CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- miyagawa plack::middleware::xsendfile, plack\ +1 morePlack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting9.1 Critical
- utt hiper 1250gwUTT HiPER 1250GW NTP strcpy buffer overflow8.7 High
- admidioAdmidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation6.8 Medium
- admidioAdmidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest8.2 High
- admidioAdmidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed8.2 High
- admidioAdmidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send3.5 Low
- admidioAdmidio: Missing Minimum Administrator Check in Role Membership Removal5.2 Medium
- admidioAdmidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion6.1 Medium
- admidioAdmidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP7.1 High
- admidioAdmidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment2.7 Low
- admidioAdmidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items6.5 Medium
- algovate xhs-mcpAlgovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery6.9 Medium
- admidioAdmidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php4.9 Medium
- admidioAdmidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read4.5 Medium
- admidioAdmidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials6.5 Medium
- openclawOpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding6.3 Medium
- polarvista xcode-mcp-serverPolarVista xcode-mcp-server MCP index.ts run_tests os command injection6.9 Medium
- openclawOpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders2.3 Low
- n8nn8n: XML Node Prototype Pollution to RCE9.4 Critical
- n8nn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE9.4 Critical
- n8nn8n: XSS via MCP OAuth client8.8 High
- n8nn8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay7.1 High
- n8nn8n: Python Task Runner Sandbox Escape7.1 High
- n8nn8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure6.0 Medium
- n8nn8n: Unauthenticated Denial of Service via MCP Client Registration8.7 High
- n8nn8n: Hijacking of Unauthenticated Chat Execution6.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php add_to_cart sql injection5.3 Medium
- n8nn8n: SQL Injection in SeaTable Node5.3 Medium
- n8nn8n: Open Redirect in MCP OAuth Consent Flow5.1 Medium
- n8nn8n: SQL Injection in Oracle Database Node via Limit Field5.3 Medium
- n8nn8n: SQL Injection in Snowflake and MySQL Nodes5.3 Medium
- icinga ipl-webipl/web is vulnerable to reflected XSS by malformed search requests7.6 High
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php save_user sql injection5.1 Medium
com.appsmith:interfacesMavenappsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution7.2 High- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services8.5 High
- roadiz core-bundle-dev-appRoadiz OpenID Connect nonce generated but never validated — ID token replay attack5.7 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection5.1 Medium
- osrg gobgpGoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE7.5 High
- osrg gobgpGoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute7.5 High
- ci4-cms-erp ci4msCI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution8.6 High
- hyperledger fabricObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE9.3 Critical
- ckanCKAN: CSRF exemption primed by anonymous requests6.1 Medium
- ckanCKAN: No certificate validation on STMP connection6.6 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injection5.1 Medium
- phpoffice phpspreadsheetPhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions7.5 High
- phpoffice phpspreadsheetPhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader7.5 High
- phpoffice phpspreadsheetPhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load9.2 Critical
- opentelemetry opentelemetry.exporter.onecollector, open-telemetry opentelemetry-dotnet-contrib +1 moreOpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body5.3 Medium
- gnu wget2wget2 Improper Certificate Validation4.8 Medium
- getsimpletool mcpo-simple-servergetsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal6.9 Medium
- Show moreLoading…