Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58205 | high | 8.1 | No | GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequa... | 2026-10-29 |
| CVE-2026-56778 | medium | 6.4 | No | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes acc... | 2026-10-29 |
| CVE-2026-56776 | high | 7.4 | No | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which a... | 2026-10-29 |
| CVE-2026-56775 | medium | 5.4 | No | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authori... | 2026-10-29 |
| CVE-2026-56777 | medium | 5.0 | No | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An auth... | 2026-10-29 |
| CVE-2026-57203 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-29 |
| CVE-2026-58202 | high | 8.3 | No | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the acco... | 2026-10-29 |
| CVE-2026-54162 | medium | 4.7 | No | Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy... | 2026-10-29 |
| CVE-2026-56354 | medium | 5.4 | No | n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in... | 2026-10-29 |
| CVE-2026-56359 | medium | 5.4 | No | n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malici... | 2026-10-29 |
| CVE-2026-56356 | medium | 5.4 | No | n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the saniti... | 2026-10-29 |
| CVE-2026-56358 | medium | 5.4 | No | n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerabilit... | 2026-10-29 |
| CVE-2026-50106 | medium | 6.5 | No | When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for... | 2026-10-29 |
| CVE-2026-35501 | low | 3.7 | No | When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor... | 2026-10-29 |
| CVE-2026-118667 | medium | 4.3 | No | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python application... | 2026-10-29 |
| CVE-2026-118663 | medium | 5.3 | No | @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time... | 2026-10-29 |
| CVE-2026-118659 | high | 7.5 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-render... | 2026-10-29 |
| CVE-2026-118655 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Doubl... | 2026-10-29 |
| CVE-2026-116796 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor... | 2026-10-29 |
| CVE-2026-116017 | medium | 4.3 | No | Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressB... | 2026-10-29 |