CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- fortinet forticlientemsA improper neutralization of special elements used in an sql command ('sql injection')...6.2 Medium
- schneider electric easergy micom p14x, easergy micom p24x, easergy micom p341 +9 more +11 moreCWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access...6.9 Medium
- red hat build of keycloak, build of keycloak 26.4.12 +1 moreOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page6.9 Medium
- ivanti neurons for itsm (cloud), neurons for itsm (on-premise) +1 moreStored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to...5.4 Medium
- ivanti neurons for itsm (cloud), neurons for itsm (on-premise) +1 moreImproper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote...5.7 Medium
- autodesk fusionStored Cross-Site Scripting (XSS) Vulnerability in Assembly Component Name7.1 High
- autodesk fusionStored Cross-Site Scripting (XSS) Vulnerability in Design Name7.1 High
- autodesk fusionStored Cross-Site Scripting (XSS) Vulnerability in Assembly Variant Name7.1 High
- progress software corporation openedgeRecoverable obfuscation using the OECH1 prefix encoding in OpenEdge9.1 Critical
- progress software corporation openedgeUnauthorized Arbitrary File Read via RMI in AdminServer Interface8.2 High
- upkeeper solutions instant privilege access.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant...7.4 High
core2crates.iocore2 is unmaintained, all versions yankedNo score- rustls webpkirustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass2.1 Low
- rustls webpkirustls webpki Name Constraints URI Validation Bypass2.1 Low
- mozilla thin-vec, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreUse-After-Free and Double-Free in IntoIter::drop when element drop panics5.1 Medium
- upkeeper solutions instant privilege accessImproper neutralization of argument delimiters in a command ('argument injection') vulnerability...9.0 Critical
- kiuwan sastImproper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST5.4 Medium
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String Parsing7.4 High
- mcphubAuthentication bypass in MCPHub5.3 Medium
- siemens industrial edge management pro v1, industrial edge management pro v2, industrial edge management virtual +2 moreA vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 ...5.1 Medium
- siemens ruggedcom crossbow secure access manager primary (sam-p)A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) ...8.7 High
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do...8.7 High
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected...6.9 Medium
- siemens software center, simcenter 3d, simcenter femap +5 more +7 moreA vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2),...6.3 Medium
- apache apisixApache APISIX: Openid-connect `tls_verify` field is disabled by default7.5 High
- apache pdfbox, apache software foundation pdfbox examples +1 moreApache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code4.3 Medium
- apache apisixApache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP5.3 Medium
- apache apisixApache APISIX: forward auth plugin allows header injection9.1 Critical
- arraytics eventin – event calendar, event registration, tickets & booking (ai powered)Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure4.3 Medium
- vendidero germanized for woocommerceGermanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- shapedplugin smart post show – post grid, post carousel & slider, and list category postsSmart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection7.2 High
- wpcodefactory wholesale products dynamic pricing management woocommerceWholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute6.4 Medium
- surbma | booking.com shortcodeSurbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- mervinpraison praisonaiPraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence9.1 Critical
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box7.2 High
- wp media backwpup – wordpress backup & restore pluginBackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter7.2 High
- talend jobserver, runtime +1 moreCritical Security fix for the Talend JobServer and Talend Runtime9.8 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI has Blind Server Side Request Forgery in its Image Edit Functionality4.3 Medium
- 1panel-dev maxkbMaxKB: Stored XSS via Unsanitized iframe_render Parsing5.1 Medium
- crocoblock jetengineJetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter7.5 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion9.1 Critical
- 1panel-dev maxkbMaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering5.1 Medium
- wkentaro gdowngdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall6.5 Medium
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets6.9 Medium
- mitmproxyProxyAuth Addon LDAP Injection in mitmproxy4.8 Medium
- asynchttpclient async-http-clientAsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects6.8 Medium
fat_free_crmRubyGemsFat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID2.1 Low- kimaiKimai before 2.53.0 API Token Leakage via Invoice Template2.0 Low
- kimaiKimai before 2.53.0 Open Redirect via RelayState5.3 Medium
- Show moreLoading…