Skip to content
OpenAdvisories

Archive

14 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /14 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-34213 Public exploit

    Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation

    Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same wo…

    docmost docmost
  • Medium 5.4
    CVE-2026-34212 Public exploit

    Docmost page content has stored XSS via unsanitized attachment URLs

    Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment nod…

    docmost docmost
  • Medium 4.3
    CVE-2026-33146 Public exploit

    Docmost's Public Share Search Exposes Metadata of Restricted Children

    Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-se…

    docmost docmost
  • Medium 4.3
    CVE-2026-33829 Public exploit

    Windows Snipping Tool Spoofing Vulnerability

    Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 6.5
    CVE-2026-32201 Exploited Public exploit EPSS 44%

    Microsoft SharePoint Server Spoofing Vulnerability

    Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition
    KEV Apr 14, 2026
  • Medium 6.8
    CVE-2026-32223 Public exploit

    Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability

    Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
  • Medium 4.3
    CVE-2026-32202 Exploited Public exploit EPSS 71%

    Windows Shell Spoofing Vulnerability

    Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows Alpine
    KEV Apr 28, 2026
  • Medium 4.9
    CVE-2026-22692 Public exploit

    October CMS: Twig Sandbox Bypass via Collection Methods

    October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper wer…

    October CMS october october/rain Packagist
  • Medium 6.1
    CVE-2025-69993 Public exploit

    Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. Thi…

    leaflet leaflet Debian Ubuntu
  • Medium 6.5
    CVE-2026-30480 Public exploit

    A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows…