Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58196 | medium | 4.7 | No | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Ha... | 2026-09-30 |
| CVE-2026-55887 | not reported | — | No | MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the... | 2026-09-30 |
| CVE-2026-55864 | not reported | — | No | GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a... | 2026-09-30 |
| CVE-2026-55828 | not reported | — | No | qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path val... | 2026-09-30 |
| CVE-2026-55636 | medium | 5.7 | No | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml... | 2026-09-30 |
| CVE-2026-55630 | none | 0.0 | No | Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user inp... | 2026-09-30 |
| CVE-2026-55591 | medium | 5.8 | No | Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts ac... | 2026-09-30 |
| CVE-2026-55211 | critical | 9.8 | No | Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, le... | 2026-09-30 |
| CVE-2026-54724 | medium | 6.1 | No | Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter,... | 2026-09-30 |
| CVE-2026-54450 | not reported | — | No | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networkin... | 2026-09-30 |
| CVE-2026-54077 | high | 7.1 | No | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportD... | 2026-09-30 |
| CVE-2026-54076 | high | 8.1 | No | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocument... | 2026-09-30 |
| CVE-2026-50024 | medium | 5.3 | No | GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attack... | 2026-09-30 |
| CVE-2026-44282 | medium | 4.8 | No | Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with questi... | 2026-09-30 |
| CVE-2026-44163 | medium | 5.3 | No | fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentele... | 2026-09-30 |
| CVE-2026-57586 | high | 8.6 | No | CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync... | 2026-09-30 |
| CVE-2026-55650 | medium | 4.4 | No | Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextCo... | 2026-09-30 |
| CVE-2026-55617 | not reported | — | No | Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj... | 2026-09-30 |
| CVE-2026-55178 | high | 7.5 | No | GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read a... | 2026-09-30 |
| CVE-2026-54637 | not reported | — | No | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthen... | 2026-09-30 |