CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:58 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118679 New | N8 n8n n8n-io | 7.5 | Oct 28 | n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger |
| CVE-2026-118678 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction |
| CVE-2026-118676 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass |
| CVE-2026-118675 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow |
| CVE-2026-118649 New | N8 n8n n8n-io | 8.3 | Oct 28 | n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables |
| CVE-2026-118648 New | N8 n8n n8n-io | 7.3 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy |
| CVE-2026-118647 New | N8 n8n n8n-io | 8.2 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data |
| CVE-2026-118645 New | N8 n8n n8n-io | 8.7 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter |
| CVE-2026-118644 New | N8 n8n n8n-io | 7.7 | Oct 28 | n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance |
| CVE-2026-118643 New | N8 n8n n8n-io | 8.2 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data |
| CVE-2026-118642 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows |
| CVE-2026-118641 New | N8 n8n n8n-io | 7.5 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes |
| CVE-2026-118261 New | EC echo labstack | 8.2 | Oct 28 | Echo: Decompress permits unbounded gzip expansion in v4 |
| CVE-2026-118260 New | EC echo labstack | 8.2 | Oct 28 | Echo: BodyDump captures request and response bodies without size limits in v4 |
| CVE-2026-118633 New | SU SG UTM Sophos | 8.1 | Oct 28 | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining… |
| CVE-2026-118257 New | VU vue-i18n intlify | 7.2 | Oct 28 | Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages |
| CVE-2026-118255 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Grid: javascript: URL in credits.href runs script on click |
| CVE-2026-118254 New | GR grid-lite @highcharts | 8.6 | Oct 28 | Highcharts Grid: pagination language options are parsed as HTML |
| CVE-2026-118253 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: fullscreen labels are parsed as HTML |
| CVE-2026-118252 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: sidebar component labels are parsed as HTML |
| CVE-2026-118251 New | HI highcharts highcharts | 8.4 | Oct 28 | Highcharts: javascript: URL in credits.href runs script on click |
| CVE-2026-118250 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts: dotted series.keys paths write to Object.prototype |
| CVE-2026-118249 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts: series column construction writes to Object.prototype |
| CVE-2026-118246 New | HI highcharts highcharts | 8.4 | Oct 28 | Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes |
| CVE-2026-118245 New | DA dashboards @highcharts | 8.6 | Oct 28 | Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace |
| CVE-2026-118244 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print |
| CVE-2026-118242 New | GR grid-lite @highcharts | 8.5 | Oct 28 | Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` |
| CVE-2026-84725 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 8.1 | Oct 28 | Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap |
| CVE-2026-116797 New | DA dashboards @highcharts | 8.5 | Oct 28 | Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` |
| CVE-2026-116796 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts |
| CVE-2026-116795 New | RE re2js le0pard | 7.5 | Oct 28 | RE2JS: Quadratic-time denial of service in re2js lookbehind matching |
| CVE-2026-116794 New | RU russh Eugeny | 8.3 | Oct 28 | russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation |
| CVE-2026-82961 New | ZE zephyr zephyrproject | 7.8 | Oct 28 | Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode |
| CVE-2026-118619 New | UL Ultralytics Ultralytics | 8.8 | Oct 28 | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability |
| CVE-2026-118618 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118617 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2026-118616 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118615 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability |
| CVE-2026-118614 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability |
| CVE-2026-118613 New | UL Ultralytics Ultralytics | 7.8 | Oct 28 | Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability |
| CVE-2026-118610 New | IL iLX-F511 Alpine | 8.8 | Oct 28 | Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-103506 New | GR Grafana Grafana | 8.9 | Oct 28 | SSO settings authorization bypass |
| CVE-2026-118606 New | IL iLX-F511 Alpine | 8.8 | Oct 28 | Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability |
| CVE-2026-118605 New | IL iLX-F511 Alpine | 8.0 | Oct 28 | Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118603 New | IL iLX-F511 Alpine | 8.0 | Oct 28 | Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-118602 New | IL iLX-F511 Alpine | 7.8 | Oct 28 | Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability |
| CVE-2026-88967 New | GR Grafana Grafana | 7.7 | Oct 28 | Azure Monitor access token disclosure via SSRF |
| CVE-2026-100105 New | GR Grafana Grafana | 7.7 | Oct 28 | Alerting contact point authorization bypass via schema downgrade |
| CVE-2026-106079 New | SS Session Smart Conductor Juniper Networks | 8.8 | Oct 28 | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration |
| CVE-2026-103411 New | SS Session Smart Router Juniper Networks | 7.1 | Oct 28 | Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing |