Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-53753 | critical | 10.0 | No | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields f... | 2026-10-25 |
| CVE-2026-54316 | critical | 9.1 | No | Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname fo... | 2026-10-25 |
| CVE-2026-44726 | critical | 9.1 | No | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could ca... | 2026-10-25 |
| CVE-2026-54307 | critical | 9.6 | No | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a share... | 2026-10-25 |
| CVE-2026-54305 | critical | 9.9 | No | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credential... | 2026-10-25 |
| CVE-2026-49468 | critical | 9.8 | No | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the Lit... | 2026-10-25 |
| CVE-2026-9072 | critical | 9.8 | No | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServ... | 2026-10-25 |
| CVE-2026-9006 | critical | 9.1 | No | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may a... | 2026-10-25 |
| CVE-2026-6653 | critical | 9.8 | No | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of... | 2026-10-25 |
| CVE-2026-12773 | critical | 9.8 | No | A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimen... | 2026-10-25 |
| CVE-2026-49230 | critical | 9.1 | No | Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerab... | 2026-10-25 |
| CVE-2026-39999 | critical | 9.1 | No | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain... | 2026-10-25 |
| CVE-2026-3894 | critical | 9.1 | No | Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Profession... | 2026-10-25 |
| CVE-2026-32966 | critical | 9.8 | No | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affect... | 2026-10-25 |
| CVE-2026-0126 | critical | 9.8 | No | In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additio... | 2026-10-25 |
| CVE-2026-53407 | critical | 9.8 | No | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allo... | 2026-10-25 |
| CVE-2026-8686 | critical | 9.1 | No | Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by se... | 2026-10-25 |
| CVE-2026-42557 | critical | 9.6 | No | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5... | 2026-10-25 |
| CVE-2026-42238 | critical | 9.8 | No | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/res... | 2026-10-25 |
| CVE-2026-40088 | critical | 9.6 | No | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-con... | 2026-10-25 |