CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger6.9 Medium
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction7.1 High
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance5.9 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass5.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow5.1 Medium
- n8n-io n8nn8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables8.7 High
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy8.4 High
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data5.3 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node7.1 High
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter7.0 High
- n8n-io n8nn8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance5.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data5.3 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows5.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes6.9 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass5.3 Medium
- open-telemetry opentelemetry-javaopentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing5.3 Medium
- sophos sg utmA path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code...9.2 Critical
- i18next i18next-http-backendi18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string3.7 Low
- intlify vue-i18nVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages7.2 High
- intlify vue-i18nVue I18n: `escapeParameter` does not escape named values when the same call also passes a list2.1 Low
- highcharts, @highcharts dashboards, grid-pro +2 moreHighcharts Grid: javascript: URL in credits.href runs script on click8.4 High
- highcharts, @highcharts grid-lite, grid-pro +2 moreHighcharts Grid: pagination language options are parsed as HTML8.6 High
- @highcharts dashboards, highcharts +1 moreHighcharts Dashboards: fullscreen labels are parsed as HTML8.4 High
- @highcharts dashboards, highcharts +1 moreHighcharts Dashboards: sidebar component labels are parsed as HTML8.4 High
- chromedevtools chrome-devtools-mcpInsufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0...4.4 Medium
- highchartsHighcharts: javascript: URL in credits.href runs script on click8.4 High
- highchartsHighcharts: dotted series.keys paths write to Object.prototype7.2 High
- highchartsHighcharts: series column construction writes to Object.prototype7.2 High
- @highcharts dashboards, highcharts +1 moreHighcharts Dashboards: editableOptions.propertyPath writes to Object.prototype6.9 Medium
- @highcharts dashboards, highcharts, @highcharts grid-pro +2 moreHighcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.6.9 Medium
- drupal media alias displayMedia Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-2925.9 Medium
- drupal content sync (content-sync.io)Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-2913.3 Low
- highchartsHighcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes8.4 High
- @highcharts dashboards, highcharts +1 moreHighcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace8.6 High
- drupal oauth2 token managerOAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-2904.8 Medium
- drupal field permissionsField Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-2895.3 Medium
- drupal field permissionsField Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-2885.3 Medium
- drupal openid connect clientOpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-2875.4 Medium
- drupal stage file proxyStage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-2866.5 Medium
- drupal signature pad widgetSignature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-2856.1 Medium
- highchartsHighcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print7.2 High
- drupal oauth login - oauth oidc ssoOAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-2844.8 Medium
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 moreMIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion7.5 Highlibmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 moreMIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment5.3 Mediumlibmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 moreMIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes7.0 High- drupal bulk update user rolesBulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-2804.7 Medium
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 moreMIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords7.5 High- drupal s3 file systemS3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-2795.6 Medium
- highchartsHighcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`5.3 Medium
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 moreMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename5.3 Medium- Show moreLoading…