CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- josdejong mathjs, red hat developer hub, enterprise linux 10 +5 more +7 moreMath.js: Unsafe object property setter in mathjs8.8 High
- authlibAuthlib: Cross-site request forging when using cache5.4 Medium
- angularAngular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server8.7 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat cryostat 4 +20 more +22 moreprotobufjs has an arbitrary code execution issue9.4 Critical
- gfi software helpdeskVision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via...4.3 Medium
- opencryptokiopenCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c6.8 Medium
- sagredo qmailsagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in...8.1 High
- flowiseai flowiseFlowise: AccountService resetPassword Authentication Bypass Vulnerability7.7 High
- flowiseai flowise, flowise-components +1 moreFlowise: Cypher Injection in GraphCypherQAChain9.3 Critical
- flowiseai flowiseFlowise: Password Reset Link Sent Over Unsecured HTTP7.5 High
- flowiseai flowiseFlowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow7.7 High
- flowiseai flowise, flowise-components +1 moreFlowise: APIChain Prompt Injection SSRF in GET/POST API Chains7.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass (TOCTOU & Default Insecure)7.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox7.1 High
- flowiseai flowiseFlowise: File Upload Validation Bypass in createAttachment7.1 High
- flowiseai flowiseFlowise: Flowise Parameter Override Bypass Remote Command Execution7.7 High
- flowiseai flowiseFlowise: Sensitive Data Leak in public-chatbotConfig7.7 High
- flowiseai flowiseFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association8.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: Code Injection in CSVAgent leads to Authenticated RCE9.4 Critical
- flowiseai flowiseFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.8.3 High
- istioIstio Vulnerable to SSRF via RequestAuthentication jwksUri5.0 Medium
- patrickjuchli basic-ftpbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()7.5 High
- kyvernoKyverno before 1.16.4 Credential Leak via apiCall8.3 High
- kyvernoKyverno: ServiceAccount token leaked to external servers via apiCall service URL8.1 High
- kyvernoKyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)7.7 High
- ngtcp2, red hat enterprise linux 10, enterprise linux 8 +2 more +4 morengtcp2 has a qlog transport parameter serialization stack buffer overflow7.5 High
- omnifacesOmniFaces: EL injection via crafted resource name in wildcard CDN mapping8.1 High
- joedolson my-calendarMy Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog8.8 High
- py-pdf pypdfpypdf: Manipulated FlateDecode image dimensions can exhaust RAM4.8 Medium
- py-pdf pypdfpypdf: Possible long runtimes for wrong size values in incremental mode4.8 Medium
- py-pdf pypdfpypdf: Manipulated FlateDecode predictor parameters can exhaust RAM4.8 Medium
- go-acme lego, red hat openshift dev spaces 3.28 +1 moreLego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider8.8 High
- home-assistant-ecosystem home assistant command-line interface, home-assistant-cli +1 morehass-cli: Handling of user-supplied Jinja2 templates5.6 Medium
- @clerk nextjs, nuxt, shared +1 more +3 moreOfficial Clerk JavaScript SDKs: Middleware-based route protection bypass9.1 Critical
- statamic cms, statamic +1 moreStatamic: Unsafe method invocation via query value resolution allows data destruction8.1 High
- wwbn avideoWWBN AVideo vulnerable to RCE caused by clonesite plugin8.9 High
- electermelecterm has Command Injection Vulnerability via runMac function9.8 Critical
- flowiseFlowise - Server-Side Request Forgery via Execute Flow Base URL6.0 Medium
- flowiseai flowiseFlowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)5.3 Medium
- flowiseFlowise - Path Traversal in Vector Store basePath Parameter4.9 Medium
- flowiseFlowise - Weak Default Token Hash Secret in JWT Token Encryption4.3 Medium
- flowiseFlowise - Session Hijacking via Weak Default Express Session Secret9.3 Critical
- flowiseFlowise - Weak Default JWT Secrets in Authentication Middleware9.3 Critical
- flowiseFlowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint8.7 High
- openclawOpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator2.0 Low
- flowiseai flowise, flowise-components +1 moreFlowise: Authenticated RCE Via MCP Adapters10.0 Critical
- sqlalchemy makoMako: Path traversal via double-slash URI prefix in TemplateLookup7.7 High
- junrar, red hat fuse 7, jboss enterprise application platform 8 +1 more +3 moreJunrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix5.9 Medium
- psi-4ward psitransferPsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart7.5 High
- cryptomatorCryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)4.8 Medium
- Show moreLoading…