Skip to content
OpenAdvisories

Archive

30 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /30 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2025-51846 Public exploit

    CryptPad unbounded WebSocket frame flood

    CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.

    cryptpad cryptpad
  • High 7.8
    CVE-2026-7270 Public exploit

    Local privilege escalation via execve()

    An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges.

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-36960 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1…

  • High 7.5
    CVE-2026-36958 Public exploit

    A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By sending a large number of concu…

  • High 7.5
    CVE-2026-36957 Public exploit

    Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI …

  • High 7.5
    CVE-2026-36959 Public exploit

    U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. …

  • High 8.8
    CVE-2026-36956 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wirele…

  • High 8.1
    CVE-2026-36340 Public exploit

    Krayin CRM allows a remote attacker to execute arbitrary code via compose email function

    An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function

    krayin/laravel-crm Packagist