CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- kyvernoKyverno Controller Denial of Service via forEach Mutation Panic7.7 High
- smub exactmetrics – google analytics dashboard for wordpress (website stats plugin)ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'5.3 Medium
- ckp267 maxiblocks builder | 17,000+ design assets, patterns, icons & starter sitesMaxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter5.3 Medium
- wpdevteam betterdocs – knowledge base docs & faq solution for elementor & block editorBetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage4.3 Medium
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component5.4 Medium
- frappe pressPress vulnerable to reflected XSS on login redirection1.3 Low
- frappe pressFrappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation6.6 Medium
- opensource-socialnetworkOpen Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing8.2 High
- postcssPostCSS has XSS via Unescaped </style> in its CSS Stringify Output6.1 Medium
- freerdpFreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..4.2 Medium
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure8.7 High
- roxy-wiRoxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint7.4 High
- roxy-wiRoxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter8.9 High
- roxy-wiRoxy-WI has an arbitrary file read vulnerability7.7 High
- roxy-wiRoxy-WI vulnerable to path traversal and arbitrary file writing8.9 High
- getkirby kirbyKirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection7.1 High
kimageformatsOSS-FuzzUse-of-uninitialized-value in JXRHandlerPrivate::colorSpaceNo score- xibosignage xibo, xibo-cms +1 moreXibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization4.3 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality4.9 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login6.4 Medium
- senselive x3050SenseLive X3050 Missing authentication for critical function9.3 Critical
- xibosignage xibo, xibo-cms +1 moreXibo CMS API has SQL Injection via DataSet Filter Parameter7.6 High
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing authentication for critical function8.7 High
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing authentication for critical function9.3 Critical
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Cross-Site request forgery8.4 High
- kde ariannabookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection...4.0 Medium
- No product listedAn issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of...5.3 Medium
- No product listedAn issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of...3.8 Low
- No product listedCross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote...4.9 Medium
- lightspeed classroomA client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated...5.4 Medium
- No product listedA Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low...6.5 Medium
- No product listedMahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via...6.1 Medium
- No product listedIn Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution...4.7 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing Authorization7.2 High
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Cleartext transmission of sensitive information6.9 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing authentication for critical function9.2 Critical
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Insufficiently Protected Credentials9.3 Critical
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Use of Hard-coded Credentials9.3 Critical
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Insufficient session expiration6.9 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Authentication bypass using an alternate path or channel9.3 Critical
- canon inc. i-sensys c1533if ii, i-sensys mf842cdw, i-sensys x c1538 if ii +12 more +14 moreA vulnerability in the browser-based remote management interface may allow an administrator to...6.9 Medium
- rocket.chatIn versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the...4.3 Medium
- xmlsoft libxml2, ibm aix, vios +10 more +12 moreLibxml2: libxml2: denial of service via crafted xsd-validated document6.5 Medium
- openclawOpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context2.3 Low
- chainguard melangemelange has Path Traversal via .PKGINFO in --persist-lint-results4.4 Medium
- chainguard melangemelange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses6.1 Medium
- withastro @astrojs/cloudflare@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint2.2 Low
- th30d4y openlearnxOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment8.8 High
- microsoft entra id, entra +1 moreMicrosoft Entra ID Entitlement Management Spoofing Vulnerability10.0 Critical
- microsoft power appsMicrosoft Power Apps Remote Code Execution Vulnerability8.0 High
- Show moreLoading…