Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85061 | critical | 10.0 | No | MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.a... | 2026-09-09 |
| CVE-2026-77465 | high | 7.5 | No | toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser i... | 2026-09-09 |
| CVE-2026-71429 | medium | 6.2 | No | stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path... | 2026-09-09 |
| CVE-2026-63376 | high | 8.2 | No | toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such... | 2026-09-09 |
| CVE-2026-53728 | high | 7.1 | No | Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback... | 2026-09-09 |
| CVE-2026-44506 | high | 8.2 | No | Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register... | 2026-09-09 |
| CVE-2026-33630 | high | 7.5 | No | c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handlin... | 2026-09-09 |
| CVE-2026-63219 | high | 8.6 | No | GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for crea... | 2026-09-09 |
| CVE-2026-58400 | critical | 9.1 | No | GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor... | 2026-09-09 |
| CVE-2026-75602 | medium | 6.5 | No | OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline... | 2026-09-09 |
| CVE-2026-53720 | not reported | — | No | pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blo... | 2026-09-09 |
| CVE-2026-50554 | medium | 5.3 | No | Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint t... | 2026-09-09 |
| CVE-2026-48486 | high | 7.5 | No | Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to versio... | 2026-09-09 |
| CVE-2026-84989 | high | 7.1 | No | ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng... | 2026-09-09 |
| CVE-2026-55221 | medium | 6.5 | No | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications.... | 2026-09-09 |
| CVE-2026-53649 | critical | 9.6 | No | Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs... | 2026-09-09 |
| CVE-2026-53611 | critical | 9.8 | No | Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH... | 2026-09-09 |
| CVE-2026-53600 | not reported | — | No | async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extensi... | 2026-09-09 |
| CVE-2026-84374 | high | 7.5 | No | Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Exc... | 2026-09-09 |
| CVE-2026-84373 | medium | 5.9 | No | Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlu... | 2026-09-09 |