CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- nocobase, nocobase @nocobase/plugin-workflow-request +1 moreNocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins6.4 Medium
- pmmp pocketmine-mpPocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT6.9 Medium
- py-pdf pypdfpypdf has possible long runtimes for wrong size values in cross-reference and object streams6.9 Medium
- openremoteOpenRemote has XXE in Velbus Asset Import7.6 High
- apostrophecms apostrophe, apostrophecms +1 moreInformation Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions5.3 Medium
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS8.7 High
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context5.4 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-0036.1 Medium
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API5.3 Medium
- grafana lokiLoki Path Traversal - CVE-2021-36156 Bypass5.3 Medium
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex8.2 High
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims6.8 Medium
- oauth2-proxyOAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set9.3 Critical
- oauth2-proxy, oauth2 proxy project proxy, red hat ceph storage 9 +2 moreOAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing9.1 Critical
- datasharingframework dsf, dev.dsf dsf-bpe-process-api-v2, dsf-bpe-server +2 moreDSF: Inverted Time Comparison in OIDC JWKS and Token Cache6.3 Medium
- datasharingframework dsf, dev.dsf dsf-bpe-server, dsf-common-jetty +1 more +3 moreDSF: Missing Session Timeout for OIDC Sessions6.8 Medium
- red hat lightspeed core, ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 moreFfmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser6.5 Medium
- grafana pyroscope, red hat multicluster global hub, multicluster global hub 1.7.0 +5 more +7 moreSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection9.1 Critical
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint3.7 Low
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing7.3 High
- google chromeOut of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...6.5 Medium
- google chromeUse after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote...7.5 High
- google chromeUse after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeUse after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...4.3 Medium
- google chromeUse after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeHeap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a...8.3 High
- google chromeUse after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeUse after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a...8.8 High
- google chromeOut of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who...8.3 High
- google chromeInsufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote...3.1 Low
- google chromeInsufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a...3.1 Low
- google chromeUse after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...8.8 High
- google chromeUninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a...8.3 High
- google chromeUse after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had...8.3 High
- google chromeUse after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had...8.3 High
- google chromeOut of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...7.5 High
- google chromeType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeHeap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...8.8 High
- google chromeHeap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...8.8 High
- google chromeUse after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who...8.3 High
- google chromeUse after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeUse after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeUse after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote...8.8 High
- google chromeUse after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeUse after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote...8.8 High
- google chromeUse after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...8.8 High
- google chromeHeap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...4.3 Medium
- google chromeUse after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a...8.3 High
- Show moreLoading…