Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-53717 | medium | 6.5 | No | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and... | 2026-09-30 |
| CVE-2026-55847 | medium | 6.1 | No | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-gen... | 2026-09-30 |
| CVE-2026-55846 | medium | 6.2 | No | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allur... | 2026-09-30 |
| CVE-2026-55253 | high | 7.7 | No | LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and la... | 2026-09-30 |
| CVE-2026-53752 | high | 7.5 | No | docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.... | 2026-09-30 |
| CVE-2026-50270 | high | 7.5 | No | dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which d... | 2026-09-30 |
| CVE-2026-50157 | medium | 6.5 | No | Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() an... | 2026-09-30 |
| CVE-2026-94419 | medium | 5.4 | No | Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index,... | 2026-09-30 |
| CVE-2026-103398 | high | 8.1 | No | OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify... | 2026-09-30 |
| CVE-2026-103396 | medium | 4.3 | No | bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.use... | 2026-09-30 |
| CVE-2026-10764 | high | 8.7 | No | Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data. | 2026-09-30 |
| CVE-2026-103057 | medium | 4.3 | No | AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/... | 2026-09-30 |
| CVE-2026-103054 | high | 7.1 | No | AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitra... | 2026-09-30 |
| CVE-2026-103053 | medium | 5.4 | No | AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AI... | 2026-09-30 |
| CVE-2026-79537 | critical | 9.1 | No | metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session st... | 2026-09-30 |
| CVE-2026-79348 | medium | 4.3 | No | KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/r... | 2026-09-30 |
| CVE-2026-53989 | medium | 4.7 | No | Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers... | 2026-09-30 |
| CVE-2026-102879 | medium | 5.0 | No | ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authentic... | 2026-09-30 |
| CVE-2026-102878 | high | 8.1 | No | mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS rest... | 2026-09-30 |
| CVE-2026-102811 | high | 7.5 | No | Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__... | 2026-09-30 |