Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118693 | medium | 4.7 | No | CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embed... | 2026-11-03 |
| CVE-2026-118689 | high | 7.5 | No | OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers t... | 2026-11-03 |
| CVE-2026-118669 | not reported | — | No | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner... | 2026-11-03 |
| CVE-2026-118665 | not reported | — | No | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy W... | 2026-11-03 |
| CVE-2026-118686 | high | 7.5 | No | EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression a... | 2026-11-03 |
| CVE-2026-118681 | low | 3.7 | No | go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and... | 2026-11-03 |
| CVE-2026-118677 | medium | 5.9 | No | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its de... | 2026-11-03 |
| CVE-2026-118661 | medium | 6.5 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContaine... | 2026-11-03 |
| CVE-2026-118657 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A cli... | 2026-11-03 |
| CVE-2026-118652 | medium | 6.1 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a... | 2026-11-03 |
| CVE-2026-118648 | high | 7.3 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook r... | 2026-11-03 |
| CVE-2026-118644 | high | 7.7 | No | n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started... | 2026-11-03 |
| CVE-2026-118586 | medium | 5.3 | No | A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. P... | 2026-11-03 |
| CVE-2026-118578 | medium | 4.3 | No | A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the comp... | 2026-11-03 |
| CVE-2026-118640 | medium | 5.4 | No | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register r... | 2026-11-03 |
| CVE-2026-118537 | medium | 4.3 | No | A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.... | 2026-11-03 |
| CVE-2026-118266 | medium | 5.3 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target fo... | 2026-11-03 |
| CVE-2026-117574 | critical | 9.1 | No | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request s... | 2026-11-03 |
| CVE-2026-118258 | low | 3.7 | No | i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpo... | 2026-11-03 |
| CVE-2026-118254 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into... | 2026-11-03 |