CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUninitialized memory in the Audio/Video: Web Codecs component9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the WebRTC component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the DOM: Core & HTML component7.5 High
- erlang otp, erlang\/otp, erlang\/ssh +2 moreSFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT5.3 Medium
sequoia-gitcrates.iosequoia-git has broken hard revocation handling1.8 Low- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 moreInformation Disclosure Vulnerability in Quantum Networks Router QN-I-4708.7 High
- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 moreWeak Password Policy Vulnerability in Quantum Networks Router QN-I-4707.6 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 moreundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent7.4 High
- nodejs undiciundici vulnerable to cross-user information disclosure via shared cache whitespace bypass5.9 Medium
- nodejs undiciundici WebSocket client vulnerable to denial of service via cumulative fragment bypass7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 moreundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse7.5 High
- nodeca js-yamljs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing7.5 High
- nodeca js-yamljs-yaml: YAML merge-key chains can force quadratic CPU consumption5.3 Medium
- nodejs node, node.js +1 moreA flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket...3.3 Low
- nodejs node, node.js +1 moreA flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was...3.3 Low
- nodejs node, node.js +1 moreA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation....4.3 Medium
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 moreA flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(...7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent...5.6 Medium
- nodejs node, node.js +1 moreA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context...4.2 Medium
- nodejs node, node.js +1 moreA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames,...5.3 Medium
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 moreA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...7.7 High
- nodejs node, node.js +1 moreA flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL...5.9 Medium
- juliangruber brace-expansionbrace-expansion: Large numeric range defeats documented `max` DoS protection6.5 Medium
- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 moreCommand Injection Vulnerability in Quantum Networks Router QN-I-4708.7 High
- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 moreMissing Rate Limiting Vulnerability in Quantum Networks Router QN-I-4708.7 High
- typo3, typo3 cms +1 moreTYPO3 CMS Stores Cleartext Password in User Settings Module7.3 High
- metaslider responsive slider by metasliderWordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability7.2 High
- navigate cmsReflected Cross-Site Scripting in Navigate CMS application5.1 Medium
- zervit portable http/web serverIncorrect input validation on the Zervit portable HTTP/Web server8.2 High
- ryhowa website llms.txtWebsite LLMs.txt <= 8.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- ryhowa website llms.txtWebsite LLMs.txt <= 8.2.6 - Reflected Cross-Site Scripting6.1 Medium
- cyberchimps responsive blocks – page builder for blocks & patternsResponsive Blocks <= 2.2.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions4.3 Medium
- honor aiassistantPrivilege Bypass in AiAssistant7.8 High
- honor eInformation Leak Vulnerability in Honor E6.3 Medium
podmanSUSESecurity update for podmanNo score- honor pcmanagerPrivilege Bypass in PcManager3.2 Low
- newsoft newsoftoaNewSoft｜NewSoftOA - OS Command Injection9.3 Critical
- tholstkabelbwde plugin: cms für motorrad werkstättenPlugin: CMS für Motorrad Werkstätten <= 1.0.0 - Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter6.5 Medium
- cyberchimps responsive blocks – page builder for blocks & patternsResponsive Blocks <= 2.2.0 - Unauthenticated Open Email Relay via REST API 'email_to' Parameter5.3 Medium
- freescoutFreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)8.1 High
- zyxel wre6505 v2 firmware, wre6505 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program...4.5 Medium
- freescoutFreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force8.8 High
- apktoolApktool: Path Traversal to Arbitrary File Write7.1 High
- academysoftwarefoundation openexrOpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)8.4 High
- academysoftwarefoundation openexr, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreOpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)8.4 High
- academysoftwarefoundation openexrOpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl()5.3 Medium
- lawnchairLawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml7.4 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace7.7 High
- m1k1o nekoNeko has Self-service Privilege Escalation for Authenticated Users8.8 High
- jupyter nbconvertnbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding6.5 Medium
- Show moreLoading…