Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-49400 | low | 3.3 | No | October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMa... | 2026-09-30 |
| CVE-2026-59960 | high | 7.5 | No | Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or re... | 2026-09-30 |
| CVE-2026-57497 | medium | 5.3 | No | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknow... | 2026-09-30 |
| CVE-2026-55837 | medium | 6.8 | No | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_ap... | 2026-09-30 |
| CVE-2026-54452 | not reported | — | No | safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b... | 2026-09-30 |
| CVE-2026-61534 | critical | 9.1 | No | Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled J... | 2026-09-30 |
| CVE-2026-55795 | not reported | — | No | Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.p... | 2026-09-30 |
| CVE-2026-55235 | medium | 5.9 | No | langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specif... | 2026-09-30 |
| CVE-2026-54542 | low | 3.7 | No | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious... | 2026-09-30 |
| CVE-2026-54541 | low | 3.7 | No | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious... | 2026-09-30 |
| CVE-2026-54258 | medium | 6.5 | No | ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an au... | 2026-09-30 |
| CVE-2026-50018 | medium | 6.5 | No | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any time... | 2026-09-30 |
| CVE-2026-49846 | high | 7.5 | No | libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails t... | 2026-09-30 |
| CVE-2026-50025 | not reported | — | No | Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSock... | 2026-09-30 |
| CVE-2026-49464 | high | 8.1 | No | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and... | 2026-09-30 |
| CVE-2026-54072 | critical | 9.3 | No | Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accep... | 2026-09-30 |
| CVE-2026-88061 | not reported | — | No | career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/... | 2026-09-30 |
| CVE-2026-86038 | high | 7.5 | No | libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSig... | 2026-09-30 |
| CVE-2026-86000 | medium | 5.3 | No | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parse... | 2026-09-30 |
| CVE-2026-85715 | high | 7.5 | No | ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in ge... | 2026-09-30 |