Vulnerabilities
Summary — last 7 days
New vulnerabilities5,330▲ 1,883 vs. last week
Critical / high2,727▲ 1,062 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)614▲ 401 vs. last week
6 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Received | Medium (6) | 0.22% | — | Lwip Project LwipAI | 10/18/2026 | 10/18/2026 | lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below… | |
| Modified | High (8.8) | 3.7% | — | WIP Project WIP | 4/24/2023 | 6/17/2026 | `embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This vulnerability can be… | |
| Modified | High (7.5) | 1.2% | — | Lwip Project Lwip | 7/22/2021 | 6/17/2026 | A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allows attackers to access sensitive information via a crafted 6LoWPAN packet. | |
| Modified | High (7.5) | 1.4% | — | Lwip Project Lwip | 7/22/2021 | 6/17/2026 | A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows attackers to access sensitive information via a crafted ICMPv6 packet. | |
| Modified | High (8.1) | 0.54% | — | Prebuild-lwip Project Prebuild-lwip | 6/4/2018 | 6/17/2026 | prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks. | |
| Modified | Medium (4.3) | 0.57% | — | Lwip Project Lwip | 11/28/2014 | 6/17/2026 | resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets. |