CVE Monitor
Today's Vulnerabilities, In Plain English
A CVE is a public ID assigned to one specific flaw in one specific piece of software — a serial number for a broken lock. Somebody found the flaw, the vendor confirmed it, and the ID lets everyone talk about the same problem without confusion.
Thousands are published every month, and almost none of them are about you. So this page sorts them by the kind of system a business owns: the browser on the front desk, the firewall in the closet, the box your backups land on. Find your shelf, skim it, and move on.
Records come from the NIST National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalog. We write the explanation; we never write the facts. Every ID on this page is validated against the official CVE format and every link is rebuilt from that ID, so a row can only ever point at NVD's own record — check any line against the source yourself. Collection is automated and runs twice a day. Last refreshed Oct 10, 2026, 1:15 AM Central.
Plain-English remediation guides
One guide per advisory: whether it affects you, how bad it is, the steps to fix it, and how to check the fix worked. Each stays listed here after its advisory ages off the live list below.
- CVE-2026-105135 explained: what the InternLM MindSearch 0 flaw means for your business
CVE-2026-105135 is a critical code injection flaw in InternLM MindSearch 0 with no vendor fix yet. Learn what to check, and what to do, right now.
- CVE-2026-104286 explained: what the Fortinet FortiMail flaw means for your business
FortiMail path traversal flaw CVE-2026-104286 lets unauthenticated attackers write files remotely. It's on CISA's KEV list. Here's what to do now.
- CVE-2026-102578 explained: what the Moodle flaw means for your business and how to fix it
CVE-2026-102578 is a high-severity SQL injection flaw in Moodle's question bank web service. Learn if you're affected and how to patch it fast.
- CVE-2026-76504 explained: what the Cisco Catalyst SD-WAN Manager flaw means for your business
CVE-2026-76504 is a critical flaw in Cisco Catalyst SD-WAN Manager already exploited in the wild. Learn if it affects you and what to do now.
- CVE-2026-86950 explained: what the Apple Ipados flaw means for your business and how to fix it
CVE-2026-86950 is a high-severity Apple iPadOS, iPhone OS and macOS flaw already used in attacks. See if you're affected and how to fix it today.
- CVE-2026-88771 explained: what the Citrix NetScaler flaw means for your business
CVE-2026-88771 is a critical Citrix NetScaler flaw already listed on CISA's KEV catalog. Learn if you're affected and what to do about it today.
- CVE-2026-88772 explained: what the Citrix NetScaler flaw means for your business
CVE-2026-88772 is a critical, actively exploited flaw in Citrix NetScaler. See if your business is affected and what steps to take right now.
- CVE-2026-65660 explained: the Microsoft Sharepoint Server flaw and how to fix it
CVE-2026-65660 is a high-severity SharePoint Server flaw already on CISA's exploited list. Learn if you're affected and how to patch it fast.
- CVE-2026-87902 explained: what the WordPress Core flaw means for your business
CVE-2026-87902 is a high-severity WordPress Core flaw now on CISA's Known Exploited Vulnerabilities list. Check whether it affects your site today.
- CVE-2026-71362 explained: the Adobe Commerce flaw and how to fix it
CVE-2026-71362 is a critical Adobe Commerce vulnerability already listed on CISA's Known Exploited Vulnerabilities catalog. Patch it right away.
- CVE-2026-93616 explained: what to do about the Checkpoint Multi-domain Security Management flaw
CVE-2026-93616 is a critical, actively exploited flaw affecting Check Point Multi-Domain and Quantum Security Management servers. Patch now.
- CVE-2026-94127 explained: the F5 Big-ip Access Policy Manager flaw and how to fix it
CVE-2026-94127 is a critical, actively exploited F5 BIG-IP APM flaw on the CISA KEV list. Learn if you're affected and how to fix it now.
Windows, Microsoft 365 & Azure (6)
Windows desktops and servers, Microsoft 365, and the Azure services behind them. Microsoft patches the hosted side itself; the Windows side needs a reboot to finish.
