CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection9.3 Critical
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability8.8 High
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection9.3 Critical
- tenda hg3, hg3 firmware +1 moreTenda HG3 formIPv6Routing formUploadConfig stack-based overflow8.7 High
- pimcorePimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling7.0 High
- spring boot, vmware spring boot +1 moreSpring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.5.0 Medium
- dh1011 auto-favicondh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery5.3 Medium
- dexhunter kaggle-mcpdexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal6.9 Medium
- codeastro online classroomCodeAstro Online Classroom addnewfaculty sql injection5.3 Medium
- joecastrom mcp-chat-studioJoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery6.9 Medium
- dell alienware command center (awcc), alienware command center +1 moreDell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least Privilege...5.3 Medium
- dell alienware command center (awcc), alienware command center +1 moreDell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with...6.7 Medium
- alejandroarciniegas mcp-data-visAlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery6.9 Medium
- mettle sendportalmettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization5.3 Medium
- linux, linux kernel +1 moreigb: remove napi_synchronize() in igb_down()5.5 Medium
- linux, linux kernel +1 morefirmware: thead: Fix buffer overflow and use standard endian macros7.8 High
- linux, linux kernel +1 moreEDAC/mc: Fix error path ordering in edac_mc_alloc()5.5 Medium
- linux, linux kernel +1 moregpio: omap: do not register driver in probe()5.5 Medium
- linux, linux kernel +1 moremm/kasan: fix double free for kasan pXds7.8 High
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA update_passwd_process.php authorization5.3 Medium
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA block_status.php sql injection5.3 Medium
wooeyPyPIWooey API Endpoint scripts.py add_or_update_script improper authorization5.3 Medium- vllmvLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resource6.3 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi CsteSystem os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection9.3 Critical
- amd epyc™ 7001 series processors, epyc™ embedded 3000 series processors +1 moreA transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to...2.0 Low
gpacDebianGPAC MP4Box box_code_base.c elng_box_read out-of-bounds4.8 Medium- projeqtorProjeQtor < 12.4.4 Stored XSS via checkValidFileName()5.1 Medium
- projeqtorProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText()5.1 Medium
- projeqtorProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php7.1 High
- projeqtorProjeQtor < 12.4.4 Missing Authorization via objectDetail.php7.1 High
- projeqtorProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php8.7 High
- projeqtorProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login9.3 Critical
- code-projects online lot reservation systemcode-projects Online Lot Reservation System edithousepic.php unrestricted upload5.1 Medium
- code-projects online lot reservation systemcode-projects Online Lot Reservation System activity.php unrestricted upload5.1 Medium
- code-projects online lot reservation systemcode-projects Online Lot Reservation System download.php readfile path traversal6.9 Medium
- smartertools smartermailSmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG8.2 High
- pip maintainers pippip self-update functionality can import newly installed modules after wheel installation5.3 Medium
- code-projects online lot reservation systemcode-projects Online Lot Reservation System loginuser.php sql injection6.9 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- elixir-plug plug.cowboy, plug cowboy +1 moreAtom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy8.7 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System index.php cross site scripting5.3 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- apache storm prometheus reporterApache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections4.8 Medium
- apache storm, apache software foundation storm client +1 moreApache Storm Client: Anonymous principal assigned on TLS client certificate verification failure6.5 Medium
- Show moreLoading…