CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- lm-sys fastchatlm-sys fastchat Arena Side-by-Side View add_text control flow6.9 Medium
- lm-sys fastchatlm-sys fastchat Worker API Endpoint api_generate resource consumption6.9 Medium
- modelscope agentscopemodelscope agentscope _agent_base.py _process_audio_block server-side request forgery6.9 Medium
- modelscope agentscopemodelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery6.9 Medium
- modelscope agentscopemodelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery6.9 Medium
- modelscope agentscopemodelscope agentscope _python.py execute_shell_command code injection6.9 Medium
- rickxy hospital management systemrickxy Hospital Management System his_admin_account.php unrestricted upload6.9 Medium
- lagom whmcs templateLagom WHMCS Template Datatables resource consumption5.3 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow...9.3 Critical
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow...8.7 High
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for...6.9 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key....6.9 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a...8.2 High
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive...7.1 High
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow...6.9 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for...6.9 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site...5.1 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of...6.9 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreInitialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC...8.7 High
- langflow-ai langflowlangflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting5.1 Medium
- langflow-ai langflowlangflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection5.3 Medium
- langflow-ai langflowlangflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file5.3 Medium
- langflow-ai langflowlangflow-ai langflow Flow Using API core.py has_api_terms credentials storage5.1 Medium
- langflow-ai langflowlangflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload6.9 Medium
- projectsandprograms school management systemProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection6.9 Medium
- brikcss mergebrikcss merge prototype pollution6.9 Medium
- No product listedComfyUI View Endpoint server.py cross site scripting5.1 Medium
- No product listedComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting5.1 Medium
- No product listedComfyUI LoadImage Node folder_paths.py folder_paths.get_annotated_filepath path traversal5.3 Medium
- No product listedComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal5.3 Medium
- No product listedComfyUI server.py create_origin_only_middleware cross-site request forgery5.3 Medium
- serge-chat sergeserge-chat serge Model API Endpoint model.py delete_model missing authentication6.9 Medium
libiglOSS-FuzzUNKNOWN WRITE in std::__1::istreambuf_iterator<char, std::__1::char_traits<char>> std::__1::num_gNo score- vibrantlabsai ragas, red hat openshift ai (rhoai) +1 morevibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery5.3 Medium
- red hat fast datapath for red hat enterprise linux 10, fast datapath for red hat enterprise linux 8, fast datapath for red hat enterprise linux 9 +3 more +5 moreOvn: ovn: information disclosure via crafted dhcpv6 packets8.6 High
- red hat fast datapath for red hat enterprise linux 10, fast datapath for red hat enterprise linux 8, fast datapath for red hat enterprise linux 9 +3 more +5 moreOvn: ovn: heap over-read in icmp error response generation6.5 Medium
- openbsdIn OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a...4.3 Medium
- rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 moreRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution9.2 Critical
- rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 moreRclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution9.2 Critical
- No product listedCross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors...5.4 Medium
- No product listedSQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management...7.5 High
- No product listedSQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management...8.2 High
- No product listedSQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management...9.4 Critical
- doormanImproper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update...9.9 Critical
- deepcool deepcreativeInsecure Permissions vulnerability in DeepCool DeepCreative v.1.2.7 and before allows a local...7.8 High
- xiangshan nemuNEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] ...9.8 Critical
- No product listedIn OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly...8.8 High
- No product listedIn OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code...6.5 Medium
- No product listedIn OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a...9.8 Critical
- xiangshan nemuNEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in...7.5 High
- Show moreLoading…