Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58272 | medium | 5.3 | No | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observab... | 2026-09-30 |
| CVE-2026-63330 | high | 7.7 | No | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/... | 2026-09-30 |
| CVE-2026-77582 | not reported | — | No | Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between aut... | 2026-09-30 |
| CVE-2026-63199 | not reported | — | No | Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation... | 2026-09-30 |
| CVE-2026-62279 | high | 7.1 | No | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user coul... | 2026-09-30 |
| CVE-2026-77240 | critical | 9.9 | No | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/... | 2026-09-30 |
| CVE-2026-61833 | high | 8.1 | No | zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the beare... | 2026-09-30 |
| CVE-2026-54918 | medium | 5.3 | No | NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository r... | 2026-09-30 |
| CVE-2026-54596 | high | 8.1 | No | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authent... | 2026-09-30 |
| CVE-2026-54460 | critical | 9.8 | No | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/p... | 2026-09-30 |
| CVE-2026-54618 | critical | 9.4 | No | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a... | 2026-09-30 |
| CVE-2026-50125 | high | 7.5 | No | MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/serv... | 2026-09-30 |
| CVE-2026-55062 | not reported | — | No | uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenat... | 2026-09-30 |
| CVE-2026-54649 | not reported | — | No | punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handle... | 2026-09-30 |
| CVE-2026-54253 | high | 8.2 | No | TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/... | 2026-09-30 |
| CVE-2026-54677 | medium | 6.5 | No | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can... | 2026-09-30 |
| CVE-2026-54053 | critical | 9.6 | No | Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actio... | 2026-09-30 |
| CVE-2026-100310 | high | 7.0 | No | GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without p... | 2026-09-30 |
| CVE-2026-93363 | medium | 4.3 | No | The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated... | 2026-09-30 |
| CVE-2026-46655 | high | 7.8 | No | virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege loc... | 2026-09-30 |