CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- splunk mcp serverSensitive Information Disclosure in ''_internal'' index in Splunk MCP Server app7.2 High
- splunk, splunk cloud platform, enterprise +2 moreImproper Access Control in Data Model Acceleration in Splunk Enterprise4.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreImproper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise7.1 High
- splunk, splunk cloud platform, enterprise +2 moreImproper Input Validation during User Account Creation in Splunk Enterprise6.6 Medium
- grafana, grafana alerting +1 moreGrafana Alerting Editors can edit destination of webhooks they did not create1.3 Low
- hp inc deskjet 2800e all-in-one printer series, deskjet 4200 all-in-one printer series, deskjet 4200e all-in-one printer series +3 more +5 moreCertain HP DeskJet All In One (AIO) Devices – Potential Remote Code Execution & Potential Buffer Overflow8.7 High
- hp inc. omen gaming hubHP System Optimizer - Escalation of Privilege7.3 High
- apache airflowApache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access6.5 Medium
- lenovo software fixDuring an internal security assessment, a potential vulnerability was discovered in Lenovo...8.5 High
- lenovo software fixDuring an internal security assessment, a potential vulnerability was discovered in Lenovo...5.2 Medium
- lenovo software fixDuring an internal security assessment, a potential vulnerability was discovered in Lenovo...7.0 High
- lenovo service bridgeA potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain...5.4 Medium
- lenovo diagnostics, hardware scan, vantage +2 moreDuring an internal security assessment, a potential vulnerability was discovered in Lenovo...6.9 Medium
- woobeewoo product pricing table by woobewooProduct Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion6.1 Medium
- mattermost, mattermost server +1 moreRace Condition in Guest Magic Link Authentication Allows Token Reuse6.5 Medium
- apache skywalkingApache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.7.5 High
- long watch studio myrewardsWordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability4.3 Medium
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability8.1 High
- majestic support supportWordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability5.3 Medium
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability8.1 High
- wp royal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability5.3 Medium
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability7.6 High
- beaver builder builderWordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability8.5 High
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability5.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability5.4 Medium
- villatheme compeWordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- elzahlan categories imagesWordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themegrill demo importerWordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability5.3 Medium
- bplugins 3d viewer – embed 3d modelsWordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability4.3 Medium
- blockart magazine blocksWordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability4.3 Medium
- mattermost, mattermost server +1 moreCSRF Protection Bypass Allows Updating a User's Authentication Method6.8 Medium
- @fastify/reply-from @fastify/http-proxy, @fastify/reply-from, fastify reply-from +3 more +5 more@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers9.0 Critical
- mattermost, mattermost server +1 moreConnected Workspaces: Malicious remote server can manipulate arbitrary user's status2.7 Low
- fastify @fastify/express, fastify\/express +1 more@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes9.1 Critical
- bosch divar ip 7000 r2, divar ip all-in-one 5000, divar ip all-in-one 7000 +5 more +7 moreUncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows...7.5 High
- fastify @fastify/express, fastify\/express +1 more@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)9.1 Critical
- legion of the bouncy castle inc. bc-java, red hat openshift developer tools and services, openshift developer tools and services 4.12 +30 more +32 moreUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.8.7 High
- legion of the bouncy castle inc. bc-java, bcpix-lts, bcpkix-fips +43 more +45 morePKIX draft CompositeVerifier accepts empty signature sequence as valid.6.3 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +29 more +31 moreNon-constant time comparisons risk private key leakage in FrodoKEM.8.9 High
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +42 more +44 moreLDAP Injection Vulnerability in LDAPStoreHelper.java5.5 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +44 more +46 moreGOSTCTR implementation unable to process more than 255 blocks correctly9.3 Critical
- hcl aionInternal Filesystem Exploration vulnerability2.9 Low
- dgwyer power charts – responsive beautiful charts & graphsPower Charts <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- onthemapmarketing accessibly – wordpress website accessibilityAccessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API7.2 High
- webmindpt wm jqmathWM JqMath <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute6.4 Medium
- wpmet metform proMetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'5.3 Medium
- faridsaniee open-brainOPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery6.1 Medium
- colbeinformatik katalogportal-pdf-sync widgetKatalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action5.3 Medium
- visaacceptancesolutions visa acceptance solutionsVisa Acceptance Solutions <= 2.1.0 - Unauthenticated Authentication Bypass via Billing Email9.8 Critical
- coachific shortcodeCoachific Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute6.4 Medium
- Show moreLoading…