CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- petjeaf petje.afPetje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action4.3 Medium
- forfront e-shote-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX5.3 Medium
- bappidgreat wp circlifulWP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreStored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.07.1 High
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreIncorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.07.2 High
- aerin quick interest sliderQuick Interest Slider <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting7.2 High
- knighthawk vi: include post byVI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute6.4 Medium
- royalnavneet login as user – switch user & woocommerce login as customerLogin as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie8.8 High
- jdeguest apache::api::password, apache\ +1 moreApache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts7.5 High
- udamadu inquiry form to posts or pagesInquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter4.3 Medium
- maradnsDeadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose...7.5 High
- yuin goldmarkgoldmark vulnerable to Cross-site Scripting (XSS)5.1 Medium
- growi, inc. growiStored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this...4.8 Medium
- omron social solutions co., ltd. powerattendant standard editionVulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application7.8 High
- owen webstackWebStack <= 1.2024 - Unauthenticated Arbitrary File Upload9.8 Critical
- xquic project xquicXQUIC Improper STREAM Frame Validation in Initial/Handshake Packets8.3 High
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution5.4 Medium
- wpengine advanced custom fields (acf®)Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters5.3 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference4.3 Medium
- tokenoftrust age verification & identity verification by token of trustAge Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter7.2 High
- apache airflowApache Airflow: RCE by race condition in example_xcom dag8.1 High
- radare radare2radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()8.4 High
- No product listedAn issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows...7.5 High
- No product listedSlah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id...8.6 High
- No product listedIncorrect access control in the config.php component of Slah v1.5.0 and below allows...7.5 High
- No product listedSlah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability...9.8 Critical
upsonicPyPIUpsonic: remote code execution vulnerability in its MCP server/task creation functionality9.8 Critical- agent-zeroAgent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers...8.6 High
- No product listedLangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server...8.6 High
- No product listedJaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution...7.3 High
- No product listedA prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute...8.0 High
- thedaylightstudio fuel cmsDaylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution ...8.3 High
- No product listedCentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.7.5 High
- No product listedNordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue.7.5 High
github.com/NietThijmen/ShoppingCartGo,govulncheck-vulndbopenSUSE +1 moreNietThijmen ShoppingCart: Command injection in the connect function8.4 High- futo immichimmich: Open Redirect via Shared Album name5.1 Medium
NuGet.CommandLineNuGet,NuGet.PackagingNuGet,NuGet.ProtocolNuGet +2 moreDefense in Depth update for NuGet ClientNo score- boazsegev facil.io, iodine +1 morefacil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition8.7 High
- minioMinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads8.8 High
- microsoft kiotaKiota: Code Generation Literal Injection7.3 High
pyload-ngPyPIpyLoad's Session Not Invalidated After Permission Changes2.9 Low- pyloadpyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)8.8 High
- craftcms cmsCraft CMS has a host header injection leading to SSRF via resource-js endpoint5.5 Medium
- craftcms cmsCraft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations5.5 Medium
- craftcms cmsCraft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action5.3 Medium
github.com/opentofu/opentofuGoOpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses3.1 LowDotNetNuke.CoreNuGetDotNetNuke.Core security code analysis rules triggeredNo score- fatedier frpfrp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control6.5 Medium
- imagemagickImageMagick - Memory Leak in PNG Encoder via MNG Image Writing6.3 Medium
- imagemagickImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact4.8 Medium
- Show moreLoading…