Skip to content
OpenAdvisories

Archive

7 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /7 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.5
    CVE-2026-39376 Public exploit

    FastFeedParser has an infinite redirect loop DoS via meta-refresh chain

    FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visi…

    kagisearch fastfeedparser fastfeedparser PyPI
  • High 8.1
    CVE-2026-39371 Public exploit

    RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

    RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site …

    redwoodjs sdk rwsdk npm
  • High 8.2
    CVE-2026-39363 Public exploit Scanner template

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

    vitejs vite vite-plus langfuse-3-worker Wolfi npm
  • High 8.6
    CVE-2026-39338 Public exploit

    ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration

    ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prio…

    ChurchCRM CRM
  • High 7.5
    CVE-2026-35585 Public exploit

    File Browser has a Command Injection via Hook Runner

    File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file eve…

    filebrowser filebrowser filebrowser github.com/filebrowser/filebrowser/v2 Wolfi Go
  • High 8.8
    CVE-2026-35517 Public exploit

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter …

    pi-hole FTL
  • High 7.2
    CVE-2026-22666 Public exploit EPSS 16%

    Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

    Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers…

    Dolibarr Dolibarr ERP/CRM dolibarr Ubuntu
  • High 8.8
    CVE-2026-34197 Exploited Public exploit Scanner template EPSS 98%

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
    KEV Apr 16, 2026
  • High 8.8
    CVE-2026-5465 Public exploit

    Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

    The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the …

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS
  • High 7.5
    CVE-2025-56015 Public exploit

    GenieACS has an unauthenticated access vulnerability via the NBI API endpoint

    In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.

    genieacs npm