Skip to content
OpenAdvisories

Archive

21 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /21 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

129 results · Clear filters · Feed

  • High 7.4
    CVE-2026-39866 Public exploit

    Lawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml

    Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workflow dispatch input allows arbitrary code execution. Commit fcba413f55dd47f8a3921445252849126c6266b2 p…

    LawnchairLauncher lawnchair
  • High 7.7
    CVE-2026-39861

    Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

    Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, …

    anthropics claude-code @anthropic-ai/claude-code npm
  • High 8.8
    CVE-2026-39386

    Neko has Self-service Privilege Escalation for Authenticated Users

    Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, roo…

    m1k1o neko github.com/m1k1o/neko/server Go
  • High 7.5
    CVE-2026-39320

    Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

    Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unes…

    SignalK signalk-server signalk-server npm
  • High 7.3
    CVE-2026-38834

    Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via t…

  • High 8.8
    CVE-2026-31018

    Dolibarr Allows Code Injection through its Website Module

    In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through u…

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 8.8
    CVE-2026-31019

    Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions

    In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this fil…

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 8.4
    CVE-2026-40706

    In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that a…

    Tuxera NTFS-3G ntfs-3g ntfs-3g Debian Ubuntu Azure Linux Alpine
  • High 7.2
    CVE-2026-37748 Public exploit

    Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php …