Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54254 | not reported | — | No | Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host... | 2026-09-30 |
| CVE-2026-53957 | high | 7.7 | No | Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @cont... | 2026-09-30 |
| CVE-2026-49446 | medium | 6.1 | No | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Pr... | 2026-09-30 |
| CVE-2026-49254 | not reported | — | No | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GE... | 2026-09-30 |
| CVE-2026-47780 | not reported | — | No | free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscrip... | 2026-09-30 |
| CVE-2026-52827 | not reported | — | No | Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before T... | 2026-09-30 |
| CVE-2026-52824 | not reported | — | No | Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_thi... | 2026-09-30 |
| CVE-2026-52821 | not reported | — | No | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admi... | 2026-09-30 |
| CVE-2026-73497 | medium | 6.5 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_... | 2026-09-30 |
| CVE-2026-73496 | high | 7.7 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_... | 2026-09-30 |
| CVE-2026-55244 | medium | 5.0 | No | ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemEx... | 2026-09-30 |
| CVE-2026-55209 | critical | 9.8 | No | resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently valida... | 2026-09-30 |
| CVE-2026-55093 | medium | 6.1 | No | Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses un... | 2026-09-30 |
| CVE-2026-54632 | high | 7.5 | No | SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMe... | 2026-09-30 |
| CVE-2026-54629 | high | 7.5 | No | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules suc... | 2026-09-30 |
| CVE-2026-54628 | high | 8.6 | No | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules suc... | 2026-09-30 |
| CVE-2026-54447 | high | 8.4 | No | garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/c... | 2026-09-30 |
| CVE-2026-54334 | critical | 9.8 | No | UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen... | 2026-09-30 |
| CVE-2026-54333 | critical | 9.8 | No | UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTabl... | 2026-09-30 |
| CVE-2026-50006 | critical | 9.1 | No | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatib... | 2026-09-30 |