CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 04/11/2026 |
| CVE-2026-90629 | ALTO7.3 | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-90628 | ALTO7.3 | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-90627 | MEDIO5.5 | The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-90626 | ALTO7.3 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-90624 | ALTO7.3 | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-59268 | ALTO7.3 | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-59264 | ALTO7.8 | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-59263 | MEDIO5.5 | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened.
Users are recommended to upgrade to version 4.1.17, which fixes this issue. | 04/11/2026 |
| CVE-2026-115448 | ALTO8.7 | Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack | 04/11/2026 |
| CVE-2026-108946 | Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another us | 04/11/2026 |
| CVE-2026-108500 | Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL looku | 04/11/2026 |
| CVE-2026-103582 | Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.
The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did | 04/11/2026 |
| CVE-2026-102704 | MEDIO4.4 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page. For
performance reasons, Xen caches details internally | 04/11/2026 |
| CVE-2026-102703 | MEDIO4.4 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page. For
performance reasons, Xen caches details internally | 04/11/2026 |
| CVE-2026-100302 | ALTO7.1 | Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.
The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the respons | 04/11/2026 |
| CVE-2026-100300 | ALTO8.7 | Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data | 04/11/2026 |
| CVE-2026-100252 | ALTO8.6 | Improper Authorization vulnerability in Apache ZooKeeper.
When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to repl | 04/11/2026 |