CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- hclsoftware velocity, hcltech devops velocity +1 moreHCL DevOps Velocity is susceptible to brute-force attacks6.8 Medium
- artica pandora fms, pandora fms fms +1 moreOS Command Injection in Event Response Execution7.5 High
- artica pandora fms, pandora fms fms +1 moreSQL Injection in Custom Fields leads to Database Compromise8.7 High
- artica pandora fms, pandora fms fms +1 moreSQL Injection in Module Search leads to Database Compromise8.7 High
- artica pandora fms, pandora fms fms +1 moreStored Cross-Site Scripting in Event Comments via Filter Bypass2.1 Low
- artica pandora fms, pandora fms fms +1 moreMissing Authorization in Configuration Ajax Endpoint leads to Information Disclosure8.4 High
- artica pandora fms, pandora fms fms +1 moreOS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution8.7 High
- artica pandora fms, pandora fms fms +1 moreOS Command Injection in Network Report leads to Remote Code Execution8.7 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- artica pandora fms, pandora fms fms +1 moreUnrestricted File Upload in Extension Uploader leads to Remote Code Execution8.6 High
- mongodb c driverbson_validate may skip validation when processing certain inputs5.3 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- utt hiper 1200gwUTT HiPER 1200GW formNatStaticMap strcpy buffer overflow8.7 High
- code-projects simple content management systemcode-projects Simple Content Management System welcome.php cross site scripting4.8 Medium
- keras, keras-team keras-team/keras, red hat openshift ai (rhoai) +3 more +5 moreSafe Mode Bypass in keras-team/keras8.8 High
- code-projects simple content management systemcode-projects Simple Content Management System index.php sql injection6.9 Medium
- apache airflowApache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API8.8 High
- code-projects simple content management systemcode-projects Simple Content Management System login.php sql injection6.9 Medium
- apache airflowApache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI7.5 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp5.5 Medium
- linux, linux kernel +1 moreACPI: EC: clean up handlers on probe failure in acpi_ec_setup()7.0 High
- linux, linux kernel +1 morerds: ib: reject FRMR registration before IB connection is established5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet/sched: sch_hfsc: fix divide-by-zero in rtsc_min()5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet/sched: cls_flow: fix NULL pointer dereference on shared blocks5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet/sched: cls_fw: fix NULL pointer dereference on shared blocks5.5 Medium
- linux, linux kernel +1 morebridge: mrp: reject zero test interval to avoid OOM panic5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +11 more +13 morenet: bonding: fix use-after-free in bond_xmit_broadcast()7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: ipset: drop logically empty buckets in mtype_del5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet/x25: Fix overflow when accumulating packets7.5 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nfnetlink_log: account for netlink header size5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreipv6: avoid overflows in ip6_datagram_send_ctl()5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nf_conntrack_expect: use expect->helper9.8 Critical
- apache skywalking mcpApache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server7.1 High
microsoftsystem64crates.io`microsoftsystem64` was removed from crates.io for malicious codeNo scoresafe-agent-rscrates.io`safe-agent-rs` was removed from crates.io for being affiliated with malicious codeNo scorepretty-changelog-loggercrates.io`pretty-changelog-logger` was removed from crates.io for malicious codeNo score- librenmsLibreNMS: Cross-Site Scripting in ShowConfigController4.6 Medium
- 1panel-dev maxkb1Panel-dev MaxKB MdPreview chat.ts cross site scripting5.1 Medium
- apache storm, apache software foundation storm client +1 moreApache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling8.8 High
- apache storm, apache software foundation storm ui +1 moreApache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI5.4 Medium
- google cloud agent development kit (adk)Remote Code Execution in Google Agent Development Kit (ADK)9.3 Critical
- palo alto networks cortex xdr agentCortex XDR Agent: Local Administrator can disable the agent on Windows4.0 Medium
- palo alto networks autonomous digital experience managerAutonomous Digital Experience Manager: Improper validation of ADEM certificate2.0 Low
- paloaltonetworks cortex xsiam, cortex xsoar, palo alto networks cortex xsiam microsoft teams marketplace +1 more +3 moreCortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration7.2 High
- foxit pdf services apiServer-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API8.5 High
- mcrawfor solstice::session, solstice\ +1 moreSolstice::Session versions through 1440 for Perl generates session ids insecurely9.1 Critical
- zte zxedm iems, zxesm iems +1 moreZTE ZXEDM iEMS product has a password reset vulnerability7.1 High
- totolink a7000rTOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow8.7 High
- Show moreLoading…