CVE-2026-118586 is a server-side request forgery (SSRF) vulnerability in the dfm feedfinder2 project affecting versions 0.0.1 through 0.0.4. The flaw exists in the find_feeds function of feedfinder2.py, allowing remote attackers to manipulate requests and potentially cause the server to make unintended requests. The vulnerability has a medium severity rating with a CVSS score of 6.9. No patch or vendor response has been reported yet.
CVE-2026-118579 is a critical vulnerability in the D-Link DIR-505 router version 1.10B02. It involves a backdoor in the Web Management CGI component, specifically in the main function of /secmark1524.cgi. This backdoor can be triggered remotely by manipulating certain arguments, allowing unauthorized access. Public exploit code is available, increasing the risk of exploitation.
Tornado HTTP servers prior to version 6.6 are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoded bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the server's event loop to block for extended periods (up to a minute for bodies near 100 MB), impacting all connections served by the process. This vulnerability also affects Tornado's SimpleAsyncHTTPClient when reading responses from malicious servers. The issue is fixed in Tornado 6.6, which introduces periodic yielding to the event loop and more efficient chunk handling.
Crass, a CSS tokenizer, incorrectly handles bad URL tokens when a closing parenthesis follows an escaped backslash, causing it to consume more input than browsers do. This flaw can cause CSS sanitizers that rely on Crass to mistakenly allow malicious CSS declarations, style rules, or at-rules such as @import to pass through. The vulnerability affects CSS sanitizers like Sanitize, Loofah, and rails-html-sanitizer, enabling attackers to smuggle CSS that can be used for UI redress, loading attacker-controlled resources, or CSS-based data exfiltration. The issue does not enable script execution in modern browsers. The vulnerability is fixed in Crass version 1.0.8.
A vulnerability in maykinmedia's open-object API versions 2.4.3 to before 2.5.1, 3.0.0 to before 3.6.2, 4.0.0-rc.1 to before 4.0.2, and 4.1.0 to before 4.1.1 allows an API token scoped to read one ObjectType to access full versioned records of objects of other ObjectTypes via the history-detail endpoint. This bypasses authorization checks that normally restrict access, potentially exposing sensitive data such as citizen or case records in government deployments. The issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.
MailWatch for MailScanner versions prior to 1.2.27 contain an authorization bypass vulnerability. Authenticated users with low privileges can release or permanently delete quarantined emails belonging to other users or domains by manipulating the message ID parameter. This occurs because the application does not verify message ownership when processing quarantine actions, despite requiring a valid session and CSRF token. The vulnerability is fixed in version 1.2.27.
CVE-2026-116641 is a vulnerability in MongoDB Database Tools prior to version 100.20.0 caused by improper certificate validation. The tools rely on Golang's TLS implementation, which includes an internal denylist of known-bad CA certificates. Versions compiled with Golang 1.26.8 lack the updated denylist that includes eMudhra certificates, leading to potential trust of revoked or malicious certificates. This issue is fixed in Database Tools version 100.20.0, which uses Golang 1.27.3 with the updated denylist.
CVE-2026-61564 is a critical code injection vulnerability in WWBN AVideo-Encoder versions prior to 8.1.0. The unauthenticated installer endpoint 'install/checkConfiguration.php' improperly interpolates request parameters into PHP string literals without escaping, allowing attackers to inject and execute arbitrary PHP code as the web-server user. Exploitation requires the absence of the 'videos/configuration.php' file, which is typical on fresh deployments or after file removal. The vulnerability also enables arbitrary file read/write and a secondary SQL injection via unsanitized INSERT statements. This issue is fixed in version 8.1.0.
CVE-2026-57448 is a server-side request forgery (SSRF) vulnerability in the mrblomblo blombooru application prior to version 1.40.0. The vulnerability exists in the administrator-only GET /proxy-image endpoint, which fetches URLs server-side without proper validation. This allows an authenticated administrator to access internal network services and cloud instance metadata, potentially exposing sensitive credentials. The issue is fixed in version 1.40.0.
A server-side request forgery (SSRF) vulnerability exists in n8n versions before 1.123.83, 2.41.4, and 2.42.1 in the Slack Trigger webhook. This flaw allows unauthenticated attackers to bypass signature verification when no signing secret is set, enabling them to exfiltrate Slack workspace access tokens by causing the node to send these tokens to an attacker-controlled host.
MONAI versions prior to 1.6.1 have a vulnerability in the check_hash() function where integrity verification is insufficient. Specifically, if the hash value is None, the function silently returns True, and MD5 is used as the default hash type. This flaw allows attackers who can perform man-in-the-middle or registry compromise attacks to substitute bundles, datasets, or model archives downloaded without hashes. Such substitution can lead to malicious file delivery and potential code execution.
MONAI versions from 1.2.0 up to but not including 1.6.1 contain a remote code execution vulnerability in the ConfigWorkflow.__init__ method. This vulnerability arises because the method passes a bundle's configs/logging.conf file to logging.config.fileConfig, which uses eval() on handler class and args fields. An attacker can exploit this by publishing a malicious bundle with a crafted logging.conf that executes arbitrary Python code when the victim loads or runs the bundle.
A vulnerability in n8n Local Gateway desktop app versions before 2.41.4 and 2.42.x before 2.42.1 allows an attacker to silently re-pair the app with a malicious n8n instance via a crafted deep-link. This can cause the app to connect to an attacker-controlled instance without user confirmation, inheriting previously granted permissions and enabling unauthorized actions through the gateway.
A prototype pollution vulnerability exists in n8n versions before 2.41.4 and in 2.42.x versions before 2.42.1. This flaw allows low-privileged users to manipulate built-in object behavior by saving workflows with specially crafted connection keys such as __proto__. The vulnerability causes server errors during the periodic history compaction task, leading to login failures and write operation disruptions.
n8n versions before 1.123.85, 2.43.5, and 2.44.1 have an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can execute workflows in inline JSON mode, bypassing permission checks and potentially exfiltrating decrypted credentials to attacker-controlled servers.
n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 have an OData $filter injection vulnerability in Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes. This flaw allows attackers to inject single quotes into expression-bindable parameters, potentially exposing the entire contact list or redirecting SharePoint writes to unintended list items within the scope of stored credentials.
n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain webhook response paths, including error responses and responses without headers, do not include the sandbox Content-Security-Policy header. Authenticated users with permissions to create and activate workflows can exploit this to serve malicious HTML that executes scripts in the context of the n8n origin, potentially hijacking user sessions.
A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes the SeaTable Trigger node's API token to be saved in error execution data. This occurs because failed poll requests store raw request headers, exposing the API token to users who can view workflow executions but do not have credential read access.
n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 improperly store credential secrets in execution error data for certain nodes. This exposure occurs when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users with permission to view workflow executions but without credential read access can extract sensitive secrets such as Git passwords or tokens, MongoDB passwords, and Google access tokens from the error data.
An authorization bypass vulnerability exists in n8n versions before 1.123.85, 2.43.5, and 2.44.1 within the Chat Hub component. This flaw allows users with the global:chatUser role, who normally have limited chat-only permissions, to register restricted tool types and execute sandboxed code, access permitted files, and utilize instance workflows, Data Tables, and agents. The vulnerability has a medium severity rating with a CVSS score of 5.4.