Skip to content
OpenAdvisories

Archive

17 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /17 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-40477 Exploited Public exploit

    Improper restriction of the scope of accessible objects in Thymeleaf expressions

    Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expressio…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring5 org.thymeleaf:thymeleaf-spring6 Maven
  • Medium 5.4
    CVE-2026-35603 Public exploit

    Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

    Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because …

    anthropics claude-code @anthropic-ai/claude-code npm
  • Critical 9.4
    CVE-2026-23500 Public exploit

    Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

    Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a s…

    Dolibarr dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 8.1
    CVE-2026-5718 Public exploit Scanner template

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are confi…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 7.0
    CVE-2026-6421 Public exploit

    Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path

    A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have …

    Mobatek MobaXterm Home Edition
  • Medium 5.5
    CVE-2025-70795 Public exploit

    STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOC…

  • Critical 9.8
    CVE-2026-37749 Public exploit

    A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attac…