Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

149-75% vs 7-day avg of 597

2 critical, 41 high, 60 medium, 26 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	High	8.7	CVE-2017-20287	Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the... Javo Themes, WordPressJavo Themes Javo Spot	NVD		Oct 22 11:17 UTC
CVE-2017-20287Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the... Executive summary The Javo Spot theme for WordPress contains an unauthenticated file-read flaw that lets anyone on the internet read arbitrary files from the server, including WordPress configuration files that hold database credentials. The advisory does not give a CVSS severity score. The advisory states that the theme vendor has fixed the issue, but it does not state a fixed version number, so administrators should confirm they are running the updated theme or apply the workaround. Technical summary This is a path traversal (local file inclusion) flaw in the jvfrm_spot_get_json AJAX action, reachable without authentication through the wp_ajax_nopriv hook. The attacker supplies a traversal sequence in the fn GET parameter, which is appended to the uploads directory and read, and the callback parameter must also be non-empty. The advisory says the flaw is in the Javo Spot theme before 3.0.0, but the fixed version is not stated beyond the vendor saying the issue was resolved. The advisory's suggested workaround is to remove the wp_ajax_jvfrm_spot_get_json and wp_ajax_nopriv_jvfrm_spot_get_json hooks through a functions.php snippet. No detection guidance, CVSS score, or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Javo Themes WordPress Javo Themes Javo Spot NIST National Vulnerability DatabasePublished Oct 22, 2026 11:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee