Vulnerabilities
Summary — last 7 days
New vulnerabilities5,032▲ 199 vs. last week
Critical / high2,142▼ 632 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)773▲ 710 vs. last week
More filters
14 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (5.3) | 0.22% | — | Abilityai TrinityAI | 10/11/2026 | 10/16/2026 | Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with… | |
| Deferred | High (7.5) | 0.39% | — | Trinity BackupAI | 6/26/2026 | 6/26/2026 | Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions. | |
| Deferred | Medium (4.3) | 0.23% | — | Sergiotrinity Trinity AudioAI | 12/9/2025 | 10/7/2026 | Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3. | |
| Deferred | Medium (5.3) | 1.0% | Exploit | Trinity AudioAI | 10/11/2025 | 10/8/2026 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to… | |
| Deferred | Medium (6.1) | 0.27% | — | Trinity AudioAI | 10/4/2025 | 10/11/2026 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for… | |
| Deferred | Medium (4.3) | 0.20% | PoC | Trinityaudio Text TO SpeechAI | 10/4/2025 | 10/11/2026 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This makes it possible for… | |
| Deferred | Medium (4.3) | 0.28% | — | Sergiotrinity Trinity AudioAI | 6/6/2025 | 6/17/2026 | Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0. | |
| Modified | High (8.8) | 0.26% | — | Startrinity Softswitch | 9/3/2023 | 6/17/2026 | StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352) | |
| Modified | Medium (6.1) | 0.36% | — | Startrinity Softswitch | 9/3/2023 | 6/17/2026 | StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601) | |
| Modified | Medium (5.4) | 0.38% | — | Startrinity Softswitch | 9/3/2023 | 6/17/2026 | StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79) | |
| Modified | Medium (6.1) | 0.40% | — | Startrinity Softswitch | 9/3/2023 | 6/17/2026 | StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79) | |
| Modified | High (7.5) | 2.2% | — | Centrinity Firstclass Desktop Client | 5/2/2005 | 6/16/2026 | OpenText FirstClass 8.0 client does not properly sanitize strings before passing them to the Windows ShellExecute API, which allows remote attackers to execute arbitrary commands via a UNC path in a bookmark. | |
| Modified | Medium (5) | 3.4% | Exploit | Centrinity FirstclassAI | 12/31/2003 | 6/16/2026 | Centrinity FirstClass 7.1 allows remote attackers to access sensitive information by appending search to the end of the URL and checking all of the search option checkboxes and leaving the text field blank, which will return all files in the searched directory. | |
| Modified | Medium (5) | 3.1% | Exploit | Centrinity Firstclass Intranet Server | 6/27/2000 | 6/16/2026 | FirstClass Internet Services server 5.770, and other versions before 6.1, allows remote attackers to cause a denial of service by sending an email with a long To: mail header. |