Vulnerabilities
Summary — last 7 days
New vulnerabilities4,656▼ 838 vs. last week
Critical / high1,753▼ 1,366 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)954▲ 855 vs. last week
More filters
6 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (10) | 17% | PoC | Storekeeper B.V Storekeeper FOR WoocommerceAI | 8/20/2025 | 6/17/2026 | Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Using Malicious Files.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4. | |
| Modified | Critical (9.8) | 46% | Exploit | Fsmlabs Timekeeper | 7/26/2023 | 6/17/2026 | An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to… | |
| Modified | Critical (9.8) | 70% | PoC | Apache Log4jDebian LinuxCanonical Ubuntu LinuxOpensuse Leap+13 | 12/20/2019 | 6/17/2026 | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. | |
| Modified | Critical (9.8) | 14% | — | Oracle Application Testing SuiteOracle Banking Enterprise CollectionsOracle Banking Enterprise OriginationsOracle Banking Enterprise Product Manufacturing+18 | 10/16/2019 | 6/17/2026 | Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and… | |
| Modified | Critical (9.8) | 57% | — | Vmware Spring FrameworkOracle Application Testing SuiteOracle BIG Data DiscoveryOracle Communications Converged Application Server+15 | 4/11/2018 | 6/17/2026 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can… | |
| Modified | Critical (9.8) | 77% | PoC | Vmware Spring FrameworkOracle Application Testing SuiteOracle BIG Data DiscoveryOracle Communications Converged Application Server+24 | 4/6/2018 | 10/8/2026 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can… |