Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54724 | medium | 6.1 | No | Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter,... | 2026-09-30 |
| CVE-2026-54450 | not reported | — | No | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networkin... | 2026-09-30 |
| CVE-2026-54077 | high | 7.1 | No | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportD... | 2026-09-30 |
| CVE-2026-54076 | high | 8.1 | No | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocument... | 2026-09-30 |
| CVE-2026-50024 | medium | 5.3 | No | GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attack... | 2026-09-30 |
| CVE-2026-44282 | medium | 4.8 | No | Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with questi... | 2026-09-30 |
| CVE-2026-44163 | medium | 5.3 | No | fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentele... | 2026-09-30 |
| CVE-2026-57586 | high | 8.6 | No | CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync... | 2026-09-30 |
| CVE-2026-55650 | medium | 4.4 | No | Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextCo... | 2026-09-30 |
| CVE-2026-55617 | not reported | — | No | Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj... | 2026-09-30 |
| CVE-2026-55178 | high | 7.5 | No | GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read a... | 2026-09-30 |
| CVE-2026-54637 | not reported | — | No | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthen... | 2026-09-30 |
| CVE-2026-54254 | not reported | — | No | Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host... | 2026-09-30 |
| CVE-2026-53957 | high | 7.7 | No | Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @cont... | 2026-09-30 |
| CVE-2026-49446 | medium | 6.1 | No | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Pr... | 2026-09-30 |
| CVE-2026-49254 | not reported | — | No | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GE... | 2026-09-30 |
| CVE-2026-47780 | not reported | — | No | free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscrip... | 2026-09-30 |
| CVE-2026-52827 | not reported | — | No | Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before T... | 2026-09-30 |
| CVE-2026-52824 | not reported | — | No | Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_thi... | 2026-09-30 |
| CVE-2026-52821 | not reported | — | No | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admi... | 2026-09-30 |