Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-57149 | critical | 9.9 | No | plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship wit... | 2026-09-23 |
| CVE-2026-63647 | not reported | — | No | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseControll... | 2026-09-23 |
| CVE-2026-61819 | high | 8.5 | No | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_con... | 2026-09-23 |
| CVE-2026-61781 | critical | 9.9 | No | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writab... | 2026-09-23 |
| CVE-2026-61721 | high | 8.0 | No | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-con... | 2026-09-23 |
| CVE-2026-77385 | medium | 4.3 | No | Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission cou... | 2026-09-23 |
| CVE-2026-69186 | medium | 5.3 | No | c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT f... | 2026-09-23 |
| CVE-2026-63458 | not reported | — | No | Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with view... | 2026-09-23 |
| CVE-2026-77607 | medium | 6.1 | No | Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to vers... | 2026-09-23 |
| CVE-2026-77239 | high | 8.1 | No | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate accoun... | 2026-09-23 |
| CVE-2026-54734 | critical | 10.0 | No | Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into... | 2026-09-23 |
| CVE-2026-54644 | medium | 6.1 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anch... | 2026-09-23 |
| CVE-2026-54343 | not reported | — | No | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote att... | 2026-09-23 |
| CVE-2026-54907 | medium | 5.3 | No | Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enabl... | 2026-09-23 |
| CVE-2026-54604 | not reported | — | No | OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF ti... | 2026-09-23 |
| CVE-2026-54521 | medium | 6.1 | No | FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in... | 2026-09-23 |
| CVE-2026-50275 | high | 7.5 | No | The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_bag... | 2026-09-23 |
| CVE-2026-48977 | not reported | — | No | OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/opens... | 2026-09-23 |
| CVE-2026-54627 | critical | 9.8 | No | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier... | 2026-09-23 |
| CVE-2026-54594 | not reported | — | No | OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the... | 2026-09-23 |