Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 729 threats · Friday, Oct 30· last check 2026-11-04 06:22 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Friday, Oct 30

Most severe in everything

BREACHNO CVE YET

Northflank (PaaS / AI app hosting platform) breached: attackers decrypted customers' environment variables and secrets, stolen AI API keys already being usedNorthflank3 talking

CRITICALNOT SCORED

EXPLOITED IN THE WILD

Drupal Commerce Core: missing access check exposes pages to forceful browsing3 talking

SUPPLY CHAINNO CVE YET

EXPLOITED IN THE WILD

Backdoored Claude Code extension 2.1.312 and 2.1.313 served through Cursor's marketplace plants an attacker SSH key and startup persistence on developer machinesClaude Code for VS Code43 talking

EXPLOITED IN THE WILD

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote…Ivanti Connect Secure3 talking

Friday, Oct 30

MEDIUM5.9secp256k1-native Ruby gem: timing leak can expose secret scalars in native buildsPackage2026-06-30 19:55 UTCby EPSS–WHAT TO DO MEDIUM5.9i18next: deep resource merge lets attacker corrupt JavaScript built-insPackage2026-06-30 18:33 UTCby EPSS–WHAT TO DO MEDIUM5.3Coop: cross-organization queue access can be granted or revoked by a userOther2026-06-30 19:04 UTCby EPSS–WHAT TO DO LOW2.3Coop: password reset leaves old sessions valid for 30 daysPackage2026-06-30 19:05 UTCby EPSS–WHAT TO DO MEDIUM6.9Coop: unauthenticated GraphQL call creates organizations on public instancesPackage2026-06-30 19:03 UTCby EPSS–WHAT TO DO HIGH7.4Coop: SAML login can take over another organization's user accountsPackage2026-06-30 19:04 UTCby EPSS–WHAT TO DO HIGH8.7Coop: unauthenticated GraphQL query exposes all organizations and user emailsPackage2026-06-30 19:04 UTCby EPSS–WHAT TO DO HIGH8.7OpenSearch SQL plugin: crafted cursor lets an authenticated user run codeInfrastructure2026-06-30 17:18 UTCby EPSS–WHAT TO DO HIGH8.8TAKO AI Agent for Okta: any logged-in user runs Python as rootAI agents & MCP2026-06-30 16:16 UTCby EPSS–WHAT TO DO CRITICAL9.8TAKO AI Agent for Okta: unauthenticated first-admin setup lets attackers take overAI agents & MCP2026-06-30 16:10 UTCby EPSS–WHAT TO DO HIGH8.6Refitter: crafted OpenAPI header name injects code into generated C# clientPackage2026-06-30 12:25 UTCby EPSS–WHAT TO DO HIGH8.6Refitter: crafted OpenAPI paths let attacker code run at buildPackage2026-06-30 11:19 UTCby EPSS–WHAT TO DO HIGH8.6Refitter: crafted OpenAPI content-type key injects code into generated C# clientPackage2026-06-30 12:25 UTCby EPSS–WHAT TO DO HIGH7.5Aedes MQTT broker: deep topic crashes the whole broker processPackage2026-06-30 14:31 UTCby EPSS–WHAT TO DO HIGH8.8IXP Manager: authenticated users can escalate privileges to administratorPackage2026-06-30 18:32 UTCby EPSS–WHAT TO DO HIGH8.3IXP Manager: users can edit other users' API keysPackage2026-06-30 18:31 UTCby EPSS–WHAT TO DO MEDIUM6.1sevenz-rust2: crafted 7z archive writes files outside extraction directoryPackage2026-06-30 15:10 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111477 was rejected and withdrawn by its numbering authorityOther2026-10-30 23:17 UTCby NVD–WHAT TO DO MEDIUM4.2signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetchersignalk-serverPackage2026-10-18 19:17 UTCby GitHub Advisories–FIX 2.34.0 CRITICAL9.8Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionsignalk-serverPackage2026-10-18 19:03 UTCby GitHub Advisories–FIX 2.34.0 CRITICAL9.8imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executiongithub.com/imgproxy/imgproxy/v3Package2026-10-06 15:30 UTCby GitHub Advisories–FIX 4.0.16 HIGH7.5imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crashgithub.com/imgproxy/imgproxy/v3Package2026-10-06 15:29 UTCby GitHub Advisories–FIX 4.0.17 HIGH7.5imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size fieldgithub.com/imgproxy/imgproxy/v3Package2026-10-06 15:28 UTCby GitHub Advisories–FIX 4.0.16 MEDIUM6.5anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSgithub.com/anacrolix/torrentPackage2026-09-11 23:39 UTCby GitHub Advisories–FIX 1.61.1-0.20260911233437-76452a2c8a2f MEDIUMNOT SCOREDAdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCEadminneo-org/adminneoPackage2026-07-20 20:50 UTCby GitHub Advisories–FIX 5.5.1 HIGH8.1AdminNeo SQLite Database-List Drop Arbitrary File Deletionadminneo-org/adminneoPackage2026-07-20 20:50 UTCby GitHub Advisories–FIX 5.5.1 HIGH8.2AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headersadminneo-org/adminneoPackage2026-07-20 20:50 UTCby GitHub Advisories–FIX 5.5.1 HIGHNOT SCOREDAdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)adminneo-org/adminneoPackage2026-07-20 20:50 UTCby GitHub Advisories–FIX 5.5.1 HIGH7.2AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)adminneo-org/adminneoPackage2026-07-20 20:49 UTCby GitHub Advisories–FIX 5.5.1 MEDIUM6.8AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgeryadminneo-org/adminneoPackage2026-07-20 20:49 UTCby GitHub Advisories–FIX 5.5.1 MEDIUM4.8NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571gov.nsa.emissary:emissaryPackage2026-04-06 22:12 UTCby GitHub Advisories–FIX 8.51.0 HIGH7.2OpenRemote: asset names inject SQL into CSV datapoint exportsOther2026-06-30 11:35 UTCby EPSS–WHAT TO DO HIGH7.1Netopeer2: crafted get request crashes NETCONF server via format stringsRuntime2026-06-30 08:23 UTCby EPSS–WHAT TO DO HIGH7.1Refitter: crafted OpenAPI files cause SSRF and local file disclosurePackage2026-06-29 22:09 UTCby EPSS–WHAT TO DO HIGH8.1LightSAML: forged SAML assertion bypasses signature check, enabling login as othersPackage2026-06-29 21:30 UTCby EPSS–WHAT TO DO MEDIUM6.3Kubewarden trusted-repos policy: mixed-case registry hostnames bypass reject listsPackage2026-06-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Ghost ActivityPub server: remote servers can undo other accounts' followsPackage2026-06-29 13:44 UTCby EPSS–WHAT TO DO MEDIUM5.9Element Call: password query parameter leaks into shared bug report logsPackage2026-06-29 14:47 UTCby EPSS–WHAT TO DO MEDIUM6.5LubeLogger: authenticated users can read other users' vehicle recordsPackage2026-06-30 14:11 UTCby EPSS–WHAT TO DO MEDIUM6.9uhttpd: mixed-case Transfer-Encoding header enables HTTP request smugglingRuntime2026-06-29 23:02 UTCby EPSS–WHAT TO DO MEDIUM6.9uhttpd: split POST body lets smuggled HTTP requests run on keep-aliveInfrastructure2026-06-29 23:00 UTCby EPSS–WHAT TO DO LOW3.7uhttpd: invalid chunked POST lets attackers smuggle HTTP requestsRuntime2026-06-29 23:01 UTCby EPSS–WHAT TO DO MEDIUM6.3LORIS: imaging browser API skips edit permission checks, letting users alter dataPackage2026-06-29 13:41 UTCby EPSS–WHAT TO DO MEDIUM4.3LORIS: issue tracker lets logged-in users edit issues outside their scopePackage2026-06-29 13:41 UTCby EPSS–WHAT TO DO HIGH8.8fickling: pickle safety scanner trusts stdlib callables, letting malicious payloads run codePackage2026-10-30 22:16 UTCby EPSS–WHAT TO DO HIGH8.8fickling: crafted pickle bypasses safety check and runs codePackage2026-10-30 22:16 UTCby EPSS–WHAT TO DO HIGH7.5WordPress PDF Invoices plugin: guest order fields enable stored cross-site scriptingPackage2026-10-30 22:16 UTCby EPSS–WHAT TO DO CRITICALCAMPAIGNDATA EXPOSEDNorthflank (PaaS / AI app hosting platform) breached: attackers decrypted customers' environment variables and secrets, stolen AI API keys already being usedNorthflank3 talkingVendor2026-10-30by InfraStack Analyst3talkingWHAT TO DO MEDIUM6.5Shopper admin panel lets staff view admin and staff profilesPackage2026-06-29 08:35 UTCby EPSS–WHAT TO DO HIGH8.7Shopper admin panel: stored upload runs script in administrators' sessionsPackage2026-06-29 08:35 UTCby EPSS–WHAT TO DO HIGH8.1Shopper admin: staff can delete product variants without permissionPackage2026-06-29 08:35 UTCby EPSS–WHAT TO DO HIGH8.4jack: error responses leak internal Radarr and Sonarr API keysOther2026-06-28 15:54 UTCby EPSS–WHAT TO DO HIGH8.7Dream Displays: user input can inject yt-dlp command-line optionsPackage2026-06-27 21:55 UTCby EPSS–WHAT TO DO HIGH8.1ZTNET: any logged-in user can lock out other accounts, including adminsPackage2026-06-28 12:54 UTCby EPSS–WHAT TO DO HIGH7.5ESPAsyncWebServer: malformed multipart upload crashes ESP32 devices remotelyPackage2026-06-28 10:54 UTCby EPSS–WHAT TO DO HIGH7.0SABnzbd: API orphan-job path check lets a key holder delete arbitrary directoriesPackage2026-06-28 10:34 UTCby EPSS–WHAT TO DO HIGH7.9libriscv: crafted ELF file can read host memory and crash emulatorPackage2026-06-27 14:30 UTCby EPSS–WHAT TO DO HIGH7.5Ring Clojure library: crafted parameter names cause regex denial of servicePackage2026-06-27 14:02 UTCby EPSS–WHAT TO DO CRITICAL9.6MoLing MCP server: browser page can run tool calls over SSEAI agents & MCP2026-06-27 13:57 UTCby EPSS–WHAT TO DO MEDIUM5.3Picsou: login timing reveals which usernames exist on the serverPackage2026-06-27 17:23 UTCby EPSS–WHAT TO DO CRITICAL9.9ThingLinks IoT platform: authenticated users can run server codeOther2026-06-27 09:54 UTCby EPSS–WHAT TO DO CRITICAL9.1ThingLinks IoT platform: unauthenticated SQL injection lets attackers tamper with sensor dataVendor2026-06-27 09:55 UTCby EPSS–WHAT TO DO HIGH7.3Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code executionMetalama.FrameworkPackage2026-06-27 09:47 UTCby EPSS–FIX 2026.1.19 HIGH8.2Metalama: predictable temp directories let local users run planted codePackage2026-06-27 09:47 UTCby EPSS–WHAT TO DO MEDIUM6.5Filecoin Pin: unbounded pin requests let callers exhaust disk, CPU and memoryPackage2026-06-26 21:31 UTCby EPSS–WHAT TO DO HIGH7.5ag-psd: crafted tiny PSD file forces multi-gigabyte memory allocationPackage2026-06-28 19:32 UTCby EPSS–WHAT TO DO MEDIUM5.5LibreDWG: crafted DWG file makes parser loop and stallPackage2026-06-27 16:54 UTCby EPSS–WHAT TO DO MEDIUM5.5LibreDWG: crafted pre-R13 DWG file exhausts memory and crashes readersPackage2026-06-27 16:54 UTCby EPSS–WHAT TO DO MEDIUM6.5Picotls TLS library: malicious server crashes client with null dereferencePackage2026-06-29 07:19 UTCby EPSS–WHAT TO DO HIGH8.2Filecoin Pin upload action spends owner's wallet on fork artifactsPackage2026-06-26 21:25 UTCby EPSS–WHAT TO DO LOW3.3LibreDWG: DWG text conversion can write to immutable input, crashing appsPackage2026-06-27 16:55 UTCby EPSS–WHAT TO DO HIGH8.6NovumOS: malicious Nova script gives local user kernel privilegesOther2026-06-27 10:22 UTCby EPSS–WHAT TO DO MEDIUM6.8Stirling-PDF: unsanitized HTML-to-PDF endpoint lets requests read server filesPackage2026-10-02 08:14 UTCby EPSS–WHAT TO DO MEDIUM5.3Stirling-PDF: crafted SVG upload reads server image files into PDF outputPackage2026-10-02 08:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDTesseract OCR: crafted template file corrupts memory, crashes the enginePackage2026-10-10 06:02 UTCby EPSS–WHAT TO DO MEDIUM5.5Tesseract OCR: crafted traineddata file can crash or corrupt memoryPackage2026-10-18 18:11 UTCby EPSS–WHAT TO DO MEDIUM5.5Tesseract OCR: crafted model file crashes the process via denial of servicePackage2026-10-20 12:10 UTCby EPSS–WHAT TO DO MEDIUM6.9Tesseract OCR: crafted Hebrew or Arabic page triggers memory corruptionPackage2026-10-22 21:07 UTCby EPSS–WHAT TO DO CRITICAL9.1ssl_verify_fun: partial wildcard certificates impersonate TLS peers in hostname checksPackage2026-10-30 20:24 UTCby EPSS–WHAT TO DO MEDIUM5.3Phoenix HTML: attribute names unescaped, letting untrusted input inject scriptsPackage2026-10-30 21:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTGitHub: Incident with DependabotGitHubVendor2026-10-30 20:59 UTCby status page–WHAT TO DO MEDIUMCAMPAIGNDON'T CLICKPhishing emails trick users into installing a legitimate Zecurit Agent RMM configured by attackers for remote access (Unit 42)Zecurit AgentVendor2026-10-30 20:28 UTCby InfraStack Analyst–WHAT TO DO MEDIUMINCIDENTFly.io: Slow image pulls delaying Machine starts in IADFly.ioVendor2026-10-30 20:24 UTCby status page–WHAT TO DO CRITICALNOT SCOREDpypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPIpypa/gh-action-pypi-publishPackage2026-10-21 17:37 UTCby GitHub Advisories–FIX 1.14.3 NOT SCOREDNOT SCOREDCVE-2026-95673 was rejected as a duplicate of CVE-2026-92243Other2026-10-30 20:17 UTCby NVD–WHAT TO DO CRITICAL9.8Thales Sentinel Keys Server: HTTP request overflow allows