CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 morexmldom: Denial of service via uncontrolled recursion in XML serialization8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.8 +6 more +8 morexmldom: XML injection through unvalidated DocumentType serialization8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 morexmldom: XML node injection through unvalidated processing instruction serialization8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 morexmldom: XML node injection through unvalidated comment serialization8.7 High
- nocobaseNocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading7.5 High
- nocobaseNocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call7.2 High
- espocrmEspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete7.2 High
- naturalintelligence fast-xml-parserfast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters6.1 Medium
- espocrmEspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user9.1 Critical
- projectdiscovery nucleiNuclei: Local File Read via require() Module Loader Bypass5.5 Medium
- monetrmonetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh8.3 High
- marko-js marko, openjsf marko\/runtime-tags +1 moreMarko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping6.4 Medium
- elated-themes frappeFrappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters4.6 Medium
- nimiq network-libp2p, proof-of-stake +1 morenetwork-libp2p: Peer can crash the node by opening discovery protocol substream twice7.5 High
- elated-themes frappeFrappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer4.6 Medium
- python, python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreBaseCookie.js_output() does not neutralize embedded characters2.1 Low
- rustfsRustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks8.3 High
- nimiq nimiq-blockchain, proof-of-stake +1 morenimiq-blockchain: Peer-triggerable panic during history sync5.3 Medium
- nimiq network-libp2p, proof-of-stake +1 moreNimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response5.3 Medium
- nimiq nimiq-transaction, proof-of-stake +1 morenimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge6.8 Medium
- nimiq nimiq-transaction, proof-of-stake +1 morenimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatch3.1 Low
- nimiq nimiq-primitives, proof-of-stake +1 morenimiq-primitives: Node crash due to missing interlink validation in election macro block proposals7.5 High
- nimiq nimiq-account, proof-of-stake +1 morenimiq-account: Vesting insufficient funds error can panic5.3 Medium
- nimiq nimiq-block, proof-of-stake +1 morenimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation9.6 Critical
- thexerteproject xerteonlinetoolkitsXerte Online Toolkits Missing Authentication via connector.php8.8 High
- thexerteproject xerteonlinetoolkitsXerte Online Toolkits File Upload RCE via elfinder Connector9.3 Critical
- thexerteproject xerteonlinetoolkitsXerte Online Toolkits Path Traversal via connector.php7.1 High
- thexerteproject xerteonlinetoolkitsXerte Online Toolkits Path Disclosure via /setup6.9 Medium
- apple ipados, ios and ipados, iphone os +2 moreA logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and...6.2 Medium
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7...8.1 High
- beghelli sicuroweb (sicuro24)Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection9.3 Critical
- beghelli sicuroweb (sicuro24)Beghelli Sicuro24 SicuroWeb Missing Content Security Policy5.1 Medium
- drupal obfuscateObfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-0336.1 Medium
- i18next i18next-fs-backendi18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite8.2 High
- i18next i18nextifyi18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes4.7 Medium
- i18next i18next-http-backendi18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns6.5 Medium
- i18next i18next-http-middlewarePrototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters8.6 High
- daptinDaptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API8.3 High
- ci4-cms-erp ci4msci4ms Theme::upload is vulnerable to Zip Slip leading to RCE9.4 Critical
- ci4-cms-erp ci4msci4ms Backup::restore is vulnerable to Zip Slip leading to RCE9.4 Critical
- ci4-cms-erp ci4msCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 29.1 Critical
- ddevDDEV has ZipSlip path traversal in tar and zip archive extraction6.5 Medium
- gitlabImproper Restriction of Rendered UI Layers or Frames in GitLab3.5 Low
- gitlabCross-Site Request Forgery (CSRF) in GitLab8.1 High
- uutils coreutilsuutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering3.3 Low
- uutils coreutilsuutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing5.5 Medium
- uutils coreutilsuutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling3.3 Low
- uutils coreutilsuutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions3.3 Low
- uutils coreutilsuutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode3.3 Low
- uutils coreutilsuutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition4.5 Medium
- Show moreLoading…