Archive
13 April 2026
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Medium 4.6CVE-2026-33657 Public exploit
EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-g…
-
Medium 4.3
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 represen…
-
Medium 5.4CVE-2026-6201 Public exploit
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls…
-
Low 2.4CVE-2026-6184 Public exploit
code-projects Simple Content Management System welcome.php cross site scripting
A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executing a manipulation of the argument News Title can lead to cross site scripting. The attack can be exec…
-
High 7.3CVE-2026-6183 Public exploit
code-projects Simple Content Management System index.php sql injection
A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /web/index.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitat…
-
High 7.3CVE-2026-6182 Public exploit
code-projects Simple Content Management System login.php sql injection
A vulnerability was identified in code-projects Simple Content Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /web/admin/login.php. Such manipulation of the argument User leads to sql injection. The attack may be…
-
Medium 6.6CVE-2026-21010 Public exploit
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged f…
-
Medium 5.1CVE-2026-21008 Public exploit
Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensiti…
-
Medium 5.1CVE-2026-21014 Public exploit
Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. Us…
-
Medium 6.9CVE-2026-21013 Public exploit
Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive i…
-
Medium 6.8CVE-2026-21012 Public exploit
External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create …
-
Medium 5.4CVE-2026-21011 Public exploit
Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attacke…
-
Medium 4.1CVE-2026-21009 Public exploit
Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass…
-
Medium 4.4CVE-2026-21007 Public exploit
Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to b…
-
Medium 4.7CVE-2026-21006 Public exploit
Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden no…
-
Medium 5.2CVE-2026-21003 Public exploit
Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attac…
-
Medium 4.0CVE-2026-33555 Public exploit
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches…
-
High 8.8CVE-2026-29955 Public exploit
The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. T…
-
Medium 6.2CVE-2026-29628 Public exploit
A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to caus…
-
High 8.0CVE-2026-31281 Public exploit
Totara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message …
-
Medium 6.5CVE-2026-31280 Public exploit
An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to caus…
-
Critical 9.8CVE-2026-31048 Public exploit
An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a cr…
-
Critical 9.8CVE-2026-31283 Public exploit
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address…
-
Critical 9.8CVE-2026-31282 Public exploit
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reve…