GHSA-MWF2-3PR3-8698

creationtimestamp| type| source ---|---|--- 2026-07-22 12:01:02+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmenwc72g 2026-08-12 12:01:34+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msv3gnshgq2p...

GHSA-MMX7-HFXF-JPPX

creationtimestamp| type| source ---|---|--- 2026-07-22 12:01:01+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmdckvy24 2026-08-12 12:01:33+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msv3gmvgco2a...

CVE-2026-16461

creationtimestamp| type| source ---|---|--- 2026-07-22 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mraag4n4sj2e 2026-07-23 22:33:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrdvfulvbi24...

CVE-2026-65593

CVE-2026-65593 affects n8n versions before 1.123.64. A SSRF vulnerability exists in the dynamic-node-parameters endpoints that lack authorization scopes, allowing authenticated attackers to supply absolute URLs in routing configuration to bypass baseURL restrictions and cause the n8n server to is...

CVE-2026-65592

n8n is affected by a stored DOM XSS in the Resource Locator component for versions before 1.123.64, 2.29.8, and 2.30.1. The vulnerability arises because the workflow-persisted cachedResultUrl is passed to window.open() without scheme validation. An attacker with workflow creation/editing privileg...

CVE-2026-65592 n8n before 1.123.64 Stored DOM XSS via cachedResultUrl

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

EUVD-2026-47636

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

CVE-2026-63264

creationtimestamp| type| source ---|---|--- 2026-07-22 09:56:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mra2n66wfk2q...

GHSA-2RP8-MM9Q-FP49

creationtimestamp| type| source ---|---|--- 2026-07-22 08:31:19+00:00| seen| https://gist.github.com/alon710/200e1b4ca9b1b66d608a6e02108ba259...

CVE-2026-65319

creationtimestamp| type| source ---|---|--- 2026-07-22 08:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr7u72hds52f...

CVE-2026-63262

creationtimestamp| type| source ---|---|--- 2026-07-22 03:04:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7dms6imx23...

CVE-2026-56820

creationtimestamp| type| source ---|---|--- 2026-07-22 02:59:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7ddtmqmx2j 2026-07-22 22:35:15+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg...

CVE-2026-62516

creationtimestamp| type| source ---|---|--- 2026-07-22 01:33:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr76kv4tsj2g 2026-07-23 18:20:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

EUVD-2026-46640

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the imageurl parameter in the chat completions endpoint. An attacker can access internal services and cloud metadata endpoints by supplying a crafted URL that redirects to internal addresses, as...

PT-2026-63350

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A stored DOM cross-site scripting issue exists in the Resource Locator component. The component passes the workflow-persisted cachedResultUrl...

PT-2026-63509

Name of the Vulnerable Software and Affected Versions Joomla Extension - regularlabs.com - IP login extension affected versions not specified Description The IP login extension generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, which can lead...

PT-2026-71310

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 4.5.10 JupyterLab versions prior to 4.6.2 Description The ImageViewer component in packages/imageviewer/src/widget.ts uses URL.createObjectURL for specially crafted SVG images and revokes the blob URL prematurely...

CVE-2026-8152: URL Redirection to Untrusted Site

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-64798: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...