Skip to content
OpenAdvisories

Archive

2 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /2 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-34828 Public exploit

    listmonk: Active sessions remain valid after password reset and password change

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes…

    knadh listmonk github.com/knadh/listmonk Go
  • High 7.8
    CVE-2026-33641 Public exploit

    Glances Vulnerable to Command Injection via Dynamic Configuration Values

    Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs…

    nicolargo glances glances glances Debian Ubuntu PyPI
  • High 7.2
    CVE-2026-29782 Public exploit

    OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

    OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table u…

    devcode-it openstamanager devcode-it/openstamanager Packagist
  • High 7.4
    CVE-2026-4282 Public exploit

    Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

    A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creatio…

    Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.4.11 Wolfi Maven
  • High 7.8
    CVE-2026-23415 Public exploit

    futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

    In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-30332 Public exploit

    A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allow…