Vulnerabilities
Summary — last 7 days
New vulnerabilities5,230▲ 2,456 vs. last week
Critical / high2,953▲ 1,621 vs. last week
New active exploitation (KEV)6▼ 2 vs. last week
Unscored (no CVSS)223▲ 49 vs. last week
10 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Received | High (7) | — | — | Venturedrake Laravel CRMAI | 10/14/2026 | 10/14/2026 | VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the… | |
| Received | High (7.1) | — | — | Venturedrake Laravel CRMAI | 10/14/2026 | 10/14/2026 | VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products… | |
| Deferred | Medium (5.5) | 1.00% | 💥 Exploit | Krayin Laravel-crmAI | 9/27/2026 | 9/30/2026 | A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has… | |
| Deferred | Low (2.1) | 0.48% | — | Krayin Laravel CRMAI | 9/27/2026 | 9/28/2026 | A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource identifiers. The attack… | |
| Deferred | Low (2.1) | 0.46% | — | Krayin Laravel CRMAI | 9/27/2026 | 9/28/2026 | A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to… | |
| Deferred | Low (1.9) | 0.26% | — | Krayin Laravel CRMAI | 9/27/2026 | 9/30/2026 | A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.label results in cross… | |
| Deferred | Medium (5.1) | 0.24% | — | Krayin Laravel-crmAI | 9/25/2026 | 9/29/2026 | A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of… | |
| Deferred | Low (2) | 0.24% | — | Krayin Laravel CRMAI | 9/25/2026 | 9/29/2026 | A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to… | |
| Deferred | Low (2.1) | 0.27% | — | Krayin Laravel-crmAI | 9/25/2026 | 9/28/2026 | A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can… | |
| Deferred | Low (2) | 0.36% | — | Krayin Laravel-crmAI | 4/2/2026 | 7/24/2026 | A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible.… |