Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93587 | low | 3.3 | No | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder:... | 2026-10-29 |
| CVE-2026-93586 | low | 3.3 | No | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer tha... | 2026-10-29 |
| CVE-2026-92588 | medium | 4.4 | No | n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set... | 2026-10-29 |
| CVE-2026-92587 | medium | 5.0 | No | n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against... | 2026-10-29 |
| CVE-2026-90932 | high | 7.2 | No | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController... | 2026-10-29 |
| CVE-2026-90931 | medium | 5.4 | No | LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the... | 2026-10-29 |
| CVE-2026-86425 | medium | 5.5 | No | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An at... | 2026-10-29 |
| CVE-2026-86424 | low | 2.5 | No | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attac... | 2026-10-29 |
| CVE-2026-86423 | medium | 5.5 | No | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A c... | 2026-10-29 |
| CVE-2026-86422 | low | 3.3 | No | ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers t... | 2026-10-29 |
| CVE-2026-86421 | high | 7.5 | No | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation wi... | 2026-10-29 |
| CVE-2026-86420 | high | 7.5 | No | ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated... | 2026-10-29 |
| CVE-2026-85173 | medium | 4.3 | No | n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated us... | 2026-10-29 |
| CVE-2026-85172 | medium | 6.4 | No | n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Fun... | 2026-10-29 |
| CVE-2026-85171 | medium | 6.5 | No | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nod... | 2026-10-29 |
| CVE-2026-85170 | medium | 6.5 | No | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifyi... | 2026-10-29 |
| CVE-2026-85169 | high | 8.8 | No | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supp... | 2026-10-29 |
| CVE-2026-85168 | high | 8.8 | No | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list... | 2026-10-29 |
| CVE-2026-85167 | medium | 6.5 | No | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Fi... | 2026-10-29 |
| CVE-2026-82854 | critical | 9.8 | No | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes... | 2026-10-29 |