Vulnerabilities
Summary — last 7 days
New vulnerabilities3,517▼ 1,240 vs. last week
Critical / high1,375▼ 1,336 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)692▲ 632 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | High (8.6) | 10% | — | Pfsense | 10/15/2026 | 10/19/2026 | Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell… | |
| Deferred | Critical (9.8) | 28% | Exploit | GiteaAI | 10/14/2026 | 10/15/2026 | Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its… | |
| Analyzed | High (8.6) | 26% | ⚠ Active exploitationExploit | Ivanti Connect Secure | 10/13/2026 | 10/13/2026 | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior. |