- CVE-2026-96207CVSS 10.0/10CVSS 10.0, critical severity.Handled for youPublished Oct 8
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over…
Guide in progressNVD recordfor CVE-2026-96207, opens in a new tab - CVE-2026-106126CVSS 9.9/10CVSS 9.9, critical severity.Act on thisPublished Oct 8
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an…
Guide in progressNVD recordfor CVE-2026-106126, opens in a new tab - CVE-2026-94510CVSS 9.9/10CVSS 9.9, critical severity.Handled for youPublished Oct 8
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privi…
Guide in progressNVD recordfor CVE-2026-94510, opens in a new tab - CVE-2026-77900CVSS 9.8/10CVSS 9.8, critical severity.Handled for youPublished Oct 8
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over…
Guide in progressNVD recordfor CVE-2026-77900, opens in a new tab - CVE-2026-88131CVSS 9.8/10CVSS 9.8, critical severity.Handled for youPublished Oct 8
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
Guide in progressNVD recordfor CVE-2026-88131, opens in a new tab - CVE-2026-69435CVSS 9.6/10CVSS 9.6, critical severity.Handled for youPublished Oct 8
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
Guide in progressNVD recordfor CVE-2026-69435, opens in a new tab
Business Software (14)
Accounting, CRM, HR, booking and other day-to-day business applications. If you recognize a name here, ask the vendor which version you are on.
- CVE-2026-12260CVSS 10.0/10CVSS 10.0, critical severity.Background noise for most businessesPublished Oct 8
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST paramet…
Guide in progressNVD recordfor CVE-2026-12260, opens in a new tab - CVE-2026-14269, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-14502, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-14991, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-14992, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-15762, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-16340, NVD record, opens in a new tabCVSS 9.8, critical severity.
6 records with the same title.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throu…
Guide in progress- CVE-2026-78401, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-78406, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-16916, NVD record, opens in a new tabCVSS 8.8, high severity.
- CVE-2026-18740, NVD record, opens in a new tabCVSS 8.8, high severity.
- CVE-2026-19482, NVD record, opens in a new tabCVSS 8.8, high severity.
- CVE-2026-78388, NVD record, opens in a new tabCVSS 8.8, high severity.
- CVE-2026-19498, NVD record, opens in a new tabCVSS 7.5, high severity.
7 records with the same title.
Ibm Security Verify Access — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11…
ibm
Guide in progress
Websites & WordPress (6)
Your public website, its theme, and every plugin bolted onto it. Plugin flaws are the most common way a small-business site gets defaced.
- CVE-2026-103646CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 8
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is l…
Guide in progressNVD recordfor CVE-2026-103646, opens in a new tab - CVE-2026-103692CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 8
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions avail…
Guide in progressNVD recordfor CVE-2026-103692, opens in a new tab - CVE-2026-103889CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 10
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions…
Guide in progressNVD recordfor CVE-2026-103889, opens in a new tab - CVE-2026-104732CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 9
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin…
Guide in progressNVD recordfor CVE-2026-104732, opens in a new tab - CVE-2026-85097CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 8
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and incl…
Guide in progressNVD recordfor CVE-2026-85097, opens in a new tab - CVE-2026-94589CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 9
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable…
Guide in progressNVD recordfor CVE-2026-94589, opens in a new tab
Network Gear, Firewalls & Cameras (14)
Routers, firewalls, VPN boxes, Wi-Fi access points and IP cameras. A flaw here is not "someone reads a file" — it is "someone is inside the network".
- CVE-2026-76482, NVD record, opens in a new tabCVSS 10.0, critical severity.
- CVE-2026-76480, NVD record, opens in a new tabCVSS 9.8, critical severity.
2 records with the same title.
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License…
Guide in progress- CVE-2026-105110CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 8
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote…
Guide in progressNVD recordfor CVE-2026-105110, opens in a new tab - CVE-2026-76455, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-76459, NVD record, opens in a new tabCVSS 9.8, critical severity.
