Vulnerabilities
Summary — last 7 days
New vulnerabilities3,526▼ 1,286 vs. last week
Critical / high1,364▼ 1,397 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)710▲ 647 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Low (3.5) | 0.15% | — | HeliumAI | 10/15/2026 | 10/16/2026 | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and… | |
| Deferred | Medium (4.3) | 0.21% | — | Helium Project HeliumAI | 10/15/2026 | 10/16/2026 | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to… | |
| Modified | High (7.5) | 1.0% | — | Heliumnetwork Project Heliumnetwork | 7/9/2018 | 6/17/2026 | The mintToken function of a smart contract implementation for HeliumNetwork, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. |