CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- No product listedSourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the...2.7 Low
- No product listedSourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the...2.7 Low
- No product listedSourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the...2.7 Low
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access7.8 High
- x.org x server, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreXorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling6.1 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption7.8 High
- x.org x server, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreXwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.6.1 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling7.8 High
- microsoft .net, .net framework, .net 10.0 +15 more +17 more.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability7.5 High
- microsoft .net, microsoft visual studio 2026 version 18.4, microsoft .net 10.0 +14 more +16 more.NET and Visual Studio Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more.NET Spoofing Vulnerability7.5 High
- No product listedAn issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary...9.8 Critical
- No product listedA Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11...6.5 Medium
- microsoft .net, powershell 7.6, microsoft .net 10.0 +11 more +13 more.NET Denial of Service Vulnerability7.5 High
- No product listedAn issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in...9.8 Critical
- leafletjs leafletLeaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the...6.1 Medium
- No product listedA side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as...4.6 Medium
- No product listedIn manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms...6.1 Medium
- No product listedIn manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability...9.8 Critical
- No product listedIn manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS)...6.1 Medium
- No product listedA SQL injection vulnerability exists in the School Management System (version 1.0) by...9.8 Critical
- No product listedalandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public...6.1 Medium
- No product listedImproper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store...9.8 Critical
@openai/codexnpmOpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files9.8 Critical- jqlang jqjq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input2.9 Low
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 morejq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed7.5 High
- nerdvana crypt::secretbuffer, crypt\ +1 moreCrypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks7.5 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter6.1 Medium
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 morejq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers6.9 Medium
- jqlang jqjq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure6.1 Medium
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +21 more +23 moreIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 High
- jqlang jqjq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()6.2 Medium
- imagemagickImageMagick: Off-by-One in MSL decoder could result in crash6.2 Medium
- imagemagickImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values5.5 Medium
- imagemagickImageMagick: Heap out-of-bounds write in JP2 encoder5.5 Medium
- imagemagickImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float5.5 Medium
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreA series of Improper Input Validation vulnerabilities could allow a Command Injection by a...9.8 Critical
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreA malicious actor with access to the UniFi Play network could exploit a Path Traversal...9.8 Critical
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreAn Improper Access Control vulnerability could allow a malicious actor with access to the UniFi...7.5 High
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreAn Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi...7.5 High
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreAn Improper Access Control vulnerability could allow a malicious actor with access to the UniFi...9.8 Critical
- imagemagickImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders6.2 Medium
- nocobase plugin-workflow-javascriptnocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox6.9 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 +2 moreImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()7.5 High
- imagemagickImageMagick has an Out-of-Bounds read via -sample operation5.5 Medium
- No product listedHummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery5.1 Medium
- imagemagickImageMagick: Stack Overflow via Recursive FX Expression Parsing5.5 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 +2 moreImageMagick has a Heap Buffer Overflow via MVG decoder7.5 High
- aandrew-me ytdownloaderaandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection4.8 Medium
- espocrmEspoCRM: Email importEml can import and delete another user's attachment by raw fileId5.4 Medium
- Show moreLoading…