2 records with the same title.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has c…
Guide in progress- CVE-2026-76465CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 7
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco…
Guide in progressNVD recordfor CVE-2026-76465, opens in a new tab - CVE-2026-76471CVSS 9.8/10CVSS 9.8, critical severity.Act on thisPublished Oct 7
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execut…
Guide in progressNVD recordfor CVE-2026-76471, opens in a new tab - CVE-2026-76485, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-76486, NVD record, opens in a new tabCVSS 9.8, critical severity.
2 records with the same title.
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as…
Guide in progress- CVE-2026-76498, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-76499, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-76500, NVD record, opens in a new tabCVSS 9.8, critical severity.
3 records with the same title.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastru…
Guide in progress- CVE-2026-76464CVSS 9.6/10CVSS 9.6, critical severity.Act on thisPublished Oct 7
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team…
Guide in progressNVD recordfor CVE-2026-76464, opens in a new tab - CVE-2026-107406CVSS 9.5/10CVSS 9.5, critical severity.Act on thisPublished Oct 8
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.
Guide in progressNVD recordfor CVE-2026-107406, opens in a new tab
Servers & Operating Systems (2)
Linux, Windows Server and the virtualization hosts your systems run on. Usually your IT provider’s job, but worth knowing so you can ask whether it is handled.
2 of these are already being exploited — handle those first.
- CVE-2015-3306CVSS 10.0/10CVSS 10.0, critical severity.Being exploitedHandled for youPublished May 18
Fedoraproject Fedora — The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary fil…
fedoraproject · debian · opensuse · suse
Guide in progressNVD recordfor CVE-2015-3306, opens in a new tab - CVE-2015-5477CVSS 7.5/10CVSS 7.5, high severity.Being exploitedHandled for youPublished Jul 29
Juniper Junos — named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to ca…
juniper · fedoraproject · redhat · debian
Guide in progressNVD recordfor CVE-2015-5477, opens in a new tab
Security & Monitoring Tools (8)
The products meant to watch everything else — worth patching first when they are the thing that slipped.
- CVE-2026-75875CVSS 9.8/10CVSS 9.8, critical severity.Background noise for most businessesPublished Oct 8
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path t…
Guide in progressNVD recordfor CVE-2026-75875, opens in a new tab - CVE-2026-76268CVSS 9.8/10CVSS 9.8, critical severity.Handled for youPublished Oct 7
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Repre…
Guide in progressNVD recordfor CVE-2026-76268, opens in a new tab - CVE-2026-80381CVSS 9.8/10CVSS 9.8, critical severity.Background noise for most businessesPublished Oct 8
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements…
Guide in progressNVD recordfor CVE-2026-80381, opens in a new tab - CVE-2026-82335CVSS 9.8/10CVSS 9.8, critical severity.Background noise for most businessesPublished Oct 8
Ibm Guardium Data Protection — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in…
ibm
Guide in progressNVD recordfor CVE-2026-82335, opens in a new tab - CVE-2026-82344CVSS 9.8/10CVSS 9.8, critical severity.Background noise for most businessesPublished Oct 8
Ibm Guardium Data Protection — IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-…
ibm
Guide in progressNVD recordfor CVE-2026-82344, opens in a new tab - CVE-2026-84249CVSS 9.8/10CVSS 9.8, critical severity.Background noise for most businessesPublished Oct 8
IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations…
Guide in progressNVD recordfor CVE-2026-84249, opens in a new tab - CVE-2026-84272CVSS 9.8/10CVSS 9.8, critical severity.Background noise for most businessesPublished Oct 8
Ibm Guardium Data Protection — IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the ed…
ibm
Guide in progressNVD recordfor CVE-2026-84272, opens in a new tab - CVE-2026-82334CVSS 9.1/10CVSS 9.1, critical severity.Background noise for most businessesPublished Oct 8
Ibm Guardium Data Protection — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read…
ibm
Guide in progressNVD recordfor CVE-2026-82334, opens in a new tab
Everything below this line sits inside other software rather than on anyone's desk — code libraries, databases, hosting plumbing. You do not install these and you cannot patch them directly. They reach you as an update from whoever built or hosts your software. They are listed because a monitor that hides things is not a monitor.
