Vulnerabilities
Summary — last 7 days
New vulnerabilities4,672▼ 683 vs. last week
Critical / high1,758▼ 1,288 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)973▲ 874 vs. last week
More filters
4 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.1) | 0.35% | — | VolosAI | 10/10/2026 | 10/13/2026 | Unauthenticated Local File Inclusion in Volos <= 1.2 versions. | |
| Analyzed | Medium (5.3) | 0.28% | — | Volosoft ABP | 12/16/2025 | 10/13/2026 | An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains. | |
| Deferred | Critical (9.3) | 0.19% | — | AESAIVolosoft ABPAI | 11/19/2025 | 10/18/2026 | When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service. Upon service restart, the malicious DLL is loaded and executed under the LocalSystem account, resulting in unauthorized code… | |
| Deferred | Critical (9.2) | 0.17% | — | AESAIVolosoft ABPAI | 7/23/2025 | 6/17/2026 | The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges, exploitation results in… |