CVE-2026-65592

n8n is affected by a stored DOM XSS in the Resource Locator component for versions before 1.123.64, 2.29.8, and 2.30.1. The vulnerability arises because the workflow-persisted cachedResultUrl is passed to window.open() without scheme validation. An attacker with workflow creation/editing privileg...

EUVD-2026-47636

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

CVE-2026-63264

creationtimestamp| type| source ---|---|--- 2026-07-22 09:56:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mra2n66wfk2q...

GHSA-2RP8-MM9Q-FP49

creationtimestamp| type| source ---|---|--- 2026-07-22 08:31:19+00:00| seen| https://gist.github.com/alon710/200e1b4ca9b1b66d608a6e02108ba259...

CVE-2026-65319

creationtimestamp| type| source ---|---|--- 2026-07-22 08:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr7u72hds52f...

CVE-2026-63262

creationtimestamp| type| source ---|---|--- 2026-07-22 03:04:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7dms6imx23...

CVE-2026-56820

creationtimestamp| type| source ---|---|--- 2026-07-22 02:59:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7ddtmqmx2j 2026-07-22 22:35:15+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg...

CVE-2026-62516

creationtimestamp| type| source ---|---|--- 2026-07-22 01:33:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr76kv4tsj2g 2026-07-23 18:20:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

EUVD-2026-46640

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the imageurl parameter in the chat completions endpoint. An attacker can access internal services and cloud metadata endpoints by supplying a crafted URL that redirects to internal addresses, as...

PT-2026-63509

Name of the Vulnerable Software and Affected Versions Joomla Extension - regularlabs.com - IP login extension affected versions not specified Description The IP login extension generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, which can lead...

PT-2026-71310

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 4.5.10 JupyterLab versions prior to 4.6.2 Description The ImageViewer component in packages/imageviewer/src/widget.ts uses URL.createObjectURL for specially crafted SVG images and revokes the blob URL prematurely...

CVE-2026-64798: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

PT-2026-63350

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

CVE-2026-8152: URL Redirection to Untrusted Site

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-60300

creationtimestamp| type| source ---|---|--- 2026-07-21 23:54:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6yykq2jd2v 2026-07-23 16:51:19+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-25 14:37:06+00:00| seen|...

CVE-2026-60298

creationtimestamp| type| source ---|---|--- 2026-07-21 23:52:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6yuxnwyy2j 2026-07-23 16:51:14+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60292

creationtimestamp| type| source ---|---|--- 2026-07-21 23:48:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ynsyrfe2v 2026-07-23 16:50:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-29 17:07:07+00:00| seen|...

CVE-2026-60288

creationtimestamp| type| source ---|---|--- 2026-07-21 23:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ygnmrgp24 2026-07-23 16:50:50+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-25 16:07:06+00:00| seen|...

CVE-2026-60286

creationtimestamp| type| source ---|---|--- 2026-07-21 23:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6yd2yztu2r 2026-07-23 16:50:45+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-25 15:07:06+00:00| seen|...