CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service7.5 High
- wpxpo post grid gutenberg blocks for news, magazines, blog websites – postxPost Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification5.3 Medium
- shahinurislam career sectionCareer Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion8.8 High
- samba rsync, red hat discovery 2, enterprise linux 10 +24 more +26 moreIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...7.4 High
- specialk prismaticPrismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode7.2 High
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'6.1 Medium
- flippercode wp maps – store locator,google maps,openstreetmap,mapbox,listing,directory & filtersWP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode6.4 Medium
- faridsaniee open-brainOPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting4.4 Medium
- wpdevteam betterdocs – knowledge base docs & faq solution for elementor & block editorBetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- livemesh addons by elementorLivemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter8.8 High
- livemesh addons by elementorLivemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings6.4 Medium
- ascensio onlyoffice documentserverONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing...5.0 Medium
- line corporation client for ios, linecorp line, ly corporation line client for ios +2 moreLINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where...7.1 High
- ascensio onlyoffice desktopeditorsIn ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions...6.2 Medium
- iandunn basic google maps placemarksBasic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update5.3 Medium
- onlineada accessibility suite by ability, incAccessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter6.5 Medium
- acyba acymailing – an ultimate newsletter plugin and marketing automation solution for wordpressAcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- jconti payment gateway for redsys & woocommerce litePayment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation7.5 High
- imprintnext riaxe product customizerRiaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data7.5 High
- rafasashi custom new user notificationCustom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting4.4 Medium
- imprintnext riaxe product customizerRiaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action9.8 Critical
- imprintnext riaxe product customizerRiaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter5.3 Medium
- eaton intelligent power protector, ipp software +1 moreEaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable...7.8 High
- eaton intelligent power protector, ipp software +1 moreA security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an...5.9 Medium
- eaton intelligent power protector, ipp software +1 moreEaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow...5.7 Medium
- wago smart designerWago: Vulnerability in Smart Designer Web-Application4.3 Medium
- eaton intelligent power protector, ipp software +1 moreEaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against...6.5 Medium
- eaton intelligent power protector, ipp software +1 moreDue to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is...6.0 Medium
- festo mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd, mse6-c2m-5000-fb36-d-m-rg-bar-m12l5-agd, mse6-c2m-5000-fb43-d-m-rg-bar-m12l4-mq1-agd +9 more +11 moreFesto: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions8.8 High
- arcserve udp consoleUDP Console provided by Arcserve contains an incorrectly specified destination in a communication...5.1 Medium
- siteorigin vantageVantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content6.4 Medium
- fahadmahmood wp docsWP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'6.4 Medium
- kpumuk codecolorerCodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode6.1 Medium
- openfind mailaudit, mailgates +1 moreOpenfind｜MailGates/MailAudit - CRLF Injection8.7 High
- radare radare2radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB...7.4 High
- openfind mailaudit, mailgates +1 moreOpenfind｜MailGates/MailAudit - Stack-based Buffer Overflow9.3 Critical
- gn themes shortcodes ultimate – content elementsWP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode6.4 Medium
- hgiga isherlock-audit-4.5, isherlock-audit-5.5, isherlock-base-4.5 +1 more +3 moreHGiga｜iSherlock - OS Command Injection9.3 Critical
- asus member center(华硕大厅)A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member...5.4 Medium
- asus driverhubAn Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub...5.4 Medium
- simopro technology winmatrixSimopro Technology｜WinMatrix - Missing Authentication9.3 Critical
- wgerwger: Stored XSS via Unescaped License Attribution Fields5.1 Medium
- wgerwger has Broken Access Control in the Global Gym Configuration Update Endpoint7.6 High
- renovatebot renovateRenovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance6.8 Medium
- ffmpegFFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common...4.9 Medium
- theopolis uefi-firmware-parserUEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`9.8 Critical
- theopolis uefi-firmware-parserUEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable9.8 Critical
- futtta wp youtube lyteWP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode6.4 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)4.8 Medium
- langchain-ai langsmith-sdkLangSmith SDK: Streaming token events bypass output redaction5.3 Medium
- Show moreLoading…