CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)7.1 High
- adobe incopyInCopy | Out-of-bounds Read (CWE-125)7.8 High
- octobercms octoberOctober CMS has Stored XSS via SVG Filter Bypass4.8 Medium
- octobercms octoberOctober CMS: Environment Variable Exfiltration via INI Parser Interpolation4.9 Medium
- it-novum openitcockpitopenITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion8.8 High
- kyvernokyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token8.1 High
- kyvernoKyverno before 1.16.2 SSRF via APICall Feature6.9 Medium
- kyvernoKyverno before 1.18.0 Server-Side Request Forgery via apiCall8.3 High
- emilstenstrom justhtmljusthtml before 1.16.0 Multiple Security Issues via Sanitization9.3 Critical
- openstack keystoneOpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean7.7 High
- composer, red hat hardened images +1 moreComposer is vulnerable to Command Injection via Malicious Perforce Repository7.8 High
- composer, red hat hardened images +1 moreComposer has Command Injection via Malicious Perforce Reference8.8 High
- adonisjs core, http-server, http-core +2 more@adonisjs/http-server has an Open Redirect vulnerability6.1 Medium
- free5gcfree5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors6.9 Medium
- free5gcfree5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions8.7 High
- free5gcfree5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions8.7 High
- free5gc, free5gc webconsole +1 morefree5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions8.7 High
- free5gcFree5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication7.5 High
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe experience manager 6.5, experience manager 6.5 lts, experience manager as a cloud service +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe photoshop, photoshop desktop +1 morePhotoshop Desktop | Out-of-bounds Read (CWE-125)7.8 High
- adobe illustrator, illustrator desktop 2025, illustrator desktop 2026 +2 moreIllustrator | Out-of-bounds Write (CWE-787)7.8 High
- adobe experience manager, experience manager screens +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager screens +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager screens +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager screens +1 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- purestorage flashbladeSensitive Information Logging Vulnerability in FlashBlade8.5 High
- cohere cohere-terrariumCVE-2026-57529.3 Critical
- purestorage flasharrayUnder certain administrative conditions, FlashArray Purity may apply snapshot retention policies...6.9 Medium
- data recognition corporation central office services - content hosting componentUnauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)7.5 High
- radware alteon vadcRadware Alteon has a reflected XSS vulnerability6.1 Medium
- octobercms octoberOctober CMS has Stored XSS via Event Log Mail Preview5.1 Medium
- adobe connect, connect desktop application +1 moreAdobe Connect | Deserialization of Untrusted Data (CWE-502)9.6 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Cross-site Scripting (XSS) (CWE-79)8.7 High
- adobe connect, connect desktop application +1 moreAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)6.1 Medium
- adobe connect, connect desktop application +1 moreAdobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)9.3 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)6.1 Medium
- adobe connect, connect desktop application +1 moreAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)9.3 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Deserialization of Untrusted Data (CWE-502)9.3 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)9.3 Critical
- octobercms octoberOctober CMS has Stored XSS in its Backend Editor Markup Classes5.1 Medium
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe experience manager 6.5, experience manager 6.5 lts, experience manager as a cloud service +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreUniversal Plug and Play (upnp.dll) Information Disclosure Vulnerability5.5 Medium
- Show moreLoading…