Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97732 | medium | 5.1 | No | IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and... | 2026-09-30 |
| CVE-2026-97724 | medium | 4.3 | No | A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing... | 2026-09-30 |
| CVE-2026-97723 | medium | 5.4 | No | madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-co... | 2026-09-30 |
| CVE-2026-61816 | high | 7.5 | No | zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Mes... | 2026-09-30 |
| CVE-2026-61784 | medium | 6.1 | No | xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.... | 2026-09-30 |
| CVE-2026-61742 | not reported | — | No | DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated... | 2026-09-30 |
| CVE-2026-61732 | critical | 10.0 | No | Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissanc... | 2026-09-30 |
| CVE-2026-61604 | not reported | — | No | The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds fro... | 2026-09-30 |
| CVE-2026-59980 | not reported | — | No | hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on... | 2026-09-30 |
| CVE-2026-93421 | not reported | — | No | Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint pass... | 2026-09-30 |
| CVE-2026-76089 | high | 7.7 | No | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content con... | 2026-09-30 |
| CVE-2026-76087 | high | 8.2 | No | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in Submissi... | 2026-09-30 |
| CVE-2026-61814 | high | 7.5 | No | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered acro... | 2026-09-30 |
| CVE-2026-59990 | high | 7.5 | No | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth... | 2026-09-30 |
| CVE-2026-61541 | not reported | — | No | Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrus... | 2026-09-30 |
| CVE-2026-58272 | medium | 5.3 | No | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observab... | 2026-09-30 |
| CVE-2026-63330 | high | 7.7 | No | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/... | 2026-09-30 |
| CVE-2026-77582 | not reported | — | No | Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between aut... | 2026-09-30 |
| CVE-2026-63199 | not reported | — | No | Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation... | 2026-09-30 |
| CVE-2026-62279 | high | 7.1 | No | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user coul... | 2026-09-30 |