CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- aguilatechnologies wp customer areaWP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file8.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)7.3 High
- hkuds openharnessOpenHarness SSRF via web_fetch and web_search7.8 High
- hkuds openharnessOpenHarness Permission Bypass via grep and glob root argument8.7 High
- veeam backup and replication, software appliance +1 moreA vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver...6.7 Medium
- prasathmani tinyfilemanagerprasathmani TinyFileManager File Upload filemanager.php server-side request forgery5.3 Medium
kernel-livepatch-MICRO-6-0-RT_Update_19SUSESecurity update for kernel-livepatch-MICRO-6-0-RT_Update_19No scorekernel-livepatch-MICRO-6-0-RT_Update_19SUSESecurity update for kernel-livepatch-MICRO-6-0-RT_Update_19No score- horner automation cscape, xl7 plc, xl4 plc +2 moreHorner Automation Cscape and XL4, XL7 PLC Weak password requirements9.3 Critical
- prasathmani tinyfilemanagerprasathmani TinyFileManager POST Parameter filemanager.php path traversal5.3 Medium
- jetbrains junieIn JetBrains Junie before 252.549.29 command execution was possible via malicious project file5.8 Medium
- lukevella ralllylukevella rallly Reset Password reset-password-form.tsx cross site scripting5.1 Medium
- arnobt78 hotel booking management systemarnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosure6.9 Medium
vipsDebianlibvips nip2 vips7compat.c im_minpos_vec heap-based overflow4.8 Medium- pac4jLDAP Injection in PAC4J8.7 High
- pac4jCross-Site Request Forgery in PAC4J7.0 High
- querymine smsQueryMine sms GET Request Parameter deletecourse.php sql injection6.9 Medium
- querymine smsQueryMine sms Background Management addteacher.php unrestricted upload5.3 Medium
- querymine smsQueryMine sms GET Request Parameter editcourse.php sql injection5.3 Medium
- qihui jtbc5 cmsQihui jtbc5 CMS Code Endpoint manage.php path traversal5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreDnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing7.5 High
- No product listedclassroombookings User Display Name layout.php read cross site scripting5.1 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...4.3 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...5.9 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.2 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.2 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.6 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.6 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0...6.7 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0...6.7 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0...6.7 Medium
- nomios poland greenmodServer-Side Request Forgery in GREENmod6.9 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0...6.7 Medium
- wavlink wl-wn530h4Wavlink WL-WN530H4 internet.cgi snprintf os command injection8.6 High
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.7 Medium
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...7.2 High
- sparx systems pty ltd. pro cloud serverUnauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server9.5 Critical
- sparx systems pty ltd. pro cloud serverPlaintext Storage of a Password in Sparx Pro Cloud Server.9.3 Critical
- sparx systems pty ltd. pro cloud serverSparx Pro Cloud Server reveals sensitive information to an unauthenticated user9.3 Critical
- sparx systems pty ltd. enterprise architectSparx Enterprise Architect Client reveals plaintext OAuth2 client secret6.2 Medium
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...7.2 High
- jconti videozenVideoZen <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field4.4 Medium
- dell data domain operating system, powerprotect data domain appliances +1 moreDell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature...7.6 High
- red hat ansible automation platform 2Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input5.3 Medium
- dell powerprotect data domain boostfs, data domain operating system +1 moreDell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5,...7.8 High
podmanSUSESecurity update for podmanNo score- jetbrains youtrackIn JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass7.2 High
- tholstkabelbwde plugin: cms für motorrad werkstättenCMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery4.3 Medium
- zte red magic 11 pro (nx809j), nubia-in nx809j firmware +1 moreZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.5.0 Medium
smc-toolsopenSUSESecurity update for smc-toolsNo score- Show moreLoading…