CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- vendurehq vendure@vendure/core has a SQL Injection vulnerability9.1 Critical
- fortinet fortiwebA out-of-bounds write vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0...6.7 Medium
- xwiki, xwiki org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore +2 moreXWiki's REST APIs can list all pages/spaces, leading to unavailability6.9 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality6.5 Medium
- authzed spicedbSpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs6.0 Medium
- lfprojects zarfZarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write7.1 High
- s9y serendipitySerendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST7.2 High
- s9y serendipitySerendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain6.9 Medium
- flux159 mcp-server-kubernetesMCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting8.3 High
- jellyfinJellyfin: Potential Application DoS from excessively large SyncPlay group names6.5 Medium
- openremoteOpenRemote is Vulnerable to Expression Injection10.0 Critical
- containers podman, red hat enterprise linux 10, enterprise linux 8 +3 more +5 morePowerShell Command Injection in Podman HyperV Machine4.0 Medium
- goshsgoshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access7.7 High
- jellyfinJellyfin: Potential SSRF + Arbitrary file read via stream argument injection9.3 Critical
- goshsgoshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation6.1 Medium
- goshsgoshs: Empty-username SFTP password authentication bypass in goshs9.8 Critical
- goshsSFTP root escape via prefix-based path validation in goshs8.7 High
- decidimDecidim's comments API allows access to all commentable resources7.5 High
- jellyfinJellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner8.6 High
- decidimDecidim amendments can be accepted or rejected by anyone7.5 High
- jellyfinJellyfin: Potential RCE via subtitle upload path traversal + .strm chain10.0 Critical
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode9.1 Critical
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy: Session cookie not cleared when rendering sign-in page3.5 Low
- saitoha libsixellibsixel: Use-after-free in load_with_gdkpixbuf()7.8 High
- saitoha libsixellibsixel: Use-after-free in sixel_encoder_encode_bytes()7.3 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)7.7 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Uncontrolled Resource Consumption (CWE-400)2.4 Low
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)8.6 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)7.5 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)9.3 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)8.4 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Uncontrolled Resource Consumption (CWE-400)2.4 Low
- saitoha libsixellibsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow7.1 High
- docmostDocmost has cross-page attachment overwrite via flawed attachmentId overwrite validation5.4 Medium
- saitoha libsixellibsixel: Integer overflow leads to Out-of-bounds Read in img2sixel7.1 High
- saitoha libsixellibsixel: Use-After-Free in load_gif()7.0 High
- docmostDocmost page content has stored XSS via unsanitized attachment URLs5.4 Medium
- docmostDocmost vulnerable to stored XSS via MIME type spoofing4.6 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Privilege Escalation via API User Role Modification8.8 High
- docmostDocmost's Public Share Search Exposes Metadata of Restricted Children4.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS has OS Command Injection via export_all_certificates action8.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses7.1 High
- cartasi nexi xpayNexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification5.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes6.5 Medium
- unisys webperfect image suiteUnisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAP7.0 High
- unisys webperfect image suiteUnisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting7.0 High
- adobe incopyInCopy | Out-of-bounds Write (CWE-787)7.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution5.1 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services8.6 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action7.2 High
- Show moreLoading…