Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-04 13:47Z
2026-06-23
2026-06-23 17:16Z
CRIT

CVE-2026-44792 — N8n N8n: When an administrator performed a Source Control Pull, n8n imported the file and could

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44792

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git repository connected to an n8n Source Control configuration could commit a malicious Data Table JSON file containing a crafted column name. When an administrator performed a Source Control Pull, n8n imported the file and could lead to SQL injection on the internal PostgreSQL instance. Exploitation requires the n8n instance uses PostgreSQL as its CVSSv3.1 9.0 (CRITICAL)

CWECWE 89VNDN8nTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-06-23
2026-06-23 17:16Z
CRIT

CVE-2026-44791 — N8n N8n: Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44791

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7. CVSSv3.1 9.9 (CRITICAL)

CWECWE 1321VNDN8nTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-06-23
2026-06-23 17:16Z
HIGH

CVE-2026-44790 — N8n N8n: is an open source workflow automation platform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44790

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7. CVSSv3.1 8.8 (HIGH)

CWECWE 88VNDN8nTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-23
2026-06-23 17:16Z
CRIT

CVE-2026-44789 — N8n N8n: Combined with other techniques this could lead to RCE on the instance.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44789

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7. CVSSv3.1 9.9 (CRITICAL)

CWECWE 1321VNDN8nTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-06-23
2026-06-23 17:16Z
HIGH

CVE-2026-34916 — A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34916

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated. CVSSv3.1 8.8 (HIGH)

CWECWE 94TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-23
2026-06-23 17:16Z
HIGH

CVE-2026-34914 — A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34914

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated. CVSSv3.1 8.3 (HIGH)

CWECWE 89TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-06-23
2026-06-23 17:16Z
HIGH

CVE-2026-33760 — Langflow: Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33760

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target CVSSv3.1 8.8 (HIGH)

CWECWE 639VNDLangflowTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-06-23
2026-06-23 16:17Z
HIGH

CVE-2026-54312 — N8n N8n: is an open source workflow automation platform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54312

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted. This vulnerabil CVSSv3.1 8.5 (HIGH)

CWECWE 1321VNDN8nTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-23
2026-06-23 16:17Z
CRIT

CVE-2026-54310 — N8n N8n: is an open source workflow automation platform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54310

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2. CVSSv3.1 9.9 (CRITICAL)

CWECWE 89VNDN8nTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-06-23
2026-06-23 16:17Z
CRIT

CVE-2026-54309 — N8n N8n: is an open source workflow automation platform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54309

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated cal CVSSv3.1 10.0 (CRITICAL)

CWECWE 306VNDN8nTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-06-23
2026-06-23 15:16Z
HIGH

CVE-2026-35018 — NetComm: NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35018

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the username JSON parameter processed by the dalStorage_addUserAccount function. Attackers can exploit the unsafe concatenation of user-supplied input into a shell command string passed to rut_doSystemAction without sanitization to achieve full CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDNetcommTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2026-56784 — OpenRemote: before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56784

OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to enumerate sequential auto-increment alarm IDs and delete cross-tenant alarm reco CVSSv3.1 8.1 (HIGH)

CWECWE 639VNDOpenremoteTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2026-56379 — Imagemagick Imagemagick: before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56379

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. CVSSv3.1 8.1 (HIGH) · EPSS 64th percentile

CWECWE 78CWECWE 116VNDImagemagickTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-23
2026-06-23 13:16Z
CRIT

CVE-2026-56274 — Flowise: before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56274

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can configure a malicious MCP server to bypass the validateCommandFlags blocklist (for example, 'docker build' is not blocked, and 'npx --yes' is not blocked while only CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDFlowiseTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2026-56258 — Kidocode Crawl4ai: before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56258

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executa CVSSv3.1 8.1 (HIGH)

CWECWE 22VNDCrawl4aiVNDKidocodeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2025-71376 — picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71376

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims. CVSSv3.1 8.1 (HIGH) · EPSS 35th percentile

CWECWE 502TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2025-71370 — Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71370

picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load(). CVSSv3.1 8.1 (HIGH) · EPSS 45th percentile

CWECWE 502TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2025-71365 — Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71365

picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded. CVSSv3.1 8.1 (HIGH) · EPSS 37th percentile

CWECWE 502TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2025-71341 — Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71341

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded. CVSSv3.1 8.1 (HIGH) · EPSS 47th percentile

CWECWE 502TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-23
2026-06-23 13:16Z
HIGH

CVE-2025-71337 — Flowiseai Flowise: before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71337

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms. CVSSv3.1 8.3 (HIGH)

CWECWE 620VNDFlowiseaiVNDFlowiseTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-06-23
2026-06-23 09:16Z
CRIT

CVE-2026-11374 — ManageEngine: In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11374

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover. CVSSv3.1 9.0 (CRITICAL)

CWECWE 287CWECWE 340CWECWE 330VNDManageengineTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-06-23
2026-06-23 05:17Z
CRIT

CVE-2026-12866 — All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-12866

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-23
2026-06-23 00:00Z
INFO

From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI

Elastic Security Labs·elastic.co

Elastic Security Labs published a technical deep-dive on automating CVE security advisory generation using Retrieval-Augmented Generation (RAG) with Claude Opus and Elasticsearch. The system ingests MITRE CWE and CAPEC catalogues via web crawlers, grounds LLM outputs against authoritative data to prevent hallucination, and produces standardized advisory text with CWE/CAPEC classification, CVSS scoring, and mitigation guidance from raw vulnerability reports in minutes rather than hours.

SRFApplicationSRFCloudSWElasticsearchSWKibanaVNDElasticTYPResearchTYPTool
68
Edit Score
2026-06-23
2026-06-23 00:00Z
CRIT

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer

Trend Micro Research·trendmicro.comCVE-2026-33017CVE-2025-3248in the wild

Trend Micro documented a live cryptomining campaign exploiting CVE-2026-33017, an unauthenticated RCE in Langflow's /api/v1/build_public_tmp endpoint. The attack chain chains Python code injection → bash dropper → Go-based miner (lambsys) with aggressive defense evasion, rival-process elimination, and SSH-key-based lateral movement. The operator reuses a hardcoded flow UUID across attempts and maintains a 22-month lineage of the lambsys toolset with deliberate evasion refinements.

SRFApplicationTACTA0005TACTA0001TACTA0002TACTA0003SRFCloudTACTA0008SWLangflow
82
Edit Score
2026-06-23
2026-06-23 00:00Z
INFO

From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI

Elastic Security Labs·elastic.co

Elastic Security Labs published a technical deep-dive on automating CVE advisory generation using Retrieval-Augmented Generation (RAG) against MITRE CWE and CAPEC catalogues. The solution uses Elastic Agent Builder with Claude Opus to draft standardized security advisories from raw vulnerability reports, including crawler configurations for continuous indexing of MITRE data and system prompt tuning to prevent hallucinations and enforce disclosure best practices.

SRFApplicationSRFCloudSWElasticsearchSWKibanaVNDElasticTYPResearchTYPTool
68
Edit Score