CVEs published in April 2026
516 tracked CVEs from 19 vendors had their first vendor advisory published in April 2026: 113 critical, 224 high, 12 in CISA KEV. Newest first.
372 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2025-22040High
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-21947High
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-6921Critical
Race in GPU
Palo Alto, Red Hat · 4 advisories - Added
CVE-2026-41989High
Denial of Service and buffer overflow via crafted ECDH ciphertext
NetApp, Red Hat · 2 advisories - Added
CVE-2026-20090Medium
Cisco · 1 advisory - Added
CVE-2026-20089Medium
Cisco · 1 advisory - Added
CVE-2026-20088Medium
Cisco · 1 advisory - Added
CVE-2026-20087Medium
Cisco · 1 advisory - Added
CVE-2026-20085Medium
Cisco · 1 advisory - Added
CVE-2026-20097High
Cisco · 1 advisory - Added
CVE-2026-20096High
Cisco · 1 advisory - Added
CVE-2026-20095High
Cisco · 1 advisory - Added
CVE-2026-20094High
Cisco · 1 advisory - Added
CVE-2026-6515Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
CVE-2026-5816High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1
GitLab · 1 advisory - Added
CVE-2026-5377Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1
GitLab · 1 advisory - Added
CVE-2026-5262High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
CVE-2026-4922High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions
GitLab · 1 advisory - Added
CVE-2026-1660Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
CVE-2025-6016Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
CVE-2025-3922Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
CVE-2025-0186Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11…
GitLab · 1 advisory - Added
CVE-2026-20133CriticalCISA KEV
Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20129Critical
Cisco · 1 advisory - Added
CVE-2026-20128CriticalCISA KEV
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20126Critical
Cisco · 1 advisory - Added
CVE-2026-20122CriticalCISA KEV
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Cisco · 1 advisory - Added
CVE-2026-40542High
Authentication bypass due to missing mutual authentication verification
Apache, Red Hat · 2 advisories - Added
CVE-2026-22753High
Spring Security: Vulnerability in Spring Spring Security.
VMware · 1 advisory - Added
CVE-2026-22748Medium
Spring Security: Vulnerability in Spring Spring Security.
VMware · 1 advisory - Added
Spring Security: Vulnerability in Spring Spring Security.
VMware · 1 advisory - Added
CVE-2026-22754High
ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
Red Hat, VMware · 2 advisories - Added
CVE-2026-22747High
User impersonation via malformed X.509 certificate Common Name (CN) values
Red Hat, VMware · 2 advisories - Added
CVE-2026-31431HighCISA KEV
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Fortinet, NetApp, Red Hat, Veeam · 5 advisories - Added
CVE-2026-34282Critical
Enhance TLS connection handling (Oracle CPU 2026-04)
NetApp, Red Hat · 3 advisories - Added
CVE-2026-34268Critical
Enhance key generation (Oracle CPU 2026-04)
NetApp, Red Hat · 3 advisories - Added
CVE-2026-22021Critical
Enhance certificate chain validation (Oracle CPU 2026-04)
NetApp, Red Hat · 4 advisories - Added
CVE-2026-22018Critical
Enhance Zip file reading (Oracle CPU 2026-04)
NetApp, Red Hat · 3 advisories - Added
CVE-2026-22016Critical
Enhance Path Factories Redux (Oracle CPU 2026-04)
NetApp, Red Hat · 3 advisories - Added
CVE-2026-22013Critical
Improve Kerberos credentialing (Oracle CPU 2026-04)
NetApp, Red Hat · 4 advisories - Added
CVE-2026-22008Critical
Improved Arena allocations (Oracle CPU 2026-04)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22007Critical
Enhance crypto algorithm support (Oracle CPU 2026-04)
NetApp, Red Hat · 4 advisories - Added
CVE-2026-22751Medium
Spring Security: Vulnerability in Spring Spring Security.
