Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91221 | critical | 10.0 | No | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected ar... | 2026-10-29 |
| CVE-2026-92287 | high | 8.1 | No | Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read... | 2026-10-29 |
| CVE-2026-87866 | critical | 9.1 | No | When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS... | 2026-10-29 |
| CVE-2026-86412 | high | 8.1 | No | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using... | 2026-10-29 |
| CVE-2026-86411 | critical | 9.1 | No | An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `... | 2026-10-29 |
| CVE-2026-86410 | high | 8.1 | No | A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, an... | 2026-10-29 |
| CVE-2026-86409 | high | 8.1 | No | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent tran... | 2026-10-29 |
| CVE-2026-65592 | medium | 5.4 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which pa... | 2026-10-29 |
| CVE-2026-65591 | high | 8.8 | No | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workf... | 2026-10-29 |
| CVE-2026-65590 | critical | 9.8 | No | n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package... | 2026-10-29 |
| CVE-2026-83813 | low | 3.1 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramPro... | 2026-10-29 |
| CVE-2026-70387 | not reported | — | No | Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes... | 2026-10-29 |
| CVE-2026-65589 | medium | 6.5 | No | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys... | 2026-10-29 |
| CVE-2026-65016 | high | 8.8 | No | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning.... | 2026-10-29 |
| CVE-2026-65015 | high | 8.8 | No | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper... | 2026-10-29 |
| CVE-2026-59259 | medium | 6.5 | No | n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatc... | 2026-10-29 |
| CVE-2026-61546 | not reported | — | No | AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to ver... | 2026-10-29 |
| CVE-2026-63190 | critical | 9.4 | No | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP s... | 2026-10-29 |
| CVE-2026-59959 | not reported | — | No | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.... | 2026-10-29 |
| CVE-2026-59254 | not reported | — | No | n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressi... | 2026-10-29 |