Vulnerabilities

Summary — last 7 days

New vulnerabilities2,623▼ 237 vs. last week

Critical / high1,384▲ 151 vs. last week

New active exploitation (KEV)7▼ 3 vs. last week

Unscored (no CVSS)56▼ 473 vs. last week

11 results, sorted by published date (most recent first)

CVE	Status	Severity	EPSS	Active exploitation	Affected technologies	Published ▼	Modified	Description
CVE-2026-92791	Deferred	High (8.7)	0.61%	—	Uber Kraken^AI	9/16/2026	9/24/2026	Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend…
CVE-2026-82955	Deferred	Critical (9)	0.18%	—	Eclipse Aerios^AI Krakend^AI	9/2/2026	9/3/2026	In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS…
CVE-2026-75625	Deferred	Critical (9.1)	0.24%	—	Kraken^AI	8/18/2026	9/24/2026	Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32…
CVE-2026-3206	Deferred	Low (1.3)	0.41%	—	Krakend-ce^AI Krakend-ee^AI	2/25/2026	6/17/2026	Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5.
CVE-2025-51387	Analyzed	Critical (9.8)	0.55%	—	Axosoft Gitkraken Desktop	8/4/2025	6/17/2026	The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode,…
CVE-2023-22708	Deferred	Medium (4.3)	0.65%	—	Kraken.io Image Optimizer^AI	12/9/2024	6/17/2026	Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kraken.io Image Optimizer: from n/a through 2.6.7.
CVE-2023-46944	Modified	High (7.8)	1.3%	—	Gitkraken Gitlens	11/28/2023	6/17/2026	An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust component.
CVE-2023-0619	Modified	Medium (6.5)	0.68%	—	Kraken.io Image Optimizer	2/1/2023	6/17/2026	The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset image optimizations.
CVE-2022-47747	Modified	High (7.5)	0.80%	—	Uber Kraken	1/20/2023	6/17/2026	kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.
CVE-2022-38454	Modified	High (8.8)	0.36%	—	Kraken.io Image Optimizer	9/23/2022	6/17/2026	Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress.
CVE-2022-1561	Modified	Medium (4.3)	0.57%	—	Krakend Luraproject Lura	8/1/2022	6/17/2026	Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend…