Skip to content
OpenAdvisories

Archive

6 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /6 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-5682 Public exploit

    Meesho Online Shopping App com.meesho.supply endpoint risky encryption

    A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component com.meesho.supply. Such manipulation leads to risky cryptographic algorithm. The attack may be perfo…

    Meesho Online Shopping App
  • Medium 6.2
    CVE-2026-0049 Public exploit

    In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaust…

    Google Android Android
  • High 8.1
    CVE-2026-35045 Public exploit

    Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification

    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space,…

    Tandoor Recipes recipes
  • High 7.2
    CVE-2026-35037 Public exploit Scanner template

    Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

    Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validati…

    lin-snow Ech0 github.com/lin-snow/Ech0 Go
  • Critical 9.4
    CVE-2026-35030 Public exploit

    LiteLLM has an authentication bypass via OIDC userinfo cache key collision

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signi…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • High 8.7
    CVE-2026-35029 Public exploit Scanner template EPSS 39%

    LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to m…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • High 8.5
    CVE-2026-34975 Public exploit

    Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers

    Plunk is an open-source email platform built on top of AWS SES. Prior to 0.8.0, a CRLF header injection vulnerability was discovered in SESService.ts, where user-supplied values for from.name, subject, custom header keys/values, and attachment filenames were …

    useplunk plunk
  • High 8.7
    CVE-2026-34940 Public exploit

    KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

    KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components (ref, modelParam…

    kubeai-project kubeai github.com/kubeai-project/kubeai Go
  • Medium 5.4
    CVE-2026-34753 Public exploit

    vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

    vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runn…

    vLLM vLLM vllm PyPI
  • High 7.9
    CVE-2026-34444 Public exploit

    Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

    Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended rest…

    scoder lupa lupa python-lupa Debian Ubuntu PyPI
  • High 8.6
    CVE-2026-33752 Public exploit

    Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)

    curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to inter…

    lexiforest curl_cffi curl-cffi PyPI
  • Critical 9.1
    CVE-2026-26026 Public exploit EPSS 12%

    GLPI has a Server-Side Template Injection via Double-Compilation

    GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.

    GLPI glpi
  • Medium 4.3
    CVE-2026-5615 Public exploit Scanner template

    givanz Vvvebjs File Upload Endpoint upload.php cross site scripting

    A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote…

    givanz Vvvebjs