Vulnerabilities
Summary — last 7 days
New vulnerabilities4,651▼ 647 vs. last week
Critical / high1,870▼ 1,181 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)730▲ 621 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | Medium (4.3) | 1.00% | PoC | Smashballoon Custom Twitter Feeds | 2/29/2024 | 6/17/2026 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctf_auto_save_tokens function. This makes it possible for unauthenticated attackers to… | |
| Modified | Medium (5.4) | 1.0% | Exploit | Smashballoon Smash Balloon Social Post Feed | 1/17/2022 | 6/17/2026 | The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page. | |
| Modified | High (7.5) | 1.3% | Exploit | Supersmashbrothers Army System | 2/18/2006 | 6/16/2026 | SQL injection vulnerability in army.php in supersmashbrothers (SSB) Army System 2.1.0 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the userstat parameter in an army action to index.php. |