CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- notamitgamer mojicMojic: Observable Timing Discrepancy in HMAC Verification4.7 Medium
- node-oauth node-oauth2-server, node-oauth\/oauth2-server +1 more@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes5.9 Medium
- chillicream graphql-platformHot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL Documents9.1 Critical
- netfoundry zrokzrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records5.3 Medium
- netfoundry zrokzrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing7.5 High
- netfoundry zrokzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering6.1 Medium
- dataeaseDataEase: Quartz Deserialization → Remote Code Execution7.5 High
- dataeaseDataEase has SQL Injection via Stacked Queries8.7 High
- quantgeekdev mcp-frameworkMCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport8.7 High
- moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 moreSpdyStream: DOS on CRI8.7 High
- valtimo-platform valtimoValtimo: Sensitive data exposure through inbox message logging in InboxHandlingService4.9 Medium
- dataeaseDataEase has an Arbitrary File Read Vulnerability8.3 High
- dataeaseDataEase SQL Injection Vulnerability8.6 High
- dataeaseDataEase has SQL Injection via Datasource Management8.6 High
- amd athlon™ 3000 series mobile processors with radeon™ graphics, epyc™ 4004 series processors, epyc™ 7002 series processors +59 more +61 moreIncorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could...7.1 High
- amd epyc™ 7003 series processors, epyc™ 8004 series processors, epyc™ 9004 series processors +6 more +8 moreA missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally...5.9 Medium
- snowflake cortex code cliImproper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface8.3 High
- amd epyc™ 7003 series processors, epyc™ 9004 series processors, epyc™ embedded 7003 series processors +1 more +3 moreInsufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with...5.6 Medium
- dataeaseDataEase has SQL Injection via Datasource Save Flow8.7 High
- dataeaseDataEase has SQL Injection through its getFieldEnumObj Endpoint8.7 High
- dell powerscale onefsDell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information...6.6 Medium
- dell powerscale onefsDell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or...4.4 Medium
- dell powerscale onefsDell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or...4.1 Medium
- dataeaseDataEase has SQL Injection in Order By Clause8.7 High
- dataeaseDataEase: SQL Injection in v2 Dataset Export8.7 High
- silverstripe silverstripe-assetsSilverstripe Assets Module has a DBFile::getURL() permission bypass5.3 Medium
- microchip istaxWeak webstax_auth Cookie Authentication Allows Privilege Escalation8.7 High
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 morelibexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted...2.9 Low
- dell alienware 16 area-51 aa16250, alienware 16x aurora ac16251, alienware 18 area-51 aa18250 +117 more +119 moreDell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An...5.1 Medium
- digital knowledge knowledgedeliverKnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value9.1 Critical
- zohocorp manageengine log360Authentication Bypass8.2 High
- onlineoptimisation email encoder – protect email addresses and phone numbersEmail Encoder – Protect Email Addresses and Phone Numbers <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcode6.4 Medium
- @fastify/middie, fastify fastify\/middie +1 more@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option7.4 High
- zohocorp manageengine pam360, manageengine password manager pro +1 moreSQL Injection8.1 High
- @fastify/middie, fastify fastify\/middie +1 more@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes9.1 Critical
- apache airflowApache Airflow: JWT token appearing in logs7.5 High
- @fastify/static, fastify fastify-static +1 more@fastify/static vulnerable to path traversal in directory listing5.3 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modific…5.3 Medium
- @fastify/static, fastify fastify-static +1 more@fastify/static vulnerable to route guard bypass via encoded path separators5.9 Medium
- goodoneuz pay-uzgoodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution10.0 Critical
- sparx systems pty ltd. enterprise architectSparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication5.7 Medium
- onesignal – web push notificationsOneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'3.1 Low
- designinvento directorypress – business directory and classified ad listingDirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'7.5 High
- codesolz better find and replace – ai-powered suggestionsBetter Find and Replace – AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title5.4 Medium
- wso2 identity serverImproper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock6.0 Medium
- wso2 api manager, identity server +1 moreCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites6.1 Medium
- wso2 api managerReflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection6.1 Medium
- wso2 api managerXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files3.5 Low
- wso2 api managerCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval5.4 Medium
- dell storage managerDell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an...7.3 High
- Show moreLoading…