CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- google chromeHeap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...9.6 Critical
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: gimp: denial of service via specially crafted seattle filmworks file6.1 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: gimp: denial of service via crafted pvr image file5.5 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: gimp: application crashes or information disclosure via crafted icns image files5.0 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: gimp: denial of service due to stack buffer overflow in tim image loader5.0 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: gimp: heap buffer overflow due to integer overflow in fits image loader5.5 Medium
- devolutions serverUsername Enumeration via Timing Attack6.9 Medium
- grafana, grafana correlations +1 moreGrafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record3.3 Low
- sonatype nexus repository, nexus repository manager +1 moreNexus Repository 3 - Hardcoded Credential in Internal Database Component9.2 Critical
- openprojectOpenProject: 2FA OTP Verification Missing Rate Limiting7.4 High
- weblateWeblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision5.0 Medium
- adobe photoshop installerPhotoshop Installer | CWE-427: Uncontrolled Search Path Element8.6 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreSssd: out-of-bounds read in the sssd5.5 Medium
- weblateWeblate: SSRF via the webhook add-on using unprotected fetch_url()4.1 Medium
- weblateWeblate: Privilege escalation in the user API endpoint8.8 High
- weblateWeblate: SSRF via Project-Level Machinery Configuration5.0 Medium
- red hat openshift virtualization 4Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation5.4 Medium
- weblateWeblate: Arbitrary File Read via Symlink7.7 High
- weblateWeblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads5.0 Medium
- weblateWeblate: Remote code execution during backup restoration8.1 High
- sailpoint technologies identityiqSailPoint IdentityIQ Debug UI Incorrect Authorization8.4 High
- weblateWeblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository6.8 Medium
- weblateWeblate has improper access control for the translation memory API4.3 Medium
- weblateWeblate: Improper access control for pending tasks in API3.1 Low
- rapid7 velociraptorVelociraptor Query() Plugin Misapplies Permissions To Orgs8.0 High
- git-for-windows gitGit for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers7.4 High
- mafintosh protocol-buffers-schema parserMafintosh's protocol-buffers-schema is vulnerable to prototype pollution6.5 Medium
- opentext, inc rightfaxDeserialization of untrusted data vulnerability in OpenText, Inc RightFax on Windows, 64 bit, 32...9.3 Critical
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability7.6 High
- plisio accept cryptocurrencies with plisioWordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability7.5 High
- cisco identity services engine, identity services engine software, identity services engine passive identity connector +2 moreCisco Identity Services Engine Authenticated Privilege Escalation Vulnerability6.0 Medium
- cisco unity connectionCisco Unity Connection Reflected Cross-Site Scripting Vulnerability6.1 Medium
- cisco unity connectionCisco Unity Connection SQL Injection Vulnerability4.3 Medium
- cisco unity connectionCisco Unity Connection Open Redirect Vulnerability4.7 Medium
- cisco webex contact centerA vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have...6.1 Medium
- cisco webex meetingsCisco Webex Meetings Certificate Validation Vulnerability9.8 Critical
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Multiple Remote Code Execution Vulnerability9.9 Critical
- cisco thousandeyes enterprise agentCisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability5.5 Medium
- cisco secure web applianceCisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability5.3 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability9.9 Critical
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Path Traversal Vulnerability4.9 Medium
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Remote Code Execution Vulnerability9.9 Critical
- cisco unity connectionCisco Unity Connection Arbitrary File Download Vulnerability6.5 Medium
- cisco unity connectionCisco Unity Connection Arbitrary File Download Vulnerability6.5 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities4.8 Medium
- hashthemes mini ajax cart for woocommerceWordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- emarket-design youtube showcaseWordPress YouTube Showcase plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- deluxethemes userproWordPress Userpro plugin < 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- aveva pipeline simulation 2025AVEVA Pipeline Simulation Missing Authorization9.3 Critical
- Show moreLoading…