Vulnerabilities
Summary — last 7 days
New vulnerabilities4,787▼ 467 vs. last week
Critical / high1,886▼ 1,154 vs. last week
New active exploitation (KEV)8▲ 1 vs. last week
Unscored (no CVSS)813▲ 701 vs. last week
More filters
412,988 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Low (3.6) | 0.12% | — | NGX Cache PurgeAI | 10/12/2026 | 10/16/2026 | ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an… | |
| Deferred | Medium (5.3) | 0.20% | — | Zkteco BiotimeAI | 10/12/2026 | 10/16/2026 | A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to… | |
| Deferred | Low (2.1) | 0.36% | — | Westboy CicadascmsAI | 10/12/2026 | 10/13/2026 | A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to… | |
| Deferred | Low (2) | 0.54% | — | Westboy CicadascmsAI | 10/12/2026 | 10/15/2026 | A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from… | |
| Deferred | Low (2) | 0.18% | — | Deepseek-ai Deepseek-harnessAI | 10/12/2026 | 10/13/2026 | A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be… | |
| Awaiting Analysis | Medium (6.2) | 0.11% | — | Geovisum Gv-e-map ServerAI | 10/12/2026 | 10/16/2026 | GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime. | |
| Awaiting Analysis | Medium (5.5) | 0.10% | — | — | 10/12/2026 | 10/16/2026 | In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges. | |
| Awaiting Analysis | Critical (9.8) | 0.46% | — | — | 10/12/2026 | 10/16/2026 | In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed. | |
| Awaiting Analysis | Medium (5.5) | 0.11% | — | — | 10/12/2026 | 10/16/2026 | In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed. | |
| Deferred | High (8.8) | 1.1% | — | BlinkoAI | 10/12/2026 | 10/16/2026 | Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes… | |
| Deferred | Low (1.9) | 0.11% | — | Deepseek-ai Deepseek-harnessAI | 10/12/2026 | 10/14/2026 | A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly… | |
| Deferred | Low (2.1) | 0.20% | — | Houtini-ai Voice Analyser MCPAI | 10/12/2026 | 10/13/2026 | A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is… | |
| Deferred | Low (2.1) | 0.20% | — | Houtini-ai Seo-crawler-mcpAI | 10/12/2026 | 10/15/2026 | A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public… | |
| Deferred | Low (2.1) | 0.29% | — | Macrozheng MallAI | 10/12/2026 | 10/13/2026 | A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has… | |
| Deferred | Medium (5.5) | 0.57% | — | Macrozheng MallAI | 10/12/2026 | 10/14/2026 | A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack… | |
| Deferred | Medium (5.5) | 0.38% | — | Prvtpro Amnezia WEB PanelAI | 10/12/2026 | 10/13/2026 | A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be… | |
| Deferred | Low (2.1) | 0.19% | — | Erzhongxmu JeewmsAI | 10/12/2026 | 10/15/2026 | A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument… | |
| Deferred | Low (2.1) | 0.20% | — | Erzhongxmu JeewmsAI | 10/11/2026 | 10/13/2026 | A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr… | |
| Deferred | Low (2.1) | 0.19% | — | Erzhongxmu JeewmsAI | 10/11/2026 | 10/14/2026 | A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The… | |
| Deferred | Low (2.1) | 0.19% | — | Erzhongxmu JeewmsAI | 10/11/2026 | 10/13/2026 | A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr causes sql injection. The… | |
| Deferred | Low (2.1) | 0.19% | — | Erzhongxmu JeewmsAI | 10/11/2026 | 10/15/2026 | A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The exploit has been… | |
| Deferred | Low (2.1) | 0.30% | — | Erzhongxmu JeewmsAI | 10/11/2026 | 10/13/2026 | A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation… | |
| Deferred | Low (2.1) | 0.30% | — | Erzhongxmu JeewmsAI | 10/11/2026 | 10/14/2026 | A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched… | |
| Deferred | Low (2.1) | 0.19% | — | Erzhongxmu JeewmsAI | 10/11/2026 | 10/13/2026 | A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely. The exploit is now… | |
| Deferred | Medium (5.5) | 0.70% | — | Bleenco AbstruseAI | 10/11/2026 | 10/15/2026 | A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has… |