CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- dvladimirov mcpdvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection6.9 Medium
- dubydu sqlite-mcpdubydu sqlite-mcp entry.py extract_to_json sql injection6.9 Medium
- duartium papers-mcp-serverduartium papers-mcp-server main.py search_papers path traversal6.9 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection9.3 Critical
- proftpdmod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a...8.1 High
- pupnppupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion6.9 Medium
- kde kcoreaddonsIn KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that...6.5 Medium
- kde dolphinKDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to...6.5 Medium
python-pyOpenSSLopenSUSE,golang-github-prometheus-prometheusSUSE,grafanaSUSE +36 more +38 moreSecurity update for python-pyOpenSSLNo score- mit kerberos 5In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of...5.9 Medium
- mit kerberos 5, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application...5.9 Medium
- No product listedCross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation...8.9 High
- No product listedCross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset...5.4 Medium
- netmakerNetmaker does not verify JWT signatures for host tokens8.2 High
- No product listedA reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1...6.1 Medium
openjdk-13Ubuntu,openjdk-16Ubuntu,openjdk-18Ubuntu +2 more +4 more[updated libpng in Oracle Java]No score- No product listedThe Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12...7.5 High
- stellar-group hpxInsecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions...9.8 Critical
- No product listedAn issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input...5.3 Medium
- milesight ms-c2964-rflpc, ms-c2966-rflwpc, ms-c2966-x12rlpc +79 more +81 moreMilesight Cameras Heap-based Buffer Overflow8.6 High
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection9.3 Critical
- milesight ms-c2964-rflpc, ms-c2966-rflwpc, ms-c2966-x12rlpc +79 more +81 moreMilesight Cameras OS Command Injection7.3 High
- milesight ms-c2964-rflpc, ms-c2966-rflwpc, ms-c2966-x12rlpc +79 more +81 moreMilesight Cameras Use of Hard-coded Cryptographic Key9.2 Critical
- milesight ms-c2964-rflpc, ms-c2966-rflwpc, ms-c2966-x12rlpc +79 more +81 moreMilesight Cameras Use of Hard-coded Credentials7.7 High
- spring boot, vmware spring boot +1 moreSpring Boot's PID file write follows symlinks at predictable default path4.7 Medium
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without Health9.1 Critical
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secrets4.8 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's Cassandra SSL auto-configuration disables TLS hostname verification5.0 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System index.php cross site scripting5.3 Medium
- spring boot, vmware spring boot +1 moreSpring Boot accepts predictable temp directory without ownership verification7.0 High
- spring boot, vmware spring boot +1 moreSpring Boot DevTools remote secret comparison is vulnerable to timing attacks7.5 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- codeastro online classroomCodeAstro Online Classroom guestdetails sql injection5.3 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker5.0 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php sql injection6.9 Medium
- milesight ms-c2964-rflpc, ms-c2966-rflwpc, ms-c2966-x12rlpc +79 more +81 moreMilesight Cameras Authorization Bypass Through User-Controlled Key7.3 High
- aligungr ueransimaligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception6.9 Medium
- ospg binwalkOSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal4.8 Medium
- chatgptnextweb nextchatChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery6.9 Medium
- chatgptnextweb nextchatChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery6.9 Medium
- tenda hg3, hg3 firmware +1 moreTenda HG3 formTracert command injection8.7 High
- douinc mkdocs-mcp-plugindouinc mkdocs-mcp-plugin server.py list_documents path traversal6.9 Medium
- dmitryglhf mcp-url-downloaderdmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery6.9 Medium
- python, python software foundation cpython +1 moreshutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs6.0 Medium
- disler aider-mcp-serverdisler aider-mcp-server aider_ai_code server.py command injection6.9 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi CsteSystem os command injection9.3 Critical
- pimcorePimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering4.8 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection9.3 Critical
- aws qnabot on awsArbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS8.6 High
- Show moreLoading…