Vulnerabilities
Summary — last 7 days
New vulnerabilities4,643▼ 852 vs. last week
Critical / high1,746▼ 1,375 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)954▲ 855 vs. last week
More filters
4 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Critical (9.2) | 0.48% | — | Phpoffice PhppresentationAI | 10/21/2026 | 10/22/2026 | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain… | |
| Deferred | Critical (9.2) | 0.46% | PoC | Phpoffice PhpspreadsheetAI | 6/22/2026 | 6/23/2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://,… | |
| Analyzed | Critical (9.2) | 0.78% | — | Phpoffice Phpspreadsheet | 5/5/2026 | 7/24/2026 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as… | |
| Modified | Critical (9.8) | 2.2% | — | Phpoffice Project Common | 7/15/2018 | 6/17/2026 | XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. |