VMware · 1 advisory - Added
CVE-2026-21571Critical
Confluence: This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center
Atlassian · 1 advisory - Added
CVE-2026-6058Medium
** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the WLAN to cause a denial-of-service (DoS) condition in the web management interface by convincing an authenticated administrator to visit the “AP Select” page while a malformed SSID is present
Zyxel · 1 advisory - Added
CVE-2026-35240Critical
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-35239Critical
DML unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-35238Critical
InnoDB unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-35237Critical
InnoDB unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-35236Critical
InnoDB unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34308Critical
JSON unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34304Critical
InnoDB unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34303Critical
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34293Medium
DML unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34278Medium
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34276Critical
Group Replication Plugin unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34271Critical
Group Replication Plugin unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34270Critical
Group Replication Plugin unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-34267Medium
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22017Critical
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22015Critical
Information Schema unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22009Critical
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22005Critical
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22004Critical
InnoDB unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22002Critical
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-22001Critical
Information Schema unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-21998Critical
Optimizer unspecified vulnerability (CPU Apr 2026)
NetApp, Red Hat · 2 advisories - Added
CVE-2026-5450Medium
Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
NetApp, Red Hat · 2 advisories - Added
CVE-2026-5928High
Information disclosure or denial of service via ungetwc function with specific wide character encodings
NetApp, Red Hat · 2 advisories - Added
CVE-2026-28684Critical
Arbitrary file overwrite via symbolic link following
Red Hat, Splunk · 2 advisories - Added
CVE-2026-33558Medium
Apache Kafka: Information exposure vulnerability has been identified in Apache Kafka.
Apache · 1 advisory - Added
CVE-2025-66335Medium
Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling
Apache · 1 advisory - Added
CVE-2026-33557Critical
Authentication bypass via improper JWT validation
Apache, Red Hat · 2 advisories - Added
CVE-2026-40948Medium
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state`…
Apache · 1 advisory - Added
Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1
Apache · 1 advisory - Added
CVE-2026-32228High
Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to
Apache · 1 advisory - Added
CVE-2026-30912High
Apache Airflow: Exposing stack trace in case of constraint error
Apache · 1 advisory - Added
CVE-2026-30898High
Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
Apache · 1 advisory - Added
CVE-2026-25917High
Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)
Apache · 1 advisory - Added
CVE-2026-22734High
Cloud Foundry UUA is vulnerable to a bypass
VMware · 1 advisory - Added
CVE-2025-65945High
Auth0/node-jws Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-20184Critical
Cisco Webex Services Certificate Validation Vulnerability
Cisco · 1 advisory - Added
CVE-2026-31987High
Apache Airflow: JWT token appearing in logs
Apache · 1 advisory - Added
CVE-2026-20152Medium
Cisco Secure Web Appliance Authentication Bypass Vulnerability
Cisco · 1 advisory - Added
CVE-2026-6732High
Denial of Service via crafted XSD-validated document
NetApp, Red Hat · 2 advisories - Added
CVE-2026-40192Critical
Denial of Service via decompression bomb in FITS image processing
NetApp, Red Hat, Splunk · 3 advisories - Added
CVE-2026-20186Critical
Cisco · 1 advisory - Added
CVE-2026-20180Critical
Cisco · 1 advisory - Added
CVE-2026-20170Medium
Cisco Webex Contact Center Cross-Site Scripting Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20161Medium
Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20136Medium
Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability
Cisco · 1 advisory - Added
CVE-2026-20132Medium
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
Cisco · 1 advisory - Added
CVE-2026-20081Medium
Cisco · 1 advisory - Added
CVE-2026-20078Medium
Cisco · 1 advisory - Added
CVE-2026-20061Medium
Cisco · 1 advisory - Added
CVE-2026-20060Medium
Cisco · 1 advisory - Added
CVE-2026-20059Medium
Cisco · 1 advisory - Added
CVE-2026-25219Medium
Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Apache · 1 advisory