Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110074 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-110075 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-83596 | high | 8.8 | No | A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. | 2026-10-29 |
| CVE-2026-96275 | high | 8.8 | No | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extrac... | 2026-10-29 |
| CVE-2026-96512 | high | 7.8 | No | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing... | 2026-10-29 |
| CVE-2026-89059 | high | 7.5 | No | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the dec... | 2026-10-29 |
| CVE-2026-78376 | high | 8.8 | No | A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result... | 2026-10-29 |
| CVE-2026-72770 | medium | 6.5 | No | n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows auth... | 2026-10-29 |
| CVE-2026-72769 | high | 8.1 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able... | 2026-10-29 |
| CVE-2026-72768 | high | 8.3 | No | n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenti... | 2026-10-29 |
| CVE-2026-72767 | high | 8.8 | No | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticate... | 2026-10-29 |
| CVE-2026-72766 | high | 7.5 | No | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does n... | 2026-10-29 |
| CVE-2026-72764 | high | 8.8 | No | n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.3... | 2026-10-29 |
| CVE-2026-72765 | critical | 9.9 | No | n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission t... | 2026-10-29 |
| CVE-2026-67205 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-67203 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-72763 | medium | 6.5 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenc... | 2026-10-29 |
| CVE-2026-72762 | high | 8.8 | No | n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its outp... | 2026-10-29 |
| CVE-2026-72750 | high | 8.8 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interp... | 2026-10-29 |
| CVE-2026-72749 | medium | 6.5 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output... | 2026-10-29 |