Vulnerabilities
Summary — last 7 days
New vulnerabilities5,308▲ 2,066 vs. last week
Critical / high2,669▲ 1,103 vs. last week
New active exploitation (KEV)7→ no change vs. last week
Unscored (no CVSS)757▲ 707 vs. last week
8 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (6.4) | 0.27% | — | Xyzscripts Contact Form ManagerAI | 6/1/2024 | 6/17/2026 | The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers… | |
| Modified | Medium (5.4) | 0.83% | — | Xyzscripts Contact Form Manager | 6/16/2022 | 6/17/2026 | A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | |
| Modified | Medium (4.3) | 0.58% | — | Xyzscripts Contact Form Manager | 6/16/2022 | 6/17/2026 | A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | |
| Modified | High (8.8) | 1.0% | — | Logrhythm Platform Manager | 12/17/2020 | 6/17/2026 | LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application server, which will… | |
| Modified | High (8.8) | 1.0% | — | Logrhythm Platform Manager | 12/17/2020 | 6/17/2026 | LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the… | |
| Modified | Critical (9.8) | 3.1% | — | Logrhythm Platform Manager | 12/17/2020 | 6/17/2026 | LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges. | |
| Modified | Critical (9.8) | 6.0% | — | Form Manager Project Form Manager | 10/17/2017 | 6/17/2026 | Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors. | |
| Modified | Medium (4.6) | 2.1% | — | Adobe Livecycle Form Manager | 4/13/2006 | 6/16/2026 | Adobe LiveCycle Workflow 7.01 and LiveCycle Forum Manager 7.01 allows users to authenticate and perform privileged actions when their account is marked "OBSOLETE" but the account is also active, within the authentication system. |