VulDB Recent Entries

A vulnerability described as problematic has been identified in fleetdm fleet up to 4.80.0. The impacted element is an unknown function of the component Google Calendar Service. Executing a manipulation can lead to insertion of sensitive information into sent data. This vulnerability is handled as CVE-2026-27465. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in wp-graphql up to 2.9.0. The affected element is an unknown function of the file release.yml. Performing a manipulation results in os command injection. This vulnerability is known as CVE-2026-27938. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in py-pdf pypdf up to 6.7.2. Impacted is an unknown function. Such manipulation leads to resource consumption. This vulnerability is traded as CVE-2026-27888. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in Agenta-AI agenta-api up to 0.48.0. This issue affects some unknown processing of the component numpy.ma.core.inspect. This manipulation causes code injection. This vulnerability appears as CVE-2026-27952. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in Packistry up to 0.12.x. This vulnerability affects the function RepositoryAwareController::authorize. The manipulation results in improper authentication. This vulnerability is reported as CVE-2026-27968. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability was found in langflow-ai langflow up to 1.7.x. It has been rated as critical. This affects an unknown part. The manipulation leads to code injection. This vulnerability is documented as CVE-2026-27966. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability was found in livehelperchat up to 4.52. It has been declared as problematic. Affected by this issue is the function erLhcoreClassChat::hasAccessToRead of the file holdaction.php. Executing a manipulation can lead to missing authorization. This vulnerability is registered as CVE-2026-27954. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in Worry Proof Backup Plugin up to 0.2.4 on WordPress. It has been classified as critical. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-1311. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in IceWarp and classified as critical. Affected is an unknown function. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2026-2493. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability has been found in Socomec DIRIS A-40 and classified as critical. This impacts an unknown function of the component HTTP API. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2026-2491. The attack is only possible within the local network. No exploit exists. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in claude-hovercraft. This affects the function executeClaudeCode. The manipulation results in command injection. This vulnerability is identified as CVE-2025-15060. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as critical, has been found in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. The impacted element is an unknown function of the component Environment Variable Handler. The manipulation of the argument NODES_EXCLUDE leads to code injection. This vulnerability is referenced as CVE-2026-27493. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in GitLab Community Edition and Enterprise Edition up to 18.7.4/18.8.4/18.9.0. The affected element is an unknown function. Executing a manipulation can lead to allocation of resources. The identification of this vulnerability is CVE-2026-2845. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in FreeRDP up to 3.22.x. Impacted is the function xf_rail_server_execute_result. Performing a manipulation of the argument execResult results in out-of-bounds read. This vulnerability was named CVE-2026-25942. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. This issue affects some unknown processing. Such manipulation leads to code injection. This vulnerability is uniquely identified as CVE-2026-27495. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. This vulnerability affects unknown code of the component Environment Variable Handler. This manipulation of the argument NODES_EXCLUDE causes basic cross site scripting. This vulnerability is handled as CVE-2026-27578. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. This affects an unknown part of the component Expressions Handler. The manipulation results in code injection. This vulnerability is known as CVE-2026-27577. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. Affected by this issue is some unknown functionality of the component Environment Variable Handler. The manipulation of the argument N8N_RUNNERS_ENABLED leads to exposure of sensitive system information to an unauthorized control sphere. This vulnerability is traded as CVE-2026-27494. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in n8n-io n8n up to 1.123.7/2.1.x. Affected by this vulnerability is an unknown functionality of the component Environment Variable Handler. Executing a manipulation of the argument NODES_EXCLUDE can lead to code injection. This vulnerability appears as CVE-2026-27498. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in maximmasiutin TinyWeb up to 2.0 on Win32. It has been rated as critical. Affected is an unknown function of the file php-cgi.exe. Performing a manipulation results in os command injection. This vulnerability is reported as CVE-2026-27613. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.