Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54549 | high | 8.3 | No | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the upload_ad_image to... | 2026-09-30 |
| CVE-2026-54547 | high | 7.4 | No | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddlewar... | 2026-09-30 |
| CVE-2026-54251 | not reported | — | No | netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP... | 2026-09-30 |
| CVE-2026-53954 | medium | 4.3 | No | Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming even... | 2026-09-30 |
| CVE-2026-45579 | critical | 9.9 | No | DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestMana... | 2026-09-30 |
| CVE-2026-59160 | high | 8.8 | No | Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js s... | 2026-09-30 |
| CVE-2026-58201 | not reported | — | No | Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsof... | 2026-09-30 |
| CVE-2026-58200 | high | 7.1 | No | Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin... | 2026-09-30 |
| CVE-2026-55863 | medium | 5.3 | No | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection... | 2026-09-30 |
| CVE-2026-55692 | high | 7.5 | No | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips... | 2026-09-30 |
| CVE-2026-55691 | high | 8.6 | No | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips... | 2026-09-30 |
| CVE-2026-55690 | high | 7.5 | No | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips... | 2026-09-30 |
| CVE-2026-55149 | high | 7.5 | No | Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go... | 2026-09-30 |
| CVE-2026-54561 | medium | 6.2 | No | MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.t... | 2026-09-30 |
| CVE-2026-53710 | critical | 10.0 | No | MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-... | 2026-09-30 |
| CVE-2026-46488 | not reported | — | No | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection... | 2026-09-30 |
| CVE-2026-65831 | high | 7.7 | No | ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because Pol... | 2026-09-30 |
| CVE-2026-59973 | high | 8.5 | No | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and... | 2026-09-30 |
| CVE-2026-59965 | high | 7.1 | No | Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /ap... | 2026-09-30 |
| CVE-2026-59157 | medium | 6.5 | No | webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd... | 2026-09-30 |