CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- crm sistemas de fidelización megacmsSQL injection in MegaCMS by CRM Sistemas de Fidelización10.0 Critical
- cdac-noida e-sushrut, hospital management information system (hmis)Cryptographic Failure Vulnerability in e-Sushrut HMIS7.1 High
- complianz – gdpr/ccpa cookie consentComplianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint5.3 Medium
- cdac-noida e-sushrut, hospital management information system (hmis)Broken Access Control Vulnerability in e-Sushrut HMIS7.1 High
- cdac-noida e-sushrut, hospital management information system (hmis)Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS7.1 High
- cdac-noida e-sushrut, hospital management information system (hmis)Sensitive Data Exposure Vulnerability in e-Sushrut HMIS8.8 High
- cdac-noida e-sushrut, hospital management information system (hmis)Authentication Bypass Vulnerability in e-Sushrut HMIS8.8 High
- wso2 identity serverReflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server6.1 Medium
- curlOCSP stapling bypass with Apple SecTrust5.3 Medium
- curlnetrc credential leak with reused proxy connection5.3 Medium
- curlstale custom cookie host causes cookie leak7.5 High
- curlproxy credentials leak over redirect-to proxy5.9 Medium
- curlwrong reuse of SMB connection7.5 High
- curlwrong reuse of HTTP Negotiate connection6.5 Medium
- curlconnection reuse ignores TLS requirement5.9 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability6.5 Medium
- brainstorm force sureforms proWordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability7.3 High
- samsung android, samsung mobile devices +1 moreInsufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026...6.9 Medium
- dell idrac10, idrac10 firmware +1 moreDell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected...7.1 High
- dell disk library for mainframe dlm2700, disk library for mainframe dlm8700 +1 moreDell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request...4.3 Medium
- gchq cyberchefCyberChef has a Cross-site Scripting issue7.2 High
matioOSS-FuzzUse-of-uninitialized-value in Mat_int32SwapNo scoregdalOSS-FuzzContainer-overflow in OGRGeometryFactory::organizePolygonsNo scoresentencepieceOSS-FuzzHeap-buffer-overflow in sentencepiece::unigram::Model::EncodeOptimizedNo score- curlcross-proxy Digest auth state leak5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreCockpit is vulnerable to directory traversal6.5 Medium
cockpit-hq/cockpitPackagistCockpit is vulnerable to arbitrary code execution9.8 Criticalcockpit-hq/cockpitPackagistCockpit Vulnerable to Unrestricted Upload of File with Dangerous Type8.8 High- libsndfile project libsndfile, red hat ai inference server 3.3, enterprise linux 10 +14 more +16 moreAn issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was...7.5 High
- No product listedTOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and...9.8 Critical
- No product listedTOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer...7.5 High
- entechtaiwan tvicportAn issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0...7.8 High
- opennebulaA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0...6.1 Medium
- opennebulaA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to...6.1 Medium
- opennebulaA cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute...6.1 Medium
- opennebulaA cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10...6.1 Medium
- No product listedA vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to...7.3 High
- miyagawa starmanStarman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence7.5 High
- opentelemetry opentelemetry.exporter.zipkin, open-telemetry opentelemetry-dotnet +1 moreOpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth5.3 Medium
- phpoffice phpspreadsheetPhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes5.4 Medium
- coredns, red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.14 +1 more +3 moreCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports8.2 High
- phpoffice phpspreadsheetPhpSpreadsheet XSS via number format text substitution in HTML Writer4.8 Medium
- corednsCoreDNS TSIG authentication bypass on encrypted DNS transports8.7 High
- corednsCoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison8.2 High
- corednsCoreDNS DoH GET path missing size validation causes CPU and memory amplification8.7 High
- corednsCoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service8.7 High
- neorazorx facturascriptsFacturaScripts unauthorized modification of immutable nick field via EditUser controller5.3 Medium
- google chromeUse after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in ANGLE in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote...4.3 Medium
- google chromeHeap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker...8.8 High
- Show moreLoading…