CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- notepad++, notepad-plus-plus notepad\+\+ +1 moreStack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS6.0 Medium
- vmware spring cloud gatewaySSL bundle configuration silently bypassed in Spring Cloud Gateway7.5 High
- codeastro online classroomCodeAstro Online Classroom updatedetailsfromstudent.php sql injection5.3 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System checkcheckout.php cross site scripting5.3 Medium
- code-projects simple it discussion forumcode-projects Simple IT Discussion Forum add-category-function.php sql injection6.9 Medium
- itsourcecode construction management systemitsourcecode Construction Management System del1.php sql injection5.3 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection9.3 Critical
- lollms, parisneo parisneo/lollms +1 moreStored XSS in parisneo/lollms9.6 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injection9.3 Critical
- unknown yith woocommerce wishlist, yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR6.5 Medium
- unknown yml for yandex marketYML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation6.5 Medium
- japan computer emergency response team coordination center (jpcert/cc) emocheckEmocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the...8.4 High
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection9.3 Critical
- tenda i6, i6 firmware +1 moreTenda i6 HTTP R7WebsSecurityHandlerfunction path traversal6.9 Medium
- wolfsslPrefix-substitution forgery via integer overflow in wolfCrypt CMAC8.2 High
- tenda ac9, ac9 firmware +1 moreTenda AC9 POST Request WizardHandle decodePwd stack-based overflow8.7 High
- tenda ac9, ac9 firmware +1 moreTenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow8.7 High
- d-link dir-513, dlink dir-513 firmware +1 moreD-Link DIR-513 POST Request formAdvanceSetup buffer overflow8.7 High
- rapid7 insight agentInsight Agent Private Key Information Disclosure via Inherited File Permissions6.8 Medium
- d-link dir-513, dlink dir-513 firmware +1 moreD-Link DIR-513 POST Request formSetRoute buffer overflow8.7 High
- d-link dir-513, dlink dir-513 firmware +1 moreD-Link DIR-513 POST Request formSetPassword buffer overflow8.7 High
- openclawOpenClaw assertPublicHostname web-fetch.ts server-side request forgery6.3 Medium
- addfunc head & footer codeAddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields6.4 Medium
- codeastro online classroomCodeAstro Online Classroom takeassessment2.php sql injection5.3 Medium
- wolfsslInteger underflow in X.509 SAN parsing in wolfSSL2.3 Low
- itsourcecode construction management systemitsourcecode Construction Management System del.php sql injection5.3 Medium
- wolfsslImproper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass8.7 High
- wolfsslImproper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates8.6 High
- wolfsslwc_VerifyEccsiHash missing sanity check7.6 High
- code-projects patient record management systemcode-projects Patient Record Management System edit_hpatient.php sql injection5.3 Medium
- code-projects patient record management systemcode-projects Patient Record Management System hematology_print.php sql injection5.3 Medium
- wolfsslwolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag7.6 High
- code-projects simple it discussion forumcode-projects Simple IT Discussion Forum delete-category.php sql injection6.9 Medium
- code-projects simple it discussion forumcode-projects Simple IT Discussion Forum user.php cross site scripting4.8 Medium
- code-projects online library management systemcode-projects Online Library Management System SQL Database Backup File library.sql information disclosure5.3 Medium
- No product listedJeecgBoot SysAnnouncementController improper authorization5.3 Medium
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal6.9 Medium
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter4.3 Medium
- wproyal royal wordpress backup, restore & migration plugin – backup wordpress sites safelyRoyal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter6.1 Medium
- perfmattersPerfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter8.1 High
- arubadev aruba hispeed cacheAruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset4.3 Medium
- usystemsgmbh weblingWebling <= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter6.4 Medium
- codename065 download managerDownload Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal4.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter7.5 High
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter5.3 Medium
- davidanderson wp-optimize – cache, compress images, minify & clean database to boost page speed & performanceWP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation5.4 Medium
- samsung electronics magicinfo 9 serverSamsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability...7.8 High
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection9.3 Critical
- Show moreLoading…