Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-59259 | medium | 6.5 | No | n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatc... | 2026-10-29 |
| CVE-2026-61546 | not reported | — | No | AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to ver... | 2026-10-29 |
| CVE-2026-63190 | critical | 9.4 | No | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP s... | 2026-10-29 |
| CVE-2026-59959 | not reported | — | No | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.... | 2026-10-29 |
| CVE-2026-59254 | not reported | — | No | n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressi... | 2026-10-29 |
| CVE-2026-58661 | medium | 4.3 | No | n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpo... | 2026-10-29 |
| CVE-2026-59257 | high | 8.8 | No | n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's execut... | 2026-10-29 |
| CVE-2026-59179 | high | 8.3 | No | OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameter... | 2026-10-29 |
| CVE-2026-59164 | high | 7.1 | No | NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fa... | 2026-10-29 |
| CVE-2026-59158 | high | 7.5 | No | Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges... | 2026-10-29 |
| CVE-2026-58205 | high | 8.1 | No | GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequa... | 2026-10-29 |
| CVE-2026-58120 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-58119 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-58118 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-56778 | medium | 6.4 | No | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes acc... | 2026-10-29 |
| CVE-2026-56776 | high | 7.4 | No | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which a... | 2026-10-29 |
| CVE-2026-56775 | medium | 5.4 | No | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authori... | 2026-10-29 |
| CVE-2026-56777 | medium | 5.0 | No | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An auth... | 2026-10-29 |
| CVE-2026-57203 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-29 |
| CVE-2026-58202 | high | 8.3 | No | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the acco... | 2026-10-29 |