Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-27851 | critical | 9.1 | No | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabli... | 2026-10-26 |
| CVE-2026-43914 | critical | 9.8 | No | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows... | 2026-10-26 |
| CVE-2026-43995 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations direc... | 2026-10-26 |
| CVE-2026-43639 | critical | 9.1 | No | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary o... | 2026-10-26 |
| CVE-2026-42858 | critical | 9.9 | No | Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataVie... | 2026-10-26 |
| CVE-2026-44643 | critical | 10.0 | No | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a ma... | 2026-10-26 |
| CVE-2026-42608 | critical | 9.1 | No | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By ma... | 2026-10-26 |
| CVE-2026-35157 | critical | 9.8 | No | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula ele... | 2026-10-26 |
| CVE-2026-44400 | critical | 9.8 | No | MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows a... | 2026-10-26 |
| CVE-2026-44694 | critical | 9.1 | No | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to be... | 2026-10-26 |
| CVE-2026-41889 | critical | 9.8 | No | pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used,... | 2026-10-26 |
| CVE-2026-41583 | critical | 9.1 | No | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring,... | 2026-10-26 |
| CVE-2026-44335 | critical | 9.8 | No | PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypas... | 2026-10-26 |
| CVE-2026-45321 | critical | 9.6 | Listed | On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm reg... | 2026-10-26 |
| CVE-2026-105133 | high | 7.3 | Listed | A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/ap... | 2026-10-26 |
| CVE-2026-105134 | critical | 10.0 | Listed | A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateR... | 2026-10-26 |
| CVE-2026-69968 | medium | 6.5 | No | Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network. | 2026-10-26 |
| CVE-2026-69969 | medium | 4.7 | No | Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose... | 2026-10-26 |
| CVE-2026-69970 | high | 7.0 | No | Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-69971 | medium | 5.5 | No | Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | 2026-10-26 |