CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...8.4 High
- flightbycanto cantoCanto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification4.3 Medium
- essential plugin featured post creative, meta slider and carousel with lightbox, portfolio and projects +19 more +21 moreEssentialplugin Plugins (Various Versions) - Injected Backdoor9.8 Critical
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal7.5 High
- mobatek mobaxterm home editionMobatek MobaXterm Home Edition msimg32.dll uncontrolled search path7.3 High
- expresstech quiz and survey master (qsm) – easy quiz and survey makerQuiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields5.3 Medium
- rapid7 insight agentLocal Privilege Escalation via OpenSSL configuration file in Insight Agent8.5 High
- cubecartA path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an...5.1 Medium
- cubecartAn SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to...5.1 Medium
- cubecartAn OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user...8.6 High
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order5.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter6.5 Medium
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes5.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID5.3 Medium
- backupguard jetbackup – backup, restore & migrateJetBackup <= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter4.9 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter4.9 Medium
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations7.5 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Token Leaked to Backends via Authorization: Bearer Passthrough Header7.5 High
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS5.3 Medium
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service8.1 High
- tomdever wpforo forumwpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter6.5 Medium
- veronalabs wp statistics – simple, privacy-friendly google analytics alternativeWP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter7.2 High
- stylemix masterstudy lms wordpress plugin – for online courses and educationMasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters6.5 Medium
- veronalabs wp statistics – simple, privacy-friendly google analytics alternativeWP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation6.5 Medium
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget6.4 Medium
matioOSS-FuzzUse-of-uninitialized-value in H5S_select_hyperslabNo scorevlcOSS-FuzzHeap-buffer-overflow in CEA708_DTVCC_Demuxer_PushNo score- No product listedA SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote...9.8 Critical
markhuot/craftqlPackagistCraftql vulnerable to Server-Side Request Forgery7.5 High- No product listedSTProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged...5.5 Medium
- cloud foundry uuaCloud Foundry UAA SAML 2.0 Signature Bypass8.6 High
- saltcornSaltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)5.1 Medium
- langchain langchain-openaiangchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding3.1 Low
- b3log siyuanSiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE9.1 Critical
- langchain langchain-text-splitters, red hat migration toolkit for applications 8, openshift lightspeed +2 more +4 moreLangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass6.5 Medium
p3-symmetriccrates.ioPlonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths2.9 Low- saltcornSaltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)10.0 Critical
Meridian.MappingNuGet,Meridian.MediatorNuGet +1 moreMeridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)7.5 High@paperclipai/servernpmPaperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise9.9 Critical@paperclipai/uinpmPaperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization5.4 Medium@paperclipai/servernpmPaperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server4.3 Medium@paperclipai/servernpmPaperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys9.9 Critical- paperclipai @paperclipai/serverPaperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands8.7 High
paperclipainpmPaperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email8.7 High@paperclipai/servernpmPaperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode8.3 High@paperclipai/servernpmPaperclip: Malicious skills able to exfiltrate and destroy all user data7.3 High- paperclip paperclipai, paperclipai @paperclipai/server +1 morePaperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution8.8 High
@paperclipai/sharednpmPaperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath6.5 Medium- better-auth, better-auth better-auth\/oauth-provider, oauth-provider +2 moreBetter Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients7.1 High
- budibaseBudibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints9.1 Critical
- Show moreLoading…