Libraries recently hit by a critical vulnerability

One row per library, from its newest critical CVE (CVSS 9.0 or more, from the CNA or NVD) that an OSV / GitHub advisory ties to it: the affected versions, the weakness, the fix.

Updated : CVE List (cvelistV5) 2026-10-28 08:04 UTC · NVD (fkie-cad mirror) 2026-10-28 06:30 UTC · OSV.dev 2026-10-28 07:44 UTC

Latest critical vulnerabilities · Libraries recently hit by a critical vulnerability · Most likely to be exploited · Recently added to CISA KEV

Library	Affected versions	Severity	Weakness	CVE	Fixed in
mlflow PyPI 28 critical CVEs	`3.12.0rc0 – < 3.17.0`	CRITICAL 9.8	CWE-94 Code Injection +1	CVE-2026-116692 2026-10-27	3.17.0
praisonai PyPI 32 critical CVEs	`4.2.1 – < 4.6.59`	CRITICAL 9.8	CWE-200 Exposure of Sensitive Information to an Unauthorized Actor +2	CVE-2026-57116 2026-10-23	4.6.59
github.com/bytebase/bytebase Go	`< 1.0.1`	CRITICAL 9.3	CWE-290 Authentication Bypass by Spoofing	CVE-2022-51026 2026-10-22	1.0.1
litellm PyPI 8 critical CVEs	`1.91.0 – < 1.100.4 ; 1.101.0 – < 1.101.3 ; 1.102.0 – < 1.102.2 ; …`	CRITICAL 9.9	CWE-269 Improper Privilege Management +2	CVE-2026-114612 2026-10-22	1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2
better-auth npm 7 critical CVEs	`1.4.0-beta.18 – < 1.7.7`	CRITICAL 9.1	CWE-287 Improper Authentication	CVE-2026-114607 2026-10-22	1.7.7
brotli PyPI 2 critical CVEs	`1.0.3 – < 1.2.1`	CRITICAL 9.2 KEV	CWE-787 Out-of-bounds Write +1	CVE-2026-111497 2026-10-22	1.2.1
brotlicffi PyPI	`1.0.3 – < 1.2.1.0`	CRITICAL 9.2 KEV	CWE-787 Out-of-bounds Write +1	CVE-2026-111497 2026-10-22	1.2.1.0
mem0ai PyPI	`0.1.117 – < 1.0.8`	CRITICAL 9.2	CWE-89 SQL Injection	CVE-2026-115324 2026-10-22	1.0.8
laravel/framework Packagist	`13.0.0 – < 13.29.0 ; < 12.68.0`	CRITICAL 9.2	CWE-287 Improper Authentication +1	CVE-2026-114509 2026-10-21	13.29.0, 12.68.0
pillow PyPI 16 critical CVEs	`11.0.0 – < 13.0.0`	CRITICAL 9.8	CWE-125 Out-of-bounds Read +1	CVE-2026-96639 2026-10-21	13.0.0
@sentry/nextjs npm 2 critical CVEs	`9.36.0 – < 9.47.2 ; 10.0.0-alpha.0 – < 10.75.2 ; 11.0.0-alpha.0 – < 11.0.0-rc.1`	CRITICAL 9.1	CWE-693 Protection Mechanism Failure	CVE-2026-114139 2026-10-21	9.47.2, 10.75.2, 11.0.0-rc.1
vibe-trading-ai PyPI	`0.1.0 – < 0.1.7`	CRITICAL 9.3	CWE-306 Missing Authentication for Critical Function	CVE-2026-114108 2026-10-21	0.1.7
trigger.dev npm	`< 4.5.6`	CRITICAL 9.2	CWE-653	CVE-2026-114087 2026-10-21	4.5.6
vllm PyPI 10 critical CVEs	`0.7.3 – < 0.31.0`	CRITICAL 9.2	CWE-94 Code Injection	CVE-2026-114053 2026-10-21	0.31.0
mercury PyPI 2 critical CVEs	`< 3.2.6`	CRITICAL 9.8	CWE-862 Missing Authorization	CVE-2026-111058 2026-10-19	3.2.6
claude-agent-sdk PyPI	`< 0.2.121`	CRITICAL 9.2	CWE-20 Improper Input Validation +2	CVE-2026-96620 2026-10-16	0.2.121
netlicensing-mcp PyPI	`< 0.1.8`	CRITICAL 9.6	CWE-22 Path Traversal	CVE-2026-57496 2026-10-15	0.1.8
undici npm 6 critical CVEs	`4.0.0 – < 6.29.1 ; 7.0.0 – < 7.30.1 ; 8.0.0 – < 8.12.2`	CRITICAL 9.1	CWE-295 Improper Certificate Validation	CVE-2026-109383 2026-10-15	6.29.1, 7.30.1, 8.12.2
