CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- google chromeUse after free in WebView in Google Chrome on Android prior to 147.0.7727.138 allowed a remote...8.8 High
- google chromeUse after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- google chromeInsufficient validation of untrusted input in Feedback in Google Chrome prior to 147.0.7727.138...8.3 High
- google chromeUse after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local...7.5 High
- google chromeUse after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker...8.1 High
- google chromeInappropriate implementation in Tint in Google Chrome prior to 147.0.7727.138 allowed a remote...8.1 High
- google chromeType Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- google chromeUse after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- google chromeUse after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- google chromeUse after free in Codecs in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- google chromeUse after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who...8.3 High
- google chromeUse after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local...7.5 High
- google chromeUse after free in Media in Google Chrome on Android prior to 147.0.7727.138 allowed a remote...8.3 High
- google chromeRace in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user...3.1 Low
- google chromeOut of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote...8.8 High
- google chromeHeap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker...8.3 High
- google chromeUse after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had...7.5 High
- google chromeUse after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker...8.8 High
- google chromeUse after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who...8.8 High
- google chromeUse after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- google chromeUse after free in Views in Google Chrome on Mac prior to 147.0.7727.138 allowed a remote attacker...8.8 High
- google chromeInsufficient validation of untrusted input. in Compositing in Google Chrome prior to 147.0.7727...3.1 Low
- google chromeUse after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...9.6 Critical
- google chromeUse after free in Accessibility in Google Chrome on Windows prior to 147.0.7727.138 allowed a...8.8 High
- google chromeUse after free in Views in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote...7.5 High
- google chromeUse after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a...8.8 High
- google chromeUse after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- gofiber fibergithub.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters6.5 Medium
- elastic package registryImproper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass5.9 Medium
- snap one, llc wattbox 800, wattbox 820 +1 moreWattBox 800 & 820 Series < 2.10.0.0 RCE via Diagnostic Endpoints9.2 Critical
- elinsky execution-system-mcpelinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal6.9 Medium
- elie mcp-projectelie mcp-project research_server.py search_papers path traversal5.1 Medium
- grav cmsGrav CMS Cache Value FileCache.php doGet deserialization2.3 Low
- eiliyaabedini aider-mcpeiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection6.9 Medium
- getoutline outlineOutline has IDOR in document share creation that allows unauthorized access to private documents across workspaces7.7 High
- eiceblue spire-pdf-mcp-servereiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal6.9 Medium
- eiceblue spire-doc-mcp-servereiceblue spire-doc-mcp-server base.py get_doc_path path traversal6.9 Medium
- xuxueli xxl-jobXuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key6.3 Medium
- xuxueli xxl-jobXuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery5.3 Medium
- xuxueli xxl-jobXuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection6.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php save_user cross site scripting4.8 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scripting4.8 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php save_menu cross site scripting4.8 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System index.php save_settings cross site scripting4.8 Medium
- nvidia nemoclawNVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component,...6.3 Medium
- nvidia nemoclawNVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component,...8.6 High
- nvidia flare sdk, nvflare +1 moreNVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input...6.5 Medium
- nvidia flare sdk, nvflare +1 moreNVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization...8.8 High
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php delete_category sql injection5.1 Medium
- nvidia nvflare, flare sdk +1 moreNVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system9.8 Critical
- Show moreLoading…