Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-61726 | high | 8.1 | No | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and Ingred... | 2026-10-28 |
| CVE-2026-59962 | medium | 6.5 | No | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sor... | 2026-10-28 |
| CVE-2026-57169 | critical | 9.6 | No | Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enfo... | 2026-10-28 |
| CVE-2026-57446 | medium | 5.3 | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. F... | 2026-10-28 |
| CVE-2026-55543 | not reported | — | No | TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-... | 2026-10-28 |
| CVE-2026-118686 | high | 7.5 | No | EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression a... | 2026-10-28 |
| CVE-2026-118684 | medium | 5.9 | No | MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is... | 2026-10-28 |
| CVE-2026-118681 | low | 3.7 | No | go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and... | 2026-10-28 |
| CVE-2026-118680 | medium | 4.4 | No | SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers... | 2026-10-28 |
| CVE-2026-118679 | high | 7.5 | No | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauth... | 2026-10-28 |
| CVE-2026-118677 | medium | 5.9 | No | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its de... | 2026-10-28 |
| CVE-2026-118676 | high | 7.1 | No | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cann... | 2026-10-28 |
| CVE-2026-118675 | high | 7.1 | No | n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use rest... | 2026-10-28 |
| CVE-2026-118648 | high | 7.3 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook r... | 2026-10-28 |
| CVE-2026-118647 | high | 8.2 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, becaus... | 2026-10-28 |
| CVE-2026-118646 | medium | 6.5 | No | n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to b... | 2026-10-28 |
| CVE-2026-118644 | high | 7.7 | No | n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started... | 2026-10-28 |
| CVE-2026-118643 | high | 8.2 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in t... | 2026-10-28 |
| CVE-2026-118642 | high | 7.1 | No | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible... | 2026-10-28 |
| CVE-2026-118640 | medium | 5.4 | No | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register r... | 2026-10-28 |