CVEs published in April 2026
6,215 vulnerabilities, 624 critical, 20 exploited.
- aws amazon ecs agent, amazon ecs container agent +1 moreOS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials7.5 High
- opentelemetry opentelemetry.exporter.opentelemetryprotocol, open-telemetry opentelemetry-dotnet +1 moreOpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter6.5 Medium
- chartbrewChartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override6.5 Medium
- chartbrewChartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle7.5 High
- chartbrewChartbrew: Incorrect Access Control in project share policy routes via unbound policy_id8.1 High
- chartbrewChartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks7.5 High
- chartbrewUnauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew6.5 Medium
github.com/ydb-platform/ydb-go-sdk/v3Goydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction2.7 Low- chartbrewChartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks8.1 High
- @clerk backend, nextjs, shared +31 more +33 moreClerk: Authorization bypass when combining organization, billing, or reverification checks7.6 High
- hexLockfile checksums not verified in Hex allows dependency integrity bypass8.9 High
- czlonkowski n8n-mcpn8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders8.5 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +32 more +34 moreGnutls: gnutls: denial of service via dtls zero-length fragment7.5 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +13 more +15 moreGnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response3.7 Low
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +31 more +33 moreGnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison6.5 Medium
- ckanCKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`6.7 Medium
- weblateWeblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url5.3 Medium
- weblateWeblate's API Token Not Invalidated on Password Change4.2 Medium
- gotenbergGotenberg vulnerable to argument injection via newlines in ExifTool metadata values10.0 Critical
- jupyter notebook, jupyter-notebook help-extension, jupyterlab +2 moreJupyter Notebook and JupyterLab token theft via stored XSS in help command linker8.4 High
- gotenbergGotenberg unauthenticated blind SSRF via unfiltered webhook URL6.9 Medium
- gotenbergGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists7.8 High
- cryptpadCryptPad unbounded WebSocket frame flood8.7 High
- weaver network co., ltd. e-cologyWeaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet8.7 High
- weaver network co., ltd. e-officeWeaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet9.3 Critical
- synway smg gateway management softwareSynway SMG Gateway Management Software OS Command Injection via radius_address9.3 Critical
- rti connext professionalImproper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.8.8 High
- progress moveit automationImproper Access Control Vulnerability in Progress MOVEit Automation7.7 High
- progress moveit automationImproper Authentication vulnerability in Progress MOVEit Automation9.8 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled5.4 Medium
- themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fseOtter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie7.5 High
- red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.7 +2 more +4 moreAssisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure6.1 Medium
- pallets click click, red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8 +3 more +5 more[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"7.2 High
- meware software development inc. pdksImproper Rate Limiting in MeWare Software's PDKS8.1 High
- qt, qt qtdeclarative, red hat multicluster global hub +10 more +12 morePossible QML code injection in VectorImage component7.4 High
- meware software development inc. pdksIDOR in MeWare Software's PDKS8.1 High
- meware software development inc. pdksInformation Disclosure in MeWare Software's PDKS6.5 Medium
- lobster gmbh pro, lobster-world lobster pro +1 moreArbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro7.7 High
diesel-asynccrates.ioUnsound access to padding bytes while serializing date/time values using the Mysql backendNo score- bytecodealliance wasmtime, red hat enterprise linux 10, hardened images +2 moreWasmtime: Panic when allocating a table exceeding the size of the host's address space5.9 Medium
- bigpresh dancer::session::abstract, perldancer dancer\ +1 moreDancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely5.9 Medium
- linux, linux kernel +1 morecifs: some missing initializations on replay7.8 High
- wolters kluwer polska lex baza dokumentów, wolterskluwer lex baza dokumentow +1 moreCross-Site Scripting in LEX Baza Dokumentów4.6 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1...7.4 High
- linux, linux kernel +1 morertnetlink: add missing netlink_ns_capable() check for peer netns5.5 Medium
- linux, linux kernel +1 morexen/privcmd: fix double free via VMA splitting7.8 High
- linux, linux kernel +1 moreBuffer overflow in drivers/xen/sys-hypervisor.c7.8 High
- rustaurius five star restaurant reservations – wordpress booking pluginFive Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter5.3 Medium
- apache airflow, apache software foundation airflow providers smtp +1 moreApache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider5.9 Medium
pcre2TuxCare,pcre2-develTuxCare,pcre2-staticTuxCare +4 more +6 moreUpdate of pcre2No score- Show moreLoading…