Vulnerabilities
Summary — last 7 days
New vulnerabilities3,081▲ 625 vs. last week
Critical / high1,483▲ 317 vs. last week
New active exploitation (KEV)5▼ 5 vs. last week
Unscored (no CVSS)393▲ 186 vs. last week
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.3) | 1.0% | — | Rubyonrails Ruby ON RailsAIHavenweb HavenAI | 7/19/2024 | 6/17/2026 | A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate… | |
| Deferred | Medium (6.5) | 0.41% | — | Adam Dehaven Perfect PullquotesAI | 5/14/2024 | 6/17/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam DeHaven Perfect Pullquotes allows Stored XSS.This issue affects Perfect Pullquotes: from n/a through 1.7.5. | |
| Modified | Medium (5) | 0.48% | — | Havenweb Haven | 1/27/2023 | 6/17/2026 | Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have… | |
| Modified | Medium (5.4) | 0.27% | — | Creatingahaven Compassion Satisfaction | 10/19/2014 | 6/17/2026 | The Compassion Satisfaction (aka com.wCompassionSatisfactionWorkshopPresentation) application 0.75.13440.35155 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | |
| Modified | High (7.5) | 0.99% | — | 26thavenue Bspeak | 5/22/2009 | 6/16/2026 | SQL injection vulnerability in index.php in 26th Avenue bSpeak 1.10 allows remote attackers to execute arbitrary SQL commands via the forumid parameter in a post action. |