Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73494 | high | 7.4 | No | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42... | 2026-09-30 |
| CVE-2026-57581 | medium | 5.3 | No | DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configur... | 2026-09-30 |
| CVE-2026-55091 | high | 7.5 | No | flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in... | 2026-09-30 |
| CVE-2026-54567 | high | 7.5 | No | Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploa... | 2026-09-30 |
| CVE-2026-54181 | medium | 5.4 | No | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c... | 2026-09-30 |
| CVE-2026-54180 | high | 7.6 | No | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c... | 2026-09-30 |
| CVE-2026-54178 | high | 8.1 | No | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c... | 2026-09-30 |
| CVE-2026-54177 | medium | 6.6 | No | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c... | 2026-09-30 |
| CVE-2026-49400 | low | 3.3 | No | October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMa... | 2026-09-30 |
| CVE-2026-59960 | high | 7.5 | No | Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or re... | 2026-09-30 |
| CVE-2026-57497 | medium | 5.3 | No | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknow... | 2026-09-30 |
| CVE-2026-55837 | medium | 6.8 | No | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_ap... | 2026-09-30 |
| CVE-2026-54452 | not reported | — | No | safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b... | 2026-09-30 |
| CVE-2026-61534 | critical | 9.1 | No | Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled J... | 2026-09-30 |
| CVE-2026-55795 | not reported | — | No | Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.p... | 2026-09-30 |
| CVE-2026-55235 | medium | 5.9 | No | langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specif... | 2026-09-30 |
| CVE-2026-54542 | low | 3.7 | No | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious... | 2026-09-30 |
| CVE-2026-54541 | low | 3.7 | No | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious... | 2026-09-30 |
| CVE-2026-54258 | medium | 6.5 | No | ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an au... | 2026-09-30 |
| CVE-2026-50018 | medium | 6.5 | No | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any time... | 2026-09-30 |