Vulnerabilities
Summary — last 7 days
New vulnerabilities4,993▲ 135 vs. last week
Critical / high2,112▼ 668 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)824▲ 761 vs. last week
More filters
6 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.8) | 0.48% | PoC | Integration FOR Activecampaign AND Contact Form 7 Wpforms Elementor Ninja FormsAI | 6/15/2026 | 6/17/2026 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions. | |
| Analyzed | Critical (9.8) | 3.7% | Exploit | Apuswp Campress | 2/13/2025 | 6/17/2026 | The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code… | |
| Modified | Critical (9.8) | 7.9% | Exploit | Campcodes Complete Online Matrimonial Website System Script | 8/16/2023 | 6/17/2026 | install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document. | |
| Modified | Critical (9.8) | 49% | Exploit | Camp Project Camp | 11/14/2022 | 6/17/2026 | patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when password.txt is accessed… | |
| Modified | Critical (9.8) | 8.9% | Exploit | Themerex AddonsThemerex Ozeum-museumThemerex Chit Club-board GamesThemerex Yottis-simple Portfolio+59 | 3/10/2020 | 6/17/2026 | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter. | |
| Analyzed | Critical (9.8) | 100% | ⚠ Active exploitationExploit | Microsoft Windows 7Microsoft Windows Server 2008Siemens Axiom Multix M FirmwareSiemens Axiom Vertix MD Trauma Firmware+63 | 5/16/2019 | 6/17/2026 | A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'. |