Skip to content
OpenAdvisories

Archive

28 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /28 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-6807 Public exploit

    NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

    A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.

    NSA GRASSMARLIN
  • High 8.1
    CVE-2026-27760 Public exploit Scanner template EPSS 33%

    OpenCATS PHP Code Injection via installer AJAX endpoint

    OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers c…

    OpenCATS OpenCATS
  • Medium 6.3
    CVE-2026-7229 Public exploit

    code-projects Coaching Management System POST reply.php sql injection

    A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/reply.php of the component POST Handler. Performing a manipulation of the argument complaintreply results in sql inject…

    code-projects Coaching Management System
  • High 7.3
    CVE-2026-7228 Public exploit

    SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection

    A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /admin/ajax.php?action=get_cart_count. This manipulation of the argument ID causes sql injection. The attack is possible to b…

    SourceCodester Pizzafy Ecommerce System
  • Low 3.5
    CVE-2026-7222 Public exploit

    code-projects Coaching Management System Complaint Form complaint.php cross site scripting

    A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cims/modules/student/complaint.php of the component Complaint Form Page. This manipulation of the argument …

    code-projects Coaching Management System
  • High 7.5
    CVE-2025-67223 Public exploit

    The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs …

  • High 8.1
    CVE-2026-42167 Public exploit Scanner template

    mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where t…

    ProFTPD Project ProFTPD proftpd-dfsg proftpd-dfsg Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2026-37750 Public exploit

    A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated r…