CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- otrs ag otrsPossible DoS via SQL Box4.5 Medium
- gfi helpdeskGFI HelpDesk < 4.99.9 Stored XSS via charset Parameter4.8 Medium
- gfi helpdeskGFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter4.8 Medium
- gfi helpdeskGFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject5.1 Medium
- gfi helpdeskGFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter5.1 Medium
- gfi helpdeskGFI HelpDesk < 4.99.10 Stored XSS via Reports Module5.1 Medium
- ericc-ch copilot-apiericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy6.9 Medium
- dell powerprotect data domain appliances, data domain operating system +1 moreDell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release...6.3 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0...6.7 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability...6.7 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of...6.7 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0...7.2 High
- saurabh-kumar python-dotenvpython-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback6.6 Medium
- openmage magento, magento-lts +1 moreOpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution8.7 High
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0...7.2 High
- openmage magento, magento-lts +1 moreOpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant5.3 Medium
- mborgerding kissfftKissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()8.7 High
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation...7.2 High
- openmage magento, magento-lts +1 moreOpenMage LTS has Path Traversal Filter Bypass in Dataflow Module4.9 Medium
- openmage magento, magento-lts +1 moreOpenMage LTS's Phar Deserialization leads to Remote Code Execution8.1 High
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0...7.2 High
- vexaVexa Webhook Feature has a SSRF Vulnerability5.8 Medium
- vexaVexa's unauthenticated internal transcript endpoint exposed by default7.5 High
containerdSUSESecurity update for containerdNo score- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...7.2 High
rootlesskitSUSESecurity update for rootlesskitNo scorerootlesskitSUSESecurity update for rootlesskitNo scoredockerSUSESecurity update for dockerNo scorebuildahSUSESecurity update for buildahNo scorekubernetesSUSESecurity update for kubernetesNo scorekubernetes-oldSUSESecurity update for kubernetes-oldNo scorerekorSUSESecurity update for rekorNo scoreruncSUSESecurity update for runcNo score- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0...8.8 High
cosignSUSESecurity update for cosignNo score- openaev-platform openaevOpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API5.3 Medium
- filigran openaevOpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise9.1 Critical
- connectwise automateUnencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center7.1 High
- openprojectOpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup6.5 Medium
- pagekit cmsPagekit CMS StringStorage Template PhpEngine.php evaluate eval injection5.1 Medium
- pip maintainers pippip doesn't reject concatenated ZIP and tar archives4.6 Medium
- givanz vvvebVvveb < 1.0.8.1 Code Injection via Installation Endpoint9.2 Critical
- devs palace erp onlineerponline.xyz ERP Online Inventory Edit Item cross site scripting4.8 Medium
- No product listedZ-BlogPHP ZBA File app_upload.php UnPack unrestricted upload5.1 Medium
- givanz vvvebVvveb < 1.0.8.1 SSRF via oEmbedProxy8.3 High
- givanz vvvebVvveb < 1.0.8.1 Privilege Escalation via admin/user/save8.7 High
- givanz vvvebVvveb < 1.0.8.1 Stored XSS via Media Upload and Rename5.1 Medium
- lmsys sglangCVE-2026-57609.8 Critical
- canonical canonical-livepatch, livepatch client +1 moreExposed Session Token in canonical-livepatch client snap5.7 Medium
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF8.4 High
- Show moreLoading…