gitpython PyPI 6 critical CVEs	`3.1.30 – < 3.2.0`	CRITICAL 9.2	CWE-88 Argument Injection	CVE-2026-110858 2026-10-14	3.2.0
github.com/dgraph-io/dgraph/v25 Go 7 critical CVEs	`< 25.4.0`	CRITICAL 9.2	CWE-306 Missing Authentication for Critical Function +1	CVE-2026-102748 2026-10-14	25.4.0
github.com/kedacore/keda Go	`≤ 1.5.0`	CRITICAL 9.9	CWE-269 Improper Privilege Management +1	CVE-2026-77524 2026-10-14	≤ 1.5.0, no fix
github.com/kedacore/keda/v2 Go	`< 2.21.0`	CRITICAL 9.9	CWE-269 Improper Privilege Management +1	CVE-2026-77524 2026-10-14	2.21.0
git-diff npm	`< 2.0.7`	CRITICAL 9.3	CWE-78 OS Command Injection	CVE-2026-110634 2026-10-14	2.0.7
vitess.io/vitess Go 2 critical CVEs	`< 0.23.5 ; 0.24.0 – < 0.24.2`	CRITICAL 9.8	CWE-79 Cross-site Scripting (XSS)	CVE-2026-104252 2026-10-13	0.23.5, 0.24.2
microsoft.native.quic.msquic.schannel NuGet 2 critical CVEs	`2.5.11-ci.156755675 – < 2.5.11-ci.159417053`	CRITICAL 9.8	CWE-122 Heap-based Buffer Overflow	CVE-2026-105016 2026-10-13	2.5.11-ci.159417053
microsoft.aspnetcore.app.runtime.linux-arm NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-arm64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-musl-arm NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-musl-arm64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-musl-x64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-x64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.osx-arm64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.osx-x64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.win-arm64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.win-x64 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.win-x86 NuGet 3 critical CVEs	`8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …`	CRITICAL 9.4	CWE-444 HTTP Request/Response Smuggling	CVE-2026-88092 2026-10-13	8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
github.com/containers/podman Go	`4.4.0 – < 5.8.8`	CRITICAL 10.0	CWE-693 Protection Mechanism Failure	CVE-2026-94603 2026-10-13	5.8.8
go.podman.io/podman/v6 Go	`6.0.0 – < 6.1.3`	CRITICAL 10.0	CWE-693 Protection Mechanism Failure	CVE-2026-94603 2026-10-13	6.1.3
github.com/containers/podman/v2 Go	`*`	CRITICAL 10.0	CWE-693 Protection Mechanism Failure	CVE-2026-94603 2026-10-13	no fix published
github.com/containers/podman/v3 Go	`*`	CRITICAL 10.0	CWE-693 Protection Mechanism Failure	CVE-2026-94603 2026-10-13	no fix published
github.com/containers/podman/v4 Go	`≥ 4.4.0`	CRITICAL 10.0	CWE-693 Protection Mechanism Failure	CVE-2026-94603 2026-10-13	no fix published
github.com/containers/podman/v5 Go	`< 5.8.8`	CRITICAL 10.0	CWE-693 Protection Mechanism Failure	CVE-2026-94603 2026-10-13	5.8.8
github.com/argoproj/argo-cd/v2 Go 16 critical CVEs	`2.10.0 – 2.14.21`	CRITICAL 9.9	CWE-863 Incorrect Authorization	CVE-2026-77459 2026-10-13	≤ 2.14.21, no fix
