CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- powerdns recursorInsufficient validation of cookie reply5.9 Medium
- powerdns recursorNull pointer accces in aggressive NSEC(3) cache5.9 Medium
- powerdns authoritative, dnsdist, recursor +2 moreInsufficient input validation of internal webserver5.3 Medium
- powerdns recursorConcurrent modification of RPZ data can lead to denial of servce5.0 Medium
- powerdns recursorCrafted zones can cause increased resource usage5.3 Medium
- powerdns authoritative, dnsdist, recursor +2 moreInsufficient input validation of internal webserver5.3 Medium
- powerdns recursorUnbounded memory allocation by internal web server5.3 Medium
- powerdns recursorInsufficient validation of zonemd record4.4 Medium
- powerdns recursorNull pointer dereference in RPZ transfer4.4 Medium
- gallagherwebsitedesign gallagher website designGallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute6.4 Medium
- gutentoolsGutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes6.4 Medium
- hanicker emailchefEmailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion4.3 Medium
- redhat quay, red hat quay 3 +1 moreQuay: red hat quay: authentication bypass allows privileged actions without valid credentials5.4 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: binutils: arbitrary code execution via malformed xcoff object file processing7.8 High
- gnu binutils, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreBinutils: binutils: denial of service vulnerabilities in readelf via crafted elf files5.5 Medium
- gnu nano, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreNano: nano: format string vulnerability leads to denial of service5.5 Medium
- linux, linux kernel +1 moreksmbd: fix potencial OOB in get_file_all_info() for compound requests8.8 High
- linux, linux kernel +1 moreksmbd: fix OOB write in QUERY_INFO for compound requests8.8 High
- amazon linux, linux kernel, arista cloudvision agni +142 more +144 morecrypto: algif_aead - Revert to operating out-of-place7.8 High
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreBinutils: binutils: denial of service via crafted elf file5.0 Medium
- cihubconnector ci hub connectorCI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- byybora google pagerank displayGoogle PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page4.3 Medium
- lucdecri posts mapPosts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute6.4 Medium
- nofearinc dx unanswered commentsDX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update4.3 Medium
- jppreus create db tablesCreate DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php9.1 Critical
- calj shabbat timesCalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action5.3 Medium
- zinoui http headersHTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters7.2 High
- ksolves kcaptchaKcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- fpoller private wp suitePrivate WP suite <= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting4.4 Medium
- snedled text snippetsText Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute6.4 Medium
- karim42 quran live multilanguageQuran Live Multilanguage <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- mkerstner simple random posts shortcodeSimple Random Posts Shortcode <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute6.4 Medium
- eazyserver sentence to seo (keywords, description and tags)Sentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' Field4.4 Medium
- maltathemes easy social photos gallery – mifEasy Social Photos Gallery <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute6.4 Medium
- sendmachine for wordpressSendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests9.8 Critical
- ravster inquiry cartInquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form6.1 Medium
- zinoui http headersHTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values5.5 Medium
- chsxf mcatfiltermCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function4.3 Medium
- wpmkorg wpmk blockWPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- tmarek call to action pluginCall To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update4.3 Medium
- luetkemj slideshowpro scSlideShowPro SC <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute6.4 Medium
- tplugins tp restore categories and taxonomiesTP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action4.3 Medium
- johnnie2u twittee text tweetTwittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- webarea fast & fancy filter – 3fFast & Fancy Filter – 3F <= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action4.3 Medium
- itsananderson short comment filterShort Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting4.4 Medium
- doctorwp breaking news wpBreaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read6.5 Medium
- anzia ni woocommerce order exportNi WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action4.3 Medium
- textp2p texting widgetTextP2P Texting Widget <= 1.7 - Cross-Site Request Forgery to Settings Update4.3 Medium
- primisdigital table managerTable Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute4.3 Medium
- felipermendes slider bootstrap carouselSlider Bootstrap Carousel <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- Show moreLoading…