Vulnerabilities
Summary — last 7 days
New vulnerabilities4,588▼ 805 vs. last week
Critical / high1,807▼ 1,299 vs. last week
New active exploitation (KEV)6▼ 3 vs. last week
Unscored (no CVSS)739▲ 636 vs. last week
More filters
10 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.5) | 0.34% | — | Lambertgroup Chameleon Html5 Audio Player With Without PlaylistAI | 5/16/2025 | 6/17/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Playlist lbg-audio1-html5 allows SQL Injection.This issue affects Chameleon HTML5 Audio Player With/Without Playlist: from n/a through <= 3.5.6. | |
| Deferred | High (7.1) | 0.36% | — | Chameleoni JobsAI | 12/2/2024 | 6/17/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chameleoni Chameleoni Jobs chameleon-jobs allows Reflected XSS.This issue affects Chameleoni Jobs: from n/a through <= 2.5.4. | |
| Modified | High (7.5) | 0.92% | — | Hyphensolutions Chameleon Power | 11/22/2023 | 6/17/2026 | Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files located on the server and gain access to sensitive information such as configuration files. | |
| Modified | Medium (4.8) | 0.42% | — | Chameleon Project Chameleon | 11/17/2022 | 6/17/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress. | |
| Modified | High (8.8) | 0.73% | — | Chameleon CSS Project Chameleon CSS | 11/8/2021 | 6/17/2026 | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it… | |
| Modified | Critical (9.1) | 1.3% | — | Chameleon Mini Live Debugger Project Chameleon Mini Live Debugger | 8/28/2020 | 6/17/2026 | Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory. | |
| Modified | Medium (4.3) | 1.5% | Exploit | Abk-soft Chameleon Social Networking | 12/1/2010 | 6/16/2026 | Multiple cross-site scripting (XSS) vulnerabilities in forum_new_topic.php in Chameleon Social Networking allow remote attackers to inject arbitrary web script or HTML via the (1) thread_title and (2) thread_description parameters in a message. | |
| Modified | High (7.5) | 1.7% | — | Chameleon CMS | 6/6/2007 | 6/16/2026 | Session fixation vulnerability in chameleon cms 3.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. | |
| Modified | Medium (5) | 3.5% | Exploit | Unidomedia Chameleon LE | 7/25/2006 | 6/16/2026 | Directory traversal vulnerability in index.php in UNIDOmedia Chameleon LE 1.203 and earlier, and possibly Chameleon PRO, allows remote attackers to read arbitrary files via the rmid parameter. | |
| Modified | Medium (5) | 1.4% | — | Netmanager Chameleon SmtpdAI | 3/1/1999 | 6/16/2026 | Netmanager Chameleon SMTPd has several buffer overflows that cause a crash. |