CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- rescue themes shortcodesWordPress Rescue Shortcodes plugin <= 3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- navneil naicker acf galerie 4WordPress ACF Galerie 4 plugin <= 1.4.2 - Broken Access Control vulnerability4.3 Medium
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- zurich instruments labonePath Traversal Vulnerability in LabOne User Interface8.7 High
- borg technology corporation spm 2007BorG Technology Corporation｜Borg SPM 2007 - SQL Injection9.3 Critical
- borg technology corporation spm 2007BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass9.3 Critical
- borg technology corporation spm 2007BorG Technology Corporation｜Borg SPM 2007 - Arbitrary File Upload9.3 Critical
- h2o, h2oai h2oai/h2o-3 +1 moreRemote Code Execution in h2oai/h2o-35.9 Medium
- google cloud bigquerySensitive Data Disclosure in BigQuery via Materialized View Error Messages7.1 High
- smub exactmetrics – google analytics dashboard for wordpress (website stats plugin)ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process7.2 High
qt6-translationsopenSUSESecurity update for qt6-translationsNo score- dcit cryptxCryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking7.5 High
- growi, inc. growiGROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via...8.7 High
- efficientlab, llc controlioDLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation5.1 Medium
- i-pro co., ltd. ip setting softwareIP Setting Software contains an issue with the DLL search path, which may lead to insecurely...7.0 High
- unknown recaptcha by webdesignbyWP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS3.5 Low
- unknown ht mega addons for elementorHT Mega < 3.0.7 – Unauthenticated PII Disclosure5.3 Medium
- gnupg libgcryptLibgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds...4.0 Medium
- gnupg libgcrypt, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreLibgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via...6.7 Medium
- kanata limited cms alayaCMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored...5.1 Medium
- tijmensmit wp store locatorWP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta6.4 Medium
- three learning koollab learning management systemStored Cross-Site Scripting (XSS) Vulnerability5.4 Medium
- cloudways breeze cacheBreeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote9.8 Critical
- gutentor – gutenberg blocks – page builder for gutenberg editorGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML5.4 Medium
- socialrocket social rocket – social sharing pluginSocial Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id6.4 Medium
- nuwcdivnpt stig-managerSTIG Manager has reflected XSS vulnerability in the Web App8.5 High
- siemvk openlearnOpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled6.9 Medium
- japan media systems corporation canonnwcamplugin.exe, canonnwcampluginforadmin.exe, downloader5installer.exe +1 more +3 moreThe installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and...8.4 High
- zio ziostation2A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A remote...8.7 High
- bytedance verlByteDance verl grader.py math_equal sandbox6.3 Medium
qemuAlpaquita,qemu-hweUbuntu +1 moreUpdated qemu packages fix many security vulnerabilitiesNo scoreqemuAlpaquita,qemu-hweUbuntu +1 moreUpdated qemu packages fix many security vulnerabilitiesNo scoreqemuAlpaquita,qemu-hweUbuntu +1 moreUpdated qemu packages fix many security vulnerabilitiesNo score- ruby erb, red hat enterprise linux 10, enterprise linux 10.0 extended update support +10 more +12 moreERB has an @_init deserialization guard bypass via def_module / def_method / def_class8.1 High
- openvpnA race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote...6.1 Medium
- ntfyntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function6.4 Medium
qemuAlpaquita,qemu-hweUbuntu +1 moreUpdated qemu packages fix many security vulnerabilities8.8 High- openvpnImproper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through...6.9 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...9.8 Critical
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...9.8 Critical
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...9.8 Critical
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...9.8 Critical
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...6.5 Medium
- Show moreLoading…