Handling Vulnerability (CVE-2025-32371) |
| 531103 | DNN Captcha Bypass Vulnerability (CVE-2025-32036) |
| 531104 | DNN File Upload Bypass Vulnerability (CVE-2025-32035) |
| 531106 | WordPress Everest Forms Pro Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-3300) |
| 531107 | WordPress WP DSGVO Tools Plugin: Missing Authorization Vulnerability (CVE-2026-4283) |
| 531108 | WordPress Contact Form Plugin: Server-Side Template Injection (SSTI) Vulnerability (CVE-2026-4257) |
| 531109 | WordPress Pix for WooCommerce Plugin: Arbitrary File Upload Vulnerability (CVE-2026-3891) |
| 531110 | MLflow Command Injection Vulnerability (CVE-2025-15379) |
| 531111 | Qwik Remote Code Execution Vulnerability (CVE-2026-27971) |
| 531112 | Fortinet FortiClientEMS Improper Access Control Vulnerability (CVE-2026-35616) |
| 531113 | WordPress NextGEN Gallery Plugin: Local File Inclusion Vulnerability (CVE-2026-1463) |
| 531114 | WordPress Ultimate Member Plugin: Account Takeover Vulnerability (CVE-2026-4248) |
| 531115 | WordPress Import and Export Users Plugin: Privilege Escalation Vulnerability (CVE-2026-3629) |
| 531116 | Grafana Remote Code Execution Vulnerability (CVE-2026-27876) |
| 531117 | GitLab CE/EE Server-Side Request Forgery Vulnerability (CVE-2021-22175) |
| 531118 | Zabbix API SQL Injection Vulnerability (CVE-2026-23921) |
| 531119 | WordPress MW WP Form Plugin: Arbitrary File Move Vulnerability (CVE-2026-4347) |
| 531120 | WordPress WC Frontend Manager Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-4896) |
| 531121 | WordPress Jupiter X Core Plugin: File Upload Vulnerability (CVE-2026-3533) |
| 531122 | Apache ActiveMQ Remote Code Execution Vulnerability (CVE-2026-34197) |
| 531123 | WordPress WP Job Portal Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-4758) |
| 531124 | WordPress Contest Gallery Plugin: Account Takeover Vulnerability (CVE-2026-4021) |
| 531125 | WordPress CMS Commander Plugin: SQL Injection Vulnerability (CVE-2026-3334) |
| 531126 | DNN Path Traversal Vulnerability (CVE-2022-2922) |
| 531127 | DNN Cross-Site Scripting Vulnerability (CVE-2021-31858) |
| 531128 | WordPress Everest Forms Plugin: PHP Object Injection Vulnerability (CVE-2026-3296) |
| 531129 | WordPress Masteriyo LMS Plugin: Privilege Escalation Vulnerability (CVE-2026-4484) |
| 531130 | Apache Airflow JWT Tokens Remain Valid After Logout Vulnerability (CVE-2025-57735) |
| 531131 | Apache Airflow Authorization Bypass Vulnerability (CVE-2026-34538) |
| 531132 | React Server Components Remote Code Execution (RCE) Vulnerability (CVE-2025-55182) (Error Digest Detection) |
| 531133 | Apache Tomcat HTTP Request Smuggling Vulnerability (CVE-2026-24880) |
| 531134 | WordPress MimeTypes Link Icons Plugin: Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-1313) |
| 531135 | WordPress KiviCare Plugin: Privilege Escalation Vulnerability (CVE-2026-2992) |
| 531136 | Apache Tomcat OCSP Validation Bypass Vulnerability (CVE-2026-34500) |
| 531137 | DNN Server-Side Request Forgery Vulnerability (CVE-2021-40186) |
| 531138 | DNN Multiple Vulnerabilities (CVE-2020-5186, CVE-2020-5187, CVE-2020-5188) |
| 531139 | WordPress Expire Users Plugin: Privilege Escalation Vulnerability (CVE-2026-4261) |
| 531140 | WordPress WP Extended Plugin: Privilege Escalation Vulnerability (CVE-2026-4314) |
| 531141 | WordPress Quick Playground Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-1830) |
| 531142 | WordPress W3 Total Cache Plugin: Sensitive Information Exposure Vulnerability (CVE-2026-5032) |
| 531143 | WordPress Formidable Forms Plugin: Payment Integrity Bypass Vulnerability (CVE-2026-2890) |
