CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- artifex mupdfMuPDF < 1.27 mutool ANSI Injection via Metadata4.8 Medium
- marcobambini gravityCreolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_exec9.3 Critical
- parzivalhack pyspectorPySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code6.9 Medium
Microsoft.Native.Quic.MsQuic.OpenSSLNuGet,Microsoft.Native.Quic.MsQuic.SchannelNuGet +1 moreMsQuic has a Remote Elevation of Privilege Vulnerability9.8 Critical- voidzero-dev vite-plus, voidzero vite\+ +1 more`vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`8.4 High
- honohono - HTML Injection via Improper JSX Attribute Name Handling in SSR5.3 Medium
- froxlorFroxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution10.0 Critical
- luantiLuanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least...8.1 High
- luanti-org luanti, minetest +1 moreLuanti has a mod security sandbox escape9.0 Critical
- luantiLuanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.9.3 Critical
- froxlorFroxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)9.1 Critical
- froxlorFroxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()8.5 High
- froxlorFroxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron7.5 High
- froxlorFroxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing5.0 Medium
- froxlorFroxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()5.4 Medium
- hkuds openharnessOpenHarness Remote Administrative Command Injection via Gateway Handler8.7 High
- hkuds openharnessOpenHarness Path Traversal Information Disclosure via /memory show7.1 High
- No product listedSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in...9.1 Critical
- No product listedSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in...4.7 Medium
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...9.8 Critical
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...9.8 Critical
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...9.8 Critical
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...9.4 Critical
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...7.3 High
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...7.3 High
- No product listedAn issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar...6.5 Medium
fioAzure LinuxA NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing...7.5 High- thedaylightstudio fuel cmsAn issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated...7.1 High
- tp-link systems inc. archer c7 v5 and v5.8, tp-link archer c7 firmware +1 moreUse of weak cryptographic key in TP-Link Archer C75.4 Medium
- ukrsolution barcode scanner (+mobile app) – inventory manager, order fulfillment system, pos (point of sale)Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication9.8 Critical
- yubico libfido2, python-fido2, yubikey-manager +2 moreYubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have...2.9 Low
- owasp bltOWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow8.8 High
- istioIstio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass5.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription4.3 Medium
- ocaml opam, debian linux, red hat enterprise linux 10 +1 more +3 moreIn OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to...7.3 High
- red hat openshift gitopsArgocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation9.1 Critical
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.4.8 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.5.1 Medium
- barracuda networks rmmBarracuda RMM < 2025.2.2 Privilege Escalation via Insecure Directory Permissions8.5 High
- dgraphDgraph: Unauthenticated pprof endpoint leaks admin auth token9.4 Critical
- apostrophecms apostrophe, apostrophecms, apostrophecms sanitize-html +2 moreApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements6.1 Medium
- kimaiKimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate4.3 Medium
- kimaiKimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget5.4 Medium
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf9.1 Critical
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper restriction of the scope of accessible objects in Thymeleaf expressions9.1 Critical
- fastapiexpert python-multipartPython-Multipart affected by Denial of Service via large multipart preamble or epilogue data5.3 Medium
- Show moreLoading…