s9y has 2 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 6.7 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.7
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-73628Medium· 6.1Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>)46CVE-2024-58282High· 7.2Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality40
s9y vulnerabilities
CVEs affecting s9y, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-73628Medium· 6.1PoCSerendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>)
Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecod…
▾ Twilights9y · SerendipityEPSS 0.26%via NVD
CVE-2024-58282High· 7.2Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality
Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a…
▾ Twilights9y · serendipityEPSS 1.0%via NVD