remote code as SYSTEM on WindowsVendor2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH7.8Thales Sentinel Keys Server: buffer overflow lets local users gain SYSTEM rightsVendor2026-10-30 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.9SNARK Verifier: point-at-infinity input can corrupt final proof aggregation sumPackage2026-06-26 20:35 UTCby EPSS–WHAT TO DO MEDIUM6.9OpenVM: Solidity verifier accepts non-canonical commitments, creating verification ambiguityPackage2026-06-26 20:36 UTCby EPSS–WHAT TO DO HIGH8.7OpenVM Solidity verifier accepts forged zero-knowledge proofs through selector collisionPackage2026-06-26 20:38 UTCby EPSS–WHAT TO DO HIGH8.7OpenVM zkVM: malicious prover can forge memory state in proofsPackage2026-06-26 20:38 UTCby EPSS–WHAT TO DO HIGH8.7MyTube: static media routes skip login, exposing hidden videosPackage2026-06-26 14:44 UTCby EPSS–WHAT TO DO HIGH7.1MyTube: visitors can read hidden videos and download them without credentialsPackage2026-06-26 14:44 UTCby EPSS–WHAT TO DO HIGH8.6OSAC operator: Kubeconfig Secrets let attackers run commands in console proxyInfrastructure2026-06-26 10:09 UTCby EPSS–WHAT TO DO CRITICAL9.3Kargo: project RBAC API lets delegated users escalate to project adminInfrastructure2026-06-26 16:10 UTCby EPSS–WHAT TO DO LOW3.7go-xrpl: MPT amount parsing wraps large values negative, diverging from rippledPackage2026-06-26 16:41 UTCby EPSS–WHAT TO DO CRITICAL9.8HoneySQL: user input turned into SQL identifiers enables SQL injectionPackage2026-06-26 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.9SNARK Verifier: noncanonical KZG limbs can crash or bypass the verifierPackage2026-06-26 20:35 UTCby EPSS–WHAT TO DO CRITICAL9.1PinePods: podcast feed enclosures let users reach internal servicesPackage2026-06-26 16:00 UTCby EPSS–WHAT TO DO MEDIUM6.5HotCRP: comment search reveals identity of anonymous commentersOther2026-06-26 12:37 UTCby EPSS–WHAT TO DO MEDIUM6.5Arc time-series database: query endpoint lets tenants read other databasesAI agents & MCP2026-06-25 22:00 UTCby EPSS–WHAT TO DO MEDIUM5.1Maxthon Android browser: fullscreen mode lets pages fake the address barOther2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH7.1RAGFlow: authenticated users can run other users' private agents and read outputAI agents & MCP2026-10-05 04:38 UTCby EPSS–WHAT TO DO HIGH7.8Pi-hole: root cron job follows symlinks, letting pihole user truncate root filesInfrastructure2026-10-17 11:32 UTCby EPSS–WHAT TO DO HIGH7.8Pi-hole: crafted PID file lets a local user run commands as rootPackage2026-10-17 11:32 UTCby EPSS–WHAT TO DO LOW2.2Pi-hole: adlist file check lets a crafted path read root-only filesPackage2026-10-17 11:32 UTCby EPSS–WHAT TO DO HIGH7.8draw.io Desktop on Windows: planted executable runs when opening a diagramPackage2026-09-24 19:33 UTCby EPSS–WHAT TO DO HIGH8.8Ladybird browser: JavaScript cleanup callback frees memory a page can reuseRuntime2026-05-14 20:58 UTCby EPSS–WHAT TO DO HIGH7.1Ladybird browser: cross-origin stylesheets readable and editable by malicious pagesOther2026-10-15 21:13 UTCby EPSS–WHAT TO DO LOW3.5Immich: shared-link API lets a user share another user's photosPackage2026-10-19 14:15 UTCby EPSS–WHAT TO DO MEDIUM4.3Immich: partner users can see locations of archived photosPackage2026-10-19 12:30 UTCby EPSS–WHAT TO DO MEDIUM6.5Immich: unauthenticated ML endpoint lets attackers choose cache path, delete directoriesPackage2026-10-19 12:53 UTCby EPSS–WHAT TO DO HIGH7.1pgAdmin 4: materialized view refresh lets a database name redirect connectionsPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO MEDIUM4.2pgAdmin 4: old sessions stay valid after a password changePackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH7.3pgAdmin 4: symlink race lets server-mode file access escape storage directoryPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.4pgAdmin 4: server mode reads other users' credential files via path traversalPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.8pgAdmin: non-admin users can share servers, leaking database passwordsPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.2pgAdmin 4: missing connection files let server-mode users reach the service account's databasePackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH7.0pgAdmin 4: saved database passwords leak between users in server modePackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.2pgAdmin 4: any server-mode user can reach OS-account database credentialsPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.2PUBLIC EXPLOITpgAdmin 4: Kerberos credentials leak lets any user connect as service accountPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH7.7pgAdmin 4: uploaded files can be run as the server's OS accountOther2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.2pgAdmin 4: SSH tunnels reuse the service account's keys in server modePackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO CRITICAL9.9pgAdmin 4: Import/Export quoting bypass lets a database user run OS commandsPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH7.1pgAdmin 4: storage path checks let server-mode users read, write or delete filesPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.9pgAdmin 4: LDAP or Kerberos login can open another account's sessionPackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO CRITICAL9.2pgAdmin 4: login lockout bypass allows unlimited password guessing on server modePackage2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.7Secret Server: unsigned JWT grants cloud admin permissions under certain conditionsOther2026-10-30 20:17 UTCby EPSS–WHAT TO DO HIGH8.7Secret Server: login step can be bypassed, skipping the first factorOther2026-10-30 20:17 UTCby EPSS–WHAT TO DO MEDIUM5.1Secret Server: PIN or biometric check skipped with FIDO2 devicesOther2026-10-30 20:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTOpenAI: Elevated errors with search in Dots, ChatGPT Work, and certain ChatGPT thinking experiencesOpenAIVendor2026-10-30 19:38 UTCby status page–WHAT TO DO HIGH7.1All In One Login WordPress plugin: unauthenticated XSS through versions 2.4.1Package2026-10-30 19:20 UTCby EPSS–WHAT TO DO CRITICAL9.8LeadSnap WordPress plugin: unauthenticated PHP object injection in versions up to 1.25Package2026-10-30 19:20 UTCby EPSS–WHAT TO DO MEDIUM6.1WIT SynApps Runtime: browser forgery probes internal hosts during controller onboardingOther2026-10-30 19:19 UTCby EPSS–WHAT TO DO MEDIUM6.1WIT SynApps Runtime: unauthenticated reflected XSS via LINK parameterRuntime2026-10-30 19:19 UTCby EPSS–WHAT TO DO MEDIUM6.9WIT SynApps Runtime: hardcoded OAuth client secret exposed in frontend JavaScriptRuntime2026-10-30 19:19 UTCby EPSS–WHAT TO DO HIGH8.8GS Testimonial Slider WordPress plugin: PHP object injection by contributorsPackage2026-10-30 19:19 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Pinot: lookup() reads dimension tables without broker authorization checksPackage2026-10-30 19:19 UTCby EPSS–WHAT TO DO HIGH8.8Enable Media Replace WordPress plugin: subscriber accounts can inject PHP objectsPackage2026-10-30 19:19 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-66026 was rejected and withdrawn by its numbering authorityOther2026-10-30 19:18 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-66025 was rejected and withdrawn by its numbering authorityOther2026-10-30 19:18 UTCby NVD–WHAT TO DO HIGH8.2praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)github.com/mtzanidakis/praktorAI agents & MCP2026-06-26 08:10 UTCby EPSS–FIX 0.9.1 MEDIUM5.9Pistache C++ REST toolkit: long slash paths crash the processPackage2026-06-25 23:37 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDasn1c: OPEN TYPE decoding crashes program on unallocated memberPackage2026-06-25 22:41 UTCby EPSS–WHAT TO DO HIGH8.2Hydra: pending Cardano deposits can be redirected by any third partyPackage2026-06-25 09:59 UTCby EPSS–WHAT TO DO MEDIUM5.3Booktics WordPress plugin: missing authorization check exposes access control, through 1.0.31Other2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5Unlimited Elements For Elementor: local file inclusion through version 2.0.26Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.3Divi Contact Form 7 styler: stored script injection through web page tagsRuntime2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.3Fluent CRM WordPress plugin: missing authorization check exposes access controlPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM4.3Event Tickets WordPress plugin: missing authorization check exposes access controlsPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM4.3Unlimited Elements For Elementor: missing authorization lets users reach restricted functionsPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM4.3BookIt WordPress plugin: missing authorization check exposes access controlPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH8.2VoiceSentinel: race in report buffer cleanup can corrupt transcripts and fill diskPackage2026-06-25 05:20 UTCby EPSS–WHAT TO DO LOW2.3Quest Bot: DNS rebinding lets Discord members probe internal HTTPS hostsPackage2026-06-24 19:05 UTCby EPSS–WHAT TO DO HIGH8.2Copernik XML Factory: XInclude lets untrusted XML read local filesPackage2026-06-26 05:30 UTCby EPSS–WHAT TO DO HIGH7.1Profile Builder WordPress plugin: unauthenticated XSS through versions 4.0.5Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.3Profile Builder WordPress plugin: contributors can gain higher privilegesPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5Booking and Rental Manager WordPress plugin: subscribers can bypass access controlPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.3GIFTiT Free Gifts for WooCommerce: stored script injection through version 4.5Other2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.1Fast Velocity Minify WordPress plugin: unauthenticated XSS through 3.5.7Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.1BA Book Everything WordPress plugin: unauthenticated XSS through 1.8.33ba-book-everythingPackage2026-10-30 19:18 UTCby InfraStack Analyst–FIX 1.8.34 MEDIUM6.5Ultimate Addons for Elementor Lite: stored XSS lets attackers run scripts in pagesPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO CRITICAL9.8FunnelKit Automations: unauthenticated PHP object injection in WordPress pluginwp-marketing-automationsPackage2026-10-30 19:18 UTCby InfraStack Analyst–FIX 3.8.6.2 HIGH7.5WP EasyPay WordPress plugin: unauthenticated path traversal flawPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO CRITICAL9.3Transliterator WordPress plugin: unauthenticated SQL injection exposes databasePackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.1VikRentCar WordPress plugin: unauthenticated XSS through an unknown inputvikrentcarPackage2026-10-30 19:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5WordPress User Registration plugin: subscriber stored XSS up to 5.3.0Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.0Nezha: deleting a service crashes the dashboard on next startupOther2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.9NodeBB: registration flaw lets visitors clear other accounts' emails and sessionsRuntime2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5GStreamer: malformed MicroDVD subtitle file crashes media playbackRuntime2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5GStreamer: malformed AV1 stream integer overflow crashes media applicationsRuntime2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.5GStreamer bad plugins: malformed H.264 file crashes video parser via NULL pointerPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5GStreamer gst-plugins-bad: crafted H.265 video file crashes media-playing applicationsPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO CRITICAL9.8ThemeREX Royal Event theme: untrusted data deserialization lets attackers inject objectsThemeREX Royal EventOther2026-10-30 19:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8MasterStudy LMS: subscribers can inject PHP objects through a flawPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Product Feed Manager plugin: PHP object injection lets attackers run codePackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH8.8WP BASE Booking WordPress plugin: subscribers can escalate privilegesPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.5WP REST Cache: broken access control lets anonymous visitors bypass checkswp-rest-cachePackage2026-10-30 19:18 UTCby InfraStack Analyst–FIX 2026.4.0 HIGH7.5Flexible Chat WordPress plugin: unauthenticated users can read sensitive dataPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5WP Customer Area WordPress plugin: subscriber stored XSS up to 8.4.0Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5GiveWP WordPress donation plugin: broken access control exposes dataPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO CRITICAL9.1WordPress Widget Options plugin: author-level flaw allows remote code executionPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.1eCommerce Product Catalog WordPress plugin: unauthenticated cross-site scripting flawPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.1Mang Board WP: unauthenticated cross-site scripting in plugin up to 2.4.6Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5Masteriyo LMS WordPress plugin: unauthenticated content deletion up to 3.4.3Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.1VikRentCar WordPress plugin: unauthenticated XSS through versions 1.4.9Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.5HUSKY: unauthenticated broken access control in versions up to 1.4.6woocommerce-products-filter (HUSKY)Other2026-10-30 19:18 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8SMS Alert Order Notifications WordPress plugin: unauthenticated privilege escalationsms-alertPackage2026-10-30 19:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5HUSKY: unauthenticated request exposes sensitive data in versions up to 1.4.6Other2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.0SureDash: subscriber accounts can delete arbitrary server filesPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5MultiVendorX: subscriber stored XSS in versions up to 5.0.20Package2026-10-30 19:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-109213 was rejected as a duplicate reservation; no flawOther2026-10-30 19:18 UTCby NVD–WHAT TO DO MEDIUM5.3YITH WooCommerce Product Add-Ons: unauthenticated bypass in versions 4.34.0 and olderPackage2026-10-30 19:18 UTCby EPSS–WHAT TO DO HIGH7.1Ad Inserter WordPress plugin: unauthenticated XSS through 2.8.19ad-inserterPackage2026-10-30 19:17 UTCby InfraStack Analyst–FIX 2.8.20 MEDIUM4.3Booktics WordPress plugin: missing authorization lets users bypass access controlsOther2026-10-30 19:17 UTCby EPSS–WHAT TO DO HIGH7.5AdminNeo: version-cache array injection causes persistent denial of serviceadminneo-org/adminneoPackage2026-06-25 20:03 UTCby EPSS–FIX 5.5.0 MEDIUM6.4Meow Gallery WordPress plugin: stored XSS via image alt textPackage2026-10-30 18:18 UTCby EPSS–WHAT TO DO HIGH7.5Forminator WordPress plugin: unauthenticated users can delete others' saved form draftsPackage2026-10-30 18:18 UTCby EPSS–WHAT TO DO HIGH7.2WordPress ERP plugin: unauthenticated stored XSS via inbound emailPackage2026-10-30 18:18 UTCby EPSS–WHAT TO DO HIGH7.0glibc gettext: LANGUAGE variable lets a program load attacker-chosen message catalogsglibcRuntime2026-10-30 18:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5NextGEN Gallery WordPress plugin: authenticated users can run code on serverPackage2026-10-30 18:18 UTCby EPSS–WHAT TO DO MEDIUM4.4Microsoft Edge: incorrect authorization lets a local user gain privilegesRuntime2026-10-30 18:18 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress Meow Gallery plugin: authors can read private and draft post metadataPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH8.8LM Studio: crafted model download writes files and runs attacker Python on launchAI agents & MCP2026-10-30 18:17 UTCby EPSS–WHAT TO DO CRITICAL9.0Flowise: authenticated users can run OS commands through custom functionsflowiseAI agents & MCP2026-07-29 21:09 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8GStreamer: malformed H.266 file can overflow stack and run codegst-plugins-badPackage2026-10-30 18:17 UTCby InfraStack Analyst–FIX 1.28.2 HIGH7.4Mythic C2 UI: planted HTML in PDF-named files steals operator loginsMythicOther2026-10-30 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9changelog.com: unauthenticated users can read unpublished drafts and newslettersOther2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH8.7Axigen Mail Server: one crafted web request crashes all mail servicesOther2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Axigen WebMail: sender display names run script in the conversation viewInfrastructure2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH8.7sniproxy: overlong hostname triggers NULL dereference that crashes the daemonsniproxyRuntime2026-10-30 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5cak-filemanagement-system: unrestricted file upload in add_logs.php lets uploads throughcak-filemanagement-systemOther2026-10-30 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5cak-filemanagement-system: SQL injection in student save page lets attackers query the databasecak-filemanagement-systemOther2026-10-30 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.4WordPress CP Multi View Events Calendar plugin: stored cross-site scripting via Subject fieldPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.4GeoDirectory WordPress plugin: stored XSS via listing descriptionsPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO CRITICAL9.0JetBrains Toolbox and IntelliJ IDEA: daemon trusts compromised intermediate certificatesOther2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH8.0JetBrains IDEs: embedded browser trusts revoked intermediate certificatesOther2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress GeoDirectory plugin lets anonymous visitors run arbitrary shortcodesPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH7.4Essential Addons for Elementor: unauthenticated users can register as EditorPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.7LikeBtn WordPress plugin: client-IP header lets attackers inject stored scriptsPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.4Themify Builder for WordPress: stored XSS via Custom Font variations fieldPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Majestic Support WordPress plugin: SQL injection lets subscribers read databasePackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH8.1Avada WordPress theme: unauthenticated file upload allows remote code executionPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH7.2easy.jobs WordPress plugin: stored XSS via cover letter fieldeasyjobsPackage2026-10-30 18:17 UTCby InfraStack Analyst–FIX 2.8.5 MEDIUM6.4FV Flowplayer WordPress plugin: stored XSS via profile video uploadPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH7.5WordPress ACF Extended plugin leaks user password hashes to anonymous visitorsPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.4FV Flowplayer WordPress plugin: comment shortcode lets visitors run scriptsPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.4FV Flowplayer WordPress plugin: stored XSS via comment parameterPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.3OpenStation WordPress plugin: subscribers can alter other users' desktop placementsPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH7.5WordPress email templates plugin lets anyone read customer order detailsPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH8.8WordPress Ak Framework plugin lets anonymous visitors gain administrator rightsPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Independent Analytics Pro: unauthenticated stored XSS via utm_campaignPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.9JS Help Desk WordPress plugin: admin can delete arbitrary server filesPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress Redux Framework plugin: stored XSS via user profile fieldRuntime2026-10-30 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Ad Inserter WordPress plugin lets unauthenticated visitors run arbitrary shortcodesPackage2026-10-30 18:17 UTCby EPSS–WHAT TO DO HIGH8.7WordPress Database Cleaner plugin lets admins delete core WordPress tablesRuntime2026-10-30 18:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vas-tops2-digital-assistant-ui (npm)vas-tops2-digital-assistant-uiPackage2026-10-30 18:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @tops2/digital-assistant-ui (npm)@tops2/digital-assistant-uiPackage2026-10-30 18:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vas-tops2-reportingui (npm)vas-tops2-reportinguiPackage2026-10-30 18:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vas-tops2-core-property-search (npm)vas-tops2-core-property-searchPackage2026-10-30 18:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vas-tops2-core-clients-search (npm)vas-tops2-core-clients-searchPackage2026-10-30 18:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vas-tops2-core-client-cleanup-ui (npm)vas-tops2-core-client-cleanup-uiPackage2026-10-30 18:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vas-tops2-bidmatrix-ui (npm)vas-tops2-bidmatrix-uiPackage2026-10-30 18:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tefeest-npm-com-test (npm)tefeest-npm-com-testPackage2026-10-30 18:04 UTCby osv-malicious–UNINSTALL HIGHINCIDENTGitHub: Incident with Actions, Pages, and WebhooksGitHubVendor2026-10-30 17:50 UTCby status page–WHAT TO DO HIGH8.8AI Engine WordPress plugin: CSRF flaw lets attackers act as adminsai-enginePackage2026-10-30 17:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.3Event Tickets WordPress plugin: missing authorization check exposes access controlPackage2026-10-30 17:17 UTCby EPSS–WHAT TO DO CRITICAL10.0Bazarr: unauthenticated Plex endpoints let anyone change config and steal credentialsPackage2026-06-24 14:18 UTCby EPSS–WHAT TO DO MEDIUM5.3Frappe LMS: unpublished certificate records readable by unauthorized usersPackage2026-06-24 12:47 UTCby EPSS–WHAT TO DO MEDIUM5.3Frappe LMS: students can forge passing quiz results and certificatesPackage2026-06-24 12:38 UTCby EPSS–WHAT TO DO HIGH8.1myTinyWMS: stored script in product and category names hijacks user sessionsPackage2026-06-24 12:49 UTCby EPSS–WHAT TO DO MEDIUM5.3Frappe LMS: client-set prices let users buy courses for lessPackage2026-06-24 12:33 UTCby EPSS–WHAT TO DO MEDIUM6.1DBHub MCP server: read-only check bypassed on MySQL and MariaDBAI agents & MCP2026-06-24 07:42 UTCby EPSS–WHAT TO DO MEDIUM6.5ZAC: case read endpoints skip authorization checks, exposing other case typesPackage2026-06-24 12:03 UTCby EPSS–WHAT TO DO MEDIUM5.0SecureDrop: API session tokens accepted by web UI in Journalist InterfaceOther2026-06-24 14:05 UTCby EPSS–WHAT TO DO MEDIUM5.1Frappe LMS: stored script injection through course meta tag fieldsRuntime2026-06-24 11:23 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDBeeHome MyBeeHome: stored XSS in profile editing and chat lets attackers run scriptsInfrastructure2026-10-30 17:17 UTCby EPSS–WHAT TO DO MEDIUM5.4WooCommerce Square plugin: cross-site request forgery through version 4.7.5Package2026-10-30 17:17 UTCby EPSS–WHAT TO DO MEDIUM5.4The Events Calendar WordPress plugin: missing authorization check exposes event dataRuntime2026-10-30 17:17 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress Media Player Addons for Elementor: stored XSS through versions 1.1.10Other2026-10-30 17:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Wekan: user search lets a logged-in user stall the databasePackage2026-08-25 01:44 UTCby EPSS–WHAT TO DO MEDIUM5.9gopacket: crafted SCTP packet can crash Go apps decoding itPackage2026-09-15 01:09 UTCby EPSS–WHAT TO DO MEDIUM4.2croc: sender can overwrite predictable croc-stdin files without confirmationPackage2026-09-10 07:59 UTCby EPSS–WHAT TO DO HIGH8.3OpenStack keystonemiddleware: forged service token header bypasses application credential restrictionsPackage2026-10-30 17:17 UTCby EPSS–WHAT TO DO CRITICAL10.0PUBLIC EXPLOITCanonical LXD: flawed certificate checks let attackers log in as trusted clients4 talkingInfrastructure2026-10-30 17:17 UTCby EPSS4talkingWHAT TO DO MEDIUM6.3PUBLIC EXPLOITRancher Manager: authenticated users can reach management cluster shellInfrastructure2026-10-29 17:26 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDKeyfactor EJBCA: removed administrators keep access via cached sessionsInfrastructure2026-10-30 17:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in neuralwhatsapp (npm)neuralwhatsappPackage2026-10-30 17:11 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in apex-fetch (npm)apex-fetchPackage2026-10-30 16:31 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ourin-baileys (npm)ourin-baileysPackage2026-10-30 16:31 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: Silent Network Authentication (SNA) Missing Redirects on KPN in NetherlandsTwilioVendor2026-10-30 16:26 UTCby status page–WHAT TO DO MEDIUM5.4Fluent CRM WordPress plugin: missing authorization check exposes dataPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Blender: crafted .blend file overruns heap memory, risking code executionPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Blender: crafted .blend file reads past heap buffer in file loaderPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Blender: crafted .blend file triggers heap out-of-bounds read and crashPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Blender: crafted .blend file thumbnail preview overflows heap, enabling code executionBlenderOther2026-10-30 16:17 UTCby InfraStack Analyst–FIX 4.5.15 HIGH8.5Blender: crafted point cache file overflows heap, runs code as userPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.2pybars4: crafted Handlebars templates run Python code in the appPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.2pybars3: crafted templates run Python code in the application processPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.3NocoDB: missing frame protection lets any site overlay signed-in sessionsOther2026-10-27 10:05 UTCby EPSS–WHAT TO DO MEDIUM6.9My Calendar WordPress plugin: unauthenticated shortcode injection via search parameterPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.8Paperclip: agent API key holders can run shell commands on the serverAI agents & MCP2026-04-16 12:21 UTCby EPSS–WHAT TO DO MEDIUM6.4PipesHub: indexing service fetches internal URLs embedded in documentsAI agents & MCP2026-10-25 16:24 UTCby EPSS–WHAT TO DO MEDIUM6.9PipesHub: spoofed forwarding headers bypass per-IP rate limits on loginOther2026-10-25 16:25 UTCby EPSS–WHAT TO DO HIGH7.1PipesHub: crawl-scope users can delete connectors via path injectionPackage2026-10-25 16:25 UTCby EPSS–WHAT TO DO MEDIUM6.9Grimoire: unauthenticated request forgery reads internal URLs before 1.0.0Package2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH7.1abp-next-admin: authenticated users can read other tenants' filesPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH7.1SonicJS: authors and editors can modify other users' documents via APIsonicjsPackage2026-10-30 16:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8LMDeploy: unauthenticated pickle upload to /update_weights runs OS commandsAI agents & MCP2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.9SerpBear: unauthenticated endpoint lets anyone trigger notification email floodsPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Bastille: symlink following lets jailed users escape isolationInfrastructure2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.3xiaozhi-esp32-server: WebSocket auth bypass lets attackers impersonate devicesxiaozhi-esp32-serverAI agents & MCP2026-10-30 16:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9WPGraphQL: unauthenticated comments on hidden WordPress posts before 2.24.1Package2026-10-15 06:51 UTCby EPSS–WHAT TO DO MEDIUM6.9WPGraphQL: missing rate limit lets anyone flood password reset emailsPackage2026-10-15 06:51 UTCby EPSS–WHAT TO DO MEDIUM6.9WPGraphQL: distinct error responses reveal hidden posts and comments to anonymous usersPackage2026-10-15 06:51 UTCby EPSS–WHAT TO DO MEDIUM6.9WPGraphQL Smart Cache: unauthenticated requests grow database table without boundPackage2026-10-14 00:44 UTCby EPSS–WHAT TO DO MEDIUM5.3JetFormBuilder WordPress plugin: basic XSS lets attackers inject scriptOther2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.5The Events Calendar WordPress plugin: stored XSS through version 6.18.2Package2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Zuke build tool: symlinks let setup overwrite files outside the projectPackage2026-09-10 14:45 UTCby EPSS–WHAT TO DO HIGH7.5Zuke: build summaries can publish secrets in cleartext to workflow runsPackage2026-09-10 14:46 UTCby EPSS–WHAT TO DO HIGH7.1Zuke: workflow gate can adopt a forged GitHub run and releasePackage2026-09-10 14:46 UTCby EPSS–WHAT TO DO HIGH7.0Zuke: Windows build shim lets injected text run extra commandsPackage2026-09-10 14:46 UTCby EPSS–WHAT TO DO HIGH8.0Zuke: MCP registry lets a writer run arbitrary commands on operator machinePackage2026-09-10 14:45 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDTenda W18E router: command injection via diagnose packet-capture featureTenda W18EInfrastructure2026-10-30 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDTraggo server: crafted GraphQL POST request causes denial of servicePackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDastro-notion-blog: path traversal in FeaturedImage lets attackers read and overwrite server filesastro-notion-blogPackage2026-10-30 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDSpina CMS: authenticated XSS in embeddable.rb lets attackers run scriptsPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Webba Booking Lite WordPress plugin: missing authorization check exposes bookingsPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.3RTIR: HTML scrubber bypass lets stored javascript links run in RT sessionsPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.3RTIR: ticket subject renders unescaped, letting email senders run scriptsPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.3RT: ticket links let HTML email plant scripts that run for viewersPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH7.9Rancher Fleet: cluster registration accepts identity not bound to its tokenInfrastructure2026-10-29 17:26 UTCby EPSS–WHAT TO DO HIGH8.5Scribus: crafted SVM file overflows memory in importsvm pluginPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Scribus: crafted Mac PICT image overflows heap memory during importOther2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Scribus: crafted DRW file write outside heap buffer, possible code executionPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Scribus: crafted TIFF image lets import overflow heap memoryOther2026-10-30 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Scribus: crafted Mac PICT file leaks heap memory or crashes the appPackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Scribus: crafted PICT image can overflow heap and run codePackage2026-10-30 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Scribus: crafted PSD file corrupts memory, enabling code executionOther2026-10-30 16:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in grizzly-baileys (npm)grizzly-baileysPackage2026-10-30 16:16 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: Silent Network Authentication (SNA) Missing Redirects on Smart in PhilippinesTwilioVendor2026-10-30 15:53 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tabby-fknat (npm)tabby-fknatPackage2026-10-30 15:30 UTCby osv-malicious–UNINSTALL CRITICAL9.4Google Cloud Application Integration: SubWorkflow task lets an authenticated user run codeApplication IntegrationVendor2026-10-28 15:19 UTCby InfraStack Analyst–FIX 2026-09-11 MEDIUM6.5Blocksy Companion WordPress plugin: stored cross-site scripting through versions 2.1.60Package2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH7.5SOCFortress CoPilot: forged token can suppress security detections platform-wideOther2026-06-24 01:59 UTCby EPSS–WHAT TO DO CRITICAL10.0SOCFortress CoPilot: upload filename lets authenticated users overwrite server filesPackage2026-06-24 01:51 UTCby EPSS–WHAT TO DO CRITICAL9.8ng-antd-admin: hardcoded default JWT secret lets attackers forge admin tokensOther2026-06-24 01:42 UTCby EPSS–WHAT TO DO CRITICAL9.3SOCFortress CoPilot: unauthenticated report mount leaks cloud credentials and findingsPackage2026-06-23 20:46 UTCby EPSS–WHAT TO DO CRITICAL9.4SOCFortress CoPilot: hardcoded webhook secret lets anonymous callers bypass authenticationOther2026-06-23 20:34 UTCby EPSS–WHAT TO DO CRITICAL9.9SOCFortress CoPilot: stored XSS in alert comments steals login tokensPackage2026-06-23 20:26 UTCby EPSS–WHAT TO DO HIGH8.5SOCFortress CoPilot: low-privilege users can overwrite other tenants' dataOther2026-06-23 20:12 UTCby EPSS–WHAT TO DO HIGH7.3libass: subtitle rendering overread and overwrite can crash or corrupt memoryPackage2026-06-24 02:55 UTCby EPSS–WHAT TO DO HIGH7.3libass: negative Matroska ReadOrder lets a subtitle file corrupt memoryPackage2026-06-24 02:53 UTCby EPSS–WHAT TO DO MEDIUM4.7Collabora Online: crafted URL injects script into the editor pagePackage2026-06-24 07:28 UTCby EPSS–WHAT TO DO MEDIUM4.3Collabora Online: read-only users can alter open documents via crafted messagesPackage2026-06-24 07:30 UTCby EPSS–WHAT TO DO HIGH7.5Chamilo LMS: unsafe PHP unserialize lets crafted data run server commandsRuntime2026-06-23 22:09 UTCby EPSS–WHAT TO DO HIGH8.9Chamilo LMS: profile fields store HTML that runs in visitors' browsersPackage2026-06-23 22:09 UTCby EPSS–WHAT TO DO MEDIUM6.5Chamilo LMS: missing CSRF token lets visiting admin alter skill recordsPackage2026-06-23 22:09 UTCby EPSS–WHAT TO DO MEDIUM6.6Chamilo LMS: form element names let attackers run PHP codeRuntime2026-06-23 22:10 UTCby EPSS–WHAT TO DO HIGH7.9ManageEngine SharePoint Manager Plus: low-privileged users can alter MFA settingsVendor2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH8.5SharePoint Manager Plus: stored XSS in charts runs scripts in other users' browsersOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM6.3WHartTest: missing authorization lets users touch other projects' scheduled tasksPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Tamery: authenticated users can write messages into other users' AI chat historyAI agents & MCP2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Tamery: authenticated users can attach resources to other users' connectionsOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH8.8Songloft: hardcoded admin/admin login lets nearby attackers take overOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM4.2ShowDoc: authenticated users can delete other users' parameter entriesPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO CRITICAL9.8MuseBot: hard-coded session key lets attackers forge admin sessionsOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Blossom: authenticated users can read, rename or delete other users' foldersOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3PowerDNS-Admin: authenticated users can refresh zones they cannot accessPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.0FilePress: authenticated users can delete or read other libraries' foldersPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH8.7CoreShop: unauthenticated SQL injection leaks member accounts and ordersPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH8.7CoreShop: unauthenticated SQL injection in goods list endpoint exposes accountsCoreShop (CoreUnion)Package2026-10-30 15:16 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8DataCap: any logged-in user can grant themselves administrator roleDataCapOther2026-10-30 15:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Nging: authenticated users can list server directories via autocomplete endpointOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3HuLa-Server: any logged-in user can read other users' friend listsRuntime2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.4HuLa-Server: authenticated users can delete other users' momentsOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.4HuLa-Server: authenticated users can read and change other users' privacy settingsOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH7.1Orchard CMS: authors can read, copy and delete other users' mediaOrchard CMSRuntime2026-10-30 15:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Tencent BlueKing CMDB: authenticated users can view other businesses' hostsPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3RuoYi-Vue-Plus: department-restricted users can list other departments' accountsPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Open Web Analytics: report views leak other sites' visitor and order dataPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH7.1ZenTao PMS: missing access check lets logged-in users read private documentszentaopmsPackage2026-10-30 15:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.4Blossom: authorization bypass lets users delete or star others' picturesOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3JetFormBuilder WordPress plugin: missing authorization check exposes form actionsPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM6.5The Events Calendar WordPress plugin: stored XSS through version 6.18.2Package2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3The Events Calendar WordPress plugin: missing authorization check through 6.18.2Package2026-10-30 15:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDBitcoin Core: out-of-memory bug can crash the node before 29.5Other2026-10-30 15:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDBitcoin Core: undo files have no size limit, enabling denial of serviceRuntime2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Timetics WordPress plugin: missing authorization check exposes access controlsOther2026-10-30 15:16 UTCby EPSS–WHAT TO DO CRITICAL9.0Vvveb CMS: admin can read and overwrite other admins' API tokensOther2026-10-29 01:12 UTCby EPSS–WHAT TO DO MEDIUM4.3Qt3D: assimp scene import plugin out-of-bounds write from crafted model filesPackage2026-10-30 15:16 UTCby EPSS–WHAT TO DO CRITICAL9.8Vvveb CMS: password reset flaw lets attackers bypass loginPackage2026-10-29 01:12 UTCby EPSS–WHAT TO DO MEDIUM6.1Netsweeper: reflected XSS in admin log viewer runs script in browserInfrastructure2026-10-30 15:16 UTCby EPSS–WHAT TO DO HIGH8.7DedeCMS: unauthenticated file inclusion in carbuyaction.php exposes local filesRuntime2026-10-30 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.9charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersgithub.com/charmbracelet/soft-servePackage2026-10-05 15:24 UTCby GitHub Advisories–FIX 0.12.3 MEDIUMINCIDENTLinear: Project pages failing to loadLinearVendor2026-10-30 14:53 UTCby status page–WHAT TO DO MEDIUM5.3charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesgithub.com/charmbracelet/soft-servePackage2026-10-05 15:24 UTCby GitHub Advisories–FIX 0.12.3 HIGHTECHNIQUEEXPLOITEDUnpatched WordPress sites (4.7 to 7.1.3) can be taken over during a core update: attackers race to hit the installer in wp-content/upgrade (no CVE)WordPressPackage2026-10-30by InfraStack Analyst–FIX 7.1.4 MEDIUMINCIDENTOpenAI: Elevated errors for GPT Image 2 API image editsOpenAIVendor2026-10-30 14:35 UTCby status page–WHAT TO DO CRITICALINCIDENTGitHub: Disruption with GitHub servicesGitHubVendor2026-10-30 14:31 UTCby status page–WHAT TO DO MEDIUM6.8Dell OpenManage Enterprise: injection flaw lets privileged adjacent user inject scriptsInfrastructure2026-10-30 14:17 UTCby EPSS–WHAT TO DO HIGH7.1Dell OpenManage Enterprise: authentication bypass by spoofing lets attackers steal sessionsInfrastructure2026-10-30 14:17 UTCby EPSS–WHAT TO DO HIGH8.8Dell OpenManage Enterprise: OS command injection lets low-privileged users run commandsInfrastructure2026-10-30 14:17 UTCby EPSS–WHAT TO DO HIGH7.3Dell OpenManage Enterprise: hard-coded cryptographic key leaks data to local usersInfrastructure2026-10-30 14:17 UTCby EPSS–WHAT TO DO HIGH7.1Crypttech Vatos DLP: plaintext password storage exposes stored domain credentialsVendor2026-10-30 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-49116 was rejected by its CVE Numbering Authority and withdrawnOther2026-10-30 14:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-49115 was rejected and withdrawn by its numbering authorityOther2026-10-30 14:17 UTCby NVD–WHAT TO DO MEDIUM6.3libmspack: crafted CAB file leaks heap memory during MS-ZIP extractionPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9AFFLIB: crafted AFF images corrupt heap memory and crash forensic toolsPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.3tcpflow: out-of-bounds read leaks process memory via forged packet lengthsPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.3AxonHub: project users can mint system-level API keys and read channel configsAxonHubAI agents & MCP2026-10-30 14:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Miaomiaowu: authenticated users can read other users' proxy configurationsOther2026-10-30 14:16 UTCby EPSS–WHAT TO DO CRITICAL9.8OpenDeepWiki: hard-coded JWT key lets anyone forge admin tokensOpenDeepWikiAI agents & MCP2026-10-30 14:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3UNIT3D: missing authorization lets members download others' private playlistsPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO HIGH8.5MONAI: crafted work directory lets attackers run Python codePackage2026-10-15 14:48 UTCby EPSS–WHAT TO DO HIGH7.6ArcadeDB: revoked users keep access through already-open database connectionsPackage2026-10-15 18:27 UTCby EPSS–WHAT TO DO MEDIUM5.3ArcadeDB: read-only users can replace shared GraphQL schema and alter resultsPackage2026-10-15 18:27 UTCby EPSS–WHAT TO DO HIGH7.1ArcadeDB: authenticated users can reach cloud metadata and internal servicesPackage2026-10-15 18:27 UTCby EPSS–WHAT TO DO HIGH8.2Traefik: data race in experimental FastProxy lets anyone crash the proxyInfrastructure2026-10-16 08:00 UTCby EPSS–WHAT TO DO MEDIUM4.4Traefik: Kubernetes Ingress authorization bypass reads cross-namespace CA secret existenceInfrastructure2026-10-16 08:01 UTCby EPSS–WHAT TO DO HIGH8.7Traefik: mTLS client certificate check silently skipped on shared Ingress hostsRuntime2026-10-16 08:00 UTCby EPSS–WHAT TO DO MEDIUM6.3Parse Server: installation authorization flaw lets attackers change other installations' protected fieldsPackage2026-10-15 22:55 UTCby EPSS–WHAT TO DO LOW3.1Parse Server: protected field values leak to clients through save responsesPackage2026-10-15 16:39 UTCby EPSS–WHAT TO DO MEDIUM6.0Parse Server: prototype pollution from user keys breaks requests until restartPackage2026-10-15 20:10 UTCby EPSS–WHAT TO DO MEDIUM4.3Infinispan: deeply nested query crashes server with stack overflowPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO HIGH7.8GIMP: crafted PSD file overflows a stack buffer and can run codeOther2026-10-30 14:16 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDCallBackery Perl: old session cookies accepted indefinitely via X-Session-Cookie headerPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDCallBackery for Perl: session cookie signing secret can be brute-forcedPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDBitcoin Core: out-of-memory bug in versions before 29.5, 30.4, 31.2, 32.1Other2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDSkuul School Management System: students can read other students' exam resultsOther2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.8Epiphany browser: race lets a malicious site skip certificate warningsPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9Kirki WordPress plugin: reCAPTCHA check skipped, letting bots submit formsPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO HIGH7.6Kirki WordPress plugin lets editors change any post's status and contentPackage2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Dell OpenManage Enterprise: missing authentication allows server-side request forgeryInfrastructure2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.5Dell OpenManage Enterprise: low-privileged local user can bypass protection mechanismInfrastructure2026-10-30 14:16 UTCby EPSS–WHAT TO DO MEDIUM4.7Dell OpenManage Enterprise: resource locking flaw lets admins bypass a protectionInfrastructure2026-10-30 14:16 UTCby EPSS–WHAT TO DO LOW3.1Campfire chat: link previews reach internal addresses through special-use rangesPackage2026-07-22 10:45 UTCby EPSS–WHAT TO DO LOWINCIDENTTwilio: On Call Engineers are InvestigatingTwilioVendor2026-10-30 13:53 UTCby status page–WHAT TO DO HIGH8.0Dell OpenManage Enterprise: input validation flaw lets low-privileged attacker run codeInfrastructure2026-10-30 13:20 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDateTime::Lite for Perl: huge seconds value can exhaust CPUPackage2026-10-30 13:20 UTCby EPSS–WHAT TO DO HIGH8.5ESET encryption products: standard users can reach privileged kernel driverESET Endpoint Encryption for WindowsVendor2026-10-30 13:20 UTCby InfraStack Analyst–FIX 5.4.29.0 NOT SCOREDNOT SCOREDRejected CVE: further research found no vulnerability existsOther2026-10-30 13:19 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDCallBackery: user passwords stored as unsalted fast hashes, crackable offlinePackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDPerl GoCardless library lets a leaked redirect ID charge another customerPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDBusiness::GoCardless Perl module accepts forged webhooks with an empty secretPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDPerl GoCardless module: unauthenticated webhook request exhausts server memoryPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCallBackery for Perl: users can read their own password hash and admin notesPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO LOWNOT SCOREDCallBackery for Perl: form validation accepts values it should rejectPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO LOWNOT SCOREDCallBackery for Perl: forged log entries via newlines in login namePackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCallBackery Perl: crafted request path can stall a worker for minutesPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDCallBackery for Perl: restored backup runs arbitrary OS commandsPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDCallBackery: weak backup encryption lets attackers guess passwords offlinePackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCallBackery (Perl): config backup leaves world-readable database dump in /tmpPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCallBackery Perl: unauthenticated path traversal reads arbitrary server filesPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO LOWNOT SCOREDPerl HTTP::Parser::XS: encoded NUL byte truncates request pathPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDStarlet (Perl): unbounded chunked request buffering exhausts server memoryPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO LOWNOT SCOREDStarlet for Perl: HEAD responses carry a body, desyncing pipelined connectionsPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDStarlet: chunked request parsing lets one request exhaust server CPUPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDStarlet for Perl: oversized Content-Length request kills a worker by exhausting memoryPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.1FOSSBilling: staff login form lets attackers force a victim's browser loginPackage2026-10-30 13:18 UTCby EPSS–WHAT TO DO HIGH7.1Dell OpenManage Enterprise: SQL injection lets low-privileged users read dataInfrastructure2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUM4.3Dell OpenManage Enterprise: credentials stored insufficiently protected, exposing informationInfrastructure2026-10-30 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.4Dell OpenManage Enterprise: missing login attempt limits enable phishing attacksInfrastructure2026-10-30 13:18 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @nexlayerlabs/postcss-keyframe-utils (npm)@nexlayerlabs/postcss-keyframe-utilsPackage2026-10-30 12:37 UTCby osv-malicious–UNINSTALL HIGHCAMPAIGNEXPLOITEDCryptoBilisHardware wallets sold by reseller CryptoBilis (Trezor Safe 5, Ledger) carry a hidden cellular implant that steals the recovery phraseTrezor Safe 5Vendor2026-10-30by InfraStack Analyst–WHAT TO DO MEDIUM6.8SQLite: deep expression nesting in count(*) exhausts the stack, crashing the processPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.5SQLite shell: crafted database runs OS commands via .recoversqlitePackage2026-10-30 12:16 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1vsftpd: TLS session reuse lets attackers hijack FTPS