Skip to content
OpenAdvisories

Archive

3 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /3 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.7
    CVE-2026-28797 Public exploit

    RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component

    RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These compo…

    InfiniFlow RAGFlow
  • Medium 6.1
    CVE-2026-34980 Public exploit

    OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript que…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 5.0
    CVE-2026-34990 Public exploit

    OpenPrinting CUPS: Local print admin token disclosure using temporary printers

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable A…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2025-10681 Public exploit

    Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

    Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storag…

    Gardyn Cloud API Mobile Application
  • Critical 9.1
    CVE-2026-25197 Public exploit

    Gardyn Cloud API Authorization Bypass Through User-Controlled Key

    A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

    Gardyn Cloud API
  • Critical 9.3
    CVE-2026-28766 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

    Gardyn Cloud API
  • Medium 5.3
    CVE-2026-28767 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific administrative endpoint notifications is accessible without proper authentication.

    Gardyn Cloud API
  • High 7.5
    CVE-2026-32646 Public exploit

    Gardyn Cloud API Missing Authentication for Critical Function

    A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

    Gardyn Cloud API
  • Medium 5.3
    CVE-2026-32662 Public exploit

    Gardyn Cloud API Active Debug Code

    Development and test API endpoints are present that mirror production functionality.

    Gardyn Cloud API
  • Critical 9.8
    CVE-2026-31402 Public exploit

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-4350 Public exploit

    Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter

    The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitizat…

    Perfmatters perfmatters Web / CMS