Vulnerabilities
Summary — last 7 days
New vulnerabilities4,657▼ 540 vs. last week
Critical / high1,880▼ 1,109 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)789▲ 681 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (10) | 3.0% | Exploit | RufloAI | 7/9/2026 | 7/10/2026 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the… | |
| Modified | Critical (9.8) | 2.6% | — | Uflo Project Uflo | 1/26/2023 | 6/17/2026 | All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation. | |
| Modified | Critical (9.8) | 17% | — | ABB Rmc-100 FirmwareABB Rmc-100-lite FirmwareABB XIO FirmwareABB Xfcg5 Firmware+3 | 7/21/2022 | 6/17/2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an… |