CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- geldata gel-mcpgeldata gel-mcp server.py fetch_rule path traversal6.9 Medium
- cockpit cmsCockpit CMS Authenticated Remote Code Execution via Collections8.7 High
- videoflow ltd. digital video protectionVideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal7.1 High
- videoflow ltd. digital video protectionVideoFlow Digital Video Protection DVP 2.10 - Authenticated Remote Code Execution5.3 Medium
- tenda a300 firmware, fh303/a300, fh303 firmware +2 moreTenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change9.3 Critical
- tenda a302, w3002r, w309r +3 more +5 moreTenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change9.3 Critical
- tenda w308r v2, w308r firmware +1 moreTenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change9.3 Critical
- alloksoft video joinerAlloksoft Video joiner 4.6.1217 Buffer Overflow via License Name8.6 High
- alloksoft wmv to avi mpeg dvd wmv converterAllok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow8.6 High
- sysgaugeSysGauge 4.5.18 Local Denial of Service via Proxy Configuration6.9 Medium
- lifesize clearseaLifeSize ClearSea 3.1.4 Directory Traversal Remote Code Execution7.1 High
- mybb recent threads, dragonexpert recent threads on index +1 moreMyBB Recent threads 17.0 Persistent Cross-Site Scripting5.1 Medium
- donmik buddypress xprofile custom fields typeBuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion8.7 High
- sysgauge proSysGauge Pro 4.6.12 Local Buffer Overflow SEH8.6 High
- canonical pdfunitePDFunite 0.41.0 Buffer Overflow via Malformed PDF6.9 Medium
- librsvg librsvg2-binlibrsvg2-bin 2.40.13 Buffer Overflow via Malformed SVG6.9 Medium
- filehippo free download managerFree Download Manager 2.0 Build 417 Local Buffer Overflow SEH8.6 High
- alloksoft allok video to dvd burnerAllok Video to DVD Burner 2.6.1217 Buffer Overflow SEH8.6 High
- alloksoft allok avi to dvd svcd vcd converterAllok AVI to DVD SVCD VCD Converter 4.0.1217 Buffer Overflow SEH8.5 High
- easy mpeg to dvd burnerEasy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow8.6 High
- xataboost cmsXATABoost CMS 1.0.0 SQL Injection via news.php8.8 High
- mersenne prime95Prime95 29.4b8 Local Buffer Overflow via SEH8.6 High
- merge pacsMerge PACS 7.0 Cross-Site Request Forgery via merge-viewer6.9 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting5.3 Medium
- geekgod382 filesystem-mcp-servergeekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal6.9 Medium
- amazon freertos-plus-tcpOut-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP6.1 Medium
- amazon freertos-plus-tcpOut-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP6.0 Medium
- amazon freertos-plus-tcpInteger Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP7.2 High
- berabuddies agentflowAgentFlow Arbitrary Python Pipeline Execution via pipeline_path7.7 High
- amazon freertos-plus-tcpInteger Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP6.0 Medium
- amazon freertos-plus-tcpMAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing7.1 High
- opentelemetry opentelemetry.resources.azure, open-telemetry opentelemetry-dotnet-contrib +1 moreUnbounded HTTP response body read in OpenTelemetry.Resources.Azure5.9 Medium
- florensiawidjaja bioinfomcpflorensiawidjaja BioinfoMCP Upload Endpoint app.py upload path traversal6.9 Medium
- beetbox beetsbeets is Vulnerable to XSS6.0 Medium
- dell dell/alienware purchased apps, dell\/alienware purchased apps +1 moreDell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution...6.3 Medium
- berabuddies agentflowAgentFlow Local Web API Content-Type Validation Bypass4.8 Medium
- wazuhWazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()6.5 Medium
- nousresearch hermes-agentNousResearch hermes-agent file_tools.py _check_sensitive_path symlink4.8 Medium
- wazuhWazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer9.0 Critical
- wazuhWazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_646.5 Medium
- wazuhWazuh: API brute-force protection bypass via race condition in login attempt tracking6.5 Medium
- wazuhWazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData4.4 Medium
- arc53 docsgptUnauthenticated RCE in DocsGPT MCP STDIO Configuration10.0 Critical
- nousresearch hermes-agentNousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal6.9 Medium
- sailpoint identityiqIdentityIQ Role Editor Incorrect Authorization Vulnerability8.0 High
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection5.1 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload5.1 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreFlaw in the updateUser Command May Allow Unauthorized Configuration Change5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMD5 checksum creation may cause availability loss7.1 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection5.3 Medium
- Show moreLoading…