Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103030 | high | 7.5 | No | Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by co... | 2026-10-16 |
| CVE-2026-55695 | critical | 9.1 | No | FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated adminis... | 2026-10-16 |
| CVE-2026-54697 | not reported | — | No | ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts exce... | 2026-10-16 |
| CVE-2026-49265 | medium | 6.8 | No | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib... | 2026-10-16 |
| CVE-2026-102734 | medium | 5.5 | No | asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter... | 2026-10-16 |
| CVE-2026-53711 | not reported | — | No | MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a promp... | 2026-10-16 |
| CVE-2026-106108 | not reported | — | No | Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page defi... | 2026-10-16 |
| CVE-2026-102342 | medium | 5.4 | No | ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG anima... | 2026-10-16 |
| CVE-2026-94410 | medium | 4.3 | No | A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low lev... | 2026-10-16 |
| CVE-2026-63316 | not reported | — | No | A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" q... | 2026-10-16 |
| CVE-2026-89309 | critical | 10.0 | No | The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Autho... | 2026-10-16 |
| CVE-2026-53922 | medium | 6.5 | No | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the... | 2026-10-16 |
| CVE-2026-44828 | not reported | — | No | Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without au... | 2026-10-16 |
| CVE-2026-41210 | medium | 6.5 | No | Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a stre... | 2026-10-16 |
| CVE-2026-97691 | medium | 4.3 | No | Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local... | 2026-10-16 |
| CVE-2026-41508 | medium | 5.8 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in int... | 2026-10-16 |
| CVE-2026-41504 | medium | 5.8 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter... | 2026-10-16 |
| CVE-2026-108362 | not reported | — | No | Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attes... | 2026-10-16 |
| CVE-2026-108361 | not reported | — | No | Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker... | 2026-10-16 |
| CVE-2026-104774 | medium | 5.8 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation... | 2026-10-16 |