Vulnerabilities
Summary — last 7 days
New vulnerabilities5,112▲ 1,960 vs. last week
Critical / high2,827▲ 1,289 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)197▼ 10 vs. last week
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (5.8) | 2.0% | 💥 Exploit | Pwsdashboard Personal Weather Station DashboardAI | 5/7/2025 | 6/17/2026 | Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext. | |
| Modified | High (8.8) | 0.32% | — | Weather Station Project Weather Station | 7/10/2023 | 6/17/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Jason Rouet Weather Station plugin <= 3.8.12 versions. | |
| Modified | High (7.2) | 1.3% | — | Pwsdashboard Personal Weather Station Dashboard | 4/25/2023 | 6/17/2026 | PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a… |