Vulnerabilities
Summary — last 7 days
New vulnerabilities4,513▼ 887 vs. last week
Critical / high1,767▼ 1,321 vs. last week
New active exploitation (KEV)6▼ 3 vs. last week
Unscored (no CVSS)760▲ 667 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | High (7.1) | 0.39% | — | Wukong AicrmAI | 10/13/2026 | 10/14/2026 | Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding… | |
| Awaiting Analysis | High (8.7) | 0.45% | — | Wukong AicrmAI | 10/13/2026 | 10/14/2026 | Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and… | |
| Deferred | Medium (5.3) | 0.17% | — | Wukong AicrmAI | 10/11/2026 | 10/18/2026 | Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the… |