Vulnerabilities
Summary — last 7 days
New vulnerabilities4,645▼ 588 vs. last week
Critical / high1,864▼ 1,145 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)747▲ 639 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.8) | 0.21% | — | Z.ai ZcodeAI | 10/16/2026 | 10/16/2026 | Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository. | |
| Deferred | Medium (6.9) | 0.41% | — | Ezcode Event ManagerAI | 8/27/2026 | 8/28/2026 | Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event. | |
| Modified | Critical (9.8) | 2.7% | Exploit | Ezcode Event Manager | 2/2/2018 | 6/17/2026 | SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter. |