Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-56359 | medium | 5.4 | No | n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malici... | 2026-10-29 |
| CVE-2026-56356 | medium | 5.4 | No | n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the saniti... | 2026-10-29 |
| CVE-2026-56358 | medium | 5.4 | No | n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerabilit... | 2026-10-29 |
| CVE-2026-54162 | medium | 4.7 | No | Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy... | 2026-10-29 |
| CVE-2026-50106 | medium | 6.5 | No | When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for... | 2026-10-29 |
| CVE-2026-47235 | not reported | — | No | SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7,... | 2026-10-29 |
| CVE-2026-35501 | low | 3.7 | No | When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor... | 2026-10-29 |
| CVE-2026-118667 | medium | 4.3 | No | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python application... | 2026-10-29 |
| CVE-2026-118663 | medium | 5.3 | No | @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time... | 2026-10-29 |
| CVE-2026-118659 | high | 7.5 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-render... | 2026-10-29 |
| CVE-2026-118655 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Doubl... | 2026-10-29 |
| CVE-2026-116796 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor... | 2026-10-29 |
| CVE-2026-116776 | not reported | — | No | USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior... | 2026-10-29 |
| CVE-2026-116017 | medium | 4.3 | No | Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressB... | 2026-10-29 |
| CVE-2026-116013 | low | 3.7 | No | OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to... | 2026-10-29 |
| CVE-2026-116004 | low | 3.5 | No | A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/c... | 2026-10-29 |
| CVE-2026-115997 | medium | 6.3 | No | A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/... | 2026-10-29 |
| CVE-2026-115982 | medium | 4.3 | No | A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/sho... | 2026-10-29 |
| CVE-2026-115972 | medium | 5.3 | No | A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.cha... | 2026-10-29 |
| CVE-2026-115969 | high | 7.3 | No | A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API.... | 2026-10-29 |