Skip to content
OpenAdvisories

Archive

18 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /18 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-41242 Public exploit

    protobufjs has an arbitrary code execution issue

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that…

    protobufjs protobuf.js langfuse-3-worker renovate Wolfi npm
  • High 8.6
    CVE-2026-40489 Public exploit

    editorconfig-core-c has incomplete fix for CVE-2023-0341

    editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig…

    editorconfig editorconfig-core-c editorconfig-core editorconfig-core Debian Ubuntu Alpine
  • High 8.9
    CVE-2026-40487 Public exploit

    Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

    Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploade…

    gitroomhq postiz-app