CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- oracle peoplesoft enterprise hcm shared componentsVulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft ...5.4 Medium
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...3.7 Low
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle graalvm, graalvm for jdk, jdk +33 more +35 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...7.5 High
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema)...4.3 Medium
- oracle user managementVulnerability in the Oracle User Management product of Oracle E-Business Suite (component:...3.8 Low
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...5.3 Medium
- oracle applications dbaVulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component:...7.6 High
- oracle financial services analytical applications infrastructureVulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of...7.5 High
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle corporation java se, oracle jdk, jre +2 moreVulnerability in Oracle Java SE (component: Libraries). The supported version that is affected...3.7 Low
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...2.9 Low
- oracle peoplesoft enterprise hcm human resourcesVulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft ...5.4 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...4.9 Medium
- oracle graalvm, oracle corporation graalvm enterprise edition, java se +2 more +4 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...6.0 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema)...2.7 Low
- oracle xml database, oracle corporation database server +1 moreVulnerability in the XML Database component of Oracle Database Server. Supported versions that...5.3 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle life sciences empirica signalVulnerability in the Oracle Life Sciences Empirica Signal product of Oracle Life Science...8.5 High
- sanluan publiccmsSanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file5.3 Medium
- linuxfoundation tekton pipelines, tektoncd pipeline, red hat openshift lightspeed +8 more +10 moreTekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE7.5 High
- linuxfoundation tekton pipelines, tektoncd pipeline +1 moreTekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion6.5 Medium
- linuxfoundation tekton pipelines, tektoncd pipeline +1 moreTekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check5.4 Medium
- flowiseai flowiseFlowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability9.2 Critical
- noir-lang noirBrillig: Heap corruption in foreign call results with nested tuple arrays9.3 Critical
- electric-sql electric, electric sync-service, red hat developer hub +2 moreElectric: SQL Injection via ORDER BY Parameter in Shape API10.0 Critical
- kovah linkaceLinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover8.1 High
- pjsip, pjsip pjproject +1 morePJSIP: Stack buffer overflow in pjsip_auth_create_digest2()8.1 High
- goshsGoshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence9.1 Critical
- hkuds openharnessHKUDS OpenHarness Plugin Management Command Exposure8.7 High
- frappe hr, hrms +1 moreFrappe HR has possibility of SQL Injection due to improper field sanitization6.5 Medium
- frappe hr, hrms +1 moreFrappe HR has Improper Access Control on Files6.5 Medium
- frappe hr, hrms +1 moreFrappe HR vulnerable to Improper Access Control6.5 Medium
- mailcow mailcow-dockerizedmailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping2.1 Low
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to stored XSS in user login history real_rip7.0 High
- mailcow mailcow-dockerizedmailcow: dockerized missing authorization on Forwarding Hosts delete action6.0 Medium
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames8.9 High
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field9.3 Critical
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API7.2 High
- free5gc, free5gc udr +1 morefree5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation6.9 Medium
- golang image, golang.org/x/image golang.org/x/image/font/sfnt +1 moreExcessive memory allocation when decoding malicious SFNT in golang.org/x/image6.1 Medium
- golang image, golang.org/x/image golang.org/x/image/webp +1 morePanic when decoding large WEBP image on 32-bit platforms in golang.org/x/image7.5 High
- spring security, vmware spring security +1 moreSpring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions4.8 Medium
bagisto/bagistoPackagistBagisto Custom Scripts cross site scripting5.1 Medium- horilla-opensource horillaHorilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation7.1 High
- horilla-opensource horillaHorilla: Unauthorized Document Overwrite via File Upload Endpoint8.6 High
- horilla-opensource horillaHorilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>7.1 High
- pjsip, pjsip pjproject +1 morePJSIP: Heap buffer overflow in Opus codec decoding8.5 High
- Show moreLoading…