Vulnerabilities
Summary — last 7 days
New vulnerabilities4,787▼ 467 vs. last week
Critical / high1,886▼ 1,154 vs. last week
New active exploitation (KEV)8▲ 1 vs. last week
Unscored (no CVSS)813▲ 701 vs. last week
More filters
2,397 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Received | Medium (4) | 0.17% | — | VectorimageAI | 10/21/2026 | 10/21/2026 | A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. | |
| Awaiting Analysis | High (7.4) | 0.32% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager… | |
| Awaiting Analysis | High (7.5) | 0.30% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager… | |
| Awaiting Analysis | High (8.7) | 0.26% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager… | |
| Awaiting Analysis | Critical (9.8) | 0.36% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager… | |
| Awaiting Analysis | Critical (9.1) | 0.40% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager… | |
| Awaiting Analysis | High (7.1) | 0.12% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager… | |
| Awaiting Analysis | High (7.1) | 0.15% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager… | |
| Awaiting Analysis | High (8.6) | 0.30% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager… | |
| Awaiting Analysis | High (8.7) | 0.38% | — | Oracle Identity Manager ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle… | |
| Awaiting Analysis | High (7.5) | 0.40% | — | Oracle Mysql ConnectorsAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this… | |
| Awaiting Analysis | Medium (6.8) | 0.29% | — | Oracle Mysql ConnectorsAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this… | |
| Awaiting Analysis | Low (2.5) | 0.12% | — | Oracle Mysql ConnectorsAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful… | |
| Awaiting Analysis | High (8.1) | 0.38% | — | Oracle Connector/jAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors. Successful attacks of this vulnerability can result… | |
| Awaiting Analysis | Medium (6.7) | 0.12% | — | Oracle Agile PLM Mcad ConnectorAI | 10/20/2026 | 10/21/2026 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise… | |
| Awaiting Analysis | Medium (4.3) | 0.32% | — | Oracle Connector/jAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human… | |
| Awaiting Analysis | Medium (4.3) | 0.28% | — | Oracle Mysql Connector/jAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human… | |
| Awaiting Analysis | Medium (5.9) | 0.32% | — | Oracle Mysql ConnectorsAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this… | |
| Awaiting Analysis | Medium (4.3) | 0.28% | — | Oracle Mysql ConnectorsAI | 10/20/2026 | 10/21/2026 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human… | |
| Deferred | High (7) | 0.22% | — | Opengauss-connector-jdbcAI | 10/19/2026 | 10/19/2026 | 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。 此漏洞自… | |
| Deferred | Medium (6.4) | 0.22% | — | GeodirectoryAI | 10/16/2026 | 10/16/2026 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for… | |
| Deferred | Medium (6.4) | 0.19% | — | Name DirectoryAI | 10/16/2026 | 10/16/2026 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to… | |
| Deferred | Medium (6.4) | 0.22% | — | GeodirectoryAI | 10/16/2026 | 10/16/2026 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for… | |
| Deferred | Medium (6.5) | 0.35% | — | WSP MCP AI Agents ConnectorAI | 10/16/2026 | 10/16/2026 | The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and… | |
| Deferred | Medium (6.4) | 0.27% | — | GeodirectoryAI | 10/14/2026 | 10/14/2026 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes… |