Vulnerabilities
Summary — last 7 days
New vulnerabilities2,748▲ 38 vs. last week
Critical / high1,479▲ 369 vs. last week
New active exploitation (KEV)7▼ 3 vs. last week
Unscored (no CVSS)64▼ 462 vs. last week
8 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.8) | 0.44% | — | Openknowledgemaps HeadstartAI | 5/29/2025 | 6/17/2026 | An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component | |
| Modified | Low (3.5) | 0.84% | — | Headstart Solutions Deskpro | 8/18/2007 | 6/16/2026 | Multiple cross-site scripting (XSS) vulnerabilities in Headstart Solutions DeskPRO 3.0.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters to (1) techs.php, (2) ticket_category.php, (3) ticket_priority.php, (4) ticket_workflow.php, (5) ticket_escalate.php, (6)… | |
| Modified | Low (3.5) | 0.85% | — | Headstart Solutions Deskpro | 8/18/2007 | 6/16/2026 | Direct static code injection vulnerability in admincp/user_help.php in Headstart Solutions DeskPRO 3.0.2 allows remote authenticated users to inject arbitrary PHP code into an unspecified file via a new_entry value in the do parameter. | |
| Modified | Medium (5) | 1.1% | — | Headstart Solutions Deskpro | 2/12/2007 | 6/16/2026 | install/loader_help.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERY_STRING, which calls the phpinfo function. | |
| Modified | Medium (5) | 1.2% | — | Headstart Solutions Deskpro | 2/12/2007 | 6/16/2026 | Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to (1) email/mail.php, (2) includes/init.php, (3) certain files in includes/cron/, and (4) jpgraph.php, (5) jpgraph_bar.php, (6) jpgraph_pie.php, and (7) jpgraph_pie3d.php in includes/graph/, which leaks the path in error… | |
| Modified | Medium (4.3) | 1.1% | — | Headstart Solutions Deskpro | 2/12/2007 | 6/16/2026 | attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter. | |
| Modified | High (7.5) | 1.3% | — | Headstart Solutions Deskpro | 2/7/2007 | 6/16/2026 | Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) list files in the includes/ directory; obtain the SQL username and password via a direct request for (2) config.php and (3) config.php.bak in includes/; read files in (4)… | |
| Modified | High (7.5) | 1.4% | — | Headstart Solutions Deskpro | 2/7/2007 | 6/16/2026 | Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to (1) reinstall the application via a direct request for install/index.php; (2) delete the database via a do=delete_database QUERY_STRING to a renamed… |