CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- No product listedVtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager...5.4 Medium
- gonitro nitro pdf proNitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the...8.4 High
- gonitro nitro pdf proNitro PDF Pro for Windows 14.41.1.4 contains a NULL pointer dereference vulnerability in the...7.5 High
- gonitro nitro pdf proA NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a...7.5 High
- No product listedCross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up...5.4 Medium
- No product listedIn Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was...8.8 High
- tenda f451, f451 firmware +1 moreTenda F451 AdvSetWan fromAdvSetWan stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 L7Im frmL7ImForm stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 SetIpBind fromSetIpBind stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 qossetting fromqossetting stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflow8.7 High
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setLedCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection9.3 Critical
- chatboxai chatboxchatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection6.9 Medium
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication6.9 Medium
- varnish-software varnish cache, vinyl-cache vinyl cache +1 moreVarnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after...4.0 Medium
- varnish-software varnish enterpriseVarnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic...4.0 Medium
- varnish-software varnish cache, varnish enterprise, vinyl-cache vinyl cache +2 moreVarnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow...4.0 Medium
- mesa3d mesaIn Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU...8.1 High
- libexif project libexifIn libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote...4.0 Medium
- libexif project libexifIn libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could...4.0 Medium
- myt project myt, myt project management +1 moreMyT-PM 1.5.1 SQL Injection via Charge[group_total] Parameter7.1 High
- nsasoft blueauditorBlueAuditor 1.7.2.0 Buffer Overflow Denial of Service via Registration Key6.9 Medium
- nsasoft spotftp, nsauditor spotftp password recover +1 moreSpotFTP Password Recover 2.4.2 Denial of Service via Name Field6.9 Medium
- dolibarr erp-crm, erp\/crm +1 moreDolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter8.8 High
- codefuture image hosting script, davidtavarez cf image hosting script +1 moreCF Image Hosting Script 1.6.5 Unauthorized Database Access9.3 Critical
- heatmiser wifi thermostatHeatmiser Wifi Thermostat 1.7 Cross-Site Request Forgery5.3 Medium
- ebrigade, ebrigade erp +1 moreeBrigade ERP 4.5 SQL Injection via pdf.php7.1 High
- across dr-810Across DR-810 ROM-0 Unauthenticated File Disclosure8.7 High
- interference-security echo mirageEcho Mirage 3.1 Stack Buffer Overflow via Rules Action Field8.6 High
- impresscmsImpressCMS 1.3.11 SQL Injection via bid Parameter7.1 High
- divxtodvd easy video to ipod converterEasy Video to iPod Converter 1.6.20 Local Buffer Overflow SEH8.6 High
- gurkanuzunca newsbull, newsbull haber script +1 moreNewsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameter7.1 High
- victoralagwu cmssiteCMSsite 1.0 SQL Injection via category.php8.8 High
- r-project r, red hat enterprise linux ai (rhel ai) 3 +1 moreR 3.4.4 Local Buffer Overflow Windows XP SP38.6 High
- montala resourcespaceResourceSpace 8.6 SQL Injection via collection_edit.php7.1 High
- faleemi desktop softwareFaleemi Desktop Software 1.8 Local Buffer Overflow SEH DEP Bypass8.6 High
- html5videoplayer html5 video playerHTML5 Video Player 1.2.5 Local Buffer Overflow Non-SEH8.6 High
- r-project rguiRGui 3.5.0 Local Buffer Overflow SEH DEP Bypass8.6 High
- adianti frameworkAdianti Framework 5.5.0 and 5.6.0 SQL Injection via Profile7.1 High
- dynalon mdwikiMDwiki Cross-Site Scripting via Location Hash Parameter5.1 Medium
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication6.9 Medium
- dromara warm-flowDromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection5.3 Medium
- tenda f451, f451 firmware +1 moreTenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 httpd addressNat fromAddressNat stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 httpd L7Prot frmL7ProtForm stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 httpd WrlclientSet stack-based overflow8.7 High
- tenda f451, f451 firmware +1 moreTenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflow8.7 High
- linux, linux kernel +1 morebpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR7.8 High
- astrbotdevs astrbotAstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery5.3 Medium
- Show moreLoading…