data connectionsvsftpdRuntime2026-10-30 12:16 UTCby InfraStack Analyst–WHAT TO DO LOW3.1vsftpd: X-prefixed FTP aliases bypass denied-command checks after loginInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.3Prometheus: remote_write redirects leak Azure AD and Google IAM bearer tokensRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Plausible Analytics: mass assignment lets editors reassign traffic alerts to other sitesPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.0Plausible Analytics: site editors can take over pending invitations and ownershipRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.4phpMyAdmin: table names with HTML run script in other users' sessionsRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM4.2phpMyAdmin: authenticated users can inject SQL through central columnsPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.6phpMyAdmin: WebAuthn check skips signature verification, letting attackers bypass second factorPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.0OPNsense: authenticated users can inject NTP daemon config directivesInfrastructure2026-07-01 13:29 UTCby EPSS–WHAT TO DO HIGH8.2OpenLiteSpeed: HTTP/3 lets attackers skip client certificate checks on virtual hostsRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO LOW3.1OpenCart: logged-in customers can place unpaid orders via reward pointsRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.2n8n: Databricks node path traversal lets outsiders read stored secretsAI agents & MCP2026-09-16 08:23 UTCby EPSS–WHAT TO DO MEDIUM5.3Moodle: enrolled students can list hidden gradebook items via web serviceRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Moodle: grade feedback web service leaks other groups' data to teachersRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.0Moodle: SQL injection in external database enrolment via course ID numberRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.1Moodle: crafted Blackboard question import reads server filesmoodleRuntime2026-10-30 12:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3Uptime Kuma: first-run setup race lets attackers create extra administrator accountsRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.1Jellyfin: suggestions endpoint lets users bypass library and parental restrictionsjellyfinPackage2026-09-22 01:22 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.1Jellyfin: playlist requests reveal hidden media IDs to restricted usersRuntime2026-09-22 01:22 UTCby EPSS–WHAT TO DO HIGH7.1Jellyfin: gzip-compressed SVG in image uploads lets attackers fetch internal URLsRuntime2026-09-22 01:21 UTCby EPSS–WHAT TO DO LOW3.1Lago: billing flaw lets one organization mark another's invoice paidOther2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Forgejo: key lookup lets signed-in users read other users' SSH keysPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.8Forgejo: restore-repo path traversal reads files outside the dump directoryPackage2026-07-13 17:28 UTCby EPSS–WHAT TO DO MEDIUM6.9Forgejo: OpenID login lets anyone make the server probe internal addressesRuntime2026-07-13 17:38 UTCby EPSS–WHAT TO DO MEDIUM5.3phpMyAdmin: hijacked session can strip two-factor authenticationRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.3phpMyAdmin: unauthenticated setup page lets attackers probe internal network portsRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM4.2phpMyAdmin: Designer settings save lets logged-in users inject SQLPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.7phpMyAdmin: forged requests let attackers run SQL as logged-in usersRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.4OPNsense: captive portal roaming flaw lets attackers hijack logged-in client sessionsInfrastructure2026-08-26 07:48 UTCby EPSS–WHAT TO DO MEDIUM6.8OPNsense: CR/LF in WPA fields lets authenticated users inject root-run daemon directivesInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.9OPNsense: crafted login usernames let attackers lock out victim IPsInfrastructure2026-07-01 13:44 UTCby EPSS–WHAT TO DO HIGH8.2Juspay Hyperswitch: forged Worldpay webhooks mark unpaid payments as chargedPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.2Hyperswitch: missing authorization lets anyone confirm and redirect payoutsPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.8Lago: invite flow lets org admins take over existing user accountsOther2026-10-30 12:16 UTCby EPSS–WHAT TO DO CRITICAL9.2CakePHP: unvalidated collation names let attackers inject SQLRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO CRITICAL9.2CakePHP: unvalidated window frame values let attackers inject SQLRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.3CakePHP: incomplete fix lets email headers be injected, redirecting outgoing mailPackage2026-08-21 03:57 UTCby EPSS–WHAT TO DO MEDIUM6.3CakePHP: HTTP client cookie domain check lets rogue hosts steal cookiesPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.3CakePHP: unsanitized MIME headers let attackers inject extra multipart contentPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Bitwarden Server: organization members can add vault items to read-only collectionsPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.6OPNsense: firmware mirror URL lets an admin-level user run commands as rootInfrastructure2026-10-28 09:16 UTCby EPSS–WHAT TO DO HIGH8.8n8n: deprecated Function nodes let authenticated users run code on serverAI agents & MCP2026-10-28 08:47 UTCby EPSS–WHAT TO DO HIGH7.1Element Web and Desktop: crafted links log users out and wipe local keysPackage2026-10-16 14:32 UTCby EPSS–WHAT TO DO HIGH8.5SQLite: crafted changesets overflow heap memory in session extension applyPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.8SQLite: R-Tree extension use-after-free lets crafted database crash or misbehaveRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO LOW2.5SQLite: USING column in joins skips read authorizer checksPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.8SQLite: chained COLLATE operators bypass depth limit and crash the processPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.8SQLite: crafted WAL file leaks uninitialized page-cache memory to queriesPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.5SQLite: crafted FTS5 index overflows heap during secure deletePackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.5SQLite: FTS5 heap overflow lets a crafted table crash the processPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.8SQLite: FTS3 snippet use-after-free lets a query crash the processPackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.8SQLite: deep CTE chains exhaust the stack and crash the processRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.0ProFTPD: symlink tricks let authenticated FTP users overwrite write-protected filesRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.3ProFTPD: SFTP copy command lets logged-in users write to denied directoriesRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.3ProFTPD: long FTP arguments overflow a buffer in mod_rewriteRuntime2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.8Dell OpenManage Enterprise: low-privilege users can run OS commands remotelyInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.2Dell OpenManage Enterprise: argument injection lets a privileged user escalate privilegesInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.6Płatnik: client-side login check lets attackers sign in as any userOther2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.7Płatnik software: weak password encoding lets a user decode passwordsOther2026-10-30 12:16 UTCby EPSS–WHAT TO DO LOW2.3Płatnik: updates and support files downloaded over plain HTTPOther2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Qt Core: QCborValue-to-JSON conversion can crash via a NULL pointer dereferencePackage2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.2Dell OpenManage Enterprise: OS command injection lets an admin run commandsInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.8Dell OpenManage Enterprise: low-privilege local user can gain higher privilegesInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH7.2Dell OpenManage Enterprise: OS command injection lets an admin run commandsInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO LOW2.7Dell OpenManage Enterprise: server-side request forgery exposes information to privileged usersInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.1ARKETEAM Protectel: stored XSS in note editor lets low-privilege users run scriptsVendor2026-10-30 12:16 UTCby EPSS–WHAT TO DO HIGH8.4ARKETEAM Protectel modules: SQL injection via profilInput lets low-privilege users read dataPROTECTELMAJInfrastructure2026-10-30 12:16 UTCby InfraStack Analyst–FIX 6.5.19 HIGH8.4ARKETEAM Protectel modules: SQL injection via Utilisateur parameterOther2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.1ARKETEAM Protectel: low-privileged users can reach admin-only functionsInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.3ARKETEAM Protectel modules: arbitrary file upload lets users overwrite temporary filesInfrastructure2026-10-30 12:16 UTCby EPSS–WHAT TO DO LOWINCIDENTSupabase: Logs degraded in multiple regionsSupabaseVendor2026-10-30 11:38 UTCby status page–WHAT TO DO HIGH8.7Firebase Authentication: XSS via malicious iOS bundle ID runs JavaScriptVendor2026-10-30 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3HTTP basic auth has no retry limit, so passwords can be guessedOther2026-10-30 11:17 UTCby EPSS–WHAT TO DO HIGH8.7EV charger web server skips authentication on POST and PUT requestsDelta UFC500Infrastructure2026-10-30 11:17 UTCby InfraStack Analyst–FIX 2.4.18 HIGH8.4WebUI template database ships factory default passwords for five account typesDelta UFC500 WebUIInfrastructure2026-10-30 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7Delta UFC500 EV chargers: default Service password derived from serial numberUFC500Infrastructure2026-10-30 11:17 UTCby InfraStack Analyst–FIX 2.4.18 CRITICAL9.5PUBLIC EXPLOITClickHouse Server: unauthenticated network user can run arbitrary code3 talkingRuntime2026-10-30 11:17 UTCby InfraStack Analyst3talkingWHAT TO DO CRITICAL9.8Dahua Intelligent Connection Center: crafted request runs commands remotelyInfrastructure2026-10-30 11:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUMCAMPAIGNEXPLOITEDApple sends a new round of mercenary spyware threat notifications to targeted iPhone users in 99 countries, tied to new attacksiOS7 talkingVendor2026-08-13by InfraStack Analyst7talkingWHAT TO DO HIGH8.2Forocoches comments editor: image tags leak visitor IP and browser detailsOther2026-10-30 10:16 UTCby InfraStack Analyst–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in stdid-nyxprobe (PyPI)stdid-nyxprobePackage2026-10-30 10:03 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in log-utils-sdk (PyPI)log-utils-sdkPackage2026-10-30 09:17 UTCby osv-malicious–UNINSTALL MEDIUM5.4Elixir Mix: shared temp directory lets local user run code as othersRuntime2026-10-29 20:31 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Fineract: ordering parameters allow blind SQL injection by authenticated usersPackage2026-10-30 09:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Fineract: SQL injection in search endpoint lets attackers run database queriesPackage2026-10-30 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.9UAA: private_key_jwt login flaw lets anonymous requests exhaust server memoryInfrastructure2026-10-30 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Cloud Foundry CAPI: audit logs expose buildpack, syslog and service credentialsInfrastructure2026-10-30 09:17 UTCby EPSS–WHAT TO DO HIGH8.8Cloud Controller: Nginx misroutes /internal/v3 staging callbacks to the public listenercapiRuntime2026-10-30 09:17 UTCby InfraStack Analyst–FIX 1.246.0 MEDIUM6.5Cloud Foundry: SpaceSupporter can alter app start commands and buildpacksInfrastructure2026-10-30 09:17 UTCby EPSS–WHAT TO DO LOW2.7Cloud Foundry: space developer can redirect a service broker to steal its credentialsInfrastructure2026-10-30 09:17 UTCby EPSS–WHAT TO DO LOW3.7GCC libstdc++: non-terminated string to from_chars crashes applicationsRuntime2026-10-30 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Elixir: