Vulnerabilities
Summary — last 7 days
New vulnerabilities4,573▼ 798 vs. last week
Critical / high1,789▼ 1,280 vs. last week
New active exploitation (KEV)6▼ 3 vs. last week
Unscored (no CVSS)787▲ 693 vs. last week
More filters
413,443 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users' AI evaluator or… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens exposing applications to… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other users rely on to… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings,… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every shared OCR prompt record… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting… | |
| Deferred | Medium (6.9) | 0.14% | — | Ericmj DecimalAI | 10/10/2026 | 10/15/2026 | Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of… | |
| Deferred | Critical (9.8) | 0.32% | — | Buzz StoneAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | |
| Deferred | Critical (9.8) | 0.34% | — | PhotoliaAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | |
| Deferred | High (7.1) | 0.15% | — | EducavoAI | 10/10/2026 | 10/13/2026 | Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. | |
| Deferred | Critical (9.8) | 0.34% | — | QweryAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | |
| Deferred | High (7.1) | 0.15% | — | — | 10/10/2026 | 10/13/2026 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. | |
| Deferred | Critical (9.8) | 0.31% | — | JacquelineAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | |
| Deferred | High (7.7) | 0.40% | — | Chimpgroup FoodbakeryAI | 10/10/2026 | 10/13/2026 | Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. | |
| Deferred | Critical (9.8) | 0.31% | — | AllianceAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | |
| Deferred | Critical (9.8) | 0.31% | — | Axiomthemes KickerAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | |
| Deferred | Critical (9.8) | 0.31% | — | — | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | |
| Deferred | Critical (9.8) | 0.33% | — | AnestaAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. | |
| Deferred | High (8.1) | 0.28% | — | AmbientAI | 10/10/2026 | 10/13/2026 | Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. | |
| Deferred | Critical (9.8) | 0.31% | — | FC UnitedAI | 10/10/2026 | 10/13/2026 | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |