Vulnerabilities
Summary — last 7 days
New vulnerabilities4,976▲ 106 vs. last week
Critical / high2,098▼ 687 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)823▲ 761 vs. last week
More filters
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | Critical (9.8) | 2.0% | PoC | Pluginab Plugin A/B Image Optimizer | 2/7/2025 | 6/17/2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3. | |
| Modified | Critical (9.8) | 65% | Exploit | Colorlib ActivelloColorlib BonkersColorlib IlldyColorlib Newspaper X+12 | 6/7/2023 | 6/17/2026 | The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <=… | |
| Analyzed | Critical (9.8) | 100% | ⚠ Active exploitationExploit | Vmware Spring Cloud FunctionOracle Banking BranchOracle Banking Cash ManagementOracle Banking Corporate Lending Process Management+24 | 4/1/2022 | 6/17/2026 | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. | |
| Modified | Critical (9.8) | 4.3% | PoC | Limitloginattempts Limit Login Attempts Reloaded | 12/21/2020 | 6/17/2026 | LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited… | |
| Modified | Critical (9.8) | 17% | PoC | Softwareag QuartzOracle Apache Batik MapviewerOracle Banking Enterprise OriginationsOracle Banking Enterprise Product Manufacturing+27 | 7/26/2019 | 6/17/2026 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. |