Vulnerabilities
Summary — last 7 days
New vulnerabilities4,643▼ 852 vs. last week
Critical / high1,746▼ 1,375 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)954▲ 855 vs. last week
More filters
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.2) | 0.46% | PoC | Phpoffice PhpspreadsheetAI | 6/22/2026 | 6/23/2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://,… | |
| Analyzed | Medium (5.1) | 0.40% | PoC | Phpoffice Phpspreadsheet | 1/20/2025 | 6/17/2026 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response. | |
| Analyzed | High (7.5) | 2.8% | Exploit | Phpoffice Phpspreadsheet | 10/7/2024 | 6/17/2026 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server… | |
| Modified | High (8.8) | 7.8% | Exploit | Phpoffice Phpspreadsheet | 11/14/2018 | 6/17/2026 | securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file | |
| Modified | High (7.5) | 2.9% | Exploit | TIM Jackson Phpof | 9/8/2007 | 6/16/2026 | PHP remote file inclusion vulnerability in dbmodules/DB_adodb.class.php in PHP Object Framework (PHPOF) 20040226 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHPOF_INCLUDE_PATH parameter. |