Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75857 | high | 7.0 | No | CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, a... | 2026-10-29 |
| CVE-2026-75913 | critical | 9.3 | No | CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, a... | 2026-10-29 |
| CVE-2026-85166 | medium | 6.5 | No | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inli... | 2026-10-29 |
| CVE-2026-85165 | critical | 9.9 | No | n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, o... | 2026-10-29 |
| CVE-2026-84807 | medium | 5.4 | No | Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. A... | 2026-10-29 |
| CVE-2026-73051 | not reported | — | No | actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Con... | 2026-10-29 |
| CVE-2026-72831 | high | 8.8 | No | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API.... | 2026-10-29 |
| CVE-2026-72826 | high | 8.8 | No | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's s... | 2026-10-29 |
| CVE-2026-72825 | high | 7.6 | No | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (... | 2026-10-29 |
| CVE-2026-72814 | not reported | — | No | The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is pass... | 2026-10-29 |
| CVE-2026-72813 | not reported | — | No | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. Wh... | 2026-10-29 |
| CVE-2026-73608 | high | 8.6 | No | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a... | 2026-10-29 |
| CVE-2026-72791 | medium | 5.8 | No | SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerabil... | 2026-10-29 |
| CVE-2026-72775 | high | 8.8 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied... | 2026-10-29 |
| CVE-2026-72774 | medium | 6.5 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with ed... | 2026-10-29 |
| CVE-2026-72773 | high | 7.7 | No | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A cra... | 2026-10-29 |
| CVE-2026-72772 | high | 8.8 | No | n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed in... | 2026-10-29 |
| CVE-2026-72771 | medium | 6.5 | No | n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base o... | 2026-10-29 |
| CVE-2026-70639 | medium | 5.5 | No | llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1mode... | 2026-10-29 |
| CVE-2026-70638 | high | 7.8 | No | llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() funct... | 2026-10-29 |