CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- No product listedYadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication...7.3 High
- jizhicmsJizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.9.8 Critical
- ibm guardium key lifecycle managerMultiple Vulnerabilities in IBM Guardium Key Lifecycle Manager4.8 Medium
- ibm security verify directory (container), security verify directory +1 moreSecurity vulnerability has been detected in IBM Security Verify Directory5.5 Medium
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access6.5 Medium
- ibm db2IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index6.5 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities2.7 Low
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities4.9 Medium
- rocket.chatIn Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL...9.8 Critical
- ericc-ch copilot-apiericc-ch copilot-api Header token dns rebinding5.3 Medium
- ibm total storage service console (tssc) / ts4500 imc, total storage service console, ts4500 imc +2 moreTSSC/IMC is vulnerable to OS Command Injection7.3 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities4.9 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities5.5 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities4.8 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by identity spoofing7.5 High
- openc3 cosmosOpenC3 COSMOS: Self-XSS in the Command Sender4.6 Medium
- openc3 cosmosOpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames4.3 Medium
- openc3 cosmosOpenC3 COSMOS: Hijacked session token can be used to reset password for persistence8.1 High
- ironfede openmcdfOpenMcdf has an Infinite loop DoS via crafted CFB directory cycle6.2 Medium
- evomap evolverEvolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write8.1 High
- evomap evolverEvolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution9.8 Critical
- evomap evolverEvolver: Prototype Pollution via `Object.assign()` in mailbox store operations5.2 Medium
- orneryd nornicdbNornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access9.8 Critical
- radare radare2radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names8.4 High
- emilstenstrom justhtmljusthtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities5.1 Medium
- squidexSquidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction5.5 Medium
- squidexSquidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)7.3 High
- squidexSSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient7.3 High
- squidexSquidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests7.2 High
- wekanWeKan < 8.35 SSRF via Webhook URL6.3 Medium
- wekanWeKan < 8.35 Missing Authorization via Integration REST API8.7 High
- uuidjs uuidDuplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided3.2 Low
- uuidjs uuiduuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided8.1 High
- siyuan-note siyuanSiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint7.1 High
- mcphubMCPHub: Path Traversal via Malicious MCPB Manifest Name6.9 Medium
- jackc pgxpgx: SQL Injection via placeholder confusion with dollar quoted string literals2.3 Low
- cyfershepard jellystatJellystat has SQL Injection that leads to to Remote Code Execution9.1 Critical
code.gitea.io/giteaGoGitea has insecure default SSH settings6.3 Medium- flarum frameworkFlarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)4.9 Medium
- locizelocize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor7.5 High
- locize i18next-locize-backendPath traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend6.5 Medium
- i18next i18next-http-middlewareHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header8.6 High
- Show moreLoading…