CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- happyseafox sailSAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds check9.8 Critical
- happyseafox sailSAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode9.8 Critical
- happyseafox sailSAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swap9.8 Critical
- youzify – buddypress community, user profile, social network & membership plugin for wordpressYouzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter6.4 Medium
- prasunsen hostelHostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter6.1 Medium
- editorconfig editorconfig-core-ceditorconfig-core-c has incomplete fix for CVE-2023-03418.6 High
- gitroom postiz, gitroomhq postiz-app +1 morePostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS8.9 High
- zcashfoundation zebra, zfnd zebra-script, zebrad +2 moreZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling9.3 Critical
- zcashfoundation zebra, zfnd zebra-rpc, zebrad +2 moreZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients6.9 Medium
- zcashfoundation zebra, zfnd zebra-chain, zebrad +2 moreZEBRA: rk Identity Point Panic in Transaction Verification9.2 Critical
- jstedfast mailkitMailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade6.5 Medium
- pretalxpretalx: Stored cross-site scripting in organiser search typeahead8.7 High
- pretalxpretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates6.1 Medium
- charm wishWish has SCP Path Traversal that allows arbitrary file read/write9.6 Critical
- dagster-io dagsterDagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations8.3 High
- open-telemetry opentelemetry.exporter.jaeger, opentelemetry, open-telemetry opentelemetry-dotnet +2 moreOpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path5.9 Medium
- yeswikiYesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()8.8 High
- nhost, nhost nhost\/auth +1 moreNhost Vulnerable to Account Takeover via OAuth Email Verification Bypass9.3 Critical
- phpunit project phpunitPHPUnit: Argument injection via newline in PHP INI values forwarded to child processes7.8 High
ZioNuGetZio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment3.8 Low- flowiseai flowiseFlowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability9.2 Critical
- zcashfoundation zebra-network, zebrad +1 moreZebra: addr/addrv2 Deserialization Resource Exhaustion6.3 Medium
- zcashfoundation zebra-consensus, zebrad +1 moreZebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks7.2 High
- freedom securedrop-clientSecureDrop Client has path injection in read_gzip_header_filename()7.5 High
- minecanton209 novumosNovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange)9.0 Critical
- minecanton209 novumosNovumOS has Privilege Escalation in the Syscall Interface9.4 Critical
- leepeuker movaryMovary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts8.8 High
- leepeuker movaryAuthenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true8.8 High
- churchcrm crmChurchCRM: Stored XSS in UserEditor.php via Login Name Field4.8 Medium
- leepeuker movaryMovary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing7.7 High
- churchcrm crmChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion8.1 High
- camelot-os sentry-kernelSentry kernel has incomplete ownership check for IRQ line manipulation5.1 Medium
- gphoto libgphoto2libgphoto2 has an OOB Read in ptp_unpack_EOS_FocusInfoEx3.5 Low
- gphoto libgphoto2libgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo response6.1 Medium
- gphoto libgphoto2libgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.c5.2 Medium
- gphoto libgphoto2libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c5.2 Medium
- churchcrm crmChurchCRM: Username Enumeration via Differential Response in Public Login API5.3 Medium
- gphoto libgphoto2libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c2.4 Low
- easyappointments easy appointmentsEasy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API7.5 High
- churchcrm crmChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function9.1 Critical
- churchcrm crmChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field5.4 Medium
- gphoto libgphoto2libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c5.2 Medium
- gphoto libgphoto2libgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.c3.5 Low
- churchcrm crmChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout9.1 Critical
- gphoto libgphoto2libgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() due to missing length parameter in ptp-pack.c6.1 Medium
- churchcrm crmChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`7.1 High
- churchcrm crmChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`7.1 High
- std42 elfinderelFinder: Command injection in resize background color parameter when using ImageMagick CLI8.9 High
- openclawOpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get2.3 Low
- openclawOpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths6.3 Medium
- Show moreLoading…