| 531144 | DNN Cross-Site Scripting Vulnerability (CVE-2019-12562) |
| 531145 | DNN Multiple Vulnerabilities (CVE-2018-18326, CVE-2018-18325) |
| 531146 | DNN Multiple Vulnerabilities (CVE-2018-15812, CVE-2018-15811) |
| 531147 | DNN Cross-Site Scripting Vulnerability (CVE-2018-14486) |
| 531148 | DNN Server-Side Request Forgery Vulnerability (CVE-2017-0929) |
| 531149 | DNN Information Disclosure Vulnerability (CVE-2020-11585) |
| 531150 | Microsoft SharePoint Server Spoofing Vulnerability (CVE-2026-32201) |
| 531152 | Apache ActiveMQ Denial of Service Vulnerability (CVE-2026-39304) |
| 531153 | Apache ActiveMQ Integer Overflow Vulnerability (CVE-2026-40046) |
| 531154 | WordPress Query Monitor Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-4267) |
| 531155 | WordPress Post SMTP Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-3090) |
| 531156 | WordPress SlimStat Analytics Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-1238) |
| 531157 | WordPress Download Monitor Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-3124) |
| 531158 | WordPress WP Maps Plugin: SQL Injection Vulnerability (CVE-2026-2580) |
| 531159 | WordPress Appointment Booking Calendar Plugin: Sensitive Information Exposure Vulnerability (CVE-2026-3045) |
| 531160 | WordPress Appointment Booking Calendar Plugin: SQL Injection Vulnerability (CVE-2026-3658) |
| 531161 | WordPress SureForms Plugin: Payment Amount Validation Bypass Vulnerability (CVE-2026-4987) |
| 531162 | WordPress LearnPress Plugin: Missing Authorization Vulnerability (CVE-2026-4365) |
| 531163 | WordPress Visa Acceptance Solutions Plugin: Authentication Bypass Vulnerability (CVE-2026-3461) |
| 531164 | Adobe Connect Insecure Deserialization Vulnerabilities |
| 531165 | Adobe Connect Cross-Site Scripting Vulnerabilities |
| 531166 | WordPress Barcode Scanner Plugin: Privilege Escalation Vulnerability (CVE-2026-4880) |
| 531167 | WordPress DSGVO Google Web Fonts Plugin: Arbitrary File Upload Vulnerability (CVE-2026-3535) |
| 531168 | WordPress ProSolution WP Client Plugin: Arbitrary File Upload Vulnerability (CVE-2026-2942) |
| 531169 | WordPress Riaxe Product Customizer Plugin: Privilege Escalation Vulnerability (CVE-2026-3596) |
| 531170 | WordPress Users Manager Plugin: Privilege Escalation Vulnerability (CVE-2026-4003) |
| 531171 | WordPress Addons for Elementor Plugin: Local File Inclusion Vulnerability (CVE-2026-1620) |
| 531172 | Apache Tomcat Open Redirect Vulnerability (CVE-2026-25854) |
| 531173 | Apache Tomcat Cipher Misconfiguration Vulnerability (CVE-2026-29129) |
| 531174 | Apache Tomcat Client Certificate Authentication Flaw Vulnerability (CVE-2026-29145) |
| 531175 | Apache Tomcat Padding Oracle Attack Vulnerability (CVE-2026-29146) |
| 531176 | Apache Tomcat Improper Input Validation Vulnerability (CVE-2026-32990) |
| 531177 | Apache Tomcat Improper Output Encoding Vulnerability (CVE-2026-34483) |
| 531178 | Apache Tomcat Missing Encryption Vulnerability (CVE-2026-34486) |
| 531179 | Apache Tomcat Sensitive Info Logging Vulnerability (CVE-2026-34487) |
| 531180 | Nginx UI Improper Integrity Verification Vulnerability (CVE-2026-33026) |
| 531181 | Nginx UI Missing Authentication Vulnerability (CVE-2026-33032) |
| 531182 | Nginx UI Insecure Direct Object Reference Vulnerability (CVE-2026-33030) |
| 531183 | Nginx UI Improper Input Validation Vulnerability (CVE-2026-33029) |
| 531184 | Nginx UI Race Condition Vulnerability (CVE-2026-33028) |
| 531185 | Nginx UI Improper Path Validation Vulnerability (CVE-2026-33027) |
| 531186 | WordPress Product Feed PRO for WooCommerce Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-3499) |
| 531187 | WordPress MW WP Form Plugin: Arbitrary File Move Vulnerability (CVE-2026-5436) |
| 531188 | WordPress Amelia Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-5465) |
| 531189 | WordPress AcyMailing Plugin: Privilege Escalation Vulnerability (CVE-2026-3614) |
| 531190 | WordPress BuddyPress Groupblog Plugin: Privilege Escalation Vulnerability (CVE-2026-5144) |
| 531191 | WordPress Visitor Traffic Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-2936) |
| 531192 | WordPress JetFormBuilder Plugin: Arbitrary File Read Vulnerability (CVE-2026-4373) |
| 531193 | Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808) |
| 531194 | Fortinet FortiSandbox Path Traversal Vulnerability (CVE-2026-39813) |
| 531195 | Fortinet FortiWeb Out-Of-Bounds Write Vulnerability (CVE-2026-40688) |
| 531196 | Apache HTTP CGI Environment Variable Override Vulnerability (CVE-2025-65082) |
| 531197 | WordPress RegistrationMagic Plugin: Authentication Bypass Vulnerability (CVE-2026-24373) |
| 531198 | WordPress Post Snippets Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-25001) |
| 531199 | WordPress WeForms Plugin: PHP Object Injection Vulnerability (CVE-2026-32484) |
| 531200 | WordPress EventPrime Plugin: PHP Object Injection Vulnerability (CVE-2026-24378) |
| 531201 | WordPress BackWPup Plugin: Local File Inclusion Vulnerability (CVE-2026-6227) |
| 531202 | WordPress ProfilePress Plugin: Membership Payment Bypass Vulnerability (CVE-2026-3445) |
| 531203 | DNN Improper Authorization Vulnerability (CVE-2026-40305) |
| 531204 | DNN Cross-Site Scripting Vulnerability (CVE-2026-40321) |
| 531205 | Microsoft SharePoint Server Spoofing Vulnerability (CVE-2026-20945) |
| 531206 | Oracle WebLogic Server Multiple Vulnerabilities (CPU-APR2026) |
| 531207 | Apache APISIX Header Injection Vulnerability (CVE-2026-31908) |
| 531208 | WordPress Optimole Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-5217) |
| 531209 | WordPress Form Maker Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-4388) |
| 531210 | WordPress Tutor LMS Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-3360) |
| 531211 | WordPress WpForo Forum Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-3666) |
| 531212 | WordPress WpForo Forum Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-5809) |
| 531213 | WordPress Popup Box Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2025-15611) |
| 531214 | WordPress Visual Portfolio Plugin: Local File Inclusion Vulnerability (CVE-2026-32537) |
| 531215 | WordPress SMTP Mailer Plugin: Sensitive Information Exposure Vulnerability (CVE-2026-32538) |
| 531216 | Adobe ColdFusion Arbitrary Code Execution Vulnerability (CVE-2026-27304) |
| 531217 | Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-27305) |
| 531218 | Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-27282) |
| 531219 | Adobe ColdFusion Arbitrary Code Execution Vulnerability (CVE-2026-27306) |
| 531220 | Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-34619) |
| 531221 | Adobe ColdFusion Uncontrolled Resource Consumption (DoS) Vulnerabilities (CVE-2026-27307, CVE-2026-27308) |
| 531222 | WordPress WPBot Plugin: SQL Injection Vulnerability (CVE-2026-32499) |
| 531223 | WordPress Frontend Admin Plugin: PHP Object Injection Vulnerability (CVE-2026-3328) |
| 531224 | WordPress Blackhole Bad Bots Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-4329) |
| 531225 | WordPress Lead Form Builder Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-32532) |
| 531226 | WordPress PublishPress Revisions Plugin: SQL Injection Vulnerability (CVE-2026-32539) |
