[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-657571-105":3,"detail-sidebar-cat-0-en-105":84,"doc-detail-657571-en":134},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":77,"head_meta":79,"extra_data":81,"updated_unix":83},105,"en","security-bulletin-22-april-2026-vulnerabilities-summary","Security Bulletin - 22 April 2026 - Vulnerabilities Summary","","SingCERT’s Security Bulletin dated 22 April 2026 summarizes vulnerabilities collected from NIST’s National Vulnerability Database (NVD) over the past week. Issues are categorized by CVSSv3 base score severity into Critical, High, Medium, Low, and None. The bulletin lists multiple CVEs with descriptions and base scores, including components such as Net::Dropbear, WWBN AVideo, Storable, Flowise, Spinnaker, and OpenClaw, and notes fixes or workarounds for some items.",{"@graph":14,"@context":76},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/security-bulletin-22-april-2026-vulnerabilities-summary/657571/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/security-bulletin-22-april-2026-vulnerabilities-summary/657571.png","ImageObject",300,407,{"name":42,"@type":43},"4398046744996","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-29","2026-10-26",true,{"@type":52,"interactionType":53,"userInteractionCount":22},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68,72],{"name":59,"@type":60,"acceptedAnswer":61},"What is the purpose of SingCERT’s Security Bulletin dated 22 April 2026?","Question",{"text":62,"@type":63},"It summarizes vulnerabilities collected from NIST’s National Vulnerability Database (NVD) for the past week and presents them by CVSSv3 severity.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"How does the bulletin categorize vulnerabilities?",{"text":67,"@type":63},"Vulnerabilities are tabled by severity according to CVSSv3 base scores, covering Critical, High, Medium, Low, and None.",{"name":69,"@type":60,"acceptedAnswer":70},"What should be done for vulnerabilities without assigned CVSS scores?",{"text":71,"@type":63},"The bulletin instructs readers to visit NVD for the updated CVSS vulnerability entries.",{"name":73,"@type":60,"acceptedAnswer":74},"Are fixes or workarounds mentioned for some critical issues?",{"text":75,"@type":63},"Yes. For several listed CVEs, the bulletin notes that the vulnerability is fixed in specific versions or provides workarounds such as disabling certain artifact types or configurations.","https://schema.org",{"og:url":32,"og:type":78,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":80,"canonical":32},"index,follow",{"doc_id":82,"site_id":7},657571,1792983584,{"code":4,"msg":85,"data":86},"success",[87,91,95,99,104,109,114,118,123,126,130],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":88,"show_sort_weight":89,"slug":90},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":92,"show_sort_weight":93,"slug":94},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},"Exam",70,"exam",{"id":100,"doc_module":4,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},5,"Comic",60,"comic",{"id":105,"doc_module":4,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},6,"Technology",50,"technology",{"id":110,"doc_module":4,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},7,"Healthcare",40,"healthcare",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":116,"slug":117},8,30,"research-report",{"id":119,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},9,"Religion & Spirituality",20,"religion-spirituality",{"id":121,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":121,"slug":125},"World Cup","world-cup",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":127,"slug":129},10,"Lifestyle","lifestyle",{"id":131,"doc_module":4,"doc_module_name":25,"category_name":132,"show_sort_weight":100,"slug":133},19,"General","general",{"code":4,"msg":85,"data":135},{"doc_id":82,"user_id":136,"nickname":42,"user_avatar":11,"doc_module":4,"category_id":115,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":137,"file_id":138,"file_url":139,"file_type":140,"file_size":141,"view_count":22,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":142,"language":143,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":144,"faqs":145,"seo_title":146,"seo_description":12,"update_tm":83,"read_time":147},4398046744996,"Security Bulletin 22 April 2026  \nGenerated on 22 April 2026  \nSingCERT's Security Bulletin summarises the list of vulnerabilities collated from the National Institute of Standards and Technology (NIST) 's National Vulnerability Database (NVD) in the past week.  \nThe vulnerabilities are tabled based on severity, in accordance to their CVSSv3 base scores:  \n\n| Critical | vulnerabilities with a base score of 9.0 to 10.0 |\n| --- | --- |\n| High | vulnerabilities with a base score of 7.0 to 8.9 |\n| Medium | vulnerabilities with a base score of 4.0 to 6.9 |\n| Low | vulnerabilities with a base score of 0.1 to 3.9 |\n| None | vulnerabilities with a base score of 0.0 |\n\nFor those vulnerabilities without assigned CVSS scores, please visit NVD for the updated CVSS vulnerability entries.  \nCRITICAL VULNERABILITIES  \n\n| CVE Number | Description | Base Score | Reference |\n| --- | --- | --- | --- |\n| CVE-2025- 15638 | Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1 .18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437 . | 10.0 | More Details |\n| CVE-2026- 40911 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin 's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the ` msg ` or ` callback ` fields. On the client side, ` plugin/YPTSocket/script.js ` contains two ` eval() ` sinks fed directly by those relayed fields ( `json. msg. autoEvalCodeOnHTML ` at line 568 and `json.callback ` at line 95) . Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators) , resulting in universal account takeover, session theft, and privileged action execution. Commit c08694bf6264eb4decceb78c711baee2609b4efd contains a fix. | 10.0 | More Details |\n| CVE-2017- 20230 | Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. | 10.0 | More Details |\n| CVE-2026- 40933 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0 , due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the“Custom MCP” configuration in [http://localhost:3000/canvas-where](http://localhost:3000/canvas-where) any user can add a new MCP, when doing soadding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands-these commands, for example \"npx \" can be combined with code execution arguments ( \"-c touch\u003Cbr>/tmp/pwn \") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0. | 9.9 | More Details |\n| CVE-2026- 32604 | Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0 , 2026.0.1 , 2025.4.2 , and 2025.3.2 , a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0 , 2026.0.1 , 2025.4.2 , and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types. | 9.9 | More Details |\n| CVE-2026- 32613 | Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expre","cbCaiii5VgpApxhP","https://ap.wps.com/l/cbCaiii5VgpApxhP","pdf",1127558,78,"English","# Critical Vulnerabilities\n## CVEs by severity and affected components\n### References and fixes/workarounds","[{\"question\":\"What is the purpose of SingCERT’s Security Bulletin dated 22 April 2026?\",\"answer\":\"It summarizes vulnerabilities collected from NIST’s National Vulnerability Database (NVD) for the past week and presents them by CVSSv3 severity.\"},{\"question\":\"How does the bulletin categorize vulnerabilities?\",\"answer\":\"Vulnerabilities are tabled by severity according to CVSSv3 base scores, covering Critical, High, Medium, Low, and None.\"},{\"question\":\"What should be done for vulnerabilities without assigned CVSS scores?\",\"answer\":\"The bulletin instructs readers to visit NVD for the updated CVSS vulnerability entries.\"},{\"question\":\"Are fixes or workarounds mentioned for some critical issues?\",\"answer\":\"Yes. For several listed CVEs, the bulletin notes that the vulnerability is fixed in specific versions or provides workarounds such as disabling certain artifact types or configurations.\"}]","Security Bulletin - 22 April 2026 - Vulnerabilities Summary | PDF",197]