That used to make this the part you could skip. It is not any more — this is also the supply chain an AI coding assistant pulls into an application it writes for you. The panel below names the packages involved.
What your AI builds with
These are the packages we watch because an AI coding assistant reaches for them on its own. Ask a model for a small web service and an HTTP client, a web framework and a few utilities arrive with it. Ask for an AI feature and a model SDK and somewhere to keep embeddings arrive with that. If a generated application is running in your business, this is a fair description of what it is made of.
This is the watch-list itself, separate from today's advisories. A package appearing here does not mean it has a vulnerability. When one of them is actually the subject of an advisory, it shows up in the list below with its name on the row.
What an assistant writes into your app
Asked for an ordinary service, a model reaches for these without being told to.
- axios — HTTP client. The HTTP client models reach for by default in JavaScript, so it lands in almost any generated service that calls an API. Opens in a new tab.
- express — Web framework. The minimal Node web framework an assistant writes when the ask is "an API" or "a server". Opens in a new tab.
- next — Web framework. The React framework assistants scaffold when the ask is a web application rather than a bare API. Opens in a new tab.
- react — Web framework. The UI library most generated front-end code is written against. Opens in a new tab.
- lodash — Utility library. A general-purpose JavaScript helper library that assistants still pull in for small things like deep clone and grouping. Opens in a new tab.
- moment — Utility library. The older JavaScript date library; its own maintainers now point users elsewhere, but generated code still targets it. Opens in a new tab.
- dayjs — Utility library. A small date library with a moment-shaped API, suggested as the modern replacement for it. Opens in a new tab.
- node-fetch — HTTP client. Brings the browser fetch API to Node versions that lack it, so server code written in the browser idiom still runs. Opens in a new tab.
- ws — Realtime transport. The bare WebSocket implementation for Node that most generated realtime servers sit on. Opens in a new tab.
- socket.io — Realtime transport. The higher-level realtime library assistants reach for when the ask is live updates or chat. Opens in a new tab.
- cors — Utility library. The Express middleware that sets cross-origin headers, added almost reflexively when a generated API is called from a browser. Opens in a new tab.
- body-parser — Utility library. Parses JSON and form bodies for Express, which older generated handlers still require explicitly. Opens in a new tab.
- multer — Utility library. The Express middleware for multipart file uploads, which is what a generated upload endpoint uses. Opens in a new tab.
- jsonwebtoken — Authentication. Signs and verifies JWTs, and it is what generated Node login code almost always issues tokens with. Opens in a new tab.
- bcrypt — Authentication. Hashes and checks passwords, which is the step generated sign-up code reaches for first. Opens in a new tab.
- passport — Authentication. The pluggable authentication middleware for Express, used whenever generated code needs "log in with" strategies. Opens in a new tab.
- helmet — Utility library. Sets common security response headers on an Express app, and is what an assistant adds when asked to harden a server. Opens in a new tab.
- dotenv — Utility library. Loads environment variables out of a .env file, which is how nearly every generated Node app reads its configuration and its API keys. Opens in a new tab.
- uuid — Utility library. Generates standard unique identifiers, the default whenever generated code needs an id it did not get from a database. Opens in a new tab.
- zod — Input validation. A TypeScript-first schema validator, now the usual choice for checking request bodies and for describing tool arguments to a model. Opens in a new tab.
- joi — Input validation. An older object-schema validator still generated for Express request validation. Opens in a new tab.
- yup — Input validation. A schema validator that turns up in generated React form code. Opens in a new tab.
- mongoose — Database driver or ORM. The MongoDB object-modelling layer generated Node code declares its schemas in. Opens in a new tab.
- prisma — Database driver or ORM. A typed ORM and schema tool that assistants pick for new TypeScript projects backed by SQL. Opens in a new tab.
