CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-118680SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Aliassiyuan-note siyuan
- CVE-2026-118679n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Triggern8n-io n8n
- CVE-2026-118678n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compactionn8n-io n8n
- CVE-2026-118677n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instancen8n-io n8n
- CVE-2026-118676n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypassn8n-io n8n
- CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflown8n-io n8n
- CVE-2026-118649n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tablesn8n-io n8n
- CVE-2026-118648n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policyn8n-io n8n
- CVE-2026-118647n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Datan8n-io n8n
- CVE-2026-118646n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Noden8n-io n8n
- CVE-2026-118645n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parametern8n-io n8n
- CVE-2026-118644n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritancen8n-io n8n
- CVE-2026-118643n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Datan8n-io n8n
- CVE-2026-118642n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflowsn8n-io n8n
- CVE-2026-118641n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodesn8n-io n8n
- CVE-2026-118640n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypassn8n-io n8n
- CVE-2026-118261Echo: Decompress permits unbounded gzip expansion in v4labstack echo · github.com/labstack/echo/v4
- CVE-2026-118260Echo: BodyDump captures request and response bodies without size limits in v4labstack echo · github.com/labstack/echo/v4
- CVE-2026-118259opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingopen-telemetry opentelemetry-java · io.opentelemetry:opente…
- CVE-2026-118633A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions)…Sophos SG UTM
- CVE-2026-118258i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringi18next-http-backend
- CVE-2026-118257Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesintlify vue-i18n · vue-i18n +5
- CVE-2026-118256Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listintlify vue-i18n · vue-i18n +4
- CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on clickhighcharts · @highcharts dashboards +3
- CVE-2026-118254Highcharts Grid: pagination language options are parsed as HTMLhighcharts · @highcharts grid-lite +3
- CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTMLhighcharts · @highcharts dashboards +1
- CVE-2026-118252Highcharts Dashboards: sidebar component labels are parsed as HTMLhighcharts · @highcharts dashboards +1
- CVE-2026-106484Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrarGoogle chrome-devtools-mcp
- CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on clickhighcharts
- CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototypehighcharts