Vulnerabilities
Summary — last 7 days
New vulnerabilities4,657▼ 540 vs. last week
Critical / high1,880▼ 1,109 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)789▲ 681 vs. last week
More filters
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Low (2.1) | 0.24% | — | Rapyd AdminAI | 10/13/2026 | 10/14/2026 | Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators… | |
| Awaiting Analysis | High (8.7) | 0.46% | — | Rapyd AdminAI | 10/13/2026 | 10/14/2026 | Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable… | |
| Deferred | High (8.6) | 0.33% | — | Rapyd AdminAI | 10/12/2026 | 10/16/2026 | Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own… | |
| Deferred | Critical (9.3) | 0.44% | — | Rapyd AdminAI | 10/12/2026 | 10/16/2026 | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make… | |
| Deferred | Medium (5.3) | 0.21% | — | Rapyd AdminAI | 10/12/2026 | 10/16/2026 | Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an… |