VulDB Recent Entries

A vulnerability was found in langflow-ai langflow up to 1.7.x. It has been rated as critical. This affects an unknown part. The manipulation leads to code injection. This vulnerability is documented as CVE-2026-27966. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability was found in livehelperchat up to 4.52. It has been declared as problematic. Affected by this issue is the function erLhcoreClassChat::hasAccessToRead of the file holdaction.php. Executing a manipulation can lead to missing authorization. This vulnerability is registered as CVE-2026-27954. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in Worry Proof Backup Plugin up to 0.2.4 on WordPress. It has been classified as critical. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-1311. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in IceWarp and classified as critical. Affected is an unknown function. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2026-2493. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability has been found in Socomec DIRIS A-40 and classified as critical. This impacts an unknown function of the component HTTP API. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2026-2491. The attack is only possible within the local network. No exploit exists. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in claude-hovercraft. This affects the function executeClaudeCode. The manipulation results in command injection. This vulnerability is identified as CVE-2025-15060. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as critical, has been found in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. The impacted element is an unknown function of the component Environment Variable Handler. The manipulation of the argument NODES_EXCLUDE leads to code injection. This vulnerability is referenced as CVE-2026-27493. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in GitLab Community Edition and Enterprise Edition up to 18.7.4/18.8.4/18.9.0. The affected element is an unknown function. Executing a manipulation can lead to allocation of resources. The identification of this vulnerability is CVE-2026-2845. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in FreeRDP up to 3.22.x. Impacted is the function xf_rail_server_execute_result. Performing a manipulation of the argument execResult results in out-of-bounds read. This vulnerability was named CVE-2026-25942. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. This issue affects some unknown processing. Such manipulation leads to code injection. This vulnerability is uniquely identified as CVE-2026-27495. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. This vulnerability affects unknown code of the component Environment Variable Handler. This manipulation of the argument NODES_EXCLUDE causes basic cross site scripting. This vulnerability is handled as CVE-2026-27578. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. This affects an unknown part of the component Expressions Handler. The manipulation results in code injection. This vulnerability is known as CVE-2026-27577. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. Affected by this issue is some unknown functionality of the component Environment Variable Handler. The manipulation of the argument N8N_RUNNERS_ENABLED leads to exposure of sensitive system information to an unauthorized control sphere. This vulnerability is traded as CVE-2026-27494. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in n8n-io n8n up to 1.123.7/2.1.x. Affected by this vulnerability is an unknown functionality of the component Environment Variable Handler. Executing a manipulation of the argument NODES_EXCLUDE can lead to code injection. This vulnerability appears as CVE-2026-27498. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in maximmasiutin TinyWeb up to 2.0 on Win32. It has been rated as critical. Affected is an unknown function of the file php-cgi.exe. Performing a manipulation results in os command injection. This vulnerability is reported as CVE-2026-27613. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. It has been declared as critical. This impacts an unknown function of the component Environment Variable Handler. Such manipulation of the argument NODES_EXCLUDE leads to code injection. This vulnerability is documented as CVE-2026-27497. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in pgvector 0.6.0/0.7.0/0.8.0/0.8.1. It has been classified as critical. This affects an unknown function. This manipulation causes integer underflow. This vulnerability is registered as CVE-2026-3172. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Rucio up to 35.8.2/38.5.3/39.3.0 and classified as problematic. The impacted element is an unknown function. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2026-25736. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Rucio up to 35.8.2/38.5.3/39.3.0 and classified as problematic. The affected element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-25735. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in Rucio up to 35.8.2/38.5.3/39.3.0. Impacted is an unknown function. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2026-25734. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.