Skip to content
OpenAdvisories

Archive

8 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /8 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Low 2.7
    CVE-2026-4916

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.5
    CVE-2026-5810

    SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting

    A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of th…

    SourceCodester Sales and Inventory System
  • Low 3.5
    CVE-2026-5806

    code-projects Easy Blog Site update.php cross site scripting

    A security vulnerability has been detected in code-projects Easy Blog Site 1.0. This affects an unknown function of the file /posts/update.php. The manipulation of the argument postTitle leads to cross site scripting. The attack may be initiated remotely. The…

    code-projects Easy Blog Site
  • Low 3.5
    CVE-2026-35400

    LORIS incorrectly trusts user input in publication module

    LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trust…

    aces Loris
  • Low 2.3
    CVE-2026-34720

    Zammad has an origin validation error in SSO mechanism

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fix…

    zammad zammad
  • Low 2.1
    CVE-2026-34248

    Zammad has an information disclosure in ticket detail view of customers in shared organizations

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at a…

    zammad zammad
  • Low 3.7
    CVE-2026-34166

    LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter

    LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replace…

    harttle liquidjs liquidjs npm
  • Low 3.3
    CVE-2026-28264

    Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical R…

    Dell PowerProtect Agent
  • Low 2.7
    CVE-2026-39510

    WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final …

    WP Chill Image Photo Gallery Final Tiles Grid