CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +16 more +18 moreApache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.7.5 High
- d-link di-8100, dlink di-8100 firmware +1 moreD-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflow9.3 Critical
- d-link di-8100, dlink di-8100 firmware +1 moreD-Link DI-8100 File Extension file_exten.asp file_exten_asp buffer overflow8.6 High
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection9.3 Critical
- desktime time tracking app, draugiemgroup desktime time tracking +1 moreImproper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App4.8 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection9.3 Critical
- spring ai, vmware spring ai +1 moreSpring AI Vulnerable to OOM by attacker-controlled PDF6.5 Medium
- spring ai, vmware spring ai +1 moreSpring AI's ONNX model cache defaults to world-writable predictable /tmp directory6.1 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection9.3 Critical
- spring ai, vmware spring ai +1 moreSpring AI has SQL Injection in CosmosDBVectorStore.doDelete()8.8 High
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection9.3 Critical
- hanwha vision qnd-8080r, hanwhavision knb-2000 firmware, knb-5000n firmware +251 more +253 moreAuthentication Bypass8.7 High
- hanwha vision qnd-8080r, hanwhavision knb-2000 firmware, knb-5000n firmware +251 more +253 moreCommand Injection8.5 High
- code-projects online music sitecode-projects Online Music Site AdminUpdateAlbum.php unrestricted upload5.1 Medium
- hanwha vision qnd-8080r, hanwhavision knb-2000 firmware, knb-5000n firmware +251 more +253 moreMissing Error/Exception Handling5.3 Medium
- masaakitanaka booking packageBooking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter5.3 Medium
- duongancol woostifyWoostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block6.4 Medium
- agiflow scaffold-mcpAgiFlow scaffold-mcp write-to-file Tool index.ts path traversal6.9 Medium
- vmware spring aiVectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration5.9 Medium
- erlichliu claude-agent-sdk-masterErlichLiu claude-agent-sdk-master route.ts path traversal6.9 Medium
- browseroperator browser-operator-coreBrowserOperator browser-operator-core server.js startsWith path traversal6.9 Medium
- spring ai, vmware spring ai +1 moreSpring AI has a VectorStore FilterExpression Converter injection8.6 High
- artifex mupdfArtifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds4.8 Medium
- unknown check & log emailCheck & Log Email < 2.0.13 - Unauthenticated Stored XSS5.4 Medium
- sourcecodester safety anger padSourceCodester Safety Anger Pad cross site scripting5.3 Medium
- code-projects coaching management systemcode-projects Coaching Management System POST reply.php sql injection5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection6.9 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php login sql injection6.9 Medium
- openstack ironicOpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere6.6 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection6.9 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection6.9 Medium
- dartiss social post embedSocial Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed6.4 Medium
- wpclever wpc smart messages for woocommerceWPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute6.4 Medium
- techeshta timeline blocks for gutenbergTimeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute6.4 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection6.9 Medium
- bigsweetpotatostudio hyperchatBigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery6.9 Medium
- code-projects coaching management systemcode-projects Coaching Management System Complaint Form complaint.php cross site scripting5.1 Medium
- tencentcloudbase cloudbase-mcpTencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery6.9 Medium
- jackwrichards fastlymcpjackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection6.9 Medium
- totolink n300rtTotolink N300RT formIpQoS buffer overflow8.6 High
- totolink n300rtTotolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow8.6 High
- deepractice promptxDeepractice PromptX Document File index.ts read_pdf absolute path traversal6.9 Medium
- donchelo processing-claude-mcp-bridgedonchelo processing-claude-mcp-bridge create_sketch Tool processing_server.py path traversal6.9 Medium
- zyxel ex3301-t0 firmware, am7510-00 firmware, ax7501-b1 firmware +42 more +44 moreA post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP...7.2 High
- egtai gmx-vmd-mcpegtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection6.9 Medium
- zyxel dx3300-t0 firmware, ax7501-b0 firmware, ax7501-b1 firmware +33 more +35 moreA post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel...6.8 Medium
- eghuzefa engineer-your-dataeghuzefa engineer-your-data server.py file_inf path traversal6.9 Medium
- ef10007 mlops mcpef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal6.9 Medium
- edvardlindelof notes-mcpedvardlindelof notes-mcp notes_mcp.py path traversal6.9 Medium
- Show moreLoading…