Skip to content
OpenAdvisories

Archive

8 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /8 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.5
    CVE-2026-5173 Public exploit

    Exposed Dangerous Method or Function in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.8
    CVE-2026-5865 Public exploit

    Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-23869 Public exploit

    React Server Components have a Denial of Service Vulnerability

    A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through …

    Meta react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack npm
  • High 7.3
    CVE-2026-35455 Public exploit

    immich has Stored XSS via OCR Text in 360° Panorama Viewer

    immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who vie…

    immich-app immich
  • High 8.7
    CVE-2026-34724 Public exploit

    Zammad has a server-side template injection leading to RCE via AI Agent

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrich…

    zammad zammad
  • High 8.6
    CVE-2026-33229 Public exploit

    XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting AP…

    xwiki org.xwiki.platform xwiki-platform xwiki-platform-legacy-oldcore Maven
  • Medium 5.3
    CVE-2026-39676 Public exploit

    WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.

    Shahjada Download Manager
  • Medium 6.5
    CVE-2026-39636 Public exploit

    WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through <= 9.0.

    Livemesh Livemesh Addons for Elementor