Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77240 | critical | 9.9 | No | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/... | 2026-09-30 |
| CVE-2026-61833 | high | 8.1 | No | zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the beare... | 2026-09-30 |
| CVE-2026-54918 | medium | 5.3 | No | NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository r... | 2026-09-30 |
| CVE-2026-54596 | high | 8.1 | No | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authent... | 2026-09-30 |
| CVE-2026-54460 | critical | 9.8 | No | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/p... | 2026-09-30 |
| CVE-2026-54618 | critical | 9.4 | No | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a... | 2026-09-30 |
| CVE-2026-50125 | high | 7.5 | No | MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/serv... | 2026-09-30 |
| CVE-2026-55062 | not reported | — | No | uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenat... | 2026-09-30 |
| CVE-2026-54649 | not reported | — | No | punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handle... | 2026-09-30 |
| CVE-2026-54253 | high | 8.2 | No | TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/... | 2026-09-30 |
| CVE-2026-54677 | medium | 6.5 | No | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can... | 2026-09-30 |
| CVE-2026-54053 | critical | 9.6 | No | Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actio... | 2026-09-30 |
| CVE-2026-100310 | high | 7.0 | No | GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without p... | 2026-09-30 |
| CVE-2026-93363 | medium | 4.3 | No | The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated... | 2026-09-30 |
| CVE-2026-46655 | high | 7.8 | No | virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege loc... | 2026-09-30 |
| CVE-2026-85717 | medium | 6.8 | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2... | 2026-09-30 |
| CVE-2026-81868 | medium | 6.5 | No | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0,... | 2026-09-30 |
| CVE-2026-81516 | high | 7.5 | No | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti... | 2026-09-30 |
| CVE-2026-85078 | medium | 6.5 | No | Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume t... | 2026-09-30 |
| CVE-2026-81871 | not reported | — | No | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OT... | 2026-09-30 |