CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- apache log4j, apache software foundation log4j json template layout +1 moreApache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout6.3 Medium
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters6.9 Medium
- apache log4j, apache software foundation log4j 1 to log4j 2 bridge +1 moreApache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters6.9 Medium
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility6.9 Medium
- go-vikunja vikunjaVikunja's Scoped API tokens with projects.background permission can delete project backgrounds4.3 Medium
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass6.3 Medium
@vitejs/plugin-rscnpm@vitejs/plugin-rsc has a Denial of Service with React Server Components7.5 High- hdfgroup hdf5HDF5 H5T__ref_mem_setnull Heap Buffer Overflow5.5 Medium
- go-vikunja vikunjaVikunja has a File Size Limit Bypass via Vikunja Import5.4 Medium
- go-vikunja vikunjaVikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output4.1 Medium
- go-vikunja vikunjaVikunja has HTML Injection via Task Titles in Overdue Email Notifications5.4 Medium
- go-vikunja vikunjaVikunja has an Algorithmic Complexity DoS in Repeating Task Handler6.5 Medium
- go-vikunja vikunjaVikunja has Missing Authorization on CalDAV Task Read4.3 Medium
- go-vikunja vikunjaVikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout5.9 Medium
- go-vikunja vikunjaVikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug4.3 Medium
- go-vikunja vikunjaVikunja Affected by Privilege Escalation via Project Reparenting8.3 High
- go-vikunja vikunjaVikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade6.5 Medium
- go-vikunja vikunjaVikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path7.4 High
- systemdIn systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call...6.2 Medium
- systemdIn nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted...6.4 Medium
- systemdIn udev in systemd before 260, local root execution can occur via malicious hardware devices and...6.4 Medium
- systemdIn systemd 259 before 260, there is local privilege escalation in systemd-machined because...6.7 Medium
- couchcmsCouchCMS Privilege Escalation via f_k_levels_list Parameter8.6 High
- systemdIn systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes...4.7 Medium
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +2 more +4 moreDuplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail8.8 High
- nasm, nasm netwide assembler +1 moreCVE-2026-60697.5 High
- nasm, nasm netwide assembler +1 moreCVE-2026-60689.6 Critical
- nasm, nasm netwide assembler +1 moreCVE-2026-60675.5 Medium
- zootemplate ceratoWordPress Cerato theme <= 2.2.18 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cactusthemes videoproWordPress VideoPro theme <= 2.3.8.1 - Local File Inclusion vulnerability8.1 High
- case themes theme userWordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability7.5 High
- acronis true image, true image oem +1 moreLocal privilege escalation due to improper handling of environment variables. The following...7.8 High
- canonical jujuJuju CloudSpec API could leak senstive information9.9 Critical
- canonical jujuJuju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map6.1 Medium
- egate atom 3x projectorSecurity Misconfiguration Vulnerability in Atom 3x Projector8.7 High
- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM7.5 High
- linux, linux kernel +1 moreusb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()5.5 Medium
- rocketgenius gravity smtpGravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall7.1 High
- synology ssl vpn clientA plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684...8.1 High
- synology ssl vpn clientA files or directories accessible to external parties vulnerability in Synology SSL VPN Client...6.5 Medium
- falkordb browserUnauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution9.8 Critical
- musl libcmusl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity4.8 Medium
- code-projects vehicle showroom management systemcode-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injection6.9 Medium
- checkmkPotential livestatus injection in prediction graph page5.3 Medium
- checkmkPotential livestatus injection in notification test5.1 Medium
- checkmkLivestatus injection in monitoring quicksearch5.3 Medium
- code-projects vehicle showroom management systemcode-projects Vehicle Showroom Management System AddVehicleFunction.php sql injection6.9 Medium
- code-projects vehicle showroom management systemcode-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injection6.9 Medium
- code-projects vehicle showroom management systemcode-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting5.3 Medium
- code-projects vehicle showroom management systemcode-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scripting5.3 Medium
- Show moreLoading…