Lucene search
+L
CvelistRecent

398467 matches found

Cvelist
Cvelist
•added 2026/09/18 9:28 a.m.•52 views

CVE-2026-15797 Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...

6.4CVSS0.00259EPSS
SaveExploits0References11
Cvelist
Cvelist
•added 2026/09/18 9:28 a.m.•43 views

CVE-2026-90884 WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

5.4CVSS0.00235EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/18 9:28 a.m.•44 views

CVE-2026-18405 Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it...

7.2CVSS0.00292EPSS
SaveExploits0References11
Cvelist
Cvelist
•added 2026/09/18 8:32 a.m.•42 views

CVE-2026-21822 A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized...

6.3CVSS0.0021EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:29 a.m.•40 views

CVE-2026-40539

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

7.1CVSS0.00117EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:29 a.m.•40 views

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

3.7CVSS0.00372EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:28 a.m.•41 views

CVE-2026-40535

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

6.5CVSS0.00503EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:28 a.m.•38 views

CVE-2026-40533

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

5.3CVSS0.00381EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:28 a.m.•38 views

CVE-2026-85410 Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...

8.1CVSS0.00585EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/18 8:28 a.m.•42 views

CVE-2026-83561 Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS0.00508EPSS
SaveExploits0References10
Cvelist
Cvelist
•added 2026/09/18 8:28 a.m.•36 views

CVE-2025-13533 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

4.4CVSS0.00195EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/09/18 8:28 a.m.•39 views

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

4.3CVSS0.00329EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:27 a.m.•38 views

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

4.3CVSS0.00423EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:27 a.m.•44 views

CVE-2026-40534

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

5.4CVSS0.00269EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:27 a.m.•39 views

CVE-2026-40532

A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...

6.5CVSS0.00422EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:26 a.m.•40 views

CVE-2026-40531

An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks...

4.3CVSS0.00437EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:26 a.m.•39 views

CVE-2026-4036

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

6.5CVSS0.00445EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:25 a.m.•41 views

CVE-2026-40530

An improper neutralization of CRLF sequences 'CRLF injection' vulnerability in User API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the...

8CVSS0.00493EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:25 a.m.•38 views

CVE-2026-56595 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and...

3.1CVSS0.00237EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:24 a.m.•44 views

CVE-2026-56597 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets...

3.1CVSS0.0025EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:23 a.m.•42 views

CVE-2026-56592 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...

6.5CVSS0.00445EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:22 a.m.•40 views

CVE-2026-13683

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

2.7CVSS0.00322EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:22 a.m.•41 views

CVE-2026-13623

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

4.8CVSS0.00249EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:22 a.m.•37 views

CVE-2026-13666

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL...

3.5CVSS0.00249EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:22 a.m.•43 views

CVE-2026-56590 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise...

6.4CVSS0.00285EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:22 a.m.•39 views

CVE-2026-6205

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

8.1CVSS0.00518EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:22 a.m.•42 views

CVE-2026-13673

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...

8.8CVSS0.00394EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:21 a.m.•40 views

CVE-2026-13635

An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information...

5.3CVSS0.00342EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:21 a.m.•46 views

CVE-2026-13639

An insufficient entropy vulnerability in login logic in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

9.8CVSS0.00665EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:21 a.m.•40 views

CVE-2026-21848 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...

5CVSS0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:19 a.m.•45 views

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

9.8CVSS0.00599EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:09 a.m.•39 views

CVE-2026-11757 Reflected XSS in KA Informatics' Bar Association Website

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

6.1CVSS0.00181EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 8:01 a.m.•41 views

CVE-2026-93493 Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...

5.9CVSS0.00282EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/18 7:55 a.m.•44 views

CVE-2026-67103 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

7.6CVSS0.00284EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 7:54 a.m.•43 views

CVE-2026-67102 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

8.1CVSS0.0035EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 7:53 a.m.•44 views

CVE-2026-67100 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

9.8CVSS0.00468EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 7:51 a.m.•44 views

CVE-2026-75157 Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

0.00436EPSS
SaveExploits1References2
Cvelist
Cvelist
•added 2026/09/18 7:50 a.m.•44 views

CVE-2026-67101 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

9.3CVSS0.00335EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 7:48 a.m.•44 views

CVE-2026-12384 Broken Access Control in TECHIN2B Application

Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects TECHIN2B Application: from V1.0.7676.13 through 18092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

8.8CVSS0.00309EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•38 views

CVE-2026-92249 Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

6.1CVSS0.00368EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•38 views

CVE-2026-85705 Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

7.5CVSS0.00463EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•40 views

CVE-2026-85652 Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'albumid' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

6.5CVSS0.00551EPSS
SaveExploits0References10
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•42 views

CVE-2026-12739 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

4.3CVSS0.00337EPSS
SaveExploits0References9
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•41 views

CVE-2026-15275 WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

7.5CVSS0.00374EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•41 views

CVE-2026-15004 FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

5.4CVSS0.00243EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•40 views

CVE-2026-16777 Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

4.9CVSS0.00657EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•42 views

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

8.8CVSS0.00456EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•39 views

CVE-2026-14472 Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00261EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•39 views

CVE-2026-75961 NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

4.9CVSS0.00506EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/09/18 7:40 a.m.•39 views

CVE-2026-14323 Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...

7.5CVSS0.00939EPSS
SaveExploits0References6
Total number of security vulnerabilities398467