CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- libcoaplibcoap Out-of-Bounds Read in OSCORE CBOR Unwrap Handling8.8 High
- fastgptFastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover8.8 High
- fastgptFastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass9.8 Critical
- sysadminsmedia homeboxHomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation8.1 High
- auth0 nextjs-auth0Auth0 Next.js SDK has Improper Proxy Cache Lookup5.4 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows5.4 Medium
- neo4j-contrib mcp-neo4jmcp-neo4j-cypher: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures2.3 Low
- stirling-tools stirling-pdf, stirlingpdf stirling pdf +1 moreStirling-PDF: Reflected XSS through crafted filename in file upload functionality3.1 Low
- labredescefetrj wegiaWeGIA has Cross-Site Scripting in Controle de Contribuição7.5 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration9.4 Critical
- labredescefetrj wegiaWeGIA has SQL Injection via Session Variable Override in DespachoControle.php8.8 High
- radare radare2radare2 Command Injection via DWARF Parameter Names8.5 High
- labredescefetrj wegiaWeGIA has stored XSS in listar_despachos.php6.8 Medium
- neutrinolabs xrdpxrdp: Heap buffer overflow in EGFX channel8.7 High
- labredescefetrj wegiaWeGIA has stored XSS in intercorrencia_visualizar.php6.4 Medium
- neutrinolabs xrdpxrdp: Pre-authentication out-of-bounds reads in channel parsers8.7 High
- neutrinolabs xrdpxrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman6.3 Medium
- openclawOpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route9.2 Critical
- labredescefetrj wegiaWeGIA has stored XSS in profile_paciente.php6.8 Medium
- neutrinolabs xrdpxrdp: Heap buffer overflow in xrdp_sec_process_logon_info() via incorrect g_strncat length calculation6.3 Medium
- neutrinolabs xrdpxrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers7.7 High
- anviz crosschex standardAnviz CrossChex Standard Algorithm Downgrade7.5 High
- anviz crosschex standardAnviz CrossChex Standard Improper Verification of Source of a Communication Channel8.1 High
- anviz cx2 lite firmwareAnviz CX2 Lite Command Injection8.8 High
- neutrinolabs xrdpxrdp: Heap buffer overflow in NeutrinoRDP channel reassembly7.7 High
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Download of Code Without Integrity Check8.8 High
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Missing Authentication for Critical Function9.8 Critical
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Missing Authentication for Critical Function7.5 High
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Missing Authorization5.3 Medium
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Cleartext Transmission of Sensitive Information6.5 Medium
- neutrinolabs xrdpxrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode9.3 Critical
- neutrinolabs xrdpxrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails8.8 High
- anviz cx7 firmwareAnviz CX7 Firmware Relative Path Traversal4.9 Medium
- firebirdsql firebirdFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution10.0 Critical
- anviz cx7 firmwareAnviz CX7 Firmware Use of Hard-coded Cryptographic Key7.7 High
- anviz cx7 firmwareAnviz Products Missing Authorization5.3 Medium
- anviz cx7 firmwareAnviz Products Missing Authorization5.3 Medium
- firebirdsql firebirdFirebird: DoS via malicious slice descriptor in slice packet7.5 High
- firebirdsql firebirdFirebird: DoS via `op_response` packet from client7.5 High
- firebirdsql firebirdFirebird has a buffer overflow when parsing corrupted slice packets7.5 High
- amazon aws efs csi driver, efs csi driver +1 moreAWS EFS CSI Driver Mount Option Injection6.9 Medium
- firebirdsql firebirdFirebird Null Pointer Dereference via CryptCallback causes DOS8.2 High
- firebirdsql firebirdFirebird server hangs when using specific clumplet on batch creation6.0 Medium
- volcengine openvikingOpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI9.1 Critical
- firebirdsql firebirdFirebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments8.2 High
- firebirdsql firebirdFirebird has potential server crash via null pointer dereference when processing op_slice packet7.5 High
- firebirdsql firebirdFirebird: Information leak vulnerability in firebird3 client when used with newer server7.9 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass8.1 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field7.5 High
- bytedance deerflow, deer-flow +1 moreByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode7.1 High
- Show moreLoading…