| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-55209 | resdata insufficiently validates untrusted GRDECL files | equinor | resdata | Critical | 9.8 | 2026-09-14 19:52:25 | Deep Dive |
| CVE-2026-16338 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software | IBM | DataStage on Cloud Pak for Data | Critical | 9.9 | 2026-09-14 19:49:39 | Deep Dive |
| CVE-2026-59178 | ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade | esphome | device-builder | Critical | 9.8 | 2026-09-14 18:11:02 | Deep Dive |
| CVE-2026-90945 | Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret | crawlab-team | crawlab | Critical | 9.8 | 2026-09-14 17:52:06 | Deep Dive |
| CVE-2026-90942 | Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints | casdoor | casdoor | Critical | 9.6 | 2026-09-14 17:52:05 | Deep Dive |
| CVE-2026-57578 | DotVVM: Missing authorization in AuthorizeActionFilter | riganti | dotvvm | Critical | 9.2 | 2026-09-14 17:39:25 | Deep Dive |
| CVE-2026-76461 KEV 🧪 | Cisco Secure Email Gateway SQL Injection Vulnerability | Cisco | Cisco Secure Email | Critical | 9.8 | 2026-09-14 16:09:08 | Deep Dive |
| CVE-2026-76443 | Cisco Secure Email Gateway Security Hardening Release | Cisco | Cisco Secure Email | Critical | 9.8 | 2026-09-14 16:08:59 | Deep Dive |
| CVE-2026-20353 | Cisco Secure Email Gateway Security Hardening Release | Cisco | Cisco Secure Email | Critical | 9.8 | 2026-09-14 16:08:50 | Deep Dive |
| CVE-2026-76441 | Cisco Secure Email Gateway Security Hardening Release | Cisco | Cisco Secure Email and Web Manager | Critical | 9.8 | 2026-09-14 16:08:50 | Deep Dive |
| CVE-2026-76440 | Cisco Secure Email Gateway Security Hardening Release | Cisco | Cisco Secure Email | Critical | 9.8 | 2026-09-14 16:08:50 | Deep Dive |
| CVE-2026-61534 | Yayson: Prototype pollution in the Store/LegacyStore deserialization | confetti | yayson | Critical | 9.1 | 2026-09-14 15:36:49 | Deep Dive |
| CVE-2026-57145 | PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation | MervinPraison | PraisonAI | Critical | 9.1 | 2026-09-14 15:10:46 | Deep Dive |
| CVE-2026-57131 | praisonai: Jobs API exposes agent-execution endpoints with no authentication | MervinPraison | PraisonAI | Critical | 9.8 | 2026-09-14 15:06:20 | Deep Dive |
| CVE-2026-57124 | PraisonAI UI MCP connect endpoint allows unauthenticated local command execution | MervinPraison | PraisonAI | Critical | 9.8 | 2026-09-14 15:04:54 | Deep Dive |
| CVE-2026-57127 | praisonai: recipe serve auth middleware silently disables itself when no secret is set | MervinPraison | PraisonAI | Critical | 9.8 | 2026-09-14 15:01:49 | Deep Dive |
| CVE-2026-57123 | PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in | MervinPraison | praisonaiagents | Critical | 9.8 | 2026-09-14 14:46:13 | Deep Dive |
| CVE-2026-57125 | PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass | MervinPraison | PraisonAI | Critical | 9.8 | 2026-09-14 14:19:43 | Deep Dive |
| CVE-2026-82434 | Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs | Apache Software Foundation | Apache Storm Nimbus | Critical | 10.0 | 2026-09-14 14:10:15 | Deep Dive |
| CVE-2026-90961 | MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials | MISP | MISP | Critical | 9.3 | 2026-09-14 13:22:07 | Deep Dive |