unbounded JSON integer parsing lets a request exhaust CPU and memoryRuntime2026-10-29 20:31 UTCby EPSS–WHAT TO DO MEDIUM6.3Elixir URI module: long port numbers cause CPU exhaustion denial of serviceRuntime2026-09-01 13:42 UTCby EPSS–WHAT TO DO CRITICAL9.4Teltonika RUTOS and TSWOS: unauthenticated Lua calls let attackers run OS commandsRUTOSInfrastructure2026-10-30 08:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5GCC libstdc++: bitset wide-stream extraction overflows stack, crashes applicationRuntime2026-10-30 08:16 UTCby EPSS–WHAT TO DO MEDIUM5.9GCC libstdc++: oversized std::vector<bool> size crashes applications via memory corruptionPackage2026-10-30 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.2GCC libstdc++: parallel search buffer overflow lets local crash a programRuntime2026-10-30 08:16 UTCby EPSS–WHAT TO DO HIGH7.2Gravity Forms: stored script injection through List Field entriesGravity FormsOther2026-10-30 07:16 UTCby InfraStack Analyst–FIX 3.1.3 HIGH7.2Gravity Forms WordPress plugin: stored script injection via form fieldsgravityformsPackage2026-10-30 07:16 UTCby InfraStack Analyst–FIX 3.1.2 HIGH8.8WordPress Formidable Forms plugin lets subscribers install arbitrary pluginsPackage2026-10-30 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Kroxylicious: ACL prefix matching can let a Kafka client read denied topicsInfrastructure2026-10-30 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.9Red Hat Enterprise Linux 9 kernel: SRv6 packet drop path can stall systemInfrastructure2026-10-30 07:16 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Food Store plugin: unauthenticated stored script injection via service_timefood-storePackage2026-10-30 07:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5WordPress AI Engine plugin: unauthenticated OAuth registration grants admin MCP accessPackage2026-10-30 07:16 UTCby EPSS–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITGravity Forms: unauthenticated PHP object injection through post custom fieldsPackage2026-10-30 07:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in claims-acct-unlock (npm)claims-acct-unlockPackage2026-10-30 07:14 UTCby osv-malicious–UNINSTALL MEDIUM4.3Content Egg WordPress plugin lets authors post as administratorsOther2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.3WordPress Content Egg plugin lets contributors edit other users' postsRuntime2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5JoomSport WordPress plugin: SQL injection lets contributors read database dataPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Events Made Easy WordPress plugin: stored XSS via width parameterPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress FormKit Lite plugin: stored XSS via form field custom_idPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress Page and Post Restriction plugin: logged-in users' private content readable by visiting sitesPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDFirelight Lightbox WordPress plugin: unescaped link URLs enable stored XSSPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWordPress BuddyForms plugin lets low-privilege users overwrite others' postsPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDBuddyForms WordPress plugin: unauthenticated users can export form settings and secretsPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress fraud plugin lets subscribers blacklist customers from ordersPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDJoinchat WordPress plugin lets authors inject scripts into pagesPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWP Visitor Statistics WordPress plugin: SQL injection by administratorsPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWP Visitor Statistics plugin: visitor data lets attackers run scripts in adminPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDUser Frontend WordPress plugin: reflected XSS against logged-out visitorsPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWordPress security plugin lets non-super admins read site secret keysPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWordPress security plugin skips password check at two-factor loginPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWordPress Enable Media Replace plugin: object injection leads to file inclusion and possible code executionPackage2026-10-30 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress Forminator plugin: unauthenticated attackers can delete uploaded non-PHP filesRuntime2026-10-30 05:16 UTCby EPSS–WHAT TO DO HIGH8.8WordPress Export and Import Users plugin lets subscribers become administratorsPackage2026-10-30 05:16 UTCby EPSS–WHAT TO DO HIGH7.5glib-networking: unbounded TLS 1.3 session tickets exhaust client memoryglib-networkingInfrastructure2026-10-30 05:16 UTCby InfraStack Analyst–FIX 2.90.1 NOT SCOREDNOT SCOREDDrupal Xray Audit: missing authorization lets users browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Field Permissions: incorrect authorization allows forceful browsing of fieldsPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Field Permissions: incorrect authorization allows forceful browsing of fieldsPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal CAPTCHA module: alternate path lets bots skip the CAPTCHA checkPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Stage File Proxy: cross-site scripting flaw lets attackers run scriptsPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Signature pad widget: stored XSS in versions up to 1.15.0Package2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal S3 File System: incorrect permissions let attackers reach protected filesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal OAuth2 Token Manager: missing authorization lets users browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal OAuth Login module: authentication bypass via alternate pathPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Media Alias Display: sensitive data cached in browser, exposed to othersPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Fasttoggle: CSRF flaw lets attackers trigger unwanted actionsPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Fasttoggle: incorrect authorization lets users browse forbidden pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Content Sync: insecure storage exposes embedded sensitive dataPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Bulk Update User Roles: forced browsing bypasses authorization checksPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal GroupEx PRO (Daxko) integration: flaw with unknown impactPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal PayUmoney for Drupal Commerce: unspecified vulnerability, details unknownPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal CacheFlush: unspecified vulnerability, no details published yetOther2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Single Content Sync: untrusted data deserialization allows object injectionPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Single Content Sync: path traversal in file handling, versions through 1.4.19Package2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Stripe: cross-site scripting flaw in versions 2.0.0 to 2.2.3Package2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Stripe: webhook signatures can be spoofed, versions 1.4 and 2.2.3 affectedPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Stripe: cross-site request forgery lets attackers trigger payment actionsPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Shipping: incorrect authorization allows forceful browsingPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Shipping: incorrect authorization allows forceful browsingPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce License: incorrect authorization lets users browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal OpenID Connect Client: authentication bypass through an alternate login pathPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal AI module: stored cross-site scripting in web page generationAI agents & MCP2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal AI module: cross-site scripting lets attackers run scripts in pagesRuntime2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal AI module: insecure storage lets attackers retrieve embedded sensitive dataAI agents & MCP2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal AI module: sensitive data cached in browser, exposing it to othersPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal AI module: cross-site scripting flaw in versions up to 1.5.2AI agents & MCP2026-10-30 04:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDrupal AI module: incorrect authorization allows resource injectiondrupal/aiAI agents & MCP2026-10-30 04:18 UTCby InfraStack Analyst–FIX 1.4.11 NOT SCOREDNOT SCOREDDrupal AI module: cross-site scripting lets attackers run scripts in browsersAI agents & MCP2026-10-30 04:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDrupal AI module: cross-site scripting lets attackers run scripts in pagesdrupal/aiAI agents & MCP2026-10-30 04:18 UTCby InfraStack Analyst–FIX 1.4.11 NOT SCOREDNOT SCOREDDrupal Commerce Core: data queries expose sensitive information to forceful browsingPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Core: CSRF flaw lets forged requests act as usersPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Core: incorrect authorization lets users browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Core: missing authorization lets users browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Commerce Core: incorrect authorization lets users browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDEXPLOITEDDrupal Commerce Core: missing access check exposes pages to forceful browsing3 talkingPackage2026-10-30 04:18 UTCby InfraStack Analyst3talkingWHAT TO DO NOT SCOREDNOT SCOREDDrupal Monster Menus: object injection flaw in versions up to 9.5.6Package2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Domain Login Restrict: authentication bypass through alternate login pathPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Rabbit Hole: incorrect authorization lets users browse restricted contentPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDrupal Data field module: stored XSS lets page content run scriptsPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal AI File to Text: incorrect authorization allows forceful browsingPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Frontend Editing: incorrect authorization allows forceful browsingPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal ImageAPI Optimize WebP: browser cache can expose sensitive imagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal TinyPNG module: missing access check lets visitors browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Media Alias Display: sensitive data cached in browserPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Fullcalendar View: incorrect authorization lets users browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Media Bulk Upload: missing authorization lets users browse restricted pagesRuntime2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Simple User Management: incorrect authorization allows forceful browsingPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Simple OAuth: browser cache can expose sensitive token dataPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Frontend Editing: CSRF flaw lets forged requests act as usersPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Domain module: incorrect authorization lets users force browsingPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal DocCheck Basic: authentication bypass through an alternate pathPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Bootstrap: cross-site scripting flaw lets pages run attacker scriptPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal View Unpublished: forceful browsing exposes unpublished contentRuntime2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal USWDS Paragraph Components: stored XSS through unsanitized inputPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Swiper formatter: missing access check lets visitors browse restricted contentPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Block Attributes: stored XSS in versions up to 2.1.0Package2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Ágora Transparency Theme: missing access check exposes pages to forced browsingOther2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal UI Icons: input handling lets attackers inject scripts into pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Swiper formatter: stored XSS via unescaped input in pagesOther2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Dopup: incorrect authorization lets visitors browse restricted pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDrupal CSV Field: stored cross-site scripting in versions up to 2.0.10 and 3.0.7Package2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Zero Point theme: stored XSS lets attackers run scripts in pagesOther2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal UI Icons: cross-site scripting flaw lets attackers run scripts in pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Black Hole module: stored cross-site scripting in versions up to 1.26.0Runtime2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal ABC module: stored cross-site scripting in versions up to 1.25.0Other2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Custom Formatters: unsafe privilege definitions allow privilege escalationPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal FFmpeg Image Toolkit: OS command injection lets attackers run commandsPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Gin Admin Theme: cross-site scripting lets attackers run scripts in admin pagesPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal core: cross-site scripting flaw lets attackers run scripts in pagesRuntime2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal core: cross-site scripting flaw lets attackers run scripts in pagesRuntime2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Entity List: unsafe reflection lets input select classes to runPackage2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal core: externally controlled input can select code classes, enabling reflection injectionRuntime2026-10-30 04:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Examples for Developers: resource allocation flaw allows excessive memory usePackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Permissions by Term: forceful browsing exposes restricted contentPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Freelinking: server-side request forgery lets attackers reach internal hostsPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Easy Breadcrumb: missing access check lets visitors browse restricted pagesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Country module: cross-site scripting flaw in web page outputPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal SmartLinker AI: incorrect authorization lets users force-browse restricted pagesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDrupal Menu Link Attributes: stored XSS through menu link attributesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Two Factor Authentication module: sensitive data sent to browsersPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal DKAN: missing authorization lets users browse restricted pagesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Views Share: missing authorization lets users browse restricted pagesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Leaflet module: stored cross-site scripting through unsanitized inputPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Inline Formatter Field: template injection lets attackers inject codePackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Gutenberg: incorrect authorization lets users force browsing to restricted pagesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Advanced Filesystem: CSRF flaw lets forged requests act for logged-in usersPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Authenticator Login Plus: 2FA can be bypassed through an alternate pathPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Sector Distribution: stored cross-site scripting in web page generationPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Linked Field: template engine flaw allows code injectionPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Inline Entity Form Dialog: incorrect authorization allows forceful browsingPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Actstream: incorrect authorization lets users browse restricted pagesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Shield: missing limit on login attempts allows brute-force guessingPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Restrict route by IP module lets forceful browsing bypass access rulesPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Authenticator Login Plus: authentication bypass via alternate pathPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Orphans Media: unspecified flaw, details not yet publishedPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal MathJax module: cross-site scripting lets attackers run page scriptsPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Entity Reference Manager: incorrect authorization allows forceful browsing of mergePackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal ECA Helper: vulnerability of unknown impact, all versions affectedPackage2026-10-30 04:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Block AJAX: object injection flaw in versions up to 3.0.2Package2026-10-30 04:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTCloudflare: Increased Errors for Browser RunCloudflareVendor2026-10-30 02:41 UTCby status page–WHAT TO DO MEDIUM6.5Undertow: crafted chunk size enables HTTP request smuggling on the serverRuntime2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDWeb browser WebGPU content can crash GPU process via out-of-bounds memory accessRuntime2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDGPU driver: security fix for CVE-2026-49746 breaks buffer mapping outside 0-4GBInfrastructure2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDChrome GPU process: crafted WebGPU page can corrupt memory and crashOther2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDNVIDIA GPU driver: local user can read and write arbitrary physical memoryInfrastructure2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel GPU driver: stack overflow lets local user crash systemInfrastructure2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDGPU kernel driver: integer overflow lets local users read kernel memoryInfrastructure2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDBrowser GPU shader compiler: integer overflow lets a web page crash the compilerRuntime2026-10-30 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDNVIDIA GPU driver: race condition lets local user corrupt kernel memoryInfrastructure2026-10-30 02:17 UTCby EPSS–WHAT TO DO LOW3.6Eye of GNOME: malformed PNG color profile can crash viewer or leak memoryRuntime2026-10-30 02:17 UTCby EPSS–WHAT TO DO LOW3.3Ghostscript: crafted PDF or PostScript file causes out-of-bounds memory readPackage2026-10-30 02:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Input lets a crafted page run codePackage2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in FileSystem lets crafted web page run codePackage2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in Network lets a crafted page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in FileSystem lets a crafted page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in CacheStorage lets a web page read memoryRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in Autofill lets a web page run codeOther2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in FileSystem lets a web page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDChrome: memory corruption in MediaStream lets a crafted page read memoryRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDChrome: out-of-bounds read in FileSystem lets a web page read memoryPackage2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: Skia use-after-free lets a crafted web page run codeOther2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: CacheStorage input validation flaw lets crafted page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Blink lets a crafted web page run codePackage2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: integer overflow in Editing lets a crafted page run codeOther2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: DOM memory corruption lets a crafted web page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: use-after-free in Quota lets a web page run codeOther2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in Quota lets a crafted web page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: Dawn memory corruption lets a crafted web page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: memory corruption in garbage collection lets crafted pages run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: V8 input validation flaw lets a crafted web page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: crafted web page can run code outside the browser sandboxRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Frames lets a crafted page run codeRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Keycloak: crafted login request can skip mandatory user actionsRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Keycloak: authenticated user can change resources they do not ownPackage2026-10-30 01:16 UTCby EPSS–WHAT TO DO MEDIUM5.8Ghostscript: crafted TrueType font overflows heap, risking crash or code executionRuntime2026-10-30 01:16 UTCby EPSS–WHAT TO DO HIGHTECHNIQUEGo MPTCP defaultGo programs on Linux listen with Multipath TCP by default, exposing servers to the remote-root kernel bug CVE-2026-98432 (Ubuntu and RHEL fixes still pending)Go13 talkingRuntime2026-10-29 15:57 UTCby InfraStack Analyst13talkingWHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to Altice United StatesTwilioVendor2026-10-30 00:10 UTCby status page–WHAT TO DO HIGH8.7A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of…Package2026-10-30by EPSS–WHAT TO DO CRITICALCAMPAIGNEXPLOITEDanthropic.claude-code 2.1.313svc-telemetryBackdoored Claude Code extension 2.1.312 and 2.1.313 served through Cursor's marketplace plants an attacker SSH key and startup persistence on developer machinesClaude Code for VS Code43 talkingAI agents & MCP2026-10-29by InfraStack Analyst43talkingFIX 2.1.314 HIGH8.2Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when…Package2026-10-30by EPSS–WHAT TO DO HIGHNOT SCOREDCVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for JavaPackage2026-10-30by Vendor & lab pages–WHAT TO DO NOT SCOREDNOT SCOREDXcode: symlink handling flaw lets an app read arbitrary filesOther2026-10-30by EPSS–WHAT TO DO HIGHTECHNIQUENuxt Image's default /_ipx route lets one crafted image crash the server and possibly run code (ipx multi-page decode overflow, no CVE yet)@nuxt/imagePackage2026-10-30by InfraStack Analyst–FIX 2.2.1 HIGH4.3EXPLOITEDUse of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote…Ivanti Connect Secure3 talkingVendor2026-10-30by InfraStack Analyst3talkingFIX 25.1.1.3 NOT SCOREDNOT SCOREDXcode: authorization flaw lets an app reach sensitive user dataInfrastructure2026-10-30by EPSS–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDBlack OctoberBlack October: at least nine AI developer platforms (Railway, Northflank, Warp, OpenCode, Fireworks AI and others) breached to steal stored AI and cloud keys, which are resold and used for LLMjackingRailway2 talkingVendor2026-10-30by InfraStack Analyst2talkingWHAT TO DO HIGHNOT SCOREDCVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for CVendor2026-10-30by Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for CInfrastructure2026-10-30by Vendor & lab pages–WHAT TO DO HIGH8.2Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the…Infrastructure2026-10-30by EPSS–WHAT TO DO MEDIUMNOT SCOREDCVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-KernelRuntime2026-10-30by Vendor & lab pages–WHAT TO DO HIGH8.2Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on…Runtime2026-10-30by EPSS–WHAT TO DO

Thursday, Oct 29Friday, Oct 30Saturday, Oct 31