Vulnerabilities
Summary — last 7 days
New vulnerabilities4,979▲ 187 vs. last week
Critical / high1,821▼ 927 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)1,070▲ 1,007 vs. last week
More filters
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Low (3.5) | 0.15% | — | HeliumAI | 10/15/2026 | 10/16/2026 | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and… | |
| Deferred | Medium (4.3) | 0.21% | — | Helium Project HeliumAI | 10/15/2026 | 10/16/2026 | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to… |