Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86412 | high | 8.1 | No | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using... | 2026-10-29 |
| CVE-2026-86411 | critical | 9.1 | No | An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `... | 2026-10-29 |
| CVE-2026-86410 | high | 8.1 | No | A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, an... | 2026-10-29 |
| CVE-2026-86409 | high | 8.1 | No | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent tran... | 2026-10-29 |
| CVE-2026-65592 | medium | 5.4 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which pa... | 2026-10-29 |
| CVE-2026-65591 | high | 8.8 | No | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workf... | 2026-10-29 |
| CVE-2026-65590 | critical | 9.8 | No | n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package... | 2026-10-29 |
| CVE-2026-83813 | low | 3.1 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramPro... | 2026-10-29 |
| CVE-2026-70387 | not reported | — | No | Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes... | 2026-10-29 |
| CVE-2026-61546 | not reported | — | No | AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to ver... | 2026-10-29 |
| CVE-2026-63190 | critical | 9.4 | No | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP s... | 2026-10-29 |
| CVE-2026-59959 | not reported | — | No | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.... | 2026-10-29 |
| CVE-2026-65589 | medium | 6.5 | No | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys... | 2026-10-29 |
| CVE-2026-65016 | high | 8.8 | No | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning.... | 2026-10-29 |
| CVE-2026-65015 | high | 8.8 | No | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper... | 2026-10-29 |
| CVE-2026-59259 | medium | 6.5 | No | n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatc... | 2026-10-29 |
| CVE-2026-59254 | not reported | — | No | n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressi... | 2026-10-29 |
| CVE-2026-58661 | medium | 4.3 | No | n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpo... | 2026-10-29 |
| CVE-2026-59257 | high | 8.8 | No | n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's execut... | 2026-10-29 |
| CVE-2026-59158 | high | 7.5 | No | Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges... | 2026-10-29 |