Vulnerabilities
Summary — last 7 days
New vulnerabilities4,634▼ 858 vs. last week
Critical / high1,741▼ 1,381 vs. last week
New active exploitation (KEV)7▼ 2 vs. last week
Unscored (no CVSS)953▲ 853 vs. last week
More filters
7 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (6.1) | 0.79% | Exploit | Seraphinite AcceleratorAI | 8/5/2026 | 8/12/2026 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams() function using PHP's loose inequality operator (!=) to compare the expected HMAC string… | |
| Analyzed | Critical (9.8) | 2.7% | PoC | Zapolnoch Tesseract OCR | 3/25/2026 | 6/17/2026 | node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper… | |
| Modified | Critical (9.8) | 4.8% | Exploit | Blocksera Cryptocurrency Widgets Pack | 1/2/2023 | 6/17/2026 | The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | |
| Modified | Critical (9.8) | 2.4% | Exploit | Blocksera Cryptocurrency Widgets Pack | 12/15/2022 | 6/17/2026 | Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress. | |
| Modified | Critical (9.8) | 6.5% | Exploit | Blocksera Image Hover Effects | 12/15/2021 | 6/17/2026 | Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin. | |
| Modified | High (7.8) | 1.2% | Exploit | Ignitum Sera | 11/1/2017 | 6/17/2026 | Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks. | |
| Modified | High (7.5) | 1.2% | Exploit | Seraphimtech Free Bible Search PHP Script | 1/29/2009 | 6/16/2026 | SQL injection vulnerability in readbible.php in Free Bible Search PHP Script 1.0 allows remote attackers to execute arbitrary SQL commands via the version parameter. |