- sequelize — Database driver or ORM. A long-standing SQL ORM for Node that still shows up in generated CRUD code. Opens in a new tab.
- pg — Database driver or ORM. The PostgreSQL driver for Node, sitting underneath most generated code that talks to Postgres directly. Opens in a new tab.
- mysql2 — Database driver or ORM. The MySQL driver generated Node code uses, usually through its promise API. Opens in a new tab.
- ioredis — Database driver or ORM. A widely used Node client for Redis, pulled in when generated code needs a cache or a job queue. Opens in a new tab.
- sharp — Media handling. The Node image-processing library generated upload and thumbnail code resizes with. Opens in a new tab.
- puppeteer — Scraping and parsing. Drives a headless Chrome, which is what gets generated for scraping, screenshots, PDF rendering and browser-using agents. Opens in a new tab.
- cheerio — Scraping and parsing. Parses HTML with a jQuery-shaped API, the usual dependency in generated scraping scripts and page-to-text steps. Opens in a new tab.
- nodemailer — Utility library. Sends mail from Node, which is what generated contact forms and notification code use. Opens in a new tab.
- vite — Build tooling. The dev server and bundler new generated front-end projects are scaffolded with. Opens in a new tab.
- webpack — Build tooling. The older bundler still sitting in plenty of generated build configs and existing projects. Opens in a new tab.
- esbuild — Build tooling. A fast bundler that ends up in the tree indirectly, underneath other build tooling rather than by direct choice. Opens in a new tab.
- requests — HTTP client. The HTTP client Python code reaches for by default, including the hand-rolled code that calls a model API. Opens in a new tab.
- urllib3 — HTTP client. The HTTP layer underneath requests, so it is in the tree even when nothing imports it directly. Opens in a new tab.
- flask — Web framework. The small Python web framework used to wrap a script in an API, including a model inference endpoint. Opens in a new tab.
- fastapi — Web framework. The async Python framework generated model-serving endpoints are usually written in. Opens in a new tab.
- django — Web framework. The batteries-included Python web framework generated full-stack apps are built on. Opens in a new tab.
- sqlalchemy — Database driver or ORM. The Python ORM and SQL toolkit generated database code is written against. Opens in a new tab.
- pydantic — Input validation. Declares and validates typed data models, and it is also how most Python AI libraries describe tool and response schemas. Opens in a new tab.
- jinja2 — Utility library. The Python template engine behind Flask pages, and a common way prompt text gets templated too. Opens in a new tab.
- pillow — Media handling. The Python imaging library, used for thumbnails in ordinary apps and for preparing images before a model sees them. Opens in a new tab.
- numpy — Data handling. The array library nearly every Python data or model script imports, directly or through something else. Opens in a new tab.
- pandas — Data handling. The dataframe library generated Python data-handling code loads and reshapes tables with. Opens in a new tab.
- pyyaml — Utility library. Parses YAML in Python, which is how a lot of generated services and AI tooling read their configuration. Opens in a new tab.
- cryptography — Authentication. Provides Python with real primitives for hashing, tokens and TLS, and is pulled in by many packages that never say so. Opens in a new tab.
- gin — Web framework. The HTTP framework generated Go services are usually routed with. Opens in a new tab.
- gorm — Database driver or ORM. The ORM generated Go code talks to SQL through. Opens in a new tab.
- rails — Web framework. The Ruby web framework generated Ruby applications are scaffolded in. Opens in a new tab.
- mongoid — Database driver or ORM. The Ruby object mapper for MongoDB, filling the slot mongoose fills in Node. Opens in a new tab.
- nokogiri — Scraping and parsing. Parses HTML and XML in Ruby, and is the usual dependency in generated scraping and feed code. Opens in a new tab.
- devise — Authentication. The authentication gem generated Rails apps handle sign-up and login with. Opens in a new tab.
- puma — Utility library. The application server generated Rails apps are served behind. Opens in a new tab.
- spring-boot — Web framework. The Java framework generated Java services are built on. Opens in a new tab.
