CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
container-suseconnectSUSESecurity update for container-suseconnectNo score- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- qibo cmsQibo CMS headers server-side request forgery5.3 Medium
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- apache kafka, red hat openshift serverless, build of apache camel 4 for quarkus 3 +16 more +18 moreApache Kafka: Missing JWT token validation in OAUTHBEARER authentication9.1 Critical
- apache doris mcp serverApache Doris MCP Server: MCP SQL inject5.3 Medium
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- apache kafka, apache software foundation kafka clients +1 moreApache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output5.3 Medium
- qibo cmsQibo CMS Internal Message cross site scripting5.1 Medium
- p2r3 convertp2r3 convert API buildCache.js Bun.serve path traversal5.3 Medium
- rowboatlabs rowboatrowboatlabs rowboat tools_webhook app.py tool_call improper authentication6.9 Medium
- usememos memosusememos UpdateInstanceSetting App.tsx memos_access_token improper authorization5.3 Medium
- statamic cmsYifang CMS Extended Management L_rbac_admin.php store cross site scripting5.1 Medium
- tenda f451Tenda F451 httpd SafeClientFilter fromSafeClientFilter buffer overflow8.7 High
- tenda f451Tenda F451 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow8.7 High
- tenda f451Tenda F451 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow8.7 High
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injection6.9 Medium
buildahSUSESecurity update for buildahNo score- phili67 ecclesia crmphili67 Ecclesia CRM Query Viewer view ValidateInput sql injection5.3 Medium
- cockpit-hq cockpitCockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection5.3 Medium
- linux, linux kernel +1 moreX.509: Fix out-of-bounds access when parsing extensions7.1 High
- linux, linux kernel +1 morenet: skb: fix cross-cache free of KFENCE-allocated skb head5.5 Medium
- moxi624 mogu blog v2moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery6.9 Medium
- bichitrogan isp billing softwareBichitroGan ISP Billing Software Pool List add cross site scripting4.8 Medium
- bichitrogan isp billing softwareBichitroGan ISP Billing Software Profile users-view cross site scripting4.8 Medium
- fudo security enterprise, fudosecurity fudo enterprise +1 moreIncorrect authorization in Fudo Enterprise5.1 Medium
- bichitrogan isp billing softwareBichitroGan ISP Billing Software Customer edit cross site scripting4.8 Medium
- 1024bit extend-deep1024bit extend-deep index.js prototype pollution6.9 Medium
- soniccloudorg sonic-serverSonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal5.3 Medium
- sky co.,ltd. skymec it manager, skysea client view +1 moreSKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation...8.5 High
- langgenius difylanggenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting5.1 Medium
- langgenius difylanggenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery5.3 Medium
- teamt5 threatsonar anti-ransomwareTeamT5｜ThreatSonar Anti-Ransomware - Privilege Escalation8.7 High
- teamt5 threatsonar anti-ransomwareTeamT5｜ThreatSonar Anti-Ransomware - Arbitrary File Deletion7.2 High
- digiwin easyflow .netDigiwin｜EasyFlow .NET - SQL Injection9.3 Critical
- digiwin easyflow .netDigiwin｜EasyFlow .NET - SQL Injection9.3 Critical
- langgenius difylanggenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery5.3 Medium
- projectdiscovery nucleiNuclei: Environment variable disclosure via Response-Derived DSL Expressions5.3 Medium
- projectdiscovery nucleiProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env...4.0 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal6.9 Medium
- asustor inc. adm, asustor data master +1 moreA command injection vulnerability was found in the PPTP VPN Clients on the ADM9.4 Critical
- transformeroptimus superagiTransformerOptimus SuperAGI project.py get_projects_organisation authorization5.3 Medium
- asustor inc. adm, asustor data master +1 moreA stack-based buffer overflow vulnerability in the VPN Clients on the ADM8.6 High
- transformeroptimus superagiTransformerOptimus SuperAGI agent.py get_schedule_data authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization5.3 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key2.3 Low
- unknown email encoderEmail Encoder < 2.3.4 - Admin+ Stored XSS3.5 Low
- liangliangyy djangoblogliangliangyy DjangoBlog Setting settings.py hard-coded credentials6.3 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog views.py form_valid improper authorization5.3 Medium
- Show moreLoading…