Vulnerabilities
Summary — last 7 days
New vulnerabilities3,199▲ 621 vs. last week
Critical / high1,509▲ 117 vs. last week
New active exploitation (KEV)5▼ 1 vs. last week
Unscored (no CVSS)236▲ 222 vs. last week
404,365 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (6.9) | 0.22% | — | B3log SiyuanAI | 10/4/2026 | 10/5/2026 | SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo or getDocsInfo for a… | |
| Deferred | Medium (5.5) | 0.41% | — | Rainygao DocsysAI | 10/4/2026 | 10/6/2026 | A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is… | |
| Deferred | Low (2.1) | 0.45% | — | Rainygao DocsysAI | 10/4/2026 | 10/6/2026 | A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitation of the attack is… | |
| Deferred | Low (2.9) | 0.19% | — | YzmcmsAI | 10/4/2026 | 10/6/2026 | A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This… | |
| Deferred | Medium (5.5) | 0.26% | — | MoosocialAI | 10/4/2026 | 10/6/2026 | A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for… | |
| Deferred | Medium (5.5) | 0.28% | — | Sciphi-ai R2RAI | 10/4/2026 | 10/5/2026 | A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base leads to server-side request forgery. The attack can be… | |
| Deferred | Medium (5.5) | 0.28% | — | Sciphi-ai R2RAI | 10/4/2026 | 10/5/2026 | A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed… | |
| Deferred | High (7.5) | 0.24% | — | Stylemixthemes Cost Calculator BuilderAI | 10/4/2026 | 10/6/2026 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17. | |
| Deferred | Low (2) | 0.20% | — | Comsenz DiscuzAI | 10/4/2026 | 10/6/2026 | A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql injection. It is… | |
| Deferred | Medium (5.5) | 0.29% | — | Weaviate VerbaAI | 10/4/2026 | 10/6/2026 | A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components/util.py of the component generate_stream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The… | |
| Deferred | High (7.1) | 0.15% | — | Veronalabs WP StatisticsAI | 10/4/2026 | 10/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14. | |
| Deferred | Medium (5.5) | 0.54% | — | DrogonAI | 10/4/2026 | 10/6/2026 | A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been… | |
| Deferred | Medium (5.3) | 0.34% | — | Topoteretes CogneeAI | 10/4/2026 | 10/6/2026 | A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in… | |
| Deferred | Low (1.3) | 0.13% | — | LaradockAI | 10/4/2026 | 10/6/2026 | A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The… | |
| Deferred | Critical (9.3) | 0.25% | 💥 PoC | Unlimited-elements Unlimited Elements FOR ElementorAI | 10/4/2026 | 10/6/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets,… | |
| Deferred | High (7.1) | 0.15% | — | Kadenceblocks Kadence BlocksAI | 10/4/2026 | 10/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1. | |
| Deferred | High (7.1) | 0.15% | — | Unlimited-elements Unlimited Elements FOR ElementorAI | 10/4/2026 | 10/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons,… | |
| Deferred | High (7.1) | 0.15% | — | Cozmoslabs TranslatepressAI | 10/4/2026 | 10/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6. | |
| Deferred | Medium (5.3) | 0.20% | 💥 PoC | Userprivatefiles User Private FilesAI | 10/4/2026 | 10/9/2026 | The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly. | |
| Deferred | High (8.8) | 0.14% | — | CocartAI | 10/4/2026 | 10/6/2026 | The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in… | |
| Deferred | Medium (4.9) | 0.23% | — | Fivestarplugins Five Star Business Profile AND SchemaAI | 10/4/2026 | 10/6/2026 | The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and… | |
| Deferred | Medium (6.8) | 0.24% | — | Horizontal Scrolling AnnouncementsAI | 10/4/2026 | 10/6/2026 | The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored… | |
| Deferred | Critical (9.3) | 0.77% | — | Internlm MindsearchAI | 10/4/2026 | 10/6/2026 | A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to… | |
| Deferred | Critical (9.3) | 1.8% | 💥 PoC | AhsaycbsAI | 10/4/2026 | 10/6/2026 | A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit… | |
| Deferred | Medium (5.5) | 0.38% | — | AhsaycbsAI | 10/4/2026 | 10/6/2026 | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit… |