CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- pylixm django-mdeditordjango-mdeditor is Missing Authentication for Critical Function5.1 Medium
- tenda 4g300, 4g300 firmware +1 moreTenda 4G300 SafeMacFilter sub_427C3C stack-based overflow8.7 High
- tenda 4g300, 4g300 firmware +1 moreTenda 4G300 DelFil sub_425A28 command injection5.3 Medium
- 1024-lab smart-admin1024-lab smart-admin Demo Site index.html access control6.9 Medium
tarantoolOSS-FuzzHeap-buffer-overflow in lj_record_idxNo score- sourcecodester pet grooming management softwareSourceCodester Pet Grooming Management Software update_customer.php sql injection5.3 Medium
openexrOSS-FuzzHeap-buffer-overflow in generic_unpackNo scoreflywayOSS-FuzzSecurity exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternalNo score- vetcoders mcp-server-semgrepVetCoders mcp-server-semgrep MCP index.ts create_rule os command injection6.9 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +14 more +16 moreGnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal3.7 Low
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: information disclosure via heap overread in rsa key exchange8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +21 more +23 moreGnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling5.3 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +21 more +23 moreGnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin6.6 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: certificate validation bypass due to oversized subject alternative name8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +24 more +26 moreGnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans7.1 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +46 more +48 moreGnutls: gnutls: denial of service via dtls packet reordering vulnerability7.5 High
- eximIn Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the...5.9 Medium
- No product listedCross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to...6.1 Medium
- No product listedCross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to...6.1 Medium
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U...8.8 High
- u-speed n300 firmwareU-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the...7.5 High
- u-speed n300 firmwareA denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By sending a...7.5 High
- dbitnet dbit n300 t1 pro firmwareDbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via...7.5 High
- dbitnet dbit n300 t1 pro firmwareA Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the...8.8 High
com.shopizer:shopizerMavenShopizer has a path traversal issue10.0 Criticalcom.shopizer:shopizerMavenShopizer is vulnerable to Cross-site Scripting5.4 Medium- No product listedAn XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4...8.8 High
- No product listedA Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of...5.0 Medium
- No product listedA stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint...6.1 Medium
- No product listedAn issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows...8.8 High
- No product listedA stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite...6.1 Medium
- No product listedAn issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows...9.6 Critical
- No product listedA Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2...6.5 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14...4.3 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2...4.3 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14...5.4 Medium
krayin/laravel-crmPackagistKrayin CRM allows a remote attacker to execute arbitrary code via compose email function8.1 High- No product listedAssertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF ...7.5 High
- No product listedAn issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted...7.5 High
- zachhandley zmcptoolsZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal5.3 Medium
- ckanCKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`8.3 High
- burtthecoder mcp-dnstwistBurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection6.9 Medium
- utt hiper 1250gwUTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow8.7 High
- anthropic claude sdk for typescript, anthropics anthropic-sdk-typescript +1 moreClaude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool4.8 Medium
- i18next i18next-http-middlewarePath traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters8.2 High
github.com/tinfoil-factory/netfoilGonetfoil's optional seccomp sandboxing was not applied6.9 Mediumgithub.com/tinfoil-factory/netfoilGoNetfoil has incorrect allowlist enforcement6.9 Medium- geopython pygeoapipygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber8.6 High
- geopython pygeoapipygeoapi: Path Traversal in STAC FileSystemProvider7.5 High
- utt hiper 1250gwUTT HiPER 1250GW formTaskEdit_ap strcpy buffer overflow8.7 High
- Show moreLoading…