CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- utt hiper 1200gw UTT HiPER 1200GW formRemoteControl strcpy buffer overflow 8.7 High
- utt hiper 1200gw UTT HiPER 1200GW formUser strcpy buffer overflow 8.7 High
- cloudfoundry routing release, cloudfoundry foundation cf deployment, cloudfoundry cf-deployment +2 more Route Services Firewall Bypass 5.0 Medium
- wireshark Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark 4.7 Medium
- wireshark, red hat enterprise linux 10, enterprise linux 6 +3 more +5 more Heap-based Buffer Overflow in Wireshark 7.8 High
- wireshark, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 more Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark 7.0 High
- wireshark, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 more Heap-based Buffer Overflow in Wireshark 7.8 High
- owap defectdojo OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization 5.3 Medium
- bootstrap cms Bootstrap CMS Page Creation show.blade.php code injection 5.3 Medium
- sourcecodester hotel management system SourceCodester Hotel Management System check sql injection 6.9 Medium
- nextlevelbuilder goclaw, goclaw lite +1 more nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization 6.9 Medium
- apple container, macos +1 more Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3. 6.5 Medium
- ibm db2 IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries 6.5 Medium
- ibm db2 IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic 6.5 Medium
- ibm db2 IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations 5.3 Medium
- code-projects for plugin code-projects for Plugin cstecgi.cgi setWiFiMultipleConfig buffer overflow 8.7 High
- ibm i IBM i is affected by a privilege escalation vulnerability in Web Administration GUI [] 6.4 Medium
- hkuds openharness HKUDS OpenHarness Remote Command Execution via /bridge Slash Command 8.7 High
- ibm watsonx.data Inadequate Pod Communication Restrictions, affects watsonx.data 5.3 Medium
- ibm turbonomic prometurbo agent IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability 8.8 High
- ibm langflow oss, langflow +1 more Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id 6.5 Medium
- linkstackorg linkstack LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization 5.3 Medium
- ibm watsonx.data, watsonx.data intelligence +1 more Vulnerabilities found 6.2 Medium
- ibm langflow desktop, langflow desktop +1 more Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint 8.8 High
- ibm langflow desktop, langflow desktop +1 more Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint 6.5 Medium
- ibm langflow desktop, langflow desktop +1 more Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw 6.4 Medium
- ibm langflow desktop, langflow desktop +1 more Server-Side Request Forgery (SSRF) in Langflow URL Component 6.5 Medium
- getkirby kirby Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog 7.1 High
-
prestashop/ps_checkoutPackagist ps_checkout allows unauthorized method invocation through unvalidated parameter 2.7 Low - edgelesssys contrast Contrast before 1.19.1 CopyFile Policy Symlink Subversion 8.6 High
- ibm langflow desktop, langflow desktop +1 more Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API 6.5 Medium
- getarcane arcane Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) 8.7 High
- ibm langflow desktop, langflow desktop +1 more Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint 7.5 High
- go-pkgz auth auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation 9.1 Critical
- linkstackorg linkstack LinkStackOrg LinkStack UserController.php editPage cross site scripting 5.1 Medium
- getsentry sentry Sentry: Improper authentication on SAML SSO process allows user identity linking 9.1 Critical
- notepad++, notepad-plus-plus notepad\+\+ +1 more Notepad++ 8.9.3 Format String Injection via nativeLang.xml 4.6 Medium
- absolute secure access Memory corruption in Secure Access Windows clients prior to 14.50 6.8 Medium
- absolute secure access Buffer overflow in the Secure Access server prior to 14.50 7.1 High
- frrouting frr, frrouting +1 more FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions 6.0 Medium
- absolute secure access Buffer overflow in Windows clients prior to 14.50 6.8 Medium
- absolute secure access Buffer overflow in Windows clients prior to 14.50 5.9 Medium
- siteserver sscms SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString 8.6 High
- absolute secure access Arbitrary read/write vulnerability in Windows clients prior to 14.50 8.5 High
- absolute secure access Out of bounds read in Secure Access MacOS clients prior to 14.50 2.3 Low
- absolute secure access Message handler buffer overflow in clients prior to 14.50 2.3 Low
- absolute secure access Format string vulnerability in MacOS clients prior to 14.50 4.8 Medium
- siteserver sscms SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing 2.1 Low
- absolute secure access CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client... 2.3 Low
- absolute secure access Buffer overflow in client authentication prior to version 14.50 2.3 Low
- Show olderLoading…