Vulnerabilities
Summary — last 7 days
New vulnerabilities4,993▲ 135 vs. last week
Critical / high2,112▼ 668 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)824▲ 761 vs. last week
More filters
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.3) | 1.1% | — | Apache Axis2AISangoma FilestoreAI | 4/24/2026 | 6/17/2026 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default… | |
| Analyzed | Critical (9.1) | 0.37% | — | Sainwp Onestore Sites | 2/27/2025 | 6/17/2026 | The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query… | |
| Deferred | Critical (9.6) | 0.24% | — | Sainwp Onestore SitesAI | 2/7/2025 | 6/17/2026 | Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: from n/a through <= 0.1.1. | |
| Deferred | Critical (9.8) | 23% | Exploit | WP Umbrella Update Backup Restore AND MonitoringAI | 12/8/2024 | 6/17/2026 | The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the… | |
| Modified | Critical (9.8) | 0.69% | — | NQ Contacts Backup & Restore | 10/29/2017 | 6/17/2026 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash… |