CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- cerberus ftp serverLocal Privilege Escalation in Cerberus FTP Server =< 2025.4.27.3 High
- ribblr crotchet and knittingAuthenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application5.3 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection9.3 Critical
- rrwo text::minify::xs, text\ +1 moreText::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters7.5 High
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection9.3 Critical
libcrux-ml-dsacrates.ioAVX2 Implementation Did Not Fully Reduce Intermediate ValuesNo scoreastral-tokio-tarcrates.ioastral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks2.7 Lowastral-tokio-tarcrates.ioastral-tokio-tar is Vulnerable to PAX Header Desynchronization6.6 Medium- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection9.3 Critical
- tenda hg3, hg3 firmware +1 moreTenda HG3 formCountrystr os command injection8.7 High
packagekitUbuntupackagekit vulnerabilityNo score- No product listedSecurity update for container-suseconnectNo score
- No product listedSecurity update for container-suseconnectNo score
- code-projects employee management systemcode-projects Employee Management System cancel.php sql injection5.3 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerability5.5 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability5.5 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability5.5 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- foxit pdf editor, pdf reader +1 moreUAF in Foxit PDF Editor/Reader via XFA calculate event5.5 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability7.8 High
- code-projects employee management systemcode-projects Employee Management System approve.php sql injection5.3 Medium
- code-projects employee management systemcode-projects Employee Management System mark.php cross site scripting5.3 Medium
- codexthemes thegem theme elements (for elementor)WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- directorist social loginWordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability9.8 Critical
- code-projects employee management systemcode-projects Employee Management System delete.php sql injection5.3 Medium
- directorist booking bookingWordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerability9.3 Critical
- code-projects employee management systemcode-projects Employee Management System edit.php sql injection5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication6.3 Medium
- apache camel, red hat build of apache camel for spring boot 4, fuse 7 +2 more +4 moreApache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store8.8 High
- apache camel, red hat build of apache camel 4.18.1 for spring boot 3.5.14, fuse 7 +2 more +4 moreApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution10.0 Critical
- nousresearch hermes-agentNousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication6.3 Medium
- apache camel, red hat build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +8 more +10 moreApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)9.4 Critical
- apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 moreApache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime8.2 High
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository8.8 High
- code-projects invoice system in laravelcode-projects Invoice System in Laravel item cross site scripting5.1 Medium
- apache minaApache MINA: CWE-502 Deserialization of Untrusted Data9.8 Critical
- code-projects invoice system in laravelcode-projects Invoice System in Laravel API Endpoint item improper authorization6.9 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel cross-site request forgery5.3 Medium
- apache minaApache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE9.8 Critical
- code-projects invoice system in laravelcode-projects Invoice System in Laravel company unrestricted upload5.3 Medium
- code-projects chat systemcode-projects Chat System MD5 Hash update_user.php weak hash6.3 Medium
- wpdeveloper templatelyWordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerability7.7 High
- apache camel, apache software foundation camel coap, camel google pubsub +10 more +12 moreApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows ca…9.9 Critical
- tenda f456, f456 firmware +1 moreTenda F456 httpd WriteFacMac FromWriteFacMac command injection5.3 Medium
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp9.8 Critical
- tenda f456, f456 firmware +1 moreTenda F456 httpd WrlclientSet fromWrlclientSet buffer overflow8.7 High
- Show moreLoading…