CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- webonyx graphql-phpgraphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation6.9 Medium
- 1panel-dev maxkbMaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing3.1 Low
- linuxfoundation sigstore timestamp authority, sigstore timestamp-authority +1 moreSigstore Timestamp Authority has Improper Certificate Validation in verifier5.5 Medium
- 1panel-dev maxkbMaxKB has CSV Injection in its Application Chat Export Functionality5.3 Medium
- 1panel-dev maxkbStored XSS via Eval Injection in EchartsRander Component6.9 Medium
- 1panel-dev maxkbMaxKB has Stored XSS via ChatHeadersMiddleware6.9 Medium
- 1panel-dev maxkbMaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect6.3 Medium
- nestjs nestNest: DoS via Recursive handleData in JsonSocket (TCP Transport)7.5 High
- 1panel-dev maxkbMaxKB: Sandbox escape via LD_PRELOAD bypass6.3 Medium
- sap human capital management, sap se human capital management for sap s/4hana +1 moreInformation Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA6.5 Medium
- sap hana cockpit, hana database explorer, sap se hana cockpit and hana database explorer +2 moreInformation Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer5.0 Medium
- sap se business analytics and sap content managementMissing Authorization check in SAP Business Analytics and SAP Content Management6.5 Medium
- 1panel-dev maxkbMaxKB: SSRF via sandbox network hook bypass5.0 Medium
- sap netweaver application server abapOpen Redirect vulnerability in SAP NetWeaver Application Server ABAP6.1 Medium
- sap se erp and sap s/4 hana (private cloud and on-premise)Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)7.1 High
- sap se businessobjects business intelligence platformReflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform4.1 Medium
- sap se business planning and consolidation and sap business warehouseSQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse9.9 Critical
- sap manage reference structures, sap se s/4hana frontend odata service (manage reference structures) +1 moreMissing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)6.5 Medium
- sap se s/4hana backend odata service (manage reference structures)Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)6.5 Medium
- sap se s/4hana odata service (manage reference equipment)Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment)6.5 Medium
- sap se s/4hana odata service (manage technical object structures)Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures)4.3 Medium
- sap se landscape transformationCode Injection vulnerability in SAP Landscape Transformation2.0 Low
- sap netweaver application server java, sap se netweaver application server java (web dynpro java) +1 moreCode Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)6.1 Medium
- sap se s/4hana (private cloud and on-premise)Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise)4.9 Medium
- sap se material master applicationMissing Authorization check in Material Master Application4.3 Medium
- sap se businessobjects business intelligence platformInsecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform4.2 Medium
- sap se supplier relationship management (sicf handler in srm catalog)Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)6.1 Medium
- succinct sp1SP1 V6 Recursion Circuit Row-Count Binding Gap8.9 High
- minioMinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads8.8 High
@aiondadotcom/mcp-sshnpmSSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh8.7 High- monetrmonetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation8.2 High
- haris-musa excel-mcp-serverImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server9.4 Critical
- 1panel-dev maxkbMaxKB: RCE via MCP stdio command injection in workflow engine4.6 Medium
- snipeitapp snipe-itAn improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0...6.5 Medium
- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php8.1 High
- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php8.1 High
- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php8.8 High
- No product listedKrayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead...7.1 High
krayin/laravel-crmPackagistWebkul Krayin CRM has Server-Side Request Forgery (SSRF)8.5 High- No product listedAn authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of...9.9 Critical
- No product listedSourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the...2.7 Low
- No product listedSourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the...2.7 Low
- No product listedSourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the...2.7 Low
- No product listedSourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code...2.7 Low
- No product listedSourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL...2.7 Low
- No product listedSourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL...2.7 Low
- No product listedSourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL...2.7 Low
- No product listedSourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL...2.7 Low
- No product listedSourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL...2.7 Low
- No product listedSourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file ...2.7 Low
- Show moreLoading…