CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- imagemagickImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method4.8 Medium
Magick.NET-Q16-AnyCPUNuGet,Magick.NET-Q16-arm64NuGet,Magick.NET-Q16-HDRI-AnyCPUNuGet +15 more +17 moreImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete6.9 Medium- imagemagickImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing4.8 Medium
- imagemagickImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter4.8 Medium
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33502 (Command Injection)9.3 Critical
- kimipooh list view google calendarList View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description4.4 Medium
- iberezansky 3d flipbook – pdf embedder, pdf flipbook viewer, flipbook image gallery3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure5.3 Medium
- designingmedia eleganzoEleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion6.5 Medium
- wwbn avideoWWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)5.4 Medium
- wwbn avideoWWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters6.5 Medium
novu/apinpmNovu has a XSS sanitization bypass8.1 High- novuhq novuNovu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection8.3 High
- wwbn avideoWWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver5.4 Medium
- wwbn avideoAVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL7.7 High
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo8.1 High
- wwbn avideoAVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses7.1 High
- wwbn avideoAVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover8.1 High
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33039 (SSRF)8.6 High
- oxia-db oxiaOxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles6.9 Medium
- oxia-db oxiaOxia: Server crash via race condition in session heartbeat handling8.7 High
- oxia-db oxiaOxia: OIDC token audience validation bypass via SkipClientIDCheck9.2 Critical
- oxia-db oxiaOxia: Bearer token exposed in debug log messages on authentication failure8.7 High
- giskard, giskard-ai giskard-oss +1 moreGiskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck5.4 Medium
- giskard, giskard-ai giskard-oss +1 moreGiskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check1.0 Low
- wwbn avideoWWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure5.3 Medium
- wwbn avideoWWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators5.4 Medium
- wwbn avideoAVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion5.4 Medium
- wwbn avideoWWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)7.1 High
- wwbn avideoWWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials8.3 High
- b3log siyuanSiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)5.3 Medium
- nuget nugetgalleryNuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation9.6 Critical
- adobe framemakerAdobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)7.8 High
- adobe framemakerAdobe Framemaker | Access of Uninitialized Pointer (CWE-824)5.5 Medium
- adobe framemakerAdobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)7.8 High
- adobe framemakerAdobe Framemaker | Untrusted Search Path (CWE-426)8.6 High
- adobe framemakerAdobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)7.8 High
- adobe framemakerAdobe Framemaker | Out-of-bounds Read (CWE-125)7.8 High
- adobe framemakerAdobe Framemaker | Out-of-bounds Write (CWE-787)7.8 High
- adobe framemakerAdobe Framemaker | Heap-based Buffer Overflow (CWE-122)5.5 Medium
- adobe framemakerAdobe Framemaker | Improper Input Validation (CWE-20)6.3 Medium
- adobe framemakerAdobe Framemaker | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe framemakerAdobe Framemaker | Use After Free (CWE-416)7.8 High
- boidcmsBoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter7.2 High
github.com/patrickhener/goshsGo,github.com/patrickhener/goshs/v2Go +1 moreUnauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint0.0 None- wwbn avideoWWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks10.0 Critical
- wwbn avideoWWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)8.7 High
- wwbn avideoWWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version5.3 Medium
- wwbn avideoWWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens6.5 Medium
- hkuds nanobotnanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)8.0 High
- gomarkdown markdowngithub.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer7.5 High
- Show moreLoading…