Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2021-44906 | critical | 9.8 | No | Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). | 2026-10-08 |
| CVE-2021-3711 | critical | 9.8 | No | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will... | 2026-10-08 |
| CVE-2021-3331 | critical | 9.8 | No | WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session... | 2026-10-08 |
| CVE-2020-8840 | critical | 9.8 | No | FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi... | 2026-10-08 |
| CVE-2020-27619 | critical | 9.8 | No | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. | 2026-10-08 |
| CVE-2019-17531 | critical | 9.8 | No | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globall... | 2026-10-08 |
| CVE-2019-16942 | critical | 9.8 | No | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globall... | 2026-10-08 |
| CVE-2019-16335 | critical | 9.8 | No | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource.... | 2026-10-08 |
| CVE-2019-14892 | critical | 9.8 | No | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization... | 2026-10-08 |
| CVE-2019-14540 | critical | 9.8 | No | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. | 2026-10-08 |
| CVE-2019-14379 | critical | 9.8 | No | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache... | 2026-10-08 |
| CVE-2018-14719 | critical | 9.8 | No | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-... | 2026-10-08 |
| CVE-2018-14718 | critical | 9.8 | No | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-... | 2026-10-08 |
| CVE-2018-11307 | critical | 9.8 | No | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBat... | 2026-10-08 |
| CVE-2018-1000802 | critical | 9.8 | No | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C... | 2026-10-08 |
| CVE-2016-9063 | critical | 9.8 | No | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | 2026-10-08 |
| CVE-2017-1000158 | critical | 9.8 | No | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in... | 2026-10-08 |
| CVE-2016-0718 | critical | 9.8 | No | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input docum... | 2026-10-08 |
| CVE-2013-7285 | critical | 9.8 | No | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run... | 2026-10-08 |
| CVE-2026-97717 | not reported | — | No | CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malforme... | 2026-10-08 |