CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- espocrmEspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access3.5 Low
- aandrew-me ytdownloaderaandrew-me ytDownloader Error Details Panel createTextNode cross site scripting5.3 Medium
- craftcms commerceCraft Commerce: Blind SQL Injection via hasVariant/hasProduct8.7 High
- craftcms commerceCraft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget7.7 High
dbgate-webnpmDbGate SVG Icon String FontIcon.svelte cross site scripting5.1 Medium- craftcms commerceCraft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments1.7 Low
- espocrmEspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field4.6 Medium
- imagemagickImageMagick: Heap BufferOverflow write of single zero byte when parsing XML5.3 Medium
- enchant97 note-markNote Mark has Broken Access Control on Asset Download5.9 Medium
- enchant97 note-markNote Mark: Username Enumeration via Login Endpoint Timing Side-Channel3.7 Low
- No product listedDbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgery5.3 Medium
- enchant97 note-markNote Mark has Stored XSS via Unrestricted Asset Upload8.7 High
- foxcpp maddyMaddy Mail Server: LDAP Filter Injection via Unsanitized Username8.2 High
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bomb8.7 High
- espocrmEspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation4.3 Medium
- code-projects easy blog sitecode-projects Easy Blog Site post.php sql injection5.3 Medium
- imagemagickImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds5.1 Medium
- imagemagickImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds5.9 Medium
- codeastro online job portalCodeAstro Online Job Portal Delete Job Posting job-delete.php access control5.3 Medium
- nimiq core-rs-albatross, proof-of-stake +1 moreNimiq: Remote crash via off-by-one signer bounds check in proposal buffer7.5 High
- tenda f456Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow8.7 High
- tenda f456Tenda F456 qossetting fromqossetting stack-based overflow8.7 High
- tenda f456Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow8.7 High
- pachnoPachno 1.0.6 FileCache Deserialization Remote Code Execution9.3 Critical
- pancho pachnoPachno 1.0.6 Authentication Bypass via runSwitchUser()7.1 High
- pachnoPachno 1.0.6 Wiki TextParser XML External Entity Injection9.3 Critical
- pachnoPachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints5.3 Medium
- pachnoPachno 1.0.6 Unrestricted File Upload Remote Code Execution8.7 High
- pachnoPachno 1.0.6 Open Redirection via return_to Parameter7.1 High
- pachnoPachno 1.0.6 Stored Cross-Site Scripting via Multiple Parameters5.1 Medium
- tenda f456Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflow8.7 High
- jqlang jqjq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow8.2 High
- tenda f456Tenda F456 exeCommand fromexeCommand stack-based overflow8.7 High
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection9.3 Critical
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +22 more +24 moreUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 Critical
- totolink a3002muTotolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow8.7 High
- abb ac800m (system 800xa), s+ operations, symphony plus mr (melody rack) +1 more +3 moreDenial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 618507.1 High
- phpgurukul daily expense tracking systemPHPGurukul Daily Expense Tracking System register.php sql injection6.9 Medium
- uclouvain openjpeguclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow4.8 Medium
kernel-livepatch-MICRO-6-0_Update_18SUSESecurity update for kernel-livepatch-MICRO-6-0_Update_18No scorekernel-livepatch-MICRO-6-0_Update_18SUSESecurity update for kernel-livepatch-MICRO-6-0_Update_18No score- prometheusPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 Medium
- external-secrets external secrets operator, external-secrets +1 moreExternal Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine7.1 High
- nimiq core-rs-albatross, proof-of-stake +1 morenimiq-consensus panics via RequestMacroChain micro-block locator5.3 Medium
- simple-git project simple-git, red hat build of keycloak, enterprise linux 8 +5 more +7 moresimple-git has Command Execution via Option-Parsing Bypass8.1 High
- decidimDecidim has a Cross-site scripting (XSS) vulnerability via user name field9.3 Critical
- churchcrm crmChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php5.3 Medium
- itsourcecode construction management systemitsourcecode Construction Management System equipments.php sql injection5.3 Medium
- itsourcecode construction management systemitsourcecode Construction Management System employees.php sql injection5.3 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- Show moreLoading…