CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- weblizar institute management – learning management systemInstitute Management <= 5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Enquiry Form Title' Setting4.4 Medium
- mixer2 buzz commentsBuzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting4.4 Medium
- wpshouter switch cta boxSwitch CTA Box <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- bhubbard real estate proReal Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings5.5 Medium
- sphex1987 wp responsive popup + optinWP Responsive Popup + Optin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter6.1 Medium
- erithq er swiffy insertER Swiffy Insert <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- breadbutter bread & butter: ai-powered lead intelligenceBread & Butter: Content Gating for Verified Leads <= 8.2.0.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- zinoui http headersHTTP Headers <= 1.19.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting4.4 Medium
- sproutient zypento blocksZypento Blocks <= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block6.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreNano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions2.5 Low
podmanSUSESecurity update for podmanNo score- progress telerik ui for asp.net ajaxDeserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- progress telerik ui for asp.net ajaxUncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 moreApache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification7.3 High
- samsung oneMissing bounds validation for operator could allow out of range operator-code lookup during...5.5 Medium
- samsung oneImproper validation of STRING tensor offsets could allows malformed string metadata to trigger...6.6 Medium
- samsung oneInteger overflow in constant tensor data size calculation in Samsung Open Source ONE could cause...6.6 Medium
- samsung oneInteger overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of...6.6 Medium
- samsung oneInteger overflow in scratch buffer initialization size calculation in Samsung Open Source ONE...6.1 Medium
- samsung oneInteger overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid...6.6 Medium
- samsung oneInteger overflow in output tensor copy size calculation in Samsung Open Source ONE could cause...6.6 Medium
- samsung oneInteger overflow in buffer size calculation could result in out of bounds memory access when...6.6 Medium
- samsung onePotential Integer overflow in tensor allocation size calculation could lead to insufficient...5.3 Medium
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization Rules7.5 High
- spring security, vmware spring security +1 moreServlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers7.5 High
- spring security, vmware spring security +1 morePotential Security Misconfiguration when Using withIssuerLocation5.3 Medium
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client Certificates6.8 Medium
- spring security, vmware spring security +1 moreUser Attribute Enumeration when Using DaoAuthenticationProvider3.7 Low
- deepl chrome browser extensionDeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to execute arbitrary script in a user's browser, and inject mali…5.1 Medium
- aenrich a+hcmaEnrich｜a+HCM - Arbitrary File Upload5.1 Medium
- aenrich a+hrdaEnrich｜a+HRD - Missing Authorization7.1 High
- aenrich a+hrdaEnrich｜a+HRD - SQL Injection7.1 High
- freebsdMissing large page handling in pmap_pkru_update_range()6.2 Medium
- freebsdKernel use-after-free bug in the TIOCNOTTY handler8.4 High
- tanium serverTanium addressed an information disclosure vulnerability in Tanium Server.2.7 Low
- tanium threat responseTanium addressed an information disclosure vulnerability in Threat Response.2.7 Low
- owntone owntone-serverOwnTone Server < 29.1 Race Condition DoS via DAAP Login8.2 High
- tanium interactTanium addressed an uncontrolled resource consumption vulnerability in Interact.2.7 Low
- owntone owntone-serverOwnTone Server < 29.1 SQL Injection via query and filter Parameters6.9 Medium
matioOSS-FuzzHeap-buffer-overflow in ParseOpaqueMetadataNo scorehaproxyOSS-FuzzMemcpy-param-overlap in htx_replace_blk_valueNo scorejavaparserOSS-FuzzSecurity exception in com.github.javaparser.ast.NodeList.forEachNo scorecoturnOSS-FuzzStack-buffer-overflow in is_httpNo score- suse opensuse tumbleweedcsync2 uses insecure temporary directories when compiled with C99 or later5.1 Medium
- guardsix logpoint, odbc +1 moreAn issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2...8.5 High
- raindropInsufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5...6.5 Medium
org.silverpeas.core:silverpeas-core-warMaven,org.silverpeas.core:silverpeas-core-webMaven +1 moreSilverpeas Core has a reflected cross-site scripting vulnerability6.1 Medium- nasa fprimeF´ (F Prime) has Integer Overflow in FileUplink0.0 None
- free5gc amf, free5gc +1 morefree5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer5.5 Medium
- free5gc, free5gc pcf +1 morefree5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service7.5 High
- Show moreLoading…