| 531227 | WordPress Smart Post Show Plugin: PHP Object Injection Vulnerability (CVE-2026-3017) |
| 531228 | WordPress ReviewX Plugin: Arbitrary Method Call Vulnerability (CVE-2025-10679) |
| 531229 | Apache APISIX Cleartext Transmission of Sensitive Information Vulnerability (CVE-2026-31923) |
| 531230 | F5 BIG-IP IKEv1 Pre-Shared Key Offline Dictionary Attack Vulnerability (CVE-2018-5389) |
| 531231 | WordPress WPJAM Basic Plugin: Arbitrary File Upload Vulnerability (CVE-2026-32523) |
| 531232 | WordPress Booking Calendar Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-25435) |
| 531233 | WordPress JS Help Desk Plugin: SQL Injection Vulnerability (CVE-2026-2511) |
| 531234 | WordPress WP Job Portal Plugin: SQL Injection Vulnerability (CVE-2026-4306) |
| 531235 | WordPress NEX-Forms Plugin: Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-1947) |
| 531236 | WordPress Nelio A/B Testing Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-32573) |
| 531237 | WordPress WP REST Cache Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-25347) |
| 531238 | JetBrains YouTrack Remote Code Execution Vulnerability (CVE-2026-33392) |
| 531239 | JetBrains YouTrack Missing Authorization Vulnerability (CVE-2026-28193) |
| 531240 | JetBrains YouTrack Access Token Exposure Vulnerability (CVE-2026-25846) |
| 531241 | Grafana Server-Side Request Forgery Vulnerability (CVE-2020-13379) |
| 531242 | Joomla! Core Arbitrary File Deletion Vulnerability (CVE-2026-23898) |
| 531243 | WordPress WowStore Plugin: SQL Injection Vulnerability (CVE-2026-2579) |
| 531244 | WordPress WooCommerce Redsys Gateway Light Plugin: Improper Verification of Cryptographic Signature Vulnerability (CVE-2026-5050) |
| 531245 | WordPress Photo Engine Plugin: Arbitrary File Upload Vulnerability (CVE-2026-32524) |
| 531246 | WordPress OOPSpam Anti-Spam Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-32544) |
| 531247 | WordPress WC Ajax Product Filter Plugin: SQL Injection Vulnerability (CVE-2026-3396) |
| 531248 | Adobe Magento Cross-Site Scripting Vulnerabilities |
| 531249 | Adobe Magento Incorrect Authorization Vulnerabilities |
| 531250 | Adobe Magento Server-Side Request Forgery (SSRF) Vulnerabilities (CVE-2026-21293, CVE-2026-21294) |
| 531251 | Adobe Magento Path Traversal Vulnerability (CVE-2026-21360) |
| 531252 | Adobe Magento Improper Input Validation Vulnerabilities (CVE-2026-21282, CVE-2026-21310) |
| 531253 | Adobe Magento Open Redirect Vulnerability (CVE-2026-21295) |
| 531256 | WordPress Abandoned Cart Recovery Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-32526) |
| 531257 | WordPress Fluent Booking Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-2231) |
| 531258 | WordPress Fraud Prevention Plugin: Missing Authorization Vulnerability (CVE-2026-25443) |
| 531259 | WordPress JS Archive List Plugin: PHP Object Injection Vulnerability (CVE-2026-32513) |
| 531260 | WordPress Prismatic Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-3876) |
| 531261 | WordPress KiviCare Plugin: Authentication Bypass Vulnerability (CVE-2026-2991) |
| 531262 | WordPress Widgets for Social Photo Feed Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-5425) |
| 580944 | OTP Bypass via NoSQL Injection |
| 580945 | NoSQL Injection in Password Reset Token Verification |
| 580946 | CAPTCHA Answer Disclosure via API |
| 580947 | Password Change Bypass via Missing Current Password Parameter |
| 580948 | Password Change Bypass via Empty String as Current Password |
| 580949 | Authentication Header Confusion via Alternate Headers |
Qualys Notification: Application Security Detections Published in April 2026