Vulnerabilities
Summary — last 7 days
New vulnerabilities3,202▲ 616 vs. last week
Critical / high1,511▲ 116 vs. last week
New active exploitation (KEV)5▼ 1 vs. last week
Unscored (no CVSS)236▲ 222 vs. last week
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.1) | 0.19% | — | LegcordAI | 10/4/2026 | 10/6/2026 | Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors… | |
| Deferred | Critical (9.2) | 0.38% | — | LegcordAI | 10/4/2026 | 10/6/2026 | Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install… |