github.com/argoproj/argo-cd/v3 Go 5 critical CVEs	`3.0.0 – < 3.3.15 ; 3.4.0 – < 3.4.10 ; 3.5.0 – < 3.5.4 ; …`	CRITICAL 9.9	CWE-863 Incorrect Authorization	CVE-2026-77459 2026-10-13	3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2
github.com/argoproj/argo-cd Go 14 critical CVEs	`*`	CRITICAL 9.9	CWE-863 Incorrect Authorization	CVE-2026-77459 2026-10-13	no fix published
@tanstack/react-start npm 2 critical CVEs	`1.143.12 – < 1.168.60`	CRITICAL 9.3	CWE-79 Cross-site Scripting (XSS)	CVE-2026-102989 2026-10-13	1.168.60
@tanstack/solid-start npm 2 critical CVEs	`1.143.12 – < 1.168.57`	CRITICAL 9.3	CWE-79 Cross-site Scripting (XSS)	CVE-2026-102989 2026-10-13	1.168.57
@tanstack/start-server-core npm 2 critical CVEs	`1.143.12 – < 1.169.39`	CRITICAL 9.3	CWE-79 Cross-site Scripting (XSS)	CVE-2026-102989 2026-10-13	1.169.39
@tanstack/vue-start npm 2 critical CVEs	`1.143.12 – < 1.168.56`	CRITICAL 9.3	CWE-79 Cross-site Scripting (XSS)	CVE-2026-102989 2026-10-13	1.168.56
praisonaiagents PyPI 11 critical CVEs	`< 1.6.59`	CRITICAL 9.8	CWE-306 Missing Authentication for Critical Function +1	CVE-2026-57118 2026-10-12	1.6.59
obsidian-tc npm	`< 1.3.1`	CRITICAL 9.9	CWE-639 Authorization Bypass Through User-Controlled Key (IDOR) +1	CVE-2026-77366 2026-10-12	1.3.1
@tinacms/app npm	`< 2.5.14`	CRITICAL 9.3	CWE-346 Origin Validation Error +2	CVE-2026-108261 2026-10-09	2.5.14
tinacms npm	`< 3.14.0`	CRITICAL 9.3	CWE-346 Origin Validation Error +2	CVE-2026-108261 2026-10-09	3.14.0
contao/comments-bundle Packagist	`4.0.0 – < 5.3.50 ; 5.4.0-RC1 – < 5.7.12`	CRITICAL 9.3	CWE-79 Cross-site Scripting (XSS) +1	CVE-2026-107845 2026-10-09	5.3.50, 5.7.12
github.com/0xJacky/Nginx-UI Go 7 critical CVEs	`1.9.10-0.20260421071512-7864e378f5cf – < 1.9.10-0.20260728074146-a467ed652591`	CRITICAL 9.4	CWE-94 Code Injection	CVE-2026-107806 2026-10-09	1.9.10-0.20260728074146-a467ed652591
golang.org/x/net Go 2 critical CVEs	`< 0.60.0`	CRITICAL 9.1	CWE-675	CVE-2026-78663 2026-10-08	0.60.0
com.hazelcast/hazelcast Maven 3 critical CVEs	`5.6.0 – < 5.7.0 ; 5.5.0 – < 5.7.0 ; < 5.7.0`	CRITICAL 9.3	CWE-20 Improper Input Validation	CVE-2026-107726 2026-10-08	5.7.0
fast-jwt npm 4 critical CVEs	`6.2.0 – < 6.3.0`	CRITICAL 9.8	CWE-347 Improper Verification of Cryptographic Signature	CVE-2026-107722 2026-10-08	6.3.0
org.asynchttpclient/async-http-client Maven 2 critical CVEs	`3.0.0 – < 3.0.13 ; 2.0.0 – < 2.16.1`	CRITICAL 9.4	CWE-319 Cleartext Transmission of Sensitive Information +2	CVE-2026-107282 2026-10-07	3.0.13, 2.16.1
github.com/sipcapture/homer-app Go 2 critical CVEs	`< 0.0.0-20260625091610-b2e942031ff8`	CRITICAL 9.8	CWE-798 Use of Hard-coded Credentials	CVE-2026-62252 2026-10-07	0.0.0-20260625091610-b2e942031ff8
lmcache PyPI	`0.3.9 – < 0.5.6`	CRITICAL 9.8	CWE-502 Deserialization of Untrusted Data +1	CVE-2026-105192 2026-10-07	0.5.6
@backstage/plugin-scaffolder-backend npm 3 critical CVEs	`< 3.3.1 ; 3.4.0 – < 3.4.1 ; 4.0.0 – < 4.0.3 ; …`	CRITICAL 9.6	CWE-200 Exposure of Sensitive Information to an Unauthorized Actor +1	CVE-2026-106501 2026-10-06	3.3.1, 3.4.1, 4.0.3, 4.1.0
