| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-85167 | 6.5 | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly in | 2026-10-29 21:17:34 | 2026-09-03 13:06:24 |
| CVE-2026-85166 | 6.5 | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a work | 2026-10-29 21:17:33 | 2026-09-03 13:06:23 |
| CVE-2026-85165 | 9.9 | n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission | 2026-10-29 21:17:33 | 2026-09-03 13:06:23 |
| CVE-2026-84807 | 5.4 | Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or a | 2026-10-29 21:17:33 | 2026-09-02 12:17:17 |
| CVE-2026-82854 | 9.8 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatena | 2026-10-29 21:17:33 | 2026-08-31 09:17:05 |
| CVE-2026-75913 | 9.3 | CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git | 2026-10-29 21:17:33 | 2026-08-18 16:18:23 |
| CVE-2026-75857 | 7.0 | CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_interact (al | 2026-10-29 21:17:33 | 2026-08-18 16:18:21 |
| CVE-2026-73051 | - | actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through | 2026-10-29 21:17:32 | 2026-08-14 12:16:47 |
| CVE-2026-72831 | 8.8 | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additiona | 2026-10-29 21:17:32 | 2026-08-14 12:16:46 |
| CVE-2026-72826 | 8.8 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access | 2026-10-29 21:17:32 | 2026-08-14 12:16:45 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39855
Zapisa po stranici: