CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- No product listedXiangShan (Open-source high-performance RISC-V processor) commit...7.1 High
- No product listedA local attacker who can execute privileged CSR operations (or can induce firmware to do so)...7.8 High
arduinoUbuntuA stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0....5.3 Medium- No product listedA vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated...6.5 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Vector Database Management Endpoint vector_dbs.py get_vector_db_details missing authentication6.9 Medium
- h3c magic b1H3C Magic B1 aspForm SetMobileAPInfoById buffer overflow8.7 High
- liangliangyy djangoblogliangliangyy DjangoBlog Amap API Call views.py hard-coded key6.9 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog Clean Endpoint views.py missing authentication6.9 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog Setting settings.py hard-coded credentials6.3 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog logtracks Endpoint views.py missing authentication6.9 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection5.3 Medium
- osuuu lightpictureosuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials6.9 Medium
- No product listedPHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery5.3 Medium
- collabora kodexplorerCollabora KodExplorer fileUpload Endpoint share.class.php improper authorization6.3 Medium
- collabora kodexplorerkodcloud KodExplorer systemRole.class.php roleGroupAction authorization5.3 Medium
- rust-opensslrust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peer8.3 High
- rust-opensslrust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check8.1 High
- rust-opensslrust-openssl: Incorrect bounds assertion in aes key wrap7.2 High
- rust-opensslrust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length1.7 Low
- rust-opensslrust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.17.2 High
- collabora kodexplorerkodcloud KodExplorer systemMember.class.php initInstall authorization5.1 Medium
- collabora kodexplorerkodcloud KodExplorer fileGet Endpoint share.class.php improper authentication6.9 Medium
- collabora kodexplorerkodcloud KodExplorer Public Share share.class.php initShareOld path traversal6.9 Medium
- emq emqx enterpriseEMQ EMQX Enterprise Session Handling improper authorization5.3 Medium
- h3c magic b1H3C Magic B1 aspForm SetAPWifiorLedInfoById buffer overflow8.7 High
- dameng100 muucmfdameng100 muucmf index.html getListByPage sql injection6.9 Medium
- No product listedEyouCMS Index.php edit_adminlogo unrestricted upload5.1 Medium
- h3c magic b0H3C Magic B0 aspForm Edit_BasicSSID buffer overflow8.7 High
- wavlink wl-wn579a3Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting5.3 Medium
- turn2honey emc – easily embed calendly schedulingEMC Scheduling Manager <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode6.4 Medium
libcoapOSS-FuzzHeap-double-free in coap_new_oscore_confNo score- gnu sedRace Condition in GNU Sed2.1 Low
- apache apache-airflow-providers-keycloak, apache software foundation airflow providers keycloak +1 moreApache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager5.4 Medium
- ajay contextual related postsContextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'6.4 Medium
- elzahlan categories imagesCategories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode5.4 Medium
- vanderwijk content blocks (custom post widget)Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode6.4 Medium
- littlecms little cms, little cms color engine +1 moreLittle CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the...4.0 Medium
- apache airflowApache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=13.7 Low
- apache airflowApache Airflow: Bad example of BashOperator shell injection via dag_run.conf8.8 High
- apache airflowApache Airflow: Exposing stack trace in case of constraint error7.5 High
- apache airflowApache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)7.2 High
- apache airflowApache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to7.5 High
- iterm2In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC...6.9 Medium
- dragwyb flipbox addon for elementorFlipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes6.4 Medium
- niteo cmp – coming soon & maintenance plugin by niteothemesCMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution8.8 High
- godaddy page builder gutenberg blocks – coblocksPage Builder Gutenberg Blocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data6.4 Medium
- Show moreLoading…