Vulnerabilities
Summary — last 7 days
New vulnerabilities5,351▲ 1,987 vs. last week
Critical / high2,732▲ 1,125 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)615▲ 401 vs. last week
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | Medium (6.1) | 0.45% | — | PAY Project PAY | 4/19/2023 | 6/17/2026 | Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed… | |
| Modified | High (8.8) | 0.47% | — | Facepay Project Facepay | 12/5/2022 | 6/17/2026 | A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched remotely. The identifier… | |
| Modified | High (7.2) | 1.5% | — | Alipay Project Alipay | 9/6/2021 | 6/17/2026 | A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection. | |
| Modified | High (7.5) | 1.1% | — | Trippay Project Trippay | 7/9/2018 | 6/17/2026 | The mintToken function of a smart contract implementation for TripPay, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |
| Modified | Medium (4.3) | 1.7% | — | Alipay Project Alipay | 10/21/2014 | 6/17/2026 | Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function. |