- jackson-databind — Data handling. Turns JSON into Java objects and back, and is in nearly every Java service an assistant writes. Opens in a new tab.
- Newtonsoft.Json — Data handling. The JSON library generated C# code still serializes with most often. Opens in a new tab.
- Microsoft.EntityFrameworkCore — Database driver or ORM. The ORM generated .NET code reaches the database through. Opens in a new tab.
- serde — Data handling. The serialization framework nearly every generated Rust program derives its types from. Opens in a new tab.
- tokio — Utility library. The async runtime generated Rust services run on. Opens in a new tab.
- reqwest — HTTP client. The HTTP client generated Rust code calls APIs with. Opens in a new tab.
- docker — Build tooling. The container runtime generated projects are packaged into, usually via a Dockerfile the assistant writes alongside the code. Opens in a new tab.
- kubernetes — Build tooling. The orchestrator those containers land on once the application outgrows a single box. Opens in a new tab.
- helm — Build tooling. The packaging and templating layer for Kubernetes deployments. Opens in a new tab.
- nginx — Utility library. The reverse proxy and static file server generated deployment configs put in front of the application. Opens in a new tab.
- postgres — Database driver or ORM. The SQL database generated code assumes by default, usually added as a container in the compose file written with it. Opens in a new tab.
- redis — Database driver or ORM. The cache and queue added beside a generated application, and the store a lot of AI tooling keeps sessions and embeddings in. Opens in a new tab.
What you build AI features with
The pieces that show up once the application itself has to call a model.
- vm2 — Code sandbox. A Node sandbox used to run model-generated or user-supplied code inside the host process, with a long enough run of escapes that it should not be the only thing standing between generated code and your server. Opens in a new tab.
- openai — Model SDK. The official SDK for OpenAI's API, and usually the first dependency added when a feature calls a hosted model. Opens in a new tab.
- anthropic — Model SDK. The official SDK for Anthropic's API, filling the same slot when the app calls Claude. Opens in a new tab.
- langchain — Model SDK. A framework for chaining model calls, tools and retrieval together, common in first-draft AI features. Opens in a new tab.
- langchain-community — Model SDK. The community integration package for LangChain, which is where most third-party connectors actually live. Opens in a new tab.
- llama-index — Model SDK. A framework for indexing your own documents and answering questions over them with a model. Opens in a new tab.
- litellm — Model SDK. Puts one API shape in front of many model providers so application code can switch between them. Opens in a new tab.
- tiktoken — Model SDK. Splits and counts text as tokens the way the model does, so a prompt can be measured before it is sent. Opens in a new tab.
- huggingface-hub — Model SDK. Downloads models and datasets from the Hugging Face Hub, and is pulled in by most code that runs an open model. Opens in a new tab.
- transformers — Machine-learning runtime. Hugging Face's library for loading, running and fine-tuning open models. Opens in a new tab.
- sentence-transformers — Machine-learning runtime. Turns text into embeddings locally, which is the first step in most retrieval features. Opens in a new tab.
- torch — Machine-learning runtime. The tensor and training runtime most open models are loaded through. Opens in a new tab.
- tensorflow — Machine-learning runtime. The other major ML runtime, still underneath a lot of existing model code. Opens in a new tab.
- vllm — Machine-learning runtime. A high-throughput server for hosting open models behind an OpenAI-shaped API. Opens in a new tab.
- lightllm — Machine-learning runtime. A Python server for hosting open models in the same slot as vLLM, distributed from its repository rather than as a published package. Opens in a new tab.
- lmdeploy — Machine-learning runtime. A toolkit for compressing, deploying and serving large language models. Opens in a new tab.
- chromadb — Vector store. An embedded vector database, and the default local store in a lot of retrieval examples. Opens in a new tab.
- pinecone — Vector store. The current client library for the hosted Pinecone vector database, replacing the older pinecone-client package that is now marked deprecated. Opens in a new tab.
- weaviate-client — Vector store. The client library for the Weaviate vector database. Opens in a new tab.
