Skip to content
OpenAdvisories

Archive

7 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /7 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-4406 Public exploit

    Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter

    The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputtin…

    Gravity Forms Gravity Forms Web / CMS
  • Medium 5.4
    CVE-2025-14857 Public exploit

    Semtech LR11xx Memory Write Access Control Bypass

    An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An at…

    Semtech LR1110 LR1121 LR1120
  • Medium 6.9
    CVE-2026-35584 Public exploit

    FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

    FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the g…

    freescout-help-desk freescout
  • Medium 6.5
    CVE-2026-35492 Public exploit

    Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write

    Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious…

    kedro-org kedro-plugins
  • Medium 6.5
    CVE-2026-33033 Public exploit

    Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Ea…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI