Skip to content
OpenAdvisories

Archive

23 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /23 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-41264 Public exploit

    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when evaluating an LLM genera…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.8
    CVE-2026-23751 Public exploit

    Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting

    Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publ…

    Tungsten Automation Tungsten Capture (formerly Kofax Capture)
  • Critical 9.9
    CVE-2026-39440 Public exploit

    WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1.

    Funnelforms FunnelFormsPro
  • Medium 5.3
    CVE-2026-4106 Public exploit Scanner template

    HT Mega < 3.0.7 – Unauthenticated PII Disclosure

    The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days

    Web / CMS
  • Critical 9.8
    CVE-2026-3844 Public exploit Scanner template EPSS 28%

    Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

    The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to…

    Cloudways Breeze Cache Web / CMS
  • Critical 10.0
    CVE-2026-41679 Exploited Public exploit Scanner template EPSS 32%

    Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

    Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authen…

    paperclipai @paperclipai/server paperclip @paperclipai/server npm
  • Critical 9.2
    CVE-2026-41179 Public exploit Scanner template

    RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attac…

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Alpine Wolfi Go
  • High 7.3
    CVE-2025-70994 Public exploit

    Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless en…