Vulnerabilities
Summary — last 7 days
New vulnerabilities5,169▲ 2,076 vs. last week
Critical / high2,875▲ 1,375 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)184▼ 23 vs. last week
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Medium (5.3) | 0.19% | — | Enviragallery Envira Gallery LiteAI | 10/9/2026 | 10/14/2026 | Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and… | |
| Deferred | Medium (6.4) | 0.35% | — | Envira Gallery LiteAI | 5/14/2026 | 6/17/2026 | The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. The… |