Skip to content
OpenAdvisories

Archive

7 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /7 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-33439 Public exploit Scanner template

    Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

    Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypas…

    OpenIdentityPlatform OpenAM org.openidentityplatform.openam:openam Maven
  • Critical 9.3
    CVE-2026-39382 Public exploit

    dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

    dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses pet…

    dbt-labs dbt-core
  • Critical 9.3
    CVE-2026-39324 Public exploit

    Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

    Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default deco…

    rack rack-session logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi RubyGems
  • Critical 9.8
    CVE-2026-4631 Public exploit Scanner template EPSS 15%

    Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

    Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login en…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-35580 Public exploit

    Emissary has GitHub Actions Shell Injection via Workflow Inputs

    Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An…

    National Security Agency emissary gov.nsa.emissary:emissary Maven
  • Critical 9.8
    CVE-2026-22679 Public exploit EPSS 21%

    Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

    Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed deb…

    Weaver Network E-cology
  • Critical 9.8
    CVE-2026-0740 Public exploit Scanner template EPSS 63%

    Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

    The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possibl…

    Saturday Drive Ninja Forms - File Uploads Web / CMS
  • Critical 9.8
    CVE-2024-36058 Public exploit

    The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fai…

  • Critical 9.8
    CVE-2024-36057 Public exploit

    Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code e…

  • Critical 9.1
    CVE-2025-69515 Public exploit

    An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system in…