CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- sonicwall sonicosA post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote...4.9 Medium
- sonicwall sonicosA post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with...6.8 Medium
- sonicwall sonicosA vulnerability in the access control mechanism of SonicOS may allow certain management interface...8.0 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection5.3 Medium
- pgjdbc, postgresql jdbc driver, red hat amq broker 7.13.6 +17 more +19 morepgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS7.5 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting5.1 Medium
- helpy.io helpyHelpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering4.8 Medium
- helpy.io helpyHelpy 2.8.0 - Stored XSS in post author display via PostsHelper5.1 Medium
- No product listedEyouCMS common.php GetSortData sql injection6.9 Medium
- netskope clientEndpoint DLP Driver Out-of-Bounds Read6.8 Medium
- No product listedEyouCMS Template File FilemanagerLogic.php editFile code injection5.1 Medium
- cpanel, cpanel whm, wp squared +1 more +3 moreWebPros cPanel and WHM Authentication Bypass via Login Flow9.3 Critical
- fatbobman mail-mcp-bridgefatbobman mail-mcp-bridge mail_mcp_server.py path traversal6.9 Medium
- tubitak bilgem software technologies research institute pardus os my computerOS Command Injection in TUBITAK BILGEM's Pardus OS My Computer8.8 High
- tubitak bilgem software technologies research institute pardus software centerPath Traversal in TUBITAK BILGEM's Pardus Software Center9.6 Critical
- ezequiroga mcp-basesezequiroga mcp-bases research_server.py search_papers path traversal6.9 Medium
- tubitak bilgem software technologies research institute pardus aboutImproper Authentication in TUBITAK BILGEM's Pardus About8.8 High
- hmbrand text::csv xs, text\ +1 moreText::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption8.4 High
- tubitak bilgem software technologies research institute pardus software centerImproper Access Control in TUBITAK BILGEM's Pardus Software Center8.8 High
- vimVim: OS Command Injection in netrw4.4 Medium
- acronis cyber protect cloud agent, devicelock dlp +1 moreLocal privilege escalation due to improper input validation. The following products are affected:...7.8 High
- acronis cyber protect cloud agent, devicelock dlp +1 moreLocal privilege escalation due to improper input validation. The following products are affected:...7.8 High
- acronis devicelock dlpLocal privilege escalation due to DLL hijacking vulnerability. The following products are...6.7 Medium
- jenkins azure ad, jenkins project microsoft entra id (previously azure ad) plugin +1 moreJenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability4.3 Medium
- jenkins html publisher, jenkins project html publisher plugin +1 moreJenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file8.0 High
- jenkins github, jenkins project github plugin +1 moreJenkins GitHub Plugin has an XSS vulnerability9.0 Critical
- jenkins github branch source, jenkins project github branch source plugin +1 moreJenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test4.3 Medium
- jenkins matrix authorization strategy, jenkins project matrix authorization strategy plugin +1 moreJenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors6.5 Medium
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreJenkins Credentials Binding Plugin has a path traversal vulnerability7.5 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths4.3 Medium
- tubitak bilgem software technologies research institute pardus updateAuthorization Bypass in TUBITAK BILGEM's Pardus Update8.8 High
- modelcontextprotocol rust-sdkRMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport8.8 High
- eximIn Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA...4.8 Medium
- eximIn Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large...3.7 Low
- eximIn Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a...6.5 Medium
- ollamaRemote Code Execution in Ollama via Update Mechanism7.7 High
- ollamaMissing Signature Verification for Updates in Ollama7.7 High
- vmware spring frameworkCVE-2026-22745 : Denial of service in static resource handling on Windows platforms5.3 Medium
- vmware spring frameworkStatic resource cache poisoning in Spring MVC and WebFlux3.1 Low
- aguidrevitch wp meteor website speed optimization addonWP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment6.1 Medium
- vmware spring frameworkSpring Framework DoS with Multipart Temp Files in WebFlux6.5 Medium
- wpeverest user registrationWordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- brainstorm force spectraWordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability4.3 Medium
- steve burge taxopressWordPress TaxoPress plugin <= 3.44.0 - SQL Injection vulnerability7.6 High
- dmitry v. (ceo of "ukr solution") barcode scanner with inventory & order managerWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wpdeveloper betterdocsWordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Exposure vulnerability5.3 Medium
- stellarwp image widgetWordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- stellarwp givewpWordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability5.3 Medium
- illid share this imageWordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- cdac-noida e-sushrut, hospital management information system (hmis)Information Disclosure Vulnerability in e-Sushrut HMIS8.7 High
- Show moreLoading…