CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- nsa grassmarlinNSA GRASSMARLIN Improper Restriction of XML External Entity Reference5.5 Medium
- carlson software vasco-b gnss receiverCarlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function9.4 Critical
- No product listedo2oa NodeAgent NodeAgent.java syncFile improper authorization6.3 Medium
- No product listedo2oa URL Fetching FileAction.java FileAction server-side request forgery5.3 Medium
- ercom cryptoboxVulnerability in Cryptobox allows an authenticated user to trigger an account lockout4.9 Medium
- gnu glibc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreBuffer overread in ns_printrrf with corrupted RDATA field6.5 Medium
- No product listedJeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection5.3 Medium
- apache pony mailPony Mail: Admin account takeover via request smuggling9.8 Critical
- d-link dir-825m, dlink dir-825m firmware +1 moreD-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow8.7 High
- spring grpc, vmware spring grpc +1 moreSpring gRPC AuthenticationException message reflected to remote client3.7 Low
- xengrant table v2 race in status page mapping7.8 High
- xenXenstored DoS via XS_RESET_WATCHES command6.5 Medium
- d-link dir-825m, dlink dir-825m firmware +1 moreD-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow8.7 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injection5.1 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the WebRTC: Networking component9.6 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Thunderbird 150.0.17.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreMemory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.17.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreMemory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.17.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreInformation disclosure due to incorrect boundary conditions in the Audio/Video component7.5 High
- opencatsOpenCATS PHP Code Injection via installer AJAX endpoint9.2 Critical
- spring grpc, vmware spring grpc +1 moreSpring gRPC SecurityContext leaks across requests on authorization failure4.3 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection5.1 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting4.8 Medium
- binsoft mpcrm, mpfaktura, mpfirma +5 more +7 moreRemote Code Execution in multiple BinSoft products4.7 Medium
- binsoft mpcrm, mpfaktura, mpfirma +5 more +7 moreUse of Client-Side Authentication in multiple BinSoft products8.4 High
- binsoft mpcrm, mpfaktura, mpfirma +5 more +7 morePrivilege Escalation in multiple BinSoft products6.9 Medium
- devolutions serverImproper access control in the vault documentation feature in Devolutions Server 2026.1.14.0...6.5 Medium
- cisco intersight device connector, nutanix cisco intersight device connector for prism central +1 moreCisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access6.7 Medium
- williamcloudqi matlab-mcp-serverWilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal6.9 Medium
- redhat openshift container platform, red hat openshift container platform 4 +1 moreOpenshift-controller-manager: openshift container platform: information disclosure via environment variable injection4.3 Medium
- dv0x creative-ad-agentDV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal6.9 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System index.php cross site scripting4.8 Medium
- gnu glibc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 morePotential buffer overflow in ns_sprintrrf TSIG handling path7.3 High
- agilonhealth minervaMultiple vulnerabilities in MphRx's Minerva8.5 High
- agilonhealth minervaMultiple vulnerabilities in MphRx's Minerva8.5 High
- agilonhealth minervaMultiple vulnerabilities in MphRx's Minerva9.4 Critical
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php save_category sql injection5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System view_prod.php sql injection5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php save_order sql injection5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System index.php category sql injection5.3 Medium
- vega vegapuls 6x firmware, vega grieshaber vegapuls 6x two-wire profinet, modbus tcp, opc ua (ethernet-apl) +1 moreVEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices7.5 High
- empia technology avacasteMPIA Technology｜AVACAST - Unquoted Service Path8.4 High
- empia technology avacasteMPIA Technology｜AVACAST - DLL Hijacking8.5 High
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection5.3 Medium
- apache thriftApache Thrift: Node.js skip() recursion8.7 High
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: C++ JSON OOB read6.5 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: c_glib dispatch stack overflow5.3 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Compact Protocol integer overflow7.3 High
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Range crash in skip()8.2 High
- apache thrift, red hat multicluster global hub, multicluster global hub 1.3.4 +17 more +19 moreApache Thrift: Go TFramedTransport uint32 overflow7.5 High
- Show moreLoading…