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm	`< 0.3.10`	CRITICAL 9.9	CWE-22 Path Traversal +1	CVE-2026-106486 2026-10-06	0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server npm	`< 0.2.25`	CRITICAL 9.9	CWE-22 Path Traversal +1	CVE-2026-106486 2026-10-06	0.2.25
handlebars npm 6 critical CVEs	`4.0.0 – < 4.7.10`	CRITICAL 9.8	CWE-94 Code Injection +1	CVE-2026-106446 2026-10-06	4.7.10
quasar npm	`< 2.22.0`	CRITICAL 10.0	CWE-79 Cross-site Scripting (XSS) +1	CVE-2026-106102 2026-10-06	2.22.0
payload npm 5 critical CVEs	`3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34`	CRITICAL 9.2	CWE-290 Authentication Bypass by Spoofing +1	CVE-2026-105863 2026-10-06	3.90.0, 4.0.0-canary.34
@payloadcms/plugin-form-builder npm	`< 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34`	CRITICAL 10.0	CWE-94 Code Injection +1	CVE-2026-105857 2026-10-06	3.90.0, 4.0.0-canary.34
@payloadcms/plugin-import-export npm	`3.0.0 – < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27`	CRITICAL 9.3	CWE-1321 Improperly Controlled Modification of Object Prototype (Prototype Pollution)	CVE-2026-105844 2026-10-06	3.88.0, 4.0.0-canary.27
microsoft.native.quic.msquic.openssl NuGet 2 critical CVEs	`< 2.4.20 ; 2.5.0 – < 2.5.11 ; 2.6.0 – < 2.6.1`	CRITICAL 9.1	CWE-295 Improper Certificate Validation	CVE-2026-105794 2026-10-06	2.4.20, 2.5.11, 2.6.1
langflow PyPI 20 critical CVEs	`1.1.2 – < 1.10.3`	CRITICAL 9.9	CWE-78 OS Command Injection	CVE-2026-105697 2026-10-05	1.10.3
langflow-base PyPI 2 critical CVEs	`0.1.2 – < 0.10.3`	CRITICAL 9.9	CWE-78 OS Command Injection	CVE-2026-105697 2026-10-05	0.10.3
lfx PyPI	`< 1.10.3`	CRITICAL 9.9	CWE-78 OS Command Injection	CVE-2026-105697 2026-10-05	1.10.3
tinypool npm 2 critical CVEs	`< 2.1.2`	CRITICAL 9.5	CWE-94 Code Injection +1	CVE-2026-104849 2026-10-02	2.1.2
seroval npm 3 critical CVEs	`0.12.0 – < 1.6.2`	CRITICAL 9.8	CWE-843 Type Confusion (Access of Resource Using Incompatible Type)	CVE-2026-104846 2026-10-02	1.6.2
com.capacitorjs/core Maven	`6.0.0 – < 6.2.2 ; 7.0.0 – < 7.6.9 ; 8.5.0 – < 8.5.1 ; …`	CRITICAL 9.3	CWE-346 Origin Validation Error +1	CVE-2026-103922 2026-10-01	6.2.2, 7.6.9, 8.5.1, 8.4.3, ≤ 8.3.4, no fix
@capacitor/android npm	`6.0.0 – < 6.2.2 ; 7.0.0 – < 7.6.9 ; 8.5.0 – < 8.5.1 ; …`	CRITICAL 9.3	CWE-346 Origin Validation Error +1	CVE-2026-103922 2026-10-01	6.2.2, 7.6.9, 8.5.1, 8.4.3, ≤ 8.3.4, no fix
@capacitor/ios npm	`6.0.0 – < 6.2.2 ; 7.0.0 – < 7.6.9 ; 8.5.0 – < 8.5.1 ; …`	CRITICAL 9.3	CWE-346 Origin Validation Error +1	CVE-2026-103922 2026-10-01	6.2.2, 7.6.9, 8.5.1, 8.4.3, ≤ 8.3.4, no fix
piscina npm	`5.0.0 – < 5.3.2 ; < 4.9.4 ; 6.0.0-rc.1 – < 6.0.0-rc.5`	CRITICAL 9.2	CWE-1321 Improperly Controlled Modification of Object Prototype (Prototype Pollution)	CVE-2026-102992 2026-09-30	5.3.2, 4.9.4, 6.0.0-rc.5
kobako RubyGems	`0.1.0 – < 0.9.1`	CRITICAL 10.0	CWE-94 Code Injection +1	CVE-2026-55107 2026-09-30	0.9.1
