Vulnerabilities
Summary — last 7 days
New vulnerabilities4,969▲ 170 vs. last week
Critical / high1,871▼ 880 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)1,013▲ 950 vs. last week
More filters
4 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Critical (9.9) | 0.64% | — | Kedacore KedaAI | 10/14/2026 | 10/20/2026 | KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential.… | |
| Awaiting Analysis | Medium (5.9) | 0.39% | — | KedaAIPostgresql LibpqAI | 8/21/2026 | 10/12/2026 | KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal… | |
| Deferred | High (8.2) | 0.55% | — | KedaAIHashicorp VaultAIKubernetesAI | 12/22/2025 | 9/25/2026 | KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an… | |
| Modified | High (7.4) | 1.2% | — | 77bank 77 BankAshikagabank AshiginHokkaidobank DoginHokugin Hokuriku Bank Portal+5 | 1/28/2020 | 6/17/2026 | Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted… |