- qdrant-client — Vector store. The client library for the Qdrant vector database, which is usually run as a container beside the app. Opens in a new tab.
- faiss — Vector store. An in-process similarity index, used when the embeddings stay on one machine instead of in a database. Opens in a new tab.
- ollama — Machine-learning runtime. Runs open models locally and serves them over HTTP, which is how most on-premises AI features get prototyped. Opens in a new tab.
Nothing in this panel is being reported as vulnerable. It is the list of packages we watch. Today's actual advisories are the entries below, and any that involve one of these packages carry its name on the row.
Developer & Hosting Components (3)
Code libraries, databases and hosting plumbing. These reach you as an update from whoever built your software — you do not install them yourself.
1 of these is already being exploited — handle it first.
- CVE-2016-3081CVSS 8.1/10CVSS 8.1, high severity.Being exploitedBackground noise for most businessesPublished Apr 26
Huawei Agile Controller-Campus Firmware — Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method…
huawei · apache · oracle
Guide in progressNVD recordfor CVE-2016-3081, opens in a new tab - CVE-2026-105278CVSS 9.8/10CVSS 9.8, critical severity.Background noise for most businessesOn our AI build watch-list, docker.dockerPublished Oct 9
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use.
Guide in progressNVD recordfor CVE-2026-105278, opens in a new tab - CVE-2026-107806CVSS 9.4/10CVSS 9.4, critical severity.Background noise for most businessesOn our AI build watch-list, nginx.nginxPublished Oct 9
Nginx UI is a web user interface for the Nginx web server.
Guide in progressNVD recordfor CVE-2026-107806, opens in a new tab
Everything Else (47)
Published this cycle, but not a clean fit for anything a business runs. Listed rather than dropped.
2 of these are already being exploited — handle those first.
- CVE-2021-3199CVSS 9.8/10CVSS 9.8, critical severity.Being exploitedBackground noise for most businessesPublished Jan 26
Onlyoffice Document Server — Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Serv…
onlyoffice
Guide in progressNVD recordfor CVE-2021-3199, opens in a new tab - CVE-2023-22894CVSS 4.9/10CVSS 4.9, medium severity.Being exploitedBackground noise for most businessesPublished Apr 19
Strapi — Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive us…
strapi
Guide in progressNVD recordfor CVE-2023-22894, opens in a new tab
Listed by ID and score only. Each ID opens its NVD record.
- CVE-2025-70518, NVD record, opens in a new tabCVSS 10.0, critical severity.
- CVE-2026-102255, NVD record, opens in a new tabCVSS 10.0, critical severity.
- CVE-2026-94503, NVD record, opens in a new tabCVSS 10.0, critical severity.
- CVE-2026-108263, NVD record, opens in a new tabCVSS 9.9, critical severity.
- CVE-2025-70521, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-100730, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-104075, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-105192, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107204, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107459, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107699, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107700, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107703, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107704, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107722, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107779, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107780, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107908, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-108107, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-108474, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-15340, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-56857, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-5759, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-62252, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-62253, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-76284, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-76501, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-85531, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-86405, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-9209, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-92555, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-93034, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-95606, NVD record, opens in a new tabCVSS 9.8, critical severity.
- CVE-2026-107726, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-107824, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-107845, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-107935, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-108261, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-93947, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-96327, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-96328, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-96330, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-96331, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-96809, NVD record, opens in a new tabCVSS 9.3, critical severity.
- CVE-2026-46570, NVD record, opens in a new tabCVSS 8.1, high severity.
Reading this list is the easy part
Knowing a flaw exists is not the same as knowing whether it is yours. The real questions come next: do you run the affected version, on which machines, who installed it, is anything else depending on it, and did last month's patch quietly break the one application your billing runs on? None of that is in a CVE record.
Those answers come out of an inventory — a current list of what you run and where — and most small offices have never had one. Building it is the first half of a vulnerability assessment; the second half is deciding, with you, which findings are worth a Tuesday and which are noise. 20+ years of doing it, 100% Texas-based support.