@simple-git/argv-parser npm	`< 2.0.1`	CRITICAL 9.2	CWE-78 OS Command Injection +1	CVE-2026-102829 2026-09-29	2.0.1
simple-git npm 8 critical CVEs	`3.15.0 – < 4.0.1`	CRITICAL 9.2	CWE-78 OS Command Injection +1	CVE-2026-102828 2026-09-29	4.0.1
electron npm 9 critical CVEs	`< 41.10.6 ; 42.0.0-alpha.1 – < 42.9.2 ; 43.0.0-alpha.1 – < 43.4.1 ; …`	CRITICAL 9.8	CWE-269 Improper Privilege Management +1	CVE-2026-102676 2026-09-29	41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
shell-quote npm 4 critical CVEs	`1.8.4 – < 1.11.0`	CRITICAL 9.2	CWE-78 OS Command Injection	CVE-2026-102422 2026-09-29	1.11.0
pyjwt PyPI 3 critical CVEs	`< 2.14.0`	CRITICAL 9.1	CWE-347 Improper Verification of Cryptographic Signature	CVE-2026-102268 2026-09-28	2.14.0
authlib PyPI 2 critical CVEs	`< 1.9.0`	CRITICAL 9.8	CWE-347 Improper Verification of Cryptographic Signature +3	CVE-2026-96760 2026-09-28	1.9.0
@xhmikosr/decompress npm 2 critical CVEs	`11.0.0 – < 11.1.4 ; < 10.2.2`	CRITICAL 9.1	CWE-22 Path Traversal +1	CVE-2026-101894 2026-09-28	11.1.4, 10.2.2
decompress npm 3 critical CVEs	`≤ 4.2.1`	CRITICAL 9.1	CWE-22 Path Traversal +1	CVE-2026-101894 2026-09-28	≤ 4.2.1, no fix
github.com/nezhahq/nezha Go 4 critical CVEs	`2.2.3`	CRITICAL 9.3	CWE-601 URL Redirection to Untrusted Site (Open Redirect)	CVE-2026-101090 2026-09-27	no fix published
github.com/obot-platform/obot Go	`< 0.21.1`	CRITICAL 9.3	CWE-639 Authorization Bypass Through User-Controlled Key (IDOR)	CVE-2026-101084 2026-09-27	0.21.1
vm2 npm 52 critical CVEs	`< 3.12.2`	CRITICAL 9.5	CWE-863 Incorrect Authorization	CVE-2026-100721 2026-09-27	3.12.2
fof/oauth Packagist	`< 1.7.4 ; 2.0.0-beta.1 – < 2.0.0-beta.4`	CRITICAL 9.8	CWE-345 Insufficient Verification of Data Authenticity	CVE-2026-92161 2026-09-25	1.7.4, 2.0.0-beta.4
org.http4s/http4s-scala-xml_2.12 Maven	`< 0.24.1`	CRITICAL 9.3	CWE-611 XML External Entity (XXE)	CVE-2026-61741 2026-09-24	0.24.1
org.http4s/http4s-scala-xml_2.13 Maven	`< 0.24.1 ; 1.0.0-M1 – < 1.0.0-M39`	CRITICAL 9.3	CWE-611 XML External Entity (XXE)	CVE-2026-61741 2026-09-24	0.24.1, 1.0.0-M39
org.http4s/http4s-scala-xml_3 Maven	`< 0.24.1 ; 1.0.0-M1 – < 1.0.0-M39`	CRITICAL 9.3	CWE-611 XML External Entity (XXE)	CVE-2026-61741 2026-09-24	0.24.1, 1.0.0-M39
github.com/ixofoundation/ixo-blockchain Go	`≤ 1.6.0`	CRITICAL 9.3	CWE-285 Improper Authorization +1	CVE-2026-61604 2026-09-24	≤ 1.6.0, no fix
github.com/ixofoundation/ixo-blockchain/v3 Go	`≤ 3.0.0`	CRITICAL 9.3	CWE-285 Improper Authorization +1	CVE-2026-61604 2026-09-24	≤ 3.0.0, no fix
github.com/ixofoundation/ixo-blockchain/v4 Go	`≤ 4.0.0`	CRITICAL 9.3	CWE-285 Improper Authorization +1	CVE-2026-61604 2026-09-24	≤ 4.0.0, no fix
github.com/ixofoundation/ixo-blockchain/v5 Go	`≤ 5.0.0`	CRITICAL 9.3	CWE-285 Improper Authorization +1	CVE-2026-61604 2026-09-24	≤ 5.0.0, no fix
github.com/ixofoundation/ixo-blockchain/v6 Go	`≤ 6.0.1`	CRITICAL 9.3	CWE-285 Improper Authorization +1	CVE-2026-61604 2026-09